Privacy policy

Updated 9.4.2023

1 WHO IS THE CONTROLLER AND HOW I CAN CONTACT IT?

Legal Design Finland ry is the non-profit organization behind the event Legal Design Summit, BrainFactory and related side events. Our work towards making our events possible includes actions such as maintaining and providing the website legaldesignsummit.com as well as acquiring partners and speakers and providing related services such as online registration to our events.

To organize the event and to ensure the most wonderful experience for our participants, we collect and process personal data of Summit participants that have reserved a ticket through our ticket store, have sponsored the event through one of our partnership packages or have otherwise interacted with the Summit.

While doing this Legal Design Finland ry determines the purposes for which and the means by which personal data is processed, making Legal Design Finland ry the data controller.

The purpose of this Privacy Policy is to describe:

Logo 1

which personal data we process,

Logo 2

how and why the data is processed, and

Logo 3

what rights do you have as a data subject, and how you can exercise them to influence how your data is processed.

We at Legal Design Finland ry process your data responsibly and we want to be worthy of your trust. If you have any questions or concerns regarding this Privacy Policy – or if you for example want to exercise any of your rights as a data subject, you can always contact us using these contact details:

NAME

Legal Design Finland ry

BUSINESS ID

3017417-5

EMAIL

[email protected]

2 WHEN, WHAT AND WHY?

There are multiple situations where collecting and processing your personal data is either useful or necessary - or both - for us to produce our event and to ensure the best possible experience for our participants, speakers, and representatives of our partners.

WHAT KIND OF DATA DO WE COLLECT? WHAT ARE THE LEGAL BASES FOR DATA PROCESSING? WHAT IS THE PURPOSE OF DATA PROCESSING? HOW LONG IS MY DATA STORED?
TICKETS & PARTICIPATION
  • First and last name
  • E-mail
 A CONTRACT This data is necessary for us to reserve and deliver you a ticket to the Summit. We collect this data when you register as a participant to the Summit. 1 year from the Summit that you participated in*
  • First and last name
  • E-mail
  • Billing address
 A CONTRACT & CONTROLLER’S LEGAL OBLIGATION If you have reserved a ticket but are not able to attend - and do not cancel your ticket or have someone else attend on your behalf – according to our terms, we will invoice you for the no-show. This also lengthens the storage period of your data due to legal obligations related to bookkeeping regulations. Maximum of 10 years*
  • First and last name
  • E-mail
  • Country
  • Occupation and/or organization
 A CONTRACT & LEGITIMATE INTERESTS If you apply as a participant to the BrainFactory, you can choose to provide descriptive data such as your education and work experience and other related details. This data will be processed to enable the BrainFactory team to build the most diverse, engaging and inspiring BrainFactory teams possible for the best BrainFactory experience. We will also use the data to gather your feedback on BrainFactory and develop BrainFactory to be better in the future. 2,5 years*
  • First and last name
  • Contact information
  • Details of the situation
 A CONTRACT & LEGITIMATE INTERESTS We may process your personal data before the Summit, during the Summit, or after the Summit for customer service purposes. As long as necessary for the customer service situation to be solved but no more than 3 years.
  • Country
  • Occupation and/or organization
 CONSENT & LEGITIMATE INTERESTS You can choose whether you want to provide this data when e.g., registering as a participant or becoming a partner through one of our partnership packages. There are four purposes to why data would be processed – these you may choose to add to your registration form voluntarily:
  • Occupation/organization printed in participant’s name tag alongside their name to help participants better build connections at the Summit
  • Prior to the event, we will process all country data collected to create an anonymized map of all the countries represented at the Summit to be shared during the Summit and through our social media.
  • We may pseudonymize and whenever possible anonymize this personal data for development purposes: to understand our participants better and to be able to provide a better Summits in the future.
We also process the below-mentioned personal data for the below-mentioned purpose based on your consent that is collected at the registering. Please note that you can change your consent at any time. You can do this by yourself through the ticket system until 14.8.2023, 10 AM, and after that by emailing [email protected].
  • Prior to the event, we will process all entity/organization data to create a pseudonymized list of all entities/organizations represented at the Summit to be shared to other participants prior to the event.
 2,5 years*
PARTNERSHIPS
  • First and last name
  • Contact details provided or acquired, e.g, e-mail address
  • Occupation/role at the company or organization you represent
  • Name and contact details of the company or organization you represent
 LEGITIMATE INTERESTS When you are a representative of our partner, we process your personal data on the basis of legitimate interest. Before we have agreed upon collaboration we process your publicly available personal data for the purpose of contacting you and possibly entering into an agreement with you.

When we have agreed upon collaboration we will process your personal information in order to fill our obligations to the entity that you represent.

After the Summit we might contact you to request feedback regarding the Summit or to inquire about your interest in entering into a new partnership in the future.		 2,5 years*
CUSTOMER SATISFACTION, MARKETING & SOCIAL MEDIA
  • First and last name
  • E-mail and/or social media username depending on how you choose to interact with us
  • Other descriptive data (for example your feedback to us)
 LEGITIMATE INTERESTS We always want to learn how to make the Summit better and more interesting for our community. For this reason we process customer satisfaction data for analysis, for compiling statistics and reporting actions, for the purposes of developing our event and improving our participant’s experience. We utilize anonymization or pseudonymization whenever possible.

We collect and process your personal data for processing when you contact us, interact with us in social media, participate in our events, or take part in surveys and opinion polls, allowing us to gain a better understanding of our participants and thereby make the event better for you.		 2,5 years*
  • Visual recordings
 LEGITIMATE INTERESTS & CONSENT We take photographs and record video at all our events. We will ask for your consent if we photograph you in particular for a portrait and not the whole audience or ambiance. If your consent is required and collected, visual recording of you are stored according to your consent.
SPEAKERS
  • First and last name
  • E-mail
  • Entity you represent (if applicable)
  • Your designation or position
Optional descriptive data to help us build as diverse Summit as possible:
  • Gender
  • Country or region
  • Nationality
  • Age
  • Mother tongue
  • Sector you work in/represent
  • Other details you may submit on your experience/background
  • LinkedIn profile
 A CONTRACT & LEGITIMATE INTERESTS Prior to agreeing on participating the Summit as a speaker, BrainFactory mentor, or other presenter, or obtaining your consent through our call for speakers form or other ways, or on the basis of our legitimate interests, we process personal data that is available on public sources or that b) has been collected of our past speakers or sponsors for us to plan and explore potential speakers and/or partners for the summit.

If you submit your personal data when registering as a speaker through our call for speakers form or by contacting us, we process your personal data based on your consent (optional fields in the form) or our legitimate interest (mandatory fields in the form) for us to plan the most interesting and diverse speakers for the summit.

After agreeing with you on a presentation or other similar participation, we will process your personal data based on our contract to manage our relationship with you and to make the summit possible. This includes processing actions such as contacting you regarding your role as a speaker or other similar participant and delivering your ticket to you.

After the summit, we may process your personal data based on our legitimate interests for us to contact you to hear about your experience at the summit and to inquire about you returning as a speaker. 		No more than 2,5 years from the latest Summit you participated in this capacity*
TICKETS & PARTICIPATION
WHAT KIND OF DATA DO WE COLLECT?
  • First and last name
  • E-mail
WHAT ARE THE LEGAL BASES FOR DATA PROCESSING? A CONTRACT
WHAT IS THE PURPOSE OF DATA PROCESSING? This data is necessary for us to reserve and deliver you a ticket to the Summit. We collect this data when you register as a participant to the Summit.
HOW LONG IS MY DATA STORED? 1 year from the Summit that you participated in*
WHAT KIND OF DATA DO WE COLLECT?
  • First and last name
  • E-mail
  • Billing address
WHAT ARE THE LEGAL BASES FOR DATA PROCESSING? A CONTRACT
WHAT IS THE PURPOSE OF DATA PROCESSING? This data is necessary for us to reserve and deliver you a ticket to the Summit. We collect this data when you register as a participant to the Summit.
HOW LONG IS MY DATA STORED? 1 year from the Summit that you participated in*
WHAT KIND OF DATA DO WE COLLECT?
  • First and last name
  • E-mail
  • Billing address
WHAT ARE THE LEGAL BASES FOR DATA PROCESSING? A CONTRACT & CONTROLLER’S LEGAL OBLIGATION
WHAT IS THE PURPOSE OF DATA PROCESSING? If you have reserved a ticket but are not able to attend - and do not cancel your ticket or have someone else attend on your behalf – according to our terms, we will invoice you for the no-show. This also lengthens the storage period of your data due to legal obligations related to bookkeeping regulations.
HOW LONG IS MY DATA STORED? Maximum of 10 years*
WHAT KIND OF DATA DO WE COLLECT?
  • First and last name
  • E-mail
  • Country
  • Occupation and/or organization
WHAT ARE THE LEGAL BASES FOR DATA PROCESSING? A CONTRACT & LEGITIMATE INTERESTS
WHAT IS THE PURPOSE OF DATA PROCESSING? If you apply as a participant to the BrainFactory, you can choose to provide descriptive data such as your education and work experience and other related details. This data will be processed to enable the BrainFactory team to build the most diverse, engaging and inspiring BrainFactory teams possible for the best BrainFactory experience. We will also use the data to gather your feedback on BrainFactory and develop BrainFactory to be better in the future.
HOW LONG IS MY DATA STORED? 2,5 years*
WHAT KIND OF DATA DO WE COLLECT?
  • First and last name
  • Contact information
  • Details of the situation
WHAT ARE THE LEGAL BASES FOR DATA PROCESSING? A CONTRACT & LEGITIMATE INTERESTS
WHAT IS THE PURPOSE OF DATA PROCESSING? We may process your personal data before the Summit, during the Summit, or after the Summit for customer service purposes.
HOW LONG IS MY DATA STORED? As long as necessary for the customer service situation to be solved but no more than 3 years.
WHAT KIND OF DATA DO WE COLLECT?
  • Country
  • Occupation and/or organization
WHAT ARE THE LEGAL BASES FOR DATA PROCESSING? CONSENT & LEGITIMATE INTERESTS
WHAT IS THE PURPOSE OF DATA PROCESSING? You can choose whether you want to provide this data when e.g., registering as a participant or becoming a partner through one of our partnership packages. There are four purposes to why data would be processed – these you may choose to add to your registration form voluntarily:
  • Occupation/organization printed in participant’s name tag alongside their name to help participants better build connections at the Summit
  • Prior to the event, we will process all country data collected to create an anonymized map of all the countries represented at the Summit to be shared during the Summit and through our social media.
  • We may pseudonymize and whenever possible anonymize this personal data for development purposes: to understand our participants better and to be able to provide a better Summits in the future.
We also process the below-mentioned personal data for the below-mentioned purpose based on your consent that is collected at the registering. Please note that you can change your consent at any time. You can do this by yourself through the ticket system until 14.8.2023, 10 AM, and after that by emailing [email protected].
  • Prior to the event, we will process all entity/organization data to create a pseudonymized list of all entities/organizations represented at the Summit to be shared to other participants prior to the event.
HOW LONG IS MY DATA STORED? 2,5 years*
PARTNERSHIPS
WHAT KIND OF DATA DO WE COLLECT?
  • First and last name
  • Contact details provided or acquired, e.g, e-mail address
  • Occupation/role at the company or organization you represent
  • Name and contact details of the company or organization you represent
WHAT ARE THE LEGAL BASES FOR DATA PROCESSING? LEGITIMATE INTERESTS
WHAT IS THE PURPOSE OF DATA PROCESSING? When you are a representative of our partner, we process your personal data on the basis of legitimate interest. Before we have agreed upon collaboration we process your publicly available personal data for the purpose of contacting you and possibly entering into an agreement with you.

When we have agreed upon collaboration we will process your personal information in order to fill our obligations to the entity that you represent.

After the Summit we might contact you to request feedback regarding the Summit or to inquire about your interest in entering into a new partnership in the future.
HOW LONG IS MY DATA STORED? 2,5 years*
CUSTOMER SATISFACTION, MARKETING & SOCIAL MEDIA
WHAT KIND OF DATA DO WE COLLECT?
  • First and last name
  • E-mail and/or social media username depending on how you choose to interact with us
  • Other descriptive data (for example your feedback to us)
WHAT ARE THE LEGAL BASES FOR DATA PROCESSING? LEGITIMATE INTERESTS
WHAT IS THE PURPOSE OF DATA PROCESSING? We always want to learn how to make the Summit better and more interesting for our community. For this reason we process customer satisfaction data for analysis, for compiling statistics and reporting actions, for the purposes of developing our event and improving our participant’s experience. We utilize anonymization or pseudonymization whenever possible.

We collect and process your personal data for processing when you contact us, interact with us in social media, participate in our events, or take part in surveys and opinion polls, allowing us to gain a better understanding of our participants and thereby make the event better for you.
HOW LONG IS MY DATA STORED? 2,5 years*
WHAT KIND OF DATA DO WE COLLECT?
  • Visual recordings
WHAT ARE THE LEGAL BASES FOR DATA PROCESSING? LEGITIMATE INTERESTS & CONSENT
WHAT IS THE PURPOSE OF DATA PROCESSING? We take photographs and record video at all our events. We will ask for your consent if we photograph you in particular for a portrait and not the whole audience or ambiance.
HOW LONG IS MY DATA STORED? If your consent is required and collected, visual recording of you are stored according to your consent.
SPEAKERS
WHAT KIND OF DATA DO WE COLLECT?
  • First and last name
  • E-mail
  • Entity you represent (if applicable)
  • Your designation or position
Optional descriptive data to help us build as diverse Summit as possible:
  • Gender
  • Country or region
  • Nationality
  • Age
  • Mother tongue
  • Sector you work in/represent
  • Other details you may submit on your experience/background
  • LinkedIn profile
WHAT ARE THE LEGAL BASES FOR DATA PROCESSING? A CONTRACT & LEGITIMATE INTERESTS
WHAT IS THE PURPOSE OF DATA PROCESSING? Prior to agreeing on participating the Summit as a speaker, BrainFactory mentor, or other presenter, or obtaining your consent through our call for speakers form or other ways, or on the basis of our legitimate interests, we process personal data that is available on public sources or that b) has been collected of our past speakers or sponsors for us to plan and explore potential speakers and/or partners for the summit.

If you submit your personal data when registering as a speaker through our call for speakers form or by contacting us, we process your personal data based on your consent (optional fields in the form) or our legitimate interest (mandatory fields in the form) for us to plan the most interesting and diverse speakers for the summit.

After agreeing with you on a presentation or other similar participation, we will process your personal data based on our contract to manage our relationship with you and to make the summit possible. This includes processing actions such as contacting you regarding your role as a speaker or other similar participant and delivering your ticket to you.

After the summit, we may process your personal data based on our legitimate interests for us to contact you to hear about your experience at the summit and to inquire about you returning as a speaker.
HOW LONG IS MY DATA STORED? No more than 2,5 years from the latest Summit you participated in this capacity*

*= Your data may be stored for longer if you a) consent to that, b) there is a legal claim against us and the handling of matters related to such claim are ongoing and c) if we are required to do so to comply with applicable laws.

3 TO WHOM IS YOUR DATA DISCLOSED OR TRANSFERRED TO?
WHO CAN ACCESS YOUR DATA? If any of the exceptions below do not apply or you have not consented to anything else, your personal data is only processed within the Legal Design Finland ry.
DO WE DISCLOSE YOUR DATA TO THIRD PARTIES? We only disclose your data to third parties that are controllers in their own right when we are legally required to do so. We do, however, use vendors who process personal data on our behalf as our data processors. Processors are only allowed to process personal data for the purposes that we as the controller have defined.

We use Tito as our ticket management system and in this capacity. You can read their privacy policy here.
IS YOUR DATA TRANSFERRED BEYOND THE BORDERS OF THE EU OR EAA (“THIRD COUNTRIES”) Where Legal Design Finland ry is the data controller and uses data processors that are located outside of the EU/EEA, we do this only in cases where:
  • the transfers are either made to a country that is deemed to provide a sufficient level of privacy protection by the European Commission, or
  • the transfers are carried out by using appropriate legal safeguards such as standard data protection clauses (SCC) adopted, including any supplementary measures, where assessed to be necessary, or otherwise approved by the EU Commission or competent data protection authority in accordance with the GDPR.

4 HOW CAN YOU INFLUENCE THE PROCESSING OF YOUR PERSONAL DATA?

ou have many ways to influence how your data is processed by using your data protection rights provided by the GDPR.

If you wish to exercise any of the rights specified below or if you have any questions concerning your rights as a data subject, please contact us at [email protected].

RIGHT TO ACCESS

You have the right to access your personal data; meaning that you have the right to ask us to provide you with a report that includes what personal data we are processing related to you. Please note, however, that there are some exceptions to this rule: we can not, as an example, disclose your data that also reveals other people’s personal data.

RIGHT TO OBJECT

In general, you have the right to forbid the processing of your personal data when the legal basis is legitimate interest if exceptions do not apply.

RIGHT TO RECTIFY

You have the right to ask for rectification regarding your personal data: meaning that if something is not right in the data collected or we have gotten something wrong, you can always contact us and ask us to rectify the incorrect personal data.

RIGHT TO ERASURE

You have the right to the erasure of your personal data and to be forgotten; meaning that you can ask us anytime if you want to delete your personal data. There are, again, some exceptions to this rule: sometimes we have a legal obligation or other legal bases to keep some personal data even if you ask us to delete everything.

RIGHT TO DATA PORTABILITY

In certain situations, you have the right to receive the personal data provided to us in digital format so that you can transfer the data to a third-party controller.

RIGHT TO WITHDRAW CONSENT

If the processing of your personal data is based on consent given by you, you have the right to withdraw the consent at any time.

RIGHT TO RESTRICTION OF PROCESSING

In certain situations, you have the right to restrict the processing of your personal data for a period of time. For example, if you have chosen to use your rights to rectify or object and your requests are pending, you have the right to restrict the processing of your personal data for a period of time that allows us to ensure that your concerns are handled.

5 WHO CAN YOU TURN TO IF YOU HAVE QUESTIONS CONCERNING THE PROCESSING OF YOUR DATA?
In case you have any concerns or questions related to this Privacy Policy or processing of your personal data, you can always contact us via [email protected]. If you consider our processing of personal data to be inconsistent with the applicable laws, you can also lodge a complaint with the local supervisory authority for data protection. In Finland, the authority in question is the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

Visiting address: Lintulahdenkuja 4, 00530 Helsinki, Finland

Postal address: PL 800, 00531 Helsinki, Finland

Switchboard: +358 29 566 6700

Registry: +358 29 566 6768

E-mail: [email protected]