Privacy notice

Who is the controller

Helsinki Deaconess Foundation

Business ID 0116480-8

Alppikatu 2, 00530 Helsinki, Finland

Telephone +358 9 77501

Data Protection Officer

Pilvi Karhula

Email tietosuoja@diakonissalaitos.fi

Telephone +358 50 409 7909

What personal data we process

Depending on your role and use of the service, we may process the following personal data:

• name and email address
• user account identifier and account status
• organisation, programme membership and access role
• authentication credentials in protected form; passwords are not stored in readable form
• sign-in and technical security data, including timestamps, device or browser information and IP address where collected
• audit-log data about actions in the service, including report submissions, reporting-period confirmations and reopenings, account-role changes, and programme-team additions and removals
• communications concerning the user account or access rights

Why we process personal data

We process personal data for the following purposes:

• creating and administering user accounts
• granting and managing access rights and programme-team memberships
• enabling authorised use of the Global Programme Tool
• protecting the confidentiality, integrity and availability of the service
• preventing and investigating unauthorised use or security incidents
• maintaining an audit trail of reporting and administrative actions
• providing technical support and resolving service issues

Legal basis for processing

The legal basis is Helsinki Deaconess Foundation's legitimate interests under Article 6(1)(f) of the General Data Protection Regulation. Our legitimate interests are to provide the tool to authorised users, manage access to programme information, maintain the security and reliability of the service, and keep an appropriate accountability record of reporting and administrative actions.

We have assessed these interests against the rights and freedoms of users. Processing is limited to information necessary for operating and protecting the service and maintaining programme-reporting accountability.

Where personal data comes from

We receive personal data directly from you, from an authorised administrator who creates or manages your account, and from your organisation where it requests access on your behalf. The service also generates technical and audit-log data when you sign in or perform actions in the tool.

Requirement to provide personal data

The information required to create an account, authenticate a user and manage access rights must be provided to use the Global Programme Tool. If this information is not provided, we cannot create an account or provide access to the service.

Who receives personal data

Personal data may be accessed by authorised Helsinki Deaconess Foundation administrators and other personnel who need the information to administer, secure or support the service.

Our contracted cloud application, hosting, database, authentication, storage and technical-support service providers process personal data on our behalf and under our instructions. They may use authorised subprocessors where necessary to provide and secure the service. Processing is governed by contractual, organisational and technical safeguards.

We may disclose personal data to a competent authority where disclosure is required by law. We do not sell personal data.

Transfers outside the European Economic Area

The application's database, authentication services, file storage and backend functions are hosted in London, United Kingdom. Transfers to the United Kingdom are based on the European Commission's adequacy decision under Article 45 of the GDPR.

The application's frontend is delivered through globally distributed infrastructure. Our contracted service providers and their authorised subprocessors may process or access limited personal data, such as user identifiers, IP addresses, technical information, service logs and support information, from countries outside the European Economic Area, including the United States.

Transfers outside the European Economic Area are based on an applicable adequacy decision or other safeguards permitted under Chapter V of the GDPR. Where no adequacy decision applies, the European Commission's Standard Contractual Clauses and, where required, transfer-impact assessments are used. Further information about recipients and transfer safeguards is available from the Data Protection Officer.

How long we retain personal data

We retain personal data only for as long as necessary for the purposes described in this notice:

• User accounts and associated contact and authentication information are deleted promptly when access is no longer required.
• Routine activity-history and technical log entries are automatically deleted after 24 months.
• Governance and accountability events are retained for the duration of the relevant programme and for the applicable funder, audit and legal retention periods. After those periods, the records are deleted or anonymised.
• After deletion from the active service, data may remain in protected backup copies for up to 14 days before being overwritten.

Where an accountability record can be kept intelligible without identifying the user, personal identifiers are removed or replaced with a non-identifying reference.

Programme reporting data

The tool is not intended to collect personal data in programme reporting fields. Users must not enter names or other information that identifies programme participants, beneficiaries or other individuals in those fields. If personal data is entered contrary to this instruction, it may still constitute personal data and will be removed or otherwise handled in accordance with applicable data-protection requirements.

Automated decision making and profiling

We do not use personal data processed in the Global Programme Tool for solely automated decision-making or profiling that produces legal or similarly significant effects on users.

Your data protection rights

Subject to the conditions laid down in data-protection legislation, you may have the right to:

• obtain confirmation of whether we process your personal data and receive access to it
• have inaccurate or incomplete personal data corrected
• request the erasure of your personal data
• request restriction of the processing of your personal data
• object, on grounds relating to your particular situation, to processing based on legitimate interests

These rights are not absolute and may be limited where the GDPR permits or requires continued processing. Because the processing described in this notice is not based on consent, there is no consent to withdraw. The right to data portability generally does not apply to processing based on legitimate interests.

How to exercise your rights

You can exercise your rights or ask questions about the processing of your personal data by contacting the Data Protection Officer at tietosuoja@diakonissalaitos.fi. We may need to verify your identity before completing a request.

Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes data-protection legislation. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.

Website tietosuoja.fi/en/home