Privacy Policy

This is the register and privacy policy of Sumud – The Finnish Palestine Network Association in accordance with the EU General Data Protection Regulation (GDPR). Updated on 12.6.2024.

Data Controller 

Sumud – The Finnish Palestine Network Association Vellamonkatu 30 B, 00550 Helsinki Business ID: 3374698-4

Person Responsible for the Register 

Sumud Coordinator, [email protected]

Name of the Register 

Supporter Register of Sumud – The Finnish Palestine Network Association

What Information We Collect About You 

We collect information about our members and supporters who participate in campaigns, make one-time and monthly donations, sign petitions, subscribe to newsletters, and shop in our online store.

The information we collect includes:

  • Personal data: Name
  • Contact details: Phone number, postal address, email address.
  • Payment information: During payment transactions, we store the e-billing address and, if applicable, the expiration date of the payment card.

Retention and Updating of Personal Data 

We retain your personal data as long as necessary for the purposes mentioned in this privacy policy. Legal and regulatory requirements may oblige us to retain your personal data for a longer period.

Legal Bases for Processing Personal Data 

The processing of personal data always requires a legal basis. The basis for processing your personal data depends on the situation in which the data is collected and used, such as:

  • You have given your consent for us to process your personal data for a specific purpose, for example, when signing a petition.
  • The processing of your personal data is necessary for the performance of a contract with you, for example, when you make a purchase in our online store.
  • The processing of your personal data is necessary for compliance with a legal obligation, for example, when organizing our annual meeting.
  • It is in our legitimate interests to contact you for fundraising and achieving our human rights objectives. In some cases, we may use a combination of consent and legitimate interests as the basis for processing your personal data.

How We Contact You 

We may contact you by email if you have provided us with your email address and consented to receive emails. We may send you mail if you have provided us with your postal address. You can prohibit us from contacting you at any time when the communication is based on your consent.

Third Parties 

The personal data in the supporter register is processed by employees of selected service providers when necessary for maintaining the supporter relationship or system. These service providers include suppliers of our supporter systems or website platforms, postal and banking services. All actions of external service providers are strictly regulated by contracts. We also sign data processing agreements according to which the personal data we share is only used for the agreed purposes and processed in accordance with data protection legislation. As part of the agreement, the service provider must comply with strict security measures. In addition to service providers, we only disclose your data to third parties if you request us to do so, for example, when signing our petition, or if we have a legal or regulatory obligation to do so. If you want more information on how we disclose your personal data, please contact us.

Transfer Outside the EU and EEA 

The collected personal data is stored and processed within the EU/EEA, in a third country that the European Commission considers to have an adequate level of protection, or by suppliers committed to complying with the GDPR requirements.

Your Data Protection Rights 

Every person registered has the right to check their data stored in the register and request the correction of any inaccurate or incomplete data. If a person wants to check their stored data or request corrections, the request must be made in writing to the data controller. The data controller may ask the requester to verify their identity if necessary. The data controller will respond to the member within the time frame stipulated by the EU Data Protection Regulation (generally within one month).

Changes to the Privacy Policy 

The privacy policy may be updated, for example, due to changes in legislation. We will inform you of significant changes via email and on our website.