Privacy Policy
Learn how WeCode ry protects your personal data in accordance with GDPR and Finnish privacy legislation.
WeCode ry (Business ID: 3500714-9) is committed to protecting the privacy of its members, event participants, and website visitors in accordance with the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act (Tietosuojalaki 1050/2018).
No Tracking Cookies & Cookieless Architecture
Our public website does not employ non-essential tracking cookies or third-party advertising scripts. Server log files are kept strictly for security and system stability for up to 12 months.
Membership applications
This section covers the personal data you send with the membership application form.
Controller
WeCode ry (Business ID 3500714-9). Contact: info@wecodeplatform.com.
What we collect
Your full name, email address, municipality of residence, the areas of interest you tick, your optional message, the form language, the time of submission, and the times when you confirm your email address and when the board decides.
Purpose and legal basis
We use the data to process your application, to email you the confirmation link and the board's decision and, if you join, to keep the member register required by the Associations Act (503/1989, section 11). The legal basis is the steps taken at your request before membership and the association's legal obligation to keep a member register (GDPR Article 6(1)(b) and (c)).
Storage and recipients
After you send the form, we email you a link to confirm your address. The application is stored on the association's web server (hosting provider o2switch, France), encrypted so that only the board can decrypt it. So that the server can send you the confirmation and decision emails, a second copy is also kept, encrypted with a separate server key that the server itself can use: until you confirm your address it holds the whole application, after that only your name and email address. This copy is removed when the board decides. The board sees only confirmed applications: after you confirm, a notification with your application details is emailed to the association's Gmail mailbox (Google), where the board reads it and decides. Google may process the message outside the EU. Your IP address is used only in hashed form to limit repeated submissions and is not stored with the application.
How long we keep it
An application that is not confirmed within 7 days is deleted. If the board does not accept an application, it is deleted from the server at once and you get a short email about the decision. An approved member's record is kept until the board deletes it. While the membership lasts, the association must keep it (the member register under section 11 of the Associations Act); after the membership ends, the board deletes the record. The notification email stays in the board's Gmail mailbox until the board deletes it. Server backups are overwritten on their normal cycle.
Your rights
You can ask to see, correct or delete your data, or object to its processing, by writing to info@wecodeplatform.com. You can also lodge a complaint with the Data Protection Ombudsman (tietosuoja.fi).
Contact form
This section covers the personal data you send with the contact form.
Controller
WeCode ry (Business ID 3500714-9). Contact: info@wecodeplatform.com.
What we collect
Your name, email address and message, the form language and the time of sending.
Purpose and legal basis
We use the data to read and answer your message, and to protect the association's board from spam and phishing (automatic checks, limits on repeated messages, blocking a sender). The legal basis is the association's legitimate interest in answering messages sent to it and in keeping its mailbox safe (GDPR Article 6(1)(f)).
Storage and recipients
Your message is emailed to the association's Gmail mailbox (Google), where the board reads it; Google may process the message outside the EU. To protect the board from spam and phishing, the server checks each message automatically (for example for shortened or disguised links). A message that looks suspicious is not forwarded at once: it is kept on the association's web server (hosting provider o2switch, France), encrypted, until a board member reviews it and either forwards or deletes it. The server keeps no copy of the content of the messages it has forwarded. Your IP address is used in hashed form to limit repeated submissions and is not stored with the message. Like every request to the server, the submission is recorded in the server's access log (time, the network part of your IP address and a keyed hash of it); the server's security log records that a message was received and the result of the check, without the message, your name or your email address.
How long we keep it
A suspicious message that the board does not review is deleted after 30 days. To prevent repeated and mass messages, the server keeps a record of each message for 30 days from sending, without its content: the time, the language, the result of the automatic check and one-way codes (hashes) derived from your email address and the message text. If the board blocks a sender address, a hash of the address is kept for 90 days, and messages from that address go to review instead of straight to the board. The access log and the security log are kept for 12 months. The message stays in the board's Gmail mailbox until the board deletes it. Server backups are overwritten on their normal cycle.
Your rights
You can ask to see, correct or delete your data, or object to its processing, by writing to info@wecodeplatform.com. You can also lodge a complaint with the Data Protection Ombudsman (tietosuoja.fi).