Privacy Policy

UnlocFinland Oy (business ID 3645565-6), Sorsatie 29, 90150 Oulu, Finland, is the data controller for personal data collected through this website. You can reach us at hello@unlocfinland.com for any privacy-related question or request.

When you buy a ticket or request an invoice, we collect:

• Full name and email address
• Company and job details you provide
• Phone number and country
• Billing details for invoiced orders: company name, VAT ID, billing address and invoice reference
• Order data: ticket tier, number of tickets, discount or partner code used, amount and payment status
• Attendee names you add for group bookings
• Optional notes such as dietary requirements or accessibility needs
• Payment metadata returned by our payment provider (payment method type, last four digits, receipt reference). We never see or store your full card number.

We process your data on the following bases:

• Performance of a contract (GDPR Art. 6(1)(b)) — selling and delivering your ticket, sending order confirmations and tickets, handling invoices, refunds and cancellations
• Legal obligation (GDPR Art. 6(1)(c)) — accounting, VAT and bookkeeping records
• Consent (GDPR Art. 6(1)(a)) — event update emails you opt into. We record when you gave consent and the wording you agreed to, and every update email carries a one-click unsubscribe link.
• Explicit consent (GDPR Art. 9(2)(a)) — optional dietary and accessibility details, which can reveal health information. They are used only to arrange your meals and venue access, are deleted 30 days after the event, and consent can be withdrawn anytime.
• Legitimate interest (GDPR Art. 6(1)(f)) — fraud prevention, security and essential service messages about the event you registered for

We do not sell your data, and we do not use it for profiling or automated decision-making.

Registration and order data is accessible only to the UnlocFinland organising team through an authenticated admin dashboard. The site is built so that attendee details cannot be read from the browser by anyone else — records are stored in a secured database protected by row-level security rules.

We use the following processors to run the event:

• Lovable Cloud (Supabase) — website hosting and database, data stored in the EU
• Stripe — card payments and checkout. Stripe acts as an independent controller for payment data and is PCI DSS compliant.
• Resend — transactional email delivery (order confirmations, tickets, invoice requests)
• Our accounting provider — invoicing and statutory bookkeeping

An automated monthly job anonymises all registration and attendee personal data 12 months after the event — names, emails and other identifiers are irreversibly wiped, while amounts, dates and ticket counts are kept for accounting. Optional dietary and accessibility notes are automatically deleted 30 days after the event. Accounting records tied to a purchase or invoice are kept for six years from the end of the accounting year, as required by Finnish bookkeeping law. You can request earlier deletion of anything not covered by a legal retention obligation.

International transfers

Our hosting and database are located in the EU. Some processors, such as Stripe and Resend, may process limited data outside the EEA under the European Commission's Standard Contractual Clauses.

You have the right to:

• Access — request a copy of the data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data ("right to be forgotten")
• Restriction — ask us to limit how we use your data
• Portability — receive your data in a machine-readable format
• Object — object to processing based on our legitimate interest
• Withdraw consent — at any time, with no effect on past processing. For update emails, use the unsubscribe link at the bottom of any of them; it takes effect immediately and does not affect your ticket or payment emails.
• Lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi)

To exercise any of these rights, email hello@unlocfinland.com. We will respond within 30 days.

tietosuoja.fi

Data is transmitted over TLS and encrypted at rest. Access to the organiser dashboard requires authentication, and database access is restricted by row-level security policies. Card data is handled entirely by our payment provider and never reaches our servers.

This website does not use marketing or analytics cookies and does not track you across other sites. Only strictly necessary technical storage is used, including cookies set by our payment provider during checkout and a session cookie for organiser sign-in.

If we materially change how we handle your data, we will update this page and the "Last updated" date above. For significant changes affecting ticket holders, we will also notify you by email.

Questions or requests? Email hello@unlocfinland.com.