Privacy Policy

This Privacy Policy explains how Suomen ukrainalaisten yrittäjien yhdistys ry (Business ID 3622781-3), trading as Ukrainian Business in Finland (UBF) ("UBF", "we", "us", "our"), collects, uses, and protects personal data when you use ubf.fi and its related directory, application, and account areas (the "Portal"). We act as the data controller for the personal data described below and are committed to complying with the EU General Data Protection Regulation (GDPR) and Finnish data protection law.

1. Data controller and contact

Controller: Suomen ukrainalaisten yrittäjien yhdistys ry (Ukrainian Business in Finland (UBF))

Business ID (Y-tunnus): 3622781-3

Registered address: [REGISTERED ADDRESS — TO BE COMPLETED]

Contact for privacy matters: info@ubf.fi

⚠ [PLACEHOLDER: Insert the association's registered address and, if appointed, the name/contact details of a Data Protection Officer or privacy-responsible person.]

2. What personal data we collect

2.1 Visitors browsing the public site and directory

Standard technical data generated by your browser when you request pages (IP address, browser type, pages visited, timestamps), processed via our hosting and security infrastructure.

Data set by strictly necessary cookies — see our separate Cookie Policy.

2.2 Membership applicants (/apply)

Company details: company name, Finnish Business ID, address, city, region, main field of activity, description, website and social media links.

Contact person details: name, email address, phone number, and role at the company.

Any supporting documents or images you choose to upload with the application.

2.3 Company account holders

Login credentials (email address and password — passwords are stored by Firebase Authentication in hashed form; we never see or store your plaintext password).

Company profile content you edit: description (in Finnish, English, and Ukrainian), logo, photos, tags, foundation date, and social media links.

Session information used to keep you signed in (the __session cookie), described in our Cookie Policy.

2.4 Association staff (Superadmin)

Account details, role and permission records, and an activity trail associated with managing companies, applications, blog posts, and site settings.

2.5 Blog readers and general visitors

If UBF adds comment, newsletter, or contact-form functionality, the personal data described at the time of collection (e.g. name and email address) will apply; this policy will be updated accordingly.

3. Why we process your data and our legal basis

To review and process membership applications, and to create and manage company listings and accounts — necessary for performing the association-membership relationship and our legitimate interest in running a business directory (GDPR Art. 6(1)(b) and (f)).

To authenticate users and keep the Portal secure — legitimate interest in protecting the Portal, our members, and other users (Art. 6(1)(f)).

To operate, personalize, and improve the public directory and site — legitimate interest in providing an accurate, useful business directory to the Ukrainian business community in Finland (Art. 6(1)(f)).

To communicate with applicants and members about their application or account (Art. 6(1)(b)).

To comply with legal obligations, for example bookkeeping or responding to lawful authority requests (Art. 6(1)(c)).

To show advertising, run analytics, and share data with advertising or analytics partners, where enabled — based on your consent, given via the cookie banner, or our legitimate interest for strictly necessary functionality only (Art. 6(1)(a) and (f)). See Section 6 and our Cookie Policy for details.

4. Where your data is processed and stored

The Portal is built on Nuxt and hosted on Firebase App Hosting (Google). Data is stored primarily in Google Firebase/Firestore (database), Firebase Authentication (login credentials), Firebase Realtime Database (feedback and login records), and Firebase Storage (company images). These are processed by Google as our processor under a data processing agreement. Data may be processed or stored outside Finland, including in other EU/EEA countries or, where Google's infrastructure requires it, in third countries, in which case Google's standard contractual clauses or an equivalent safeguard applies.

5. Who we share data with

Google/Firebase, as our hosting, database, authentication, and storage provider (data processor).

If enabled, advertising and analytics partners such as Google Ads, other third-party ad networks or ad-management platforms, and analytics providers, for the purpose of showing and measuring advertising and site banners/pop-ups on the Portal — only where you have consented via the cookie banner. See our Cookie Policy for the current list of partners in use.

Third-party agencies or service providers UBF works with for marketing, communications, or administrative support, where necessary and under appropriate confidentiality/data-processing terms.

Public visitors of the Portal, for the specific fields you choose to make part of a public company listing (company name, description, logo, contact and social links, region/city, field of activity) — this is the intended purpose of the directory.

Authorities, where required by law.

We do not sell personal data.

6. Cookies and tracking

The Portal uses a strictly necessary session cookie to keep you signed in, and may use additional cookies for analytics, advertising, and third-party integrations where you have given consent. Full details — including what each cookie does, how long it lasts, and how to manage your preferences — are set out in our separate Cookie Policy, which forms part of this Privacy Policy.

7. How long we keep your data

Company listings and account data: for as long as the company is an active UBF member, plus a reasonable period afterward for record-keeping and legal purposes.

Rejected or withdrawn membership applications: for a limited period necessary to handle any follow-up queries, then deleted or anonymized.

Technical/log data: for a limited retention period consistent with security and troubleshooting needs.

Cookie-based data: as described in the Cookie Policy.

⚠ [PLACEHOLDER: Confirm exact retention periods (e.g. specific number of months/years) once the association finalizes its internal data-retention schedule.]

8. Your rights

Under the GDPR, you have the right to:

access the personal data we hold about you;

request correction of inaccurate or incomplete data;

request erasure of your data, where applicable;

request restriction of, or object to, certain processing (including processing based on legitimate interest, and direct marketing);

data portability, where applicable;

withdraw consent at any time where processing is based on consent (e.g. non-essential cookies), without affecting the lawfulness of processing before withdrawal;

lodge a complaint with the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), Finland's supervisory authority, or your local supervisory authority in the EU/EEA.

To exercise these rights, contact us at info@ubf.fi.

9. Security

We rely on Firebase Authentication and Firestore/Storage security rules to restrict access to personal data, require authentication and role-based authorization for all administrative and company-account functions, and use industry-standard hosting infrastructure (Firebase App Hosting/Google Cloud). No system is completely secure, but we take reasonable technical and organizational measures to protect your data against unauthorized access, loss, or misuse.

10. Children

The Portal is intended for business use and is not directed at children. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The effective date above will be updated accordingly; significant changes will be highlighted on the Portal.

12. Contact us

For any questions about this Privacy Policy or how we handle your data, contact Suomen ukrainalaisten yrittäjien yhdistys ry at info@ubf.fi or at our registered address: [REGISTERED ADDRESS — TO BE COMPLETED].