Privacy Policy

PRIVACY NOTICE

Representatives of members, suppliers and other stakeholders, and website visitors

Updated: 17 December 2025

In this privacy notice (“privacy notice“), we explain how Suomen vetyklusteri ry (“we” or the “controller“) collects, processes and shares your personal data and what rights you have in relation to your personal data. The term “personal data” means any information relating to an identified or identifiable natural person.

When processing personal data, we always act in accordance with applicable data protection legislation. In particular, we comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679), which generally applies to all processing of personal data.

It is important to us that you can trust that your data is processed securely and in accordance with applicable legislation. We encourage you to read this privacy notice and contact us if you have any questions.

CONTROLLER AND SCOPE OF THIS PRIVACY NOTICE

Controller: Suomen vetyklusteri ry

Business ID: 3526442-8

Address: Eteläranta 10, 00130 Helsinki

Contact details: coordinator@h2cluster.fi

As a data subject, you may be a representative of one of our members, suppliers or other stakeholders, or a visitor to our website. The term “data subject” refers to a natural person whose personal data we process.

This privacy notice applies to the processing of personal data in the following situations:

Processing of personal data of representatives of our members, suppliers and other stakeholders (“Representatives“)
Visits to our website:
- https://h2cluster.fi/

PURPOSES OF PROCESSING PERSONAL DATA

We process your personal data only for the purposes described in this privacy notice or for other purposes communicated to you when your personal data is collected, and only to the extent that the processing of personal data is necessary for each purpose of processing.

We collect and process your personal data for different purposes depending on the role in which you interact with us.

Representatives:

Maintaining and administering membership information: if you act as a representative of one of our members, we process your personal data in order to maintain and administer the membership information of the organisation you represent in our systems.
Maintaining and administering supplier and other stakeholder information: if you act as a representative of one of our suppliers or other stakeholders, we process your personal data in order to maintain and administer information concerning the organisation you represent in our systems.
Communications with you and third parties: we process the personal data of representatives of members, suppliers or other stakeholders so that we can communicate about our activities with members, suppliers and other stakeholders, maintain and improve our relationships, and respond to requests or enquiries from representatives of potential or existing stakeholders.
Compliance with applicable legal requirements: complying with requirements relating to taxation and the association’s compliance, as well as requests from authorities, for example on the basis of tax or accounting legislation or other statutory obligations applicable to us.
Ensuring and monitoring compliance: monitoring compliance with agreements and investigating possible suspected misuse.
Billing: enabling us to manage our finances, for example by sending invoices.
Sending marketing communications: direct marketing and providing you with information about our activities.
Organising events: if you participate in an event organised by us, we may process your personal data to manage participant information and organise the event.
Other legitimate interests: processing your personal data to a limited extent for other legitimate purposes related to our activities; developing and improving the quality of our activities; ensuring and improving information security or the security of our premises and information networks; protecting our property; preventing and investigating suspected misuse; and analysing and compiling statistics for purposes related to our activities.

Website visitors:

Enabling use of the website: We process your personal data so that we can provide you with access to our website and its functions and ensure the overall security, functionality and stability of the website, including preventing and detecting possible misuse and attacks that threaten the security of the website. The collection and further processing of your personal data on our website mainly takes place by automated technical means, such as cookies and other similar technologies.
Improving our website: We process the personal data you provide to improve the quality and functionality of our website by analysing the website features and functions you use and the parts of the website you visit.
Marketing analytics and personalised marketing: We use marketing analytics to understand how people interact with our website and services. This helps us tailor the content and advertisements we provide, support social media features and analyse website traffic. We may use cookies and similar technologies to collect information about your browsing habits, such as the pages you visit, the links you click and the duration of your visits.
Sending newsletters: We process the personal data you provide in order to send newsletters.
Other legitimate interests: We process your personal data to a limited extent for other legitimate purposes related to our activities. These include responding to your contacts, developing the quality of our services and website and the user experience, ensuring information security, protecting our property, preventing and investigating suspected misuse, and analysing and compiling statistics.

CATEGORIES OF PERSONAL DATA PROCESSED

We process the following personal data:

Representatives

Contact details	such as name, email address and telephone number.
Organisation information	such as the name of the organisation you represent and its role in the association, your position in the organisation, your language preference, information about meetings between you and us, and information about any agreement between us and the organisation you represent and your relationship to that agreement.
Content of communications	such as information provided to us in meetings, email correspondence and through other means of communication, as well as the timing and other details of communications between you and us.

Website visitors:

Website usage information	such as IP address, information collected through cookies, time of visit, browser version and information about your use of our website.
Contact request information	such as information about your contacts with us and information you provide in connection with those contacts.
Contact details	such as your name, email address and telephone number.

LEGAL BASES FOR PROCESSING PERSONAL DATA

The processing of personal data is based on the legal bases listed in the tables below, depending on the role in which you interact with us.

Representatives:

Purpose of processing	Personal data processed	Legal basis for processing
Maintaining and administering membership information	Contact details, Organisation information, Content of communications	Legitimate interest in maintaining and administering the contact details of member representatives for the purposes of the association’s activities (Article 6(1)(f) GDPR).
Maintaining and administering supplier and other stakeholder information	Contact details, Organisation information, Content of communications	Legitimate interest in maintaining and administering the contact details of representatives of suppliers and other stakeholders for the purposes of the association’s activities (Article 6(1)(f) GDPR).
Communications with you and third parties	Contact details, Organisation information, Content of communications	Legitimate interest in maintaining and developing relationships with members, suppliers and other stakeholders through communications (Article 6(1)(f) GDPR).
Compliance with applicable legal requirements	Contact details, Organisation information, Content of communications	Legal obligation (Article 6(1)(c) GDPR).
Ensuring and monitoring compliance	Contact details, Organisation information, Content of communications	Legitimate interest in ensuring compliance with contractual obligations and investigating suspected misuse in relationships with members, suppliers and other stakeholders (Article 6(1)(f) GDPR).
Billing	Contact details, Organisation information, Content of communications	Legitimate interest in managing finances, billing and payments in connection with the association’s activities (Article 6(1)(f) GDPR).
Sending marketing communications	Contact details, Organisation information, Content of communications	Legitimate interest in providing current and potential members and other stakeholders with information about the association’s activities and maintaining relationships that are important to the association’s activities (Article 6(1)(f) GDPR). Where required by applicable law, we will send you direct marketing only on the basis of your consent (Article 6(1)(a) GDPR).
Organising events	Contact details, Organisation information, Content of communications	Legitimate interest in organising customary events relevant to the association’s activities (Article 6(1)(f) GDPR).
Other legitimate interests	Contact details, Organisation information, Content of communications	Legitimate interest in developing and improving our activities, ensuring information security, protecting property, preventing and investigating suspected misuse, and compiling statistics for the purposes of the association’s activities (Article 6(1)(f) GDPR).

Website visitors:

Purpose of processing	Personal data processed	Legal basis for processing
Enabling use of the website	Website usage information (excluding personal data collected through non-essential cookies)	Legitimate interest in maintaining a secure and functional website for the purposes of the association and for communicating with our members and other stakeholders (Article 6(1)(f) GDPR).
Improving our website	Website usage information, Contact request information, Contact details	Legitimate interest in maintaining a contact channel and improving the website (Article 6(1)(f) GDPR). The processing of personal data collected through non-essential cookies is based on your consent (Article 6(1)(a) GDPR).
Marketing analytics and personalised marketing	Website usage information	1. Consent (Article 6(1)(a) GDPR). We base our processing on your consent when processing personal data collected through non-essential cookies. 2. Legitimate interest in analysing the effectiveness of our marketing campaigns or understanding the preferences of our stakeholders where such processing is necessary to promote and improve our activities (Article 6(1)(f) GDPR).
Sending newsletters	Contact details	Consent (Article 6(1)(a) GDPR).
Other legitimate interests	Website usage information, Contact request information, Contact details	Legitimate interest in responding to contacts made through our website, developing and improving our activities, ensuring information security, protecting property, preventing and investigating suspected misuse, and compiling statistics for the purposes of the association (Article 6(1)(f) GDPR).

COOKIES

We use cookies and identifiers on our website to ensure its optimal operation and the correct display of content. A cookie is a text file stored in your browser or on your device. We use cookies to tailor the content and advertisements we provide, support social media features and analyse our visitor numbers.

You can change your browser’s cookie settings at any time. However, please note that blocking cookies may impair the functionality of the website and some content may not be displayed correctly.

See the cookie banner on our website for more detailed information about the cookies we use.

COLLECTION OF PERSONAL DATA

We collect your personal data primarily directly from you or from the organisation you represent. You may provide us with personal data, for example, through our website, by email, during telephone conversations or meetings, or in documents you provide to us.

We may collect and update personal data from publicly available sources or from registers maintained by authorities and companies providing services related to personal data.

We may collect personal data automatically through cookies when you visit our website.

RETENTION PERIOD OF PERSONAL DATA

We retain personal data only for as long as is necessary to fulfil the purpose for which it is processed or to comply with statutory obligations. The data is deleted or anonymised when its retention is no longer necessary for the purposes of the law or the rights or obligations of the parties.

Personal data of website visitors is processed primarily for the duration of the website visit. The exact retention periods for cookies are available in the cookie banner on our website. If you contact us through our website, your enquiry will primarily be retained for two (2) years, unless we have an additional obligation or right to process personal data contained in the communication for a longer period. Personal data collected for direct marketing purposes is retained for two (2) years after the end of the marketing campaign.

For Representatives, personal data is primarily retained for as long as the organisation you represent is a member of the association and for three (2) years after that relationship ends. This is because we may have reason to contact you regarding matters related to the association’s activities even after the membership of the organisation you represent has ended. If the organisation represented by a Representative is not a member of the association, we retain personal data for three (2) years from the time we were last in contact with that organisation. We may be required to retain some data for a longer period, for example due to mandatory accounting legislation.

Personal data processed on the basis of your consent is retained until you withdraw your consent or until there is no longer a need to process the personal data in question, whichever occurs first.

DISCLOSURE AND TRANSFER OF PERSONAL DATA

We may disclose your personal data to third parties that we use as service providers or subcontractors, such as providers of services used to maintain member or supplier information. We use trusted contractual partners with whom we have agreed terms that comply with the requirements of data protection legislation.

We may disclose your personal data to authorities if required by law, for example to prevent or investigate fraud or other crimes. Your personal data may also be disclosed to other parties by order of a competent court or where mandatory legislation so requires.

When transferring data, we ensure a high level of information security and data protection in accordance with the EU General Data Protection Regulation. Third parties and their subcontractors may transfer personal data outside the European Union or the European Economic Area. In these situations, we comply with applicable legislation and its requirements, such as the Standard Contractual Clauses (SCCs) approved by the European Commission. The Standard Contractual Clauses are available at: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en

We may transfer your personal data to the following countries or jurisdictions outside the European Union or the European Economic Area:

Microsoft	Data is primarily stored within the EU, but Microsoft has contractually reserved the right to transfer data to all countries in which Microsoft or its subprocessors operate.
Google	Data is primarily stored within the EU, but Google has contractually reserved the right to transfer data to all countries in which Google or its subprocessors operate.

DATA SECURITY PRINCIPLES

The security of personal data is important to us. We have implemented appropriate technical and organisational measures to protect personal data:

Access to data is restricted to persons who need it to perform their duties.
Information systems and devices are protected by technical measures such as firewalls and passwords.
Our personnel are trained to handle data appropriately and in accordance with the instructions provided by the controller.
Electronic files are backed up regularly.
Materials containing personal data are disposed of securely.
If, despite our security measures, a personal data breach occurs that is likely to adversely affect the privacy of data subjects, we will notify the competent authorities and the affected data subjects as soon as possible if required by applicable data protection legislation.

YOUR RIGHTS AS A DATA SUBJECT

Below we have summarised the rights you have as a data subject under mandatory data protection legislation. The regulation of some rights is complex in nature, and several exceptions apply to the regulated rights. In order to keep this privacy notice concise, the summary does not include all details of the regulation.

Access to your personal data

You have the right to ask us whether we process personal data concerning you. If we process your personal data, you may request access to that data. You may also request information about how we process your personal data and about your rights in relation to that data. If your personal data is inaccurate, you have the right to ask us to correct it.

Erasure of your personal data (“right to be forgotten”)

You may ask us to delete your personal data at any time. We must comply with your request if we have no lawful basis to continue processing your personal data. However, please note that statutory retention periods may apply to certain data, during which we are not permitted to delete that data.

Right to data portability

If we process your personal data on the basis of your consent or a direct contract with you and do so by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit it to another controller.

Right to object to processing

You have the right to object to the processing of your personal data if the processing is based on our legitimate interests. Following your objection, we will stop processing your personal data unless we have compelling lawful grounds to continue the processing. You also have the right to object to the use of your personal data for marketing purposes at any time, and we will stop such processing immediately. We ask for permission to send marketing communications when personal data is collected.

Restriction of processing

You have the right to request that the processing of your personal data be restricted in certain situations. If your request is accepted, we will retain your data but will not process it further except in limited circumstances.

Withdrawal of consent

If you have given your consent to certain processing activities, you may withdraw your consent at any time with effect for the future. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

How to exercise your rights

You can exercise your rights by contacting us using the contact details provided at the beginning of this privacy notice. We may refuse to process your request if it is manifestly unfounded. If you request several copies of your personal data or submit more than one request per year, we may charge a reasonable fee to cover our administrative costs.

Complaints

If you believe that our processing of your personal data infringes applicable data protection legislation, you have the right to lodge a complaint with the competent supervisory authority. In Finland, the competent authority is the Office of the Data Protection Ombudsman (https://tietosuoja.fi/yhteystiedot). However, we hope that you will contact us first.

CHANGES TO THIS PRIVACY NOTICE

We reserve the right to amend or update this privacy notice as necessary.