Privacy Policy

Controller

This service (openmat.fi) is operated by Vapaaradikaali (business ID 2302852-4), Finland. The controller’s contact person is Arttu Manninen.

For any privacy question or request, contact info@openmat.fi.

What data we process

• Listing submissions: the name and email address you provide when you submit or claim a club, plus a salted, non-reversible hash of your IP address used only to rate-limit abuse.
• Reports and feedback: when you report a listing error or send feedback, we process the name and/or email you optionally provide, your message, and a salted hash of your IP address to limit abuse. Feedback is not published.
• Sign-in: your email address (passwordless single-use magic-link login) and a session identifier stored in a cookie.
• Uploaded media: images and posters you upload; location and camera metadata (EXIF/GPS) are stripped on upload.
• Directory content: club, venue and event information shown on the site — largely public business information.
• Usage data (analytics): our self-hosted Matomo records anonymised usage data — pages viewed, referring page, approximate region, and device and browser type. It is configured to run without cookies and your IP address is anonymised (the last part is masked); the data is not used to identify you or to track you across other sites.
• Location (“near me”): only if you ask for it and grant your browser’s permission. Your browser coarsens the position to about one kilometre before it is sent, and only that approximate location is passed to the server as a search-URL parameter so distances can be calculated. It is never stored in the database or linked to you, and it disappears from the server logs when those are deleted. The basis is consent, which you can withdraw at any time by turning the filter off or revoking the location permission in your browser.
• Newsletter: if you subscribe, we process your email address, your chosen interests (new seminars / new clubs) and subscription-state timestamps. The basis is consent, which you can withdraw at any time via the unsubscribe link in every issue. See also the data register description.
• Listing reminders: we may send the listing’s contact occasional technical reminders to check the details are current (e.g. around holidays) — not marketing. The basis is legitimate interest (keeping the directory accurate). You can turn the reminders off at any time via the link in every message or in your account settings (Manage).
• Server logs: the web server records each request’s IP address, the URL requested, a timestamp, and browser and referrer information. These are used only for troubleshooting, security and abuse prevention (legitimate interest, Art. 6(1)(f)) — not for analytics or profiling. Logs are kept for 14 days on the server and 30 days in our aggregated log service, after which they are deleted automatically. That log service is our own self-hosted infrastructure in the EU; log data is not disclosed to third parties.

Data collected from public sources

Not all directory data comes from you. When the service launched, the club directory’s baseline was compiled from public sources so that it covered the whole country from day one. This section is the GDPR Art. 14 notice for data that was not obtained from the data subject.

You have the same rights over this data as over any other: you can ask us to correct or erase it, or object to the processing (Art. 21), at info@openmat.fi. We remove or correct a listing without undue delay.

• Sources: clubs’ own public websites, their public social-media profiles, and the national federation’s public club register.
• Categories: club or venue name, street address, training times, website address, public social-media handles, and public description text.
• We do not collect email addresses, phone numbers or the names of individuals this way.
• This is overwhelmingly organisation and business information, which is not personal data. Where a club is a sole trader or is named after a person, the information may also be personal data.
• The lawful basis is legitimate interest (Art. 6(1)(f)): a complete, current national directory of training times benefits practitioners and the clubs themselves. We have assessed that the processing does not override the data subject’s interests, because the information was already published by them and concerns public hobby activity.
• Retention: kept for as long as the listing is published. When a club claims its listing, this data is replaced by what the club maintains itself.

Purposes and lawful basis

We process the above to run the directory: to publish and moderate listings, to let organisers manage their own clubs, to sign you in, to prevent abuse, and to measure how the service is used so we can improve it (analytics).

Lawful bases (GDPR Art. 6): legitimate interest (Art. 6(1)(f)) for operating and securing the directory and for presenting largely-public information about clubs; and the steps necessary to provide the service you request (for example signing you in or processing your submission). Consent (Art. 6(1)(a)) is the basis for two optional features: subscribing to the newsletter, and the “near me” location search. You may withdraw consent at any time, and doing so does not affect the lawfulness of processing before the withdrawal.

Recipients and processors

We do not sell your data and we run no third-party advertising or tracking.

• Email: sign-in links and moderation notices are sent through our own mail server.
• Maps are served first-party from our own service: your browser does not contact a third-party map provider. Map imagery is © OpenStreetMap contributors; our server fetches and caches the tiles.
• Address geocoding: when we save a venue address, the address (not personal data) is sent to OpenStreetMap’s Nominatim to resolve coordinates.
• Analytics: we use self-hosted Matomo. No data is shared with third parties and there is no cross-site tracking.
• Infrastructure: the service runs on our own server in the EU.

Retention

• Listing personal data (submitter email and name, and the salted IP hash) is scrubbed 90 days after the submission is approved or rejected.
• A report’s contact details (email and IP hash) are scrubbed once the report is closed.
• Feedback is kept only as long as needed to deal with it and then deleted; you can ask us to delete it at any time at info@openmat.fi.
• Sessions expire after 30 days.
• Sign-in links are single-use and expire after 15 minutes.
• Uploaded media is kept for as long as the associated listing is published.
• Account email addresses are kept until you ask us to delete the account.
• Newsletter subscriber data is kept until you unsubscribe.
• The analytics per-visit log (including the masked IP address) is deleted automatically after at most 14 months. What remains is anonymous aggregate statistics — visit and page-view counts, referrers, coarse region and device type — which contain no personal data and are kept indefinitely.
• The outbound email queue (recipient and message content) is purged automatically within 48 hours of a message being queued.
• Internal outreach notes about a club are kept only while the contact is current. They are never shown publicly, and can be corrected or deleted on request at info@openmat.fi.

Your rights

You have the right to access your data, to rectify it, to erase it, to restrict processing, to object to processing (Art. 21), and to data portability. To exercise your rights, contact info@openmat.fi.

You can also erase all data linked to a given email address yourself at /erasure: you enter the address and we email it a single-use confirmation link — the data is erased only once you confirm.

If you believe your data is processed unlawfully, you may lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

Removing or correcting a listing

If you represent a club or venue and want a listing removed or corrected, email info@openmat.fi. We action removal and objection requests without undue delay.

Cookies

We use only strictly-necessary cookies: the session cookie (om_session) and a short-lived login-redirect cookie (om_login_next). Our analytics (Matomo) is configured to run without cookies. We use no advertising or tracking cookies, so no cookie-consent banner is required.

Security

Traffic is encrypted (HTTPS). Sign-in and session tokens are stored only as hashes, uploaded images are stripped of metadata (EXIF/GPS), and management actions are gated by passwordless login.

Changes to this policy

We may update this policy as the service evolves. Material changes appear on this page, and the date above records the most recent revision.