Data register description

Controller

Vapaaradikaali (business ID 2302852-4), Finland. The contact person for register matters is Arttu Manninen.

For any question about the register, contact info@openmat.fi.

Name of the register

openmat.fi user, listing and marketing register.

Purpose and lawful basis

• Running the directory (publishing/moderating listings, letting clubs manage their own data, sign-in, abuse prevention): legitimate interest (GDPR Art. 6(1)(f)) and the steps necessary to provide the service you request.
• Newsletter: consent (Art. 6(1)(a)). Consent can be withdrawn at any time via the unsubscribe link in every issue.
• Usage analytics to improve the service: legitimate interest (Art. 6(1)(f)).

What is stored: private individuals (consumers)

• Submitters, error-reporters and feedback senders: the name and/or email you optionally provide, your message, and a salted, non-reversible hash of your IP address (used only to limit abuse).
• Account holders (club organisers and staff): email address, a session identifier, and a content trust level.
• Uploaded media: images and posters you upload (location and camera metadata (EXIF/GPS) are stripped on upload).

What is stored: newsletter subscribers

• Email address.
• Chosen interests: new seminars and/or new clubs.
• Subscription state and timestamps: when subscribed, confirmed and unsubscribed (double opt-in).
• A salted hash of your IP address (abuse prevention).
• Basis: consent; you can unsubscribe at any time via the link in every issue.

What is stored: businesses and associations (clubs)

• Club name, description, website, social-media handles and contact email.
• Venues: address, postal code, city and coordinates.
• Open-mat and event times.
• This is largely public business/association information. For a sole trader (toiminimi) it may also be personal data.

What is stored: usage data

• Self-hosted Matomo analytics: anonymised usage data (pages viewed, referrer, approximate region, device and browser type). Cookieless, IP anonymised; not used to identify an individual.

Regular data sources

• From the data subject: forms, the newsletter subscription and sign-in.
• The initial directory dataset was compiled from public sources (business/association registers and clubs’ own public pages); see the privacy policy.
• From use of the service: analytics.

Disclosures and transfers

• Data is not sold and is not used for third-party advertising or tracking.
• Email is sent from our own server. Maps are served first-party; for address geocoding the address (not personal data) is sent to OpenStreetMap’s Nominatim.
• The service runs on our own server in the EU. No transfers outside the EU/EEA.

Retention

• Listing personal data (email, name, salted IP hash) is scrubbed 90 days after the submission is handled; a report’s contact details are scrubbed once closed.
• A newsletter subscriber’s data is kept until they unsubscribe; after that it is deleted or anonymised.
• Account email addresses are kept until you ask us to delete the account. Sessions expire after 30 days.
• The analytics per-visit log is deleted after at most 14 months; the anonymous aggregate statistics left behind are not personal data and are kept indefinitely.

Register security

Traffic is encrypted (HTTPS). Sign-in and session tokens are stored only as hashes, uploaded images are stripped of metadata, and management actions are gated by passwordless login. Access to the data is restricted.

Your rights

You have the right to access, rectify and erase your data, to restrict and object to processing, and to data portability. For the newsletter you can withdraw consent at any time. Exercise your rights at info@openmat.fi.

You may lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) if you consider the processing unlawful.