Privacy policy

Drawn up: 17.8.2026

Last updated: 17.8.2026

1. Data controller

Jenni Alasuutari

Email: jenni@jennialasuutari.fi

Address: Vantaa, Finland

For any matter concerning this policy or the processing of personal data, please use the email address above. The controller is not under a statutory obligation to appoint a data protection officer.

2. General

This policy explains how personal data is processed on the website jennialasuutari.fi. The site is the personal political website of Jenni Alasuutari, member of the Vantaa City Council and of the council of the Vantaa and Kerava Wellbeing Services County.

Processing is governed by the EU General Data Protection Regulation (2016/679), the Finnish Data Protection Act (1050/2018) and the Act on Electronic Communications Services (917/2014).

Some of the data processed through this site may reveal a person’s political opinion. Such data falls within the special categories of personal data referred to in Article 9 GDPR and is handled with particular care and only on the grounds set out below.

3. Personal data processed, purposes and legal bases

3.1 Newsletter

Data processed: first name and email address, the IP address and timestamp of the subscription, confirmation status of the subscription, and data on opens of and clicks in the newsletters.

Purpose: sending the newsletter to subscribers and monitoring how well the communication works and how relevant it is.

Legal basis: consent (Article 6(1)(a) GDPR). Because subscribing to a politician’s newsletter may reveal the subscriber’s political opinion, the processing is based on explicit consent (Article 9(2)(a)).

Subscriptions are always confirmed by double opt-in: a subscription takes effect only once the subscriber confirms it via a link sent by email. Consent may be withdrawn at any time using the link at the end of every newsletter or by contacting the controller. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Retention: data is kept until the subscriber unsubscribes. After unsubscribing, the email address and the record of the withdrawal are kept for 6 months, so that communication is not resumed by mistake and so that the giving and withdrawal of consent can be demonstrated if needed.

The newsletter is sent using the MailPoet service (see section 5).

3.2 Donations

The donation page directs visitors to pay via the MobilePay service. No payment card or online banking credentials are processed on the website or passed to the controller.

Data processed: the donor’s name or MobilePay display name, telephone number, the amount and time of the donation, payment reference details, and any message the donor may have added to the payment.

Purpose: receiving and keeping track of funding for political activity and the election campaign, and filing the statutory election funding disclosure.

Legal basis: compliance with a legal obligation (Article 6(1)(c); the Act on a Candidate’s Election Funding 273/2009) and the controller’s legitimate interest (Article 6(1)(f)) in receiving, allocating and accounting for donations. As regards special categories of personal data, processing is based on reasons of substantial public interest (Article 9(2)(g)) and, to the extent a donor’s name is published voluntarily, on explicit consent (Article 9(2)(a)).

Disclosure: the Act on a Candidate’s Election Funding requires a person elected as a councillor or deputy councillor to disclose their election funding to the National Audit Office of Finland within two months of the confirmation of the election result. Each individual contribution and its donor must be itemised where the value of the contribution is at least EUR 1100 in municipal elections or at least EUR 2000 in county elections. A private individual’s name is not disclosed or published without their explicit consent where the value of the contribution falls below those thresholds. The National Audit Office keeps the disclosed information available online for five years from the confirmation of the election result.

Retention: donation data is kept for as long as needed to prepare the election funding disclosure and for its supervision, no longer than five (5) years from the confirmation of the election result.

3.3 Website statistics (Google Analytics)

Data processed: a randomly generated identifier, a truncated IP address and the approximate location derived from it, device and browser information, the time and duration of the visit, the pages viewed, and the source from which the visitor arrived at the site.

Purpose: compiling statistics on the use of the site and developing its content and usability.

Legal basis: consent (Article 6(1)(a)). Analytics is not loaded at all until the visitor has accepted statistics cookies in the site’s cookie banner. Consent may be withdrawn and choices changed at any time in the site’s cookie settings.

The site uses Google Analytics 4 with default settings. IP addresses are not stored as such, the Google Signals feature is not enabled, and the data is not used for advertising targeting. The retention period for event-level data in Google Analytics is the default 2 months, after which only aggregated statistics remain.

3.4 Storing cookie consent

The site uses the GDPR Cookie Compliance consent manager. It stores a cookie in the browser recording the visitor’s cookie choices and the time they were made. This information is not transferred to third parties.

Legal basis: the processing is necessary to provide the service the visitor has themselves requested, namely remembering their cookie choices, and to demonstrate consent.

Retention: 12 months, or until the visitor clears the cookies in their browser.

3.5 Server logs

Data processed: IP address, timestamp, requested address, response code and browser identifier.

Purpose: the security of the site, prevention of misuse, and investigation of technical faults.

Legal basis: the controller’s legitimate interest (Article 6(1)(f)) in keeping the site secure and reliable.

Retention: no longer than 30 days.

4. Sources of the data

All personal data is obtained from the data subject themselves or arises from the technical use of the website. Personal data is not purchased or collected from external sources.

5. Recipients and processors

The following service providers process personal data on the controller’s behalf under a processing agreement compliant with Article 28 GDPR:

Website hosting and server maintenance: Zoner Oy. The servers are located in the EU.
Technical maintenance and updates of the site: Jenni Alasuutari.
Newsletter delivery (MailPoet Sending Service): WooCommerce Ireland Ltd / Aut O’Mattic A8C Ireland Ltd, Grand Canal Dock, 25 Herbert Place, Dublin, Ireland.
Website analytics (Google Analytics 4): Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

In addition, data is disclosed to the following independent controllers or authorities:

Vipps MobilePay AS, Finnish branch (business ID 3330214-4, Aleksanterinkatu 11, 00100 Helsinki) processes payment transaction data as a payment service provider acting as an independent controller under its own privacy notice.
The National Audit Office of Finland, to the extent donation data must be disclosed under the Act on a Candidate’s Election Funding.

Personal data is not sold, rented or disclosed to outside parties for marketing purposes. Data may be disclosed to authorities where required by law.

6. Transfers outside the EU and EEA

The newsletter and analytics providers may use group companies and subcontractors in the United States to deliver their services. In such cases the transfer is based on the standard contractual clauses approved by the European Commission and/or on the EU–U.S. Data Privacy Framework, together with supplementary safeguards implemented by the service providers. Otherwise personal data is processed within the EU and EEA.

7. Automated decision-making and profiling

No automated decisions producing legal effects concerning the data subject, or similarly significantly affecting them, are made on this site. Newsletter open and click data is used solely to assess how relevant the communication is and to develop its content.

8. Data security

Traffic on the site is encrypted using an HTTPS connection. Access to personal data is restricted to those who need it to perform their duties, and access is protected with personal credentials and multi-factor authentication. The site’s software and plugins are kept up to date and the data is backed up regularly. No printouts or paper records containing personal data are produced.

9. Rights of the data subject

The data subject has the right to:

obtain access to the personal data concerning them and receive a copy of it;
request the rectification of inaccurate or incomplete data;
request the erasure of their data where there is no longer a basis for the processing;
request the restriction of processing;
object to processing based on legitimate interest on grounds relating to their particular situation;
receive the data provided on the basis of consent or a contract in a machine-readable format and transmit it to another controller;
withdraw their consent at any time where processing is based on consent.

Requests should be sent by email to jenni@jennialasuutari. The identity of the person making the request may need to be verified before the request is carried out. A response is given no later than one month from receipt of the request.

The data subject also has the right to lodge a complaint with the supervisory authority:

Office of the Data Protection Ombudsman, P.O. Box 800, FI-00531 Helsinki, Finland (visiting address Lintulahdenkuja 4, 00530 Helsinki), switchboard +358 29 566 6700, email tietosuoja@om.fi, www.tietosuoja.fi

10. Changes to this policy

This policy will be updated if the site’s functions, the services used or the applicable legislation change. The current version is always available on this page, and the date of the most recent update is shown at the beginning of the policy.