Privacy

Privacy Policy

This policy explains how Karla Still handles the personal data of donation advising clients and newsletter subscribers.

Data controller

This service is currently provided by Karla Still as a private individual. In the future, the service may become part of the activities of Effective Altruism Finland ry (a Finnish association). In that case, only your data related to future payments (e.g. your name and payment details) would be processed within the association's bookkeeping. Other data I keep about you, such as conversation notes or your giving intentions, would continue to be accessible only to me. If the controller changes, I will update this policy and notify data subjects at least 30 days in advance.

Contact details

Karla Still, karla@lahjoitatehokkaasti.fi

What data is collected

I process the following data:

• Your name and email address, when you book a call or otherwise contact me.
• Any additional details you provide when booking (e.g. answers to the intake form).
• Notes on the content of our conversation: for example, which causes or organisations you're interested in donating to, donation amounts or intentions, and notes on whether we agreed to follow up later or whether you offered to help develop the service.

I keep these notes in a database that only I have access to.

How and why data is used

Your data is used to:

• Arrange and prepare for our call.
• Possibly follow up later, for example after a year.
• Evaluate and measure the service's impact. I use the data for this myself, but if I share results publicly (e.g. in an annual report), the data is always anonymized and individual respondents cannot be identified from the responses.
• Arrange payment: after the call, I'll send you any invoice or payment details by email.

Your data is not used for marketing without your separate consent, and it is not sold to third parties.

Newsletter subscribers

You can subscribe to my newsletter on my website. Subscribing is separate from donation advising: advising clients are not added to the subscriber list automatically, and subscribing does not affect advising. The same handling applies to people who subscribed earlier to my newsletter under the name Enemmän kuin rahaa.

• What data: your email address and the time of subscription. Substack may also collect technical data (e.g. IP address) and statistics on whether the newsletter is opened and links are clicked.
• What it's used for: sending the newsletter (news from the service, thoughts and news on effective giving) and seeing which content readers are interested in.
• Legal basis: your consent, which you give by subscribing. You can withdraw your consent at any time.
• Retention and unsubscribing: I keep your email address until you unsubscribe. You can unsubscribe using the link at the bottom of every newsletter or by emailing karla@lahjoitatehokkaasti.fi. On request, I will remove your email address from the subscriber list entirely.
• Service provider: the newsletter is sent through the service of Substack Inc. (USA). Substack processes subscriber data on my behalf as a data processor. Substack also processes data as an independent controller for its own purposes, under Substack's privacy policy. Substack states that it complies with the EU-U.S. Data Privacy Framework, on the basis of which data may be transferred outside the EU/EEA.
• Cookies: my website does not use cookies. When you press the “Subscribe” button, the signup form is loaded from Substack's servers, and Substack may then set cookies in your browser. The form is not loaded before you press the button.

Tools used to run the service

I use digital tools, for example for scheduling and storing data. These tools may change over time, so I don't list the exact services I use here. I always choose services that offer service agreements compliant with the EU General Data Protection Regulation ((EU) 2016/679).

Confidentiality

All our conversations are confidential. If I share information about the service, for example in an annual report, I only do so in anonymized form, and only if there are enough clients that individual people's data cannot be inferred from the responses.

Data retention

I'm aware that the data I process may be sensitive in nature. The information you give me may reveal your values or convictions, linked to your name and contact details. I delete any of your personal data that may be classified as sensitive within 13 months of our last contact, and your other personal data no later than two years after our last contact, unless you ask me to delete it sooner (see Your rights below). Throughout the retention period, I use your data only myself, and I don't disclose it to others. The providers of the tools I use (for example email, scheduling and the website form) may, however, process the data on my behalf. The handling of newsletter data is described under Newsletter subscribers.

If the service becomes part of the activities of Effective Altruism Finland ry, payment-related data may be kept longer within the association's bookkeeping, which is subject to the retention periods of the Finnish Accounting Act (1336/1997) (generally six years).

Transfers outside the EU/EEA

Some of the tools I use may store data on servers located outside the EU/EEA. Where this is the case, providers are required to have appropriate safeguards in place (such as the EU Standard Contractual Clauses) to protect your data.

Your rights

Under the GDPR, you have the right to:

• withdraw your consent to the processing of your personal data
• access the data stored about you
• request correction of inaccurate data
• request deletion of your data
• object to or request restriction of the processing of your data
• request that your data be transferred to another system
• lodge a complaint with the Office of the Data Protection Ombudsman.

To exercise these rights, email karla@lahjoitatehokkaasti.fi or contact the Office of the Data Protection Ombudsman.

Changes to this policy

I may update this policy as the service develops. I'll clearly announce any significant changes — for example, if I start using cookies or the controller changes — on this page and by contacting data subjects well in advance of the changes taking effect.