Privacy Policy

This Privacy Policy describes how Kaiku (referred to as "we", "us", "the website") processes personal data in connection with this informational website about Finland's MyKanta service.

1. Website operator

Website operator: [Operator name placeholder]
Contact email: privacy@northlight.example
Postal address: [Address placeholder]

2. Types of personal data collected

• Subscription form data: name, email address, country of residence, preferred language, chosen topic, optional general question.
• Contact form data: name, email address, subject, message.
• Technical and analytics data: anonymised page views, referring page, general device type, approximate region (only where analytics cookies are accepted).

We do not knowingly collect medical records, personal identity numbers, prescription information, authentication credentials, or other sensitive personal data through this website.

3. Purpose of processing

• To send educational updates to users who have subscribed.
• To respond to enquiries received through the contact form.
• To operate, secure and improve this website.

4. Legal basis

Processing is based on the user's consent (Article 6(1)(a) GDPR) for subscriptions and optional analytics, and on legitimate interests(Article 6(1)(f) GDPR) for the secure operation of the website.

5. Consent management

Consent for optional cookies is managed through the cookie preference centre available at the bottom of every page. Consent may be withdrawn at any time.

6. Data retention

• Subscription data: retained until the user unsubscribes or requests deletion.
• Contact enquiries: typically retained for up to 24 months for reference.
• Analytics data: aggregated and retained for a maximum of 26 months.

7. Service providers

Where necessary, personal data may be processed on our behalf by GDPR-compliant service providers such as email delivery, hosting and analytics providers. Service providers act under a data processing agreement.

8. International data transfers

Where personal data is transferred outside the European Economic Area, transfers are protected by appropriate safeguards such as Standard Contractual Clauses.

9. Your GDPR rights

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing based on legitimate interests
• Right to withdraw consent at any time
• Right to lodge a complaint with a supervisory authority

10. Cookies

See the Cookie Policy for a full list of cookies used and how to manage them.

11. Security

We apply reasonable organisational and technical measures to protect personal data, including transport encryption, restricted access and regular review of processors.

12. Updates to this policy

We may update this Privacy Policy from time to time. The latest version is always available on this page with an updated date.