Privacy Policy

Controller

Phoenix ry
Business ID: 2765975-3
Sturenkatu 4, 00510 Helsinki, Finland

Contact Person

Sara Desdashti
Startup Refugees
Sturenkatu 4, 00510 Helsinki, Finland
+358 44 978 8025
sara@startuprefugees.com

The Purpose of This Privacy Policy

This document provides detailed information about the types of personal data collected when you visit and interact with https://startuprefugees.com and https://match.startuprefugees.com. It also outlines how and why data is collected, who can access it, how long it is retained, and how it is secured.

Personal Data Collected

If you wish to find a job, develop your skills, start a business, or support Startup Refugees, you may be required to provide personal data. Your data will always be directly provided by you.

The following explains in detail the different situations where personal data is collected:

1. Match Profile

When you create an account in the Match system and make a CV, you actively and willingly enter personal data (e.g., name, phone number, email, date of birth, etc.). It is essentially your personal CV/Profile that you create on your own initiative and with your consent.

• We ensure that all personal data is secured within the Match system.
• We do not share your data unless you explicitly request us to, and only when it serves the purpose for which you provided the data.
• You have the right to update, edit, download, and remove your data at any time.
• If our staff create your profile on your behalf, we can share the password to you to enable direct login by you. In any case, you can also enter your email address in the Match login section, click on “I forgot my password”, follow the instructions, and access your profile by renewing your password.

Additionally, some of our funded projects require us to collect additional data for reporting purposes, including your full address and social security number. However, this data is:

• Not accessible to any Finnish authorities
• Securely stored for as long as needed for project reporting.

Deleted every quarter after the necessary reports are submitted.

2. Supporting or Volunteering with Us

If you offer job opportunities, business support, or volunteering, you will be asked to provide personal data (e.g., name, company, email, phone number).

• Data is collected solely for the purpose you provided it.
• Volunteer data is stored in our internal CRM system (HubSpot), accessible only to Phoenix ry staff members.

3. Website Visits & Cookies

When you visit our website, we collect non-personal data through cookies and tracking technologies. Please see our Cookies Policy: https://startuprefugees.com/cookie-policy.

Use of AI Technologies

At Startup Refugees, we are committed to responsibly integrating Artificial Intelligence (AI) into our operations while safeguarding your personal data. AI technologies help us enhance the quality and efficiency of our services, always in alignment with our core values of inclusion, integrity, transparency, non-discrimination, accountability, and sustainability.

We use AI-powered tools in a controlled and ethical manner, according to our internal AI policy, to support various activities, including:

• Assisting in CV and cover letter creation and editing
• Providing job recommendations based on skills and experience
• Developing training materials and funding applications
• Enhancing content creation, visual design, and text optimization
• Summarizing and researching information
• Supporting business planning processes

All AI-generated outputs are reviewed by our staff to ensure accuracy and relevance. We do not use AI for automated decision-making that could impact your rights or opportunities without human oversight.

We prioritize data privacy by ensuring that personal identifiers (such as names, phone numbers, and email addresses) are omitted when inputting data into AI tools whenever possible. If personal data must be processed, we ensure it is deleted immediately after use, in compliance with data protection regulations.

We ensure that our AI use aligns with strict ethical and compliance standards, including:

• Human oversight of AI-generated content
• Transparency and accountability in AI-driven processes
• Fair and non-discriminatory AI application
• Environmental sustainability in AI tool selection
• Compliance with GDPR and data protection laws

We also assess AI service providers to ensure they comply with GDPR and maintain strong data security practices.

We remain fully transparent about how AI technologies interact with your data. You have the right to:

• Be informed about AI-driven processing of your data
• Access, correct, or request deletion of your personal data
• Object to AI-based processing where applicable under GDPR

By integrating AI responsibly into our services, we continue our commitment to protecting your personal data while leveraging technology to improve our operations.

Legal Basis for Processing Personal Data

Under the General Data Protection Regulation (GDPR), we process your personal data based on:

1. Consent (Article 6(1)(a) GDPR)  When you voluntarily provide personal data for job matching, training, or volunteering.
2. Contract (Article 6(1)(b) GDPR) When you register in the Match system, you enter into a contractual relationship with us to receive job-matching and training services.
3. Legal Obligation (Article 6(1)(c) GDPR)  We may retain some personal data for reporting to funders or legal requirements.
4. Legitimate Interest (Article 6(1)(f) GDPR)  When we process minimal necessary data for improving our services or securing our platform.

If you withdraw consent, we can request third parties (e.g., employers) to delete your data.

Your Rights Under GDPR

Under GDPR, you have the following rights regarding your personal data:

• Right to Access (Article 15 GDPR) Request a copy of your personal data.
• Right to Rectification (Article 16 GDPR)  Request corrections to inaccurate data.
• Right to Erasure (“Right to be Forgotten”) (Article 17 GDPR) Request data deletion (subject to legal exceptions, you can also yourself delete your match profile).
• Right to Restrict Processing (Article 18 GDPR)  Limit how your data is used.
• Right to Data Portability (Article 20 GDPR)  Download and transfer your data.
• Right to Object (Article 21 GDPR) Object to data processing based on legitimate interests.
• Right to Withdraw Consent  You can revoke your consent at any time.

To exercise these rights, contact us at sara@startuprefugees.com.

Data Sharing & Third-Party Recipients

As a general rule, we do not share personal data with third parties, except in the following cases:

1. Job seekers: Your data may be shared with potential employers and mentors only with your explicit consent.
2. Volunteers and network members: Your data may be shared internally among relevant Startup Refugees staff: coordinating your activities.
3. Mentorship programs: If you volunteer as a mentor, we may share your data with newcomers participating in the program.
4. Fund providers:  Some funders require basic statistical data (e.g., employment status of participants). This is done only when legally necessary and with data minimization principles applied.

Security Measures

 We take strong security measures to protect your data:

• Firewalls and other technical means for all databases.
• Two-factor authentication (2FA) for Match system access.
• Access restrictions  only designated staff can view your data.

If you have concerns about how we process your data, you have the right to file a complaint with:

Finnish Data Protection Ombudsman
Website: https://tietosuoja.fi/en/home

Your privacy is important to us. If you have any questions or requests, contact us at:
sara@startuprefugees.com
+358 44 978 8025

We may update this Privacy Policy. The latest version will always be available at:
https://startuprefugees.com