NATO Innovation Range Finland 2026 privacy policy

Privacy Statement for NATO Innovation Range Finland, Riihimäki
Last updated: 21.05.2026

This Privacy Notice is issued by DEFINE (City of Riihimäki), acting as the data controller for the event.

RAIN.global acts as a service provider (data processor) and processes personal data strictly on behalf of DEFINE in connection with the organization and delivery of the event.

1. Personal Information We Collect
As part of the event registration and participation process, we may collect:

➢ Full name

➢ Email address

➢ Phone number

➢ Passport or identification details (for security and access purposes)

➢ Photograph

➢ Organization, job title, and professional details

➢ Any other information you voluntarily provide (e.g., accessibility needs, dietary preferences for catering)

2. Purpose of Processing
Personal data is processed by DEFINE (City of Riihimäki) as the data controller and by RAIN.global acting as a data processor on behalf of the controller.

We process your personal data for the following purposes:

➢ Managing registration and attendance

➢ Sending event communications and updates

➢ Coordinating travel arrangements, security verification, and venue access

➢ Ensuring the safety and security of participants and event processes

➢ Providing post-event materials and follow-up communications

For media representatives, journalists, speakers, partners, and other professional contacts, we may also use contact information to send future event-related communications, invitations, press materials, and relevant professional outreach based on our legitimate interest in maintaining ongoing professional relationships, unless you object or opt out of such communications.

Contact information used for unrelated marketing communications will only be retained and used where you have provided consent, where required by applicable law.

We do not use your personal information for unrelated marketing unless you provide explicit consent.

3. Filming and Photography
We may be filming and photographing the event for documentation and communication purposes. This may include:

➢ Internal use, such as sharing photos with event participants or including images in post-event materials

➢ External/public use, such as press releases, media coverage, social media posts, organizational publications, or a documentary

The legal basis for this processing is our legitimate interest in documenting and communicating about the event.

If you prefer not to appear in general event photographs or film recordings, please inform event staff, and we will make reasonable efforts to accommodate your request.

4. Legal Bases for Processing
For participants located in the EU/EEA, the United Kingdom, Switzerland, and Ukraine, we process personal data under one or more of the following legal bases:

➢ Consent (e.g., optional communications or participant materials)

➢ Performance of a contract (event registration and participation)

➢ Legal obligations (e.g., security requirements)

➢ Legitimate interests (event organization, logistics, security, media relations, and professional outreach)

5. International Data Transfers
Because our participants and service providers may be located internationally, your personal information may be transferred outside your home country.

Where required by applicable law (such as for EU/EEA, UK, or Swiss participants), these transfers are protected through appropriate safeguards, including:

➢ Standard Contractual Clauses (SCCs)

➢ Adequacy decisions

➢ Contractual, technical, or organizational protections

6. Data Sharing
We may share your data only with:

➢ Authorized personnel of DEFINE (City of Riihimäki) with a legitimate need to access the information for event-related purposes
➢ RAIN.global acting as a data processor
➢ Venue or security personnel

➢ Trusted third-party service providers acting as data processors under Article 28 GDPR

➢ Other service providers and partner organizations involved in the delivery of the event, acting either as data processors under Article 28 GDPR or, where applicable, as separate data controllers

Certain information may be shared with other event participants only with your explicit permission.

We will request your consent separately if you choose to be included in participant materials or optional communication channels.

All third parties are contractually required to protect your information and use it only for event-related purposes.

We do not sell personal information under any circumstances, including under U.S. privacy laws.

Personal data collected in connection with the event will not be shared with sponsors, partners, or other third parties for their independent marketing purposes without your explicit consent.

7. Data Retention
We retain your personal information only for as long as necessary to:

➢ Organize and complete the event

➢ Comply with legal, security, or audit requirements

Contact information of media representatives, journalists, speakers, partners, and other professional contacts may be retained and used for future event-related communications, invitations, press materials, and relevant professional outreach based on our legitimate interest in maintaining ongoing professional relationships, unless you object or opt out of such communications. We may periodically review media contact details to ensure relevance and accuracy of communications.

Contact information used for unrelated marketing communications will only be retained and used where you have provided consent, where required by applicable law.

If we offer an optional communication platform for participants to stay in touch after the event, any information you choose to share on that platform will be retained only for as long as the platform remains active or until you choose to leave. Participation in such platforms is entirely optional.

After retention periods expire, personal data is securely deleted, anonymized, or archived in accordance with our retention policies.

8. Your Data Protection Rights
Depending on your location, you may have some or all of the following rights regarding your personal data:

➢ The right to access the personal information we hold

➢ The right to request correction or updates

➢ The right to request deletion of your data

➢ The right to restrict or object to certain processing

➢ The right to withdraw consent at any time (where processing is based on consent)

➢ The right to receive your data in a portable format (where applicable)

➢ The right to lodge a complaint with a data protection authority

These rights are available under the EU/EEA GDPR, UK GDPR, the Swiss Federal Act on Data Protection, Ukrainian data protection law, and certain U.S. state privacy laws.

Your specific rights may vary depending on your jurisdiction.

You may exercise your rights by contacting us using the information below.

 

9. Contact Information
For questions or concerns about this Privacy Notice or your personal data, please contact:

DEFINE

Pohjoinen Asemakatu 5, 11130 Riihimäki

Teemu Seppälä, Technology and Innovation Director

teemu.seppala@riihimaki.fi

+358 50 374 4589

If required in your region, you may also contact your local data protection authority