Privacy Policy

This Privacy Policy explains how Walbrook Association LLC ("Walbrook", "we", "us"), the producer of Helsinki Blockchain Week ("HBW", the "Event"), collects, uses, and protects your personal data when you visit helsinkiblockchainweek.com or attend the Event. It is issued in accordance with Regulation (EU) 2016/679 (the "GDPR") and the Finnish Data Protection Act (1050/2018).

1. Data controller

The data controller responsible for your personal data is Walbrook Association LLC, with registered office in Helsinki, Finland. You can reach our privacy team at privacy@helsinkiblockchain.fi.

2. Personal data we collect

• Ticketing & registration: full name, email address, company, job title, billing address, VAT ID (where applicable), and dietary or accessibility requirements you choose to share.
• Payment data: payment card details are collected and processed directly by our payment processor Stripe Payments Europe Ltd. We never see or store your full card number or CVC — we retain only a Stripe session identifier, the amount charged, currency, and purchase status.
• Website analytics: your IP address and the country, region and city derived from it; a first-party visitor identifier stored in a cookie (hbw_vid, up to 400 days) and a per-session identifier; a technical device fingerprint (browser, operating system, screen size, language, time zone); the referring site, landing URL and any campaign parameters or advertising click identifiers in the link you arrived with; the pages you view, time spent on each page, scroll depth and interactions such as opening checkout; and any affiliate or invitation code. We use this to measure the site, attribute ticket sales and enquiries to marketing campaigns and build audiences for our own advertising. Legal basis: our legitimate interest in marketing the Event (Art. 6(1)(f) GDPR); you may object at any time (see section 6) and we will delete your visitor profile. Analytics data is kept for up to 14 months.
• Communications: emails, newsletter subscriptions and support requests you send us.
• On-site data: badge scans at sessions (with your consent), photography and video captured at the Event (see §7).

3. Purposes and legal bases

• To perform our contract with you (Art. 6(1)(b) GDPR) — issuing tickets, admitting you to the Event, providing customer support.
• To comply with legal obligations (Art. 6(1)(c) GDPR) — tax, accounting and consumer-protection record keeping.
• Our legitimate interests (Art. 6(1)(f) GDPR) — securing the website, preventing fraud, improving the Event and producing aggregated statistics.
• Your consent (Art. 6(1)(a) GDPR) — marketing newsletters, non-essential cookies, and optional media features. You can withdraw consent at any time.

4. Recipients & international transfers

We share personal data only with vetted processors acting on our documented instructions:

• Stripe Payments Europe Ltd. (payments) — EU/EEA.
• MongoDB Atlas (hosted database) — EU region.
• Email delivery and analytics providers under a DPA.

Where a transfer outside the EEA is necessary, we rely on Standard Contractual Clauses approved by the European Commission and additional safeguards where required.

5. Retention

• Ticketing and financial records: 6 years (statutory).
• Marketing data: until you unsubscribe or 24 months of inactivity.
• Website analytics: up to 14 months in aggregated form.

6. Your rights under the GDPR

You have the right to:

• access your personal data (Art. 15);
• request rectification (Art. 16) or erasure (Art. 17);
• restrict or object to processing (Art. 18 & 21);
• data portability (Art. 20);
• withdraw consent at any time, without affecting prior processing;
• lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) or your local supervisory authority.

To exercise any right, email privacy@helsinkiblockchain.fi. We respond within one month.

7. Photography & recording at the Event

The Event is filmed and photographed. Attendees are informed at registration and on-site. If you do not wish to appear in Event media, you may collect a "no photo" lanyard at the entrance and/or email privacy@helsinkiblockchain.fi with your removal request.

8. Cookies

We use strictly necessary cookies to make the site work, a first-party analytics cookie (hbw_vid) described in section 2, and, subject to your consent, third-party marketing cookies and pixels — Google Tag Manager / Google Ads, the Meta Pixel and the LinkedIn Insight Tag — used to measure campaigns and show you relevant advertising on those platforms (retargeting). A dedicated cookie banner allows you to accept or reject the third-party cookies; your choice is stored locally and can be changed by clearing site data.

9. Children

The Event and website are not directed at children under 16. We do not knowingly collect data from minors without verifiable parental consent.

10. Changes

We may update this Policy from time to time. Material changes will be highlighted on this page and, where appropriate, communicated by email.