Privacy Policy

This Privacy Policy explains how we process personal data on the HDF Media website and in connection with Helsinki Drink Festival events. It has been prepared in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).

1. Data controller

Half and Half Events Oy
Business ID: 2958432-9
Postal address: PL 13, 00561 Helsinki. Visiting address: Mikonkatu 9, 00100 Helsinki.
Email: jere@ofrd.fi

Data protection enquiries: jere@ofrd.fi. We have not appointed a separate data protection officer, as our operations do not require one.

2. What data we process and where it comes from

As a rule, we only process data that you provide to us directly:

• Newsletter subscribers: email address, name (if provided), the date of subscription, and data on newsletter opens and link clicks.
• Enquiries and partners: name, company, email, phone number and the content of the message.
• Use of the website: data collected via cookies, such as an approximate location derived from your IP address, browser and device information, and statistics on website use. This data is collected only with your consent – see our cookie policy.

We do not buy or collect personal data from external sources. Ticket sales for our events are handled by a separate ticketing service, which acts as its own data controller and has its own privacy policy.

3. Purposes of processing and legal bases

• Sending the newsletter – legal basis: consent (Article 6(1)(a) GDPR). You can withdraw your consent at any time via the link included in every message.
• Responding to enquiries and managing partnership matters – legal basis: legitimate interest (Article 6(1)(f) GDPR) or the preparation of a contract (Article 6(1)(b)).
• Analysing website visitor numbers and usage, as well as targeting advertising and measuring its performance on social media platforms – legal basis: consent (cookies).
• Complying with legal obligations, such as bookkeeping – legal basis: legal obligation (Article 6(1)(c)).

4. Cookies and web analytics

The website uses cookies. Cookies that are not strictly necessary for the website's operation, such as analytics and marketing cookies, are only set with your consent. Consents are collected and stored using the Cookiebot consent tool, and tracking scripts remain blocked until you give consent. The website uses Google Analytics 4 and Google Tag Manager to measure visitor numbers, as well as the Meta and TikTok pixels to target advertising and measure its performance. You can change or withdraw your consent at any time. More details can be found in our cookie policy.

5. Recipients of data

We do not sell or rent out personal data. The following service providers process data on our behalf, each under a data processing agreement:

• Website publishing platform and server infrastructure: Webflow, Inc.
• Newsletter system: Brevo (Sendinblue SAS)
• Web analytics, advertising targeting and measurement: Google Ireland Limited (Google Analytics 4 and Google Tag Manager), Meta Platforms Ireland Limited (Meta pixel) and TikTok Technology Limited (TikTok pixel). Cookie consent management: Cybot A/S (Cookiebot), Denmark.
• Email and office software: Google Workspace (Google Ireland Limited)

6. Transfer of data outside the EU or EEA

Some of the service providers we use process data outside the EU and EEA, particularly in the United States. This applies, among others, to the services of Google, Meta and TikTok. In these cases, the transfer is based on Standard Contractual Clauses approved by the European Commission or on the Commission's adequacy decision (EU–U.S. Data Privacy Framework).

7. Retention period

• Newsletter subscriber data: until the subscription is cancelled. A record of consent and its withdrawal is kept for up to 12 months after withdrawal.
• Enquiries: for up to three years after the matter has been resolved, unless a longer retention period is required for a contract, a legal claim, or a legal obligation.
• Cookie-based data: in accordance with the validity period of each cookie, see our cookie policy.
• Accounting records: retained for the period required under the Finnish Accounting Act.

8. Data security

Data is stored in the secure systems of our service providers. Access to the data is limited to individuals who need it to perform their duties. Connections are encrypted, and systems are accessed using personal credentials.

9. Your rights

You have the right to:

• find out whether we process personal data concerning you, and to receive a copy of that data
• request the correction of inaccurate data
• request the erasure of data
• request the restriction of processing
• object to processing based on legitimate interest
• receive, in a portable format, the data you have provided to us on the basis of consent or a contract
• withdraw your consent at any time; withdrawal does not affect the lawfulness of processing carried out before the withdrawal

Requests should be sent to jere@ofrd.fi. We may ask you to verify your identity before fulfilling a request. We will respond to your request within one month at the latest.

We do not make automated decisions about you that produce legal effects or similarly significantly affect you. However, if you consent to marketing cookies, you may be shown targeted advertising on Meta and TikTok's services based on your use of the website.

10. Right to lodge a complaint

If you believe that the processing of your personal data infringes data protection legislation, you can lodge a complaint with the Office of the Data Protection Ombudsman (tietosuoja.fi).

11. Changes to this Privacy Policy

We update this Privacy Policy whenever our services or data processing practices change. The current version is always available on this page, and the update date is shown at the top of the page.