01 Who we are
STUHI (StartUpHigh) is a youth-led, non-profit innovation community based in Helsinki, Finland. It is run by Nuorten startup- ja innovaatioyhdistys ry (Business ID 3613004-2), a registered non-profit association that owns and operates this website (stuhi.org) and is the data controller for the personal data described here. You can reach us by email at team@stuhi.org , or by post at Abrahaminkatu 1, 00180 Helsinki, Finland.
02 What we collect
We hold as little about you as we can. Depending on how you interact with us, this may include:
- Contact details such as your name and email when you sign up for updates, register for an event or write to us.
- What you tell us when you apply to join STUHI or take part in a programme, for example your age, school, country, your interests and anything else you choose to share.
- What you submit through our volunteer and open-role forms, such as the role you're interested in and a short background.
- Practical details needed to run an event, like a dietary note you choose to share.
- The content of messages you send us, so we can reply and keep track of the conversation.
- What you give us when you create a Temple account and use it — see “Your Temple account” below.
- Basic, aggregate statistics about how the site is used, if we have analytics enabled (see “Cookies and analytics” below).
03 Your Temple account
STUHI Temple is the platform at stuhi.org/temple, where members take on challenges and submit their work. It needs an account, so it holds more about you than the rest of this site does.
When you sign up we store:
- Your name, email and date of birth. We use the date of birth only to check you are at least 13 — under-13s cannot create an account.
- Your city, and your school if you give it.
- How you first heard about STUHI. You pick from a short list, and “Prefer not to say” is one of the choices. We use it only to see which of our channels reach people.
Once you are in, we also store:
- Anything you choose to add to your profile — a short bio, a website, social or code handles, skills, and your display name. All optional, all editable in Settings.
- The entries you submit to challenges, including any text and links, plus the score and the feedback a reviewer leaves.
- Any challenge you suggest, which an admin reads before it can be published.
The leaderboard is public. It shows your display name, your initials, your points and how many entries of yours have been reviewed, and anyone can see it — you do not need an account to look. Your display name starts as the name you signed up with, so change it in Settings if you would rather not be listed under it. You can also switch off leaderboard visibility entirely in Settings, at any time; nothing else about your account changes if you do. Your email, date of birth, city and school are never shown on it.
We keep your account for as long as you have one. To delete it and its data, email team@stuhi.org and we will remove it.
04 Why we use it, and our legal basis
We use it to send the updates you asked for, to run our events, to reply when you write to us, and to look back at past events — things like how many people came, and came back — so we can plan better ones. Under the GDPR our legal basis is your consent, or our legitimate interest in keeping the community running. Change your mind any time and we will stop.
05 Sharing
We never sell your data. We share it only with the service providers that help us run STUHI, and only as far as each one needs to do its job. These currently include Luma, which we use to manage event registrations; Supabase, which hosts the database where applications and volunteer or open-role submissions made through our forms are stored; Resend, which delivers the notification emails those forms generate to our team; and our email provider, which we use to send updates and reply to you. Cloudflare helps us protect application forms from automated spam. Those providers process your data on our behalf under their own privacy terms. Some of them may process data outside the European Economic Area; where that happens, the transfer is covered by recognised safeguards such as the EU standard contractual clauses. We may also disclose data where the law genuinely requires it.
06 How long we keep it
We keep personal data only as long as we need it for the purpose we collected it, or as the law requires, and then we delete it. As a rule of thumb: event registration details are archived after the event and kept for up to two years, so we can understand attendance and plan future events, and are then deleted or anonymised; applications and volunteer or open-role submissions are kept while we consider them and for a reasonable time after, in case a role reopens; and newsletter contact details are kept until you unsubscribe. If you ask us to delete your data sooner, we will (see “Your rights”).
07 Your rights
The GDPR puts you in charge: you can ask to see your data, fix it, delete it, limit how we use it or get a portable copy. Email team@stuhi.org and we will sort it. You can also complain to a data protection authority.
08 Cookies and analytics
The site itself sets no tracking cookies and loads no third-party trackers — its fonts, images and video are all served from our own domain, so simply browsing tells no one else you were here. We don't use cookies to build advertising profiles. If we ever run a privacy-friendly analytics tool, it will tell us only aggregate things like which pages are popular, not who you are. The application form uses Cloudflare Turnstile to check whether a submission is automated; the widget may use its own strictly necessary cookies for that check. Our pages also link out to third-party services, such as our Luma events calendar and our social media — once you follow a link, the provider's own policy applies. Where the law requires consent for non-essential cookies, we'll ask before setting them.
09 Changes
We may revise this from time to time; the date below always shows the current version.
10 Contact
Questions? team@stuhi.org .