top of page


DATA PRIVACY POLICY

​

In order to run its operations,  European CyberCrime and Fraud Investigators (“ECCFI”)  needs to process personal data. Personal data is processed in the following categories (list is not exhaustive:)
ECCFI members;
Participants of ECCFI events; and
ECCFI staff.

​

ECCFI complies with applicable law and regulation on data protection, including but not limited to Data Protection Regulation (“GDPR”) EU 2016/769.


Data controller
European CyberCrime and Fraud Investigators (“ECCFI”) is the data controller and responsible for all personal data collected by ECCFI and for processing of that personal data. 

​

ECCFI
(Registration number 2855528-6)
Address: Saikkolantie 131, 53400 Lappeenranta, Finland
Email: contact@eccfi.eu

​

Data protection principles


ECCFI is committed to processing data in accordance with its responsibilities under the GDPR. Personal data shall be:

  • Processed lawfully, fairly and in a transparent manner in relation to individuals;

  • Collected for specific, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;

  • Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;

  • Accurate and, where necessary, kept up to date. Every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;

  • Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; and 

  • Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

​​

Transparent processing


Individuals have the right to access their personal data. A request to access personal data must be made in writing to the email address provided by ECCFI. Any such requests made to ECCFI shall be dealt with in a timely manner.

​

Lawful purposes


All personal data processed by ECCFI must be done on one of the following lawful bases: consent, contract, legal obligation, vital interests, public tasks or legitimate interests.  Where consent is relied upon, evidence of opt-in consent shall be kept with the personal data. 

Where communication is sent to individuals based on their consent, the option for the individual to revoke their consent should be clearly available. Systems should be in place to ensure such revocation is reflected accurately in ECCFI’s systems.

​

Data minimisation and data accuracy


ECCFI shall ensure that personal data are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

ECCFI shall take reasonable steps to ensure personal data is accurate. Where necessary for the lawful basis on which data is processed, steps shall be put in place to ensure that personal data is kept up to date.

​

Archiving and removing data
 

To ensure that personal data is kept for no longer than necessary, ECCFI shall put in place an archiving policy for each area in which personal data is processed and review this process annually. 

The archiving policy shall consider what data should/must be retained, for how long, and why.

​

Security
 

ECCFI shall ensure that personal data is stored securely using modern software that is kept-up-to-date.  Access to personal data shall be limited to personnel who need access. Appropriate security should be in place to avoid unauthorised sharing of information.


Enforcement and follow-up


This policy is valid when it is approved by ECCFI board. Policy is to be reviewed and, when applicable, updated at least on a yearly basis.

 

 

Revision history

 

Approved 30.4.2020
Board of ECCFI

bottom of page