Last updated: 10 November 2026

SOHJO 2027 is organised by XP Crew Oy, based in Joensuu, Finland. We respect your privacy and process personal information in accordance with the EU General Data Protection Regulation (GDPR) and applicable Finnish legislation.

1. Who is responsible for your data?

Data controller: XP Crew Oy
Business ID: 3529870-8
Address: Riikolantie 245, 82600 Tohmajärvi, Finland
Email: info@xpcrew.fi

2. What information do we collect?

Depending on how you interact with SOHJO, we may collect:

  • Your name, email address, organisation and contact details.
  • Ticket purchases, registration details and payment confirmations.
  • Information you voluntarily provide through forms, competitions or event registrations.
  • Communication preferences and newsletter subscriptions.
  • Technical information, such as IP addresses and website usage data.

Payment information is processed through our payment service provider. We do not directly store your complete payment card details.

3. How do we use your information?

We process personal information to:

  • Manage ticket purchases, registrations and event access.
  • Send important information about your tickets and the event.
  • Respond to enquiries and provide customer support.
  • Manage event participation and networking services.
  • Fulfil accounting and other legal obligations.
  • Send marketing communications where we have a valid legal basis.
  • Maintain and improve our website and services.

Our legal bases for processing are the performance of a contract, compliance with legal obligations, legitimate interests where appropriate, and consent where required.

You can unsubscribe from marketing emails at any time.

4. Who do we share information with?

We may share necessary information with trusted service providers, including ticketing platforms, payment processors, email services, website hosting providers and event networking platforms.

These providers process information for the relevant services under appropriate data protection arrangements.

We do not sell your personal information.

We do not share attendee contact lists with event partners for their own marketing without an appropriate legal basis.

5. How long do we keep information?

We retain personal information only for as long as necessary for the purposes described in this policy.

  • Ticketing and registration information is normally retained for up to 12 months after the event, unless a longer period is required.
  • Accounting records are retained for the periods required by Finnish law.
  • Marketing information is retained until you unsubscribe or withdraw your consent, subject to necessary suppression records.
  • Technical information is retained according to the applicable system’s retention settings.

6. Cookies and analytics

Our website may use essential cookies to support its functionality.

If we use optional analytics or marketing cookies, we will request your consent before activating them. You can change your preferences through our cookie settings.

7. International data transfers

Some service providers may process information outside the European Economic Area. Where this happens, we use applicable GDPR safeguards, such as European Commission adequacy decisions or Standard Contractual Clauses.

8. Your rights

Under GDPR, you may have the right to:

  • Access and correct your personal information.
  • Request deletion or restriction of processing.
  • Object to certain processing activities.
  • Receive your information in a portable format where applicable.
  • Withdraw consent at any time where processing is based on consent.

To exercise your rights, contact us at [Privacy contact email].

You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman at www.tietosuoja.fi.

9. Changes to this policy

We may update this policy when our services or legal requirements change. The latest version will always be available on our website.