AIESEC in Finland — General Privacy Policy

Last updated: 3 December 2025

This privacy policy (the "Privacy Policy") governs the way AIESEC Suomi ry, registered as an association maintained by the Municipal Court in Helsinki, and having its registered office at AIESEC Linnoituksentie 10 N131 ("AIESEC", "we", "us", or "our"), as data controller, processes your personal data in relation to the aiesec.fi and joinaiesecinfinland.com websites ("Sites") and in relation to the services we provide through these Sites.

We are AIESEC in Finland, a youth leadership movement driven by one cause: peace and fulfilment of humankind's potential. We comprise AIESEC in Finland and the 5 local committees across Finland.

Definitions

Active User: A user who completed their profile and has logged into the website in the past 6 months, or a user who is on an Exchange Experience.

Customers: Users that sign up and/or find an Opportunity and go on exchange via our Platform.

Exchange Experiences: The service offered on the Platform — a social or professional work experience in the organization of an Opportunity Provider.

Members: All persons who are (voluntarily) working for or on behalf of AIESEC.

Opportunity Listings: The posting and description of an opportunity that a user can apply to for an Exchange Experience.

Opportunity Providers: Organizations and other third parties that offer Exchange Experiences on our Platform.

Partners: Users that offer Opportunities on our Platform.

Platform: Our platform on the Sites to which a user may register as Opportunity Provider, Customer, or Member.

Profile Preferences: The Preferences section under https://aiesec.org/profile/preferences where the user manages consent of use of personal data.

Review: A public review about an Exchange Experience that includes a rating on a scale from 1–10.

User: All users of the Platform, both Opportunity Providers and Customers.

1. Information We Collect

Our Platform aims to connect Opportunity Providers with Members and Active Users in the context of Exchange Experiences. There are three general categories of how we collect information.

1.1 Information You Give Us

Account Information: When you sign up for an AIESEC Account, we require your name, email address, phone number, country of residence, and date of birth.

Profile Information: To use certain features, we may ask you to complete a profile including your skills, qualifications, professional activities, personal details, academic curriculum, professional experience, current employment information, image recordings, and gender. For visa processing, we may require a copy of your passport. Sensitive data not required for the visa process will be blacklined.

By default, your public profile will be anonymous. If you are an Active User, you may consent to make certain profile parts (like your profile picture, first name, and qualifications) publicly visible by enabling POP Profile Visibility in your Profile Preferences. You may withdraw this consent at any time.

Payment Information: We collect your financial information (such as bank account or credit card details) when you use Payment Services.

Communications: When you communicate with AIESEC or other Users, we collect information about the time and date of your communication. Our chat function is secured by Amazon Web Services, and messages are encrypted at database level. Only selected employees of AIESEC International and our IT vendor Commutatus have access to the database.

Other Information: You may provide information when you fill in forms, conduct searches, update your account, respond to surveys, post in community forums, participate in promotions, or email us.

1.2 Information We Automatically Collect

Usage Information: We collect information about your interactions with the Platform, such as pages viewed, searches for Opportunity Listings, and applications sent.

Location Information: When you use certain features, we may collect information about your general location via your IP address.

Log Data: We automatically collect log information including details about how you've used the Platform, IP address, access times, hardware and software information, device information, and browser type.

Transaction Information: We collect information related to your transactions including date, time, and amounts charged.

Cookies and Similar Technologies: This website stores a small amount of information on your device. Strictly necessary storage — remembering the language you chose and the cookie preferences you set — is always active and does not require consent. Analytics and marketing technologies are used only if you opt in, and nothing in those categories is loaded before you do. You can see exactly what is stored, and change or withdraw your choice at any time, on our Cookies page or through your browser settings.

1.3 Information We Collect from Third Parties

If you link or login to your AIESEC Account with a third-party service (e.g., Facebook, LinkedIn), that service may send us information such as your registration and profile information. This information varies and is controlled by that service or as authorized by you via your privacy settings.

2. Sharing & Disclosure

2.1 Sharing Between Opportunity Providers and Exchange Participants

When you apply for an Opportunity as an Exchange Participant, certain profile information (such as your passport copy, photo, financial identification data, academic curriculum, professional experience, and current employment information) is shared with the Opportunity Provider, including your full name and qualifications.

When you as an Opportunity Provider post an Opportunity Listing, certain information is shared with Users to showcase your Opportunity and Organization. We do not share billing and payout information with other Users.

2.2 Profiles, Opportunity Listings, and Other Public Information

By default your public profile is anonymous. Active Users may consent to make certain profile parts publicly visible by enabling POP Profile Visibility in Profile Preferences, and may withdraw consent at any time.

Opportunity Listings are publicly visible and include requirements, Exchange Experience details, calendar availability, and any additional information the Opportunity Provider chooses to share.

After completing an Exchange Experience, Exchange Participants write reviews and rate the Opportunity. These reviews are displayed on your Opportunity Listings profile page.

Information you share publicly on the Platform may be indexed by third-party search engines. We do not control the practices of third-party search engines.

2.3 Safety and Compliance with Law

AIESEC may disclose your information to courts, law enforcement, governmental authorities, or authorized third parties if required by law or if reasonably necessary to: comply with legal process; respond to verified requests relating to criminal investigations or alleged illegal activity; enforce our Terms & Conditions; conduct fraud investigation and prevention; or protect the rights, property, or personal safety of AIESEC, its employees, Members, or the public.

We will attempt to notify Users about these requests unless prohibited by law, court order, or applicable Risk Scenarios.

2.4 Corporate Affiliates

We may share your information with AIESEC's affiliates and branches abroad when necessary to ensure the delivery of Exchange Experiences. This includes the legal AIESEC entity in your country of residence or the country where the Opportunity is based. AIESEC operates across numerous countries and territories worldwide.

2.5 Operating Globally

Your personal information may be transferred outside the European Economic Area, including to Canada, the United States, and other countries where our service providers are located. For transfers to countries with an adequacy decision from the European Commission, an adequate level of data protection is in place. For other transfers, appropriate safeguards such as standard contractual clauses are implemented in accordance with Article 46 of the GDPR.

To obtain access to these agreements or request a copy, please email support@aiesec.fi.

3. How Long Do We Store Your Personal Data?

Your personal data will be stored no longer than necessary for the purposes for which it was collected. The following storage periods apply:

Account information (contact details, age, nationality, location, professional experiences): 24 months after last activity or until account deletion.
Profile Information (user data connected to an application): 24 months after last activity or until account deletion.
User behaviour data: 24 months after last activity or until account deletion.
Aggregated data: 24 months after collection.
Notification data: 24 months after last activity or until account deletion.
Payment information: 13 months from the relevant payment transaction (CSV number deleted after transaction). Accounting data may be kept for the required period under Canadian Law.
Passport copy: 24 months after last activity or until account deletion.
Communication data: 24 months after last activity or until account deletion.
Contractual data: Archived 24 months after last activity or account deletion, then retained until expiry of the applicable limitation period or final legal decision.

4. Your Rights

Right to be Informed: You have the right to be informed about the processing of your personal data, including why we need it and the legal ground for processing it.

Right to Access: You have the right to access your personal data and receive relevant information about how it is being processed.

Right to Rectification: You have the right to have inaccurate or incomplete personal data corrected.

Right to Erasure: In certain circumstances, you may request the erasure of your personal data where there is no compelling reason for its continued processing.

Right to Restriction of Processing: Under certain circumstances, you may ask us to pause the processing of your personal data while retaining it.

Right to Data Portability: You may obtain your data from us in a structured, commonly used format to transfer it to another system.

Right to Object: In some circumstances, you have the right to object to the processing of your personal data, particularly for direct marketing purposes.

Rights Regarding Automated Decision Making: You have the right not to be subject to decisions based solely on automated processing that have legal or significant effects on you.

If you have provided consent for the processing of your data, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing before withdrawal.

If you are unhappy with how we handle your personal data, you may contact a supervisory authority at support@aiesec.fi or finland@aiesec.net.

5. Security

We continuously implement and update administrative, technical, and physical security measures to protect your information against unauthorized access, loss, destruction, or alteration. Specific measures include:

Authentication via a separate authentication server and database disconnected from the main website server.
Confidentiality training for staff.
Code deployment restricted to authorized Commutatus personnel only.
Servers and databases hosted on a virtual private cloud accessible only via private keys.
A contingency plan in the event of a private key being compromised.
Access logs for databases, API, and authentication stored for up to 7 days.
Routine monitoring and periodic database backups.
OwnCloud used to secure main legal documents.

Please note that the transmission of information via the internet is not completely secure. While we use strict procedures and security features once we receive your information, any transmission is at your own risk.

6. Contact & Data Protection Officer

We have a Privacy Manager / Data Protection Officer responsible for matters regarding privacy and data protection. For any questions regarding this policy or our privacy practices, please contact us:

Email: support@aiesec.fi / uvindu@aiesec.fi

General enquiries: finland@aiesec.fi

This policy was last updated 03/12/2025.