Privacy Policy

Last updated: 20.8.2026

The Timeout-portal is a tool built by the Timeout Foundation ("Timeout Foundation", "we", "us") to help our partner organizations plan, run, and reflect on Timeout-dialogues. This notice explains what personal data we collect through the platform, why, and what rights you have – whether you're a facilitator using the Timeout-portal day to day, or a participant in a dialogue someone else organized.

We've tried to write this plainly rather than in dense legal language. If anything is unclear, just ask us – see [How to contact us].

Contents

• Who is responsible for your data
• Who this notice covers
• What data we collect
• Why we collect it
• Who can see your data
• How we use aggregate statistics
• How long we keep it
• Where your data is stored
• Third parties
• Automated decisions
• Your rights
• Changes to this notice
• How to contact us
• How to contact the supervisory authority

Who is responsible for your data

The data controller is:

The Timeout Foundation

Business ID: 3007577-5

Puistokatu 4, 00140 Helsinki, Finland

Contact person for data protection matters:

Eveliina Alho

eveliina.alho@eratauko.fi

Who this notice covers

The Timeout-portal has two kinds of people in it, and this notice covers both:

• Facilitators and organization admins – people who log in to the Timeout-portal to plan dialogues, record notes, and review feedback. If this is you, you'll be asked to accept this notice the first time you log in.
• Dialogue participants – people who take part in a dialogue that a facilitator records in the Timeout-portal. Participants don't log in to the Timeout-portal themselves, so it's the facilitator's and host organization's responsibility to let participants know how their dialogue's data is being recorded and point them to this notice (for example, when inviting them or at the start of the session).

What data we collect

About facilitators and admins (account holders):

• Name and email address (used to log in – the Timeout-portal uses a one-time code sent to your email, we don't store passwords)
• Your organization and your role within it (e.g., member, admin)
• The dialogues, series, and feedback forms you create or are added to
• Basic activity timestamps (when things were created or last changed)

About dialogue participants:

The Timeout-portal is designed so that participant data is recorded in aggregate, statistical form wherever possible, not as identifiable records:

• Total number of participants in a dialogue
• Number of participants per age bracket (e.g. "3 aged 13–17"), not names or individual profiles
• Number of "less heard voices" (a count, not identities)
• Anonymous feedback responses to dialogue questions (ratings, short text, emoji reactions) – these aren't linked to a participant's name or contact details

Why we collect it

• Facilitator/admin account info – lets you securely log in and use the Timeout-portal as a facilitator and on behalf of your organization.
• Organization/role data – makes sure people only see the dialogues relevant to their organization and those specifically shared with them.
• Dialogue metadata & private notes – lets facilitators plan and document their own dialogues.
• Public notes – lets facilitators share context about a dialogue (e.g. why it was held, what came out of it, and what impact it had, for example on decision-making) with their own organization and with Timeout.
• Aggregate participant counts & age brackets – helps organizations, and the Timeout Foundation as a whole, measure the reach and impact of dialogues, and is also communicated to partner organizations and publicly at a general level (public disclosures are never broken down by organization, only compiled across dialogues, e.g. within a calendar year).
• Feedback responses – helps facilitators and organizations understand how a dialogue went.
• Aggregate statistics used for reporting (counts, age brackets, feedback ratings) – measuring and reporting Timeout’s overall impact, including to funders, in public materials, and to organizations that use the Timeout-portal, such as on Timeout’s website or in newsletters.

Only aggregate, statistical figures – never individual quotes, notes, or anything that identifies a participant – may be used externally, or in the Timeout Foundations website, in newsletters, or in funder reporting.

We don't use your data for marketing directed at you personally, and we don't sell or share it with advertisers.

Who can see your data

• Private notes are only visible to the facilitator who created the dialogue and anyone they've specifically shared it with – not other members of the organization, and not the staff of the Timeout Foundation.
• Public notes are visible to other members of the facilitator's organization and to the Timeout Foundation staff, in addition to the facilitator. Use this field only for context you're comfortable sharing more widely (e.g., why a dialogue was held, what came out of it overall, and what impact it had, for example on decision-making), not for the dialogue's substance.
• Basic dialogue details (e.g., topic, date, location, participant counts) as well as anonymous feedback are visible to members of the organization the dialogue belongs to.
• The staff of the Timeout Foundation, as the operator of the platform, can see aggregate statistics across all organizations (e.g., dialogue and participant counts), including breakdowns by organization for internal reporting and support – see [How we use aggregate statistics] below – and can process other data as needed to run and support the platform (e.g., fixing problems, helping a locked-out organization). the Timeout Foundation staff do not have access to dialogues' private notes.

We don't share your data with any other third party, other than the services that help us run the platform — see [Third parties] below.

How we use aggregate statistics

A core purpose of the Timeout-portal is helping the Timeout Foundation and its partner organizations understand and demonstrate the impact of the Timeout-dialogues and trainings. This means the aggregate statistics that the Timeout-portal collects (how many dialogues were held, how many people took part, age-bracket breakdowns, feedback ratings) are:

• Reviewed internally by the Timeout Foundation staff to understand how the method is being used in practice, and to develop Timeout's tools, materials, feedback forms, and the platform itself.
• Compiled into reports shared with funders, to demonstrate the foundation's and the method's reach and outcomes.
• Used in public materials, such as the Timeout Foundations website or newsletters, to communicate the impact of the Timeout-method. Any organization can use this compiled material on the method's impact and key figures in its own work, for example when assessing the impact of its own participation efforts.

When statistics are used publicly or with funders, they are always aggregated across dialogues – for example "1,200 people took part in Timeout dialogues this year, including 300 aged 13–17." We do not publish figures tied to an individual dialogue, organization, or participant without that organization's separate agreement. Dialogue notes are never included – see [Who can see your data].

How long we keep it

We keep data for as long as it stays on the platform. Data and other information are collected for as long as the Timeout-method exists.

Where your data is stored

All Timeout-portal data is hosted on servers located within the EU (Finland), provided by our cloud provider UpCloud Ltd (a Finnish company). See [Third parties] for the specific exceptions to this.

Third parties

The Timeout-portal relies on a small number of external services that are involved in processing your data as follows:

• UpCloud – hosts the application and database. All data handled by UpCloud stays within the EU (Finland), so this isn't an international transfer.
• Mailchimp – our transactional email provider, used to send the one-time login codes sent to your email and dialogue/organization invitation emails. This means your email address (and the content of these specific emails) passes through Mailchimp's systems.
• Google Places API – when a facilitator searches for or selects a dialogue's location, that search is sent to Google to look up the address. This applies to location data entered by the facilitator for a dialogue, not to participants' personal data.

Automated decisions

The Timeout-portal doesn't use your data to make automated decisions that would have a legal or similarly significant effect on you.

Your rights

Under GDPR, you have the right to:

• Access – ask us for a copy of the personal data we hold about you.
• Rectification – ask us to correct data that's inaccurate or incomplete.
• Erasure – ask us to delete your data, under certain conditions.
• Restriction – ask us to limit how we process your data, under certain conditions.
• Object – object to processing based on our legitimate interest, if it affects you personally.
• Data portability – ask us to transfer data you provided to another organization, or to you directly, where technically feasible.

If you're a facilitator or admin, you can exercise most of these directly – much of your account, organization, and dialogue data is visible and editable inside the Timeout-portal. For anything else, or if you're a dialogue participant, contact us using the details below and we'll respond within one month.

Changes to this notice

We review this notice whenever the Timeout-portal's features or data practices change. If we make a change, we will notify platform users by email.

How to contact us

If you have questions about this notice, the data we hold about you, or want to exercise any of your rights, contact:

Email: eveliina.alho@eratauko.fi

How to contact the supervisory authority

If you feel we haven't addressed your concern properly, you can contact the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto):

Website: https://tietosuoja.fi/

Email: tietosuoja@om.fi