Privacy Policy

1. Data controller

This Privacy Policy explains how Gene-Works Oy ("Gene-Works", "we", "us") processes your personal data when you register and participate as a berry picker through gene-works.fi.

• Controller: Gene-Works Oy, Business ID (Y-tunnus): 2198820-6
• Registered address: Tommolankatu 9, c/o Prismakeskus, 45130 Kouvola, Finland
• Contact for data-protection matters: info@gene-works.fi
• We have not appointed a statutory Data Protection Officer; privacy questions are handled at the contact above.

2. Scope

This policy applies to applicants and registered pickers, and to visitors of our website. It is provided to satisfy our information obligations under Articles 13–14 of the EU General Data Protection Regulation (GDPR, (EU) 2016/679) and Finnish data-protection legislation (Tietosuojalaki 1050/2018).

3. Categories of personal data we process

• Identification & contact: first and last name, email address, phone number, WhatsApp number, address, city, country of residence, whether you are currently in Finland, languages.
• Identity & right-to-work documents: passport, EU ID card, residence permit (oleskelulupa), EU residence permit, visa, temporary-protection document, other legal-basis documents; citizenship; legal-basis type, issuing country and validity dates.
• Photograph: a profile/identification photo (where provided).
• Driving & vehicle data: whether you hold a driving licence, licence categories, the driving-licence document, whether you have your own car.
• Financial data: bank account (IBAN), account-holder name, and — where the account belongs to another person — that fact and your relationship to the holder.
• Experience data: prior picking experience, years, berry types, experience in Finland, previous operator.
• Placement & logistics: chosen/preferred camp and area, availability dates, desired start and approximate departure dates, willingness to accept an alternative camp, transport mode (driver / passenger / needs transport), willingness to take additional pickers, travel "buddies" (Picker IDs you link to), and whether you are coming with others (names / Picker IDs).
• Account & status data: your Picker ID, application status, gender (used only for room and accommodation planning), acceptance of season terms (version and time), invoice requests, consents given, and administrative notes related to your application.
• Communications: emails we send you (a log of subject and content), and correspondence you have with us (e.g., WhatsApp or email).
• Technical data: login credentials (your password is stored only in irreversible, hashed form by our authentication provider), session cookies, and standard server log data (e.g., IP address, timestamps) needed to operate and secure the service.

4. Source of the data

We collect personal data directly from you when you create an account, complete your application, upload documents, and use your dashboard. Some status and administrative data is generated by us in the course of managing your participation.

5. Purposes and legal bases (GDPR Art. 6)

6. Special categories of data

We do not intentionally process special categories of personal data (Article 9 GDPR). Your photograph is used only for identification, not for biometric identification. Identity and residence documents are processed solely to verify your right to stay and work; please do not send us any information you are not asked to provide.

7. Recipients and processors

We do not sell your personal data. We share it only with service providers ("processors") who act on our instructions under data-processing agreements, and with authorities where legally required:

• Supabase — database, authentication and document storage, hosted in the EU (Frankfurt, Germany).
• Vercel — website hosting and delivery.
• Resend — sending transactional emails.
• Zoner — our company email mailbox.
• Competent authorities (e.g., tax, immigration, police) where we are legally obliged to disclose.

International transfers: Your application and document data is stored within the EU/EEA. Where any provider may process limited data outside the EU/EEA, such transfers are protected by appropriate safeguards under the GDPR (e.g., the European Commission's Standard Contractual Clauses).

8. Retention

We keep your personal data only as long as necessary:

• Active applicants and pickers: for the duration of your application and participation.
• Right-to-work documentation: retained for the period required by law (under the Aliens Act, generally until 4 years after the end of the work).
• Accounting and payment records: retained for the statutory bookkeeping period (generally 6 years; financial statements up to 10 years) under the Finnish Accounting Act.
• Applications that do not lead to participation: deleted within 12 months of the end of the season, unless we must keep them longer by law.

When a retention period ends, data is securely deleted or anonymised.

9. How we protect your data

Access is restricted to you and authorised Gene-Works staff. We use encrypted connections (HTTPS), access controls and role-based permissions, data stored in the EU, hashed passwords, and audited administrative access. Documents and bank details are accessible only to staff who need them for the purposes above.

10. Your rights

Under the GDPR you have the right to:

• access your personal data and obtain a copy;
• rectify inaccurate or incomplete data;
• erasure ("right to be forgotten"), where applicable;
• restrict or object to processing, including processing based on legitimate interests;
• data portability (receive your data in a structured, machine-readable format);
• withdraw consent at any time, where processing is based on consent (without affecting prior processing).

Some rights are limited where we must keep data to meet legal obligations (e.g., right-to-work or accounting records). To exercise any right, contact us at info@gene-works.fi. We respond within one month.

11. Right to lodge a complaint

If you believe we process your data unlawfully, you may contact us first, and you have the right to lodge a complaint with the Finnish supervisory authority: Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), Lintulahdenkuja 4, 00530 Helsinki / P.O. Box 800, 00531 Helsinki · tietosuoja@om.fi · tietosuoja.fi.

12. Is providing data mandatory?

Providing identity, right-to-work and contact data is necessary to register and participate; without it we cannot offer you a place or pay you lawfully. Optional items (e.g., photo) are voluntary.

13. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing, and we do not carry out profiling within the meaning of Article 22 GDPR.

14. Cookies

We use only strictly necessary cookies required to keep you logged in and to secure the service. We do not use advertising or third-party tracking cookies.

15. Changes to this policy

We may update this policy. The current version and its "last updated" date are always available at gene-works.fi/privacy; significant changes will be communicated to registered pickers.

16. Contact

Gene-Works Oy — Tommolankatu 9, c/o Prismakeskus, 45130 Kouvola, Finland — info@gene-works.fi — WhatsApp +358 400 901 467.