Privacy Policy

Last updated 5 October 2026

This privacy policy explains how the European Peace Research Association (EuPRA, "we", "us") collects and uses personal data when you visit www.euprapeace.org, become a member, register for our events, submit content or otherwise contact us. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Finnish data protection law.

1. Who is responsible for your data
2. What data we collect
3. Why we use your data and on what legal basis
4. Who we share data with
5. Cookies and analytics
6. How long we keep your data
7. How we protect your data
8. Your rights
9. Children
10. Changes to this policy
11. Contact us

1. Who is responsible for your data

The data controller is:

Email: eupra@euprapeace.org

Finnish Registration ID: 3352017-6

2. What data we collect

Data you give us

• Account and membership data: name, email address, username, password (stored only in encrypted, hashed form), affiliation or job title, and membership type and status.
• Event registration data: the information you enter in registration and abstract submission forms, such as contact details, affiliation, and the abstracts or other materials you submit.
• Payment data: the amount, date and status of membership fees and event fees. Card payments are processed by Stripe; we never see or store your full card number.
• Submissions and messages: blog posts and other content you send us, and the content of messages you send via our contact forms or by email.
• Newsletter subscription: your email address, and your name if you provide it, when you sign up for our newsletter.

Data collected automatically

• Server logs: our web server records technical information such as your IP address, browser type, the pages requested and the time of the request. We use this to operate the site securely and to investigate errors and abuse.
• Website statistics: we use Matomo to understand how our website is used. See section 5.

We do not ask for or process special categories of personal data (such as data about health or religious beliefs).

3. Why we use your data and on what legal basis

• To manage memberships, accounts and event registrations, including sending confirmations, receipts, invoices and renewal reminders. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To process payments and keep accounting records. Legal basis: performance of a contract and compliance with legal obligations, including Finnish accounting law (Art. 6(1)(b) and (c) GDPR).
• To publish content you submit, such as blog posts or conference abstracts, as agreed with you. Legal basis: performance of a contract or your consent (Art. 6(1)(b) or (a) GDPR).
• To answer your enquiries. Legal basis: our legitimate interest in responding to people who contact us (Art. 6(1)(f) GDPR).
• To send our newsletter if you have subscribed. Legal basis: your consent (Art. 6(1)(a) GDPR). Every newsletter contains an unsubscribe link, and you can unsubscribe at any time.
• To keep the website secure and prevent spam, fraud and abuse, and to produce anonymous website statistics. Legal basis: our legitimate interest in running a secure and useful website (Art. 6(1)(f) GDPR).

Where we rely on your consent, you can withdraw it at any time; this does not affect processing carried out before you withdrew it.

4. Who we share data with

We do not sell your personal data or use it for advertising. We share it only with service providers that help us run the association, and only as far as needed:

• Stripe (Stripe Payments Europe Ltd, Ireland) processes card payments. Stripe also uses payment data for its own fraud prevention as an independent controller; see Stripe's privacy policy.
• hCaptcha (Intuition Machines, Inc.) protects our forms from spam and automated abuse. When you use a protected form, hCaptcha receives technical data such as your IP address and browser information; see hCaptcha's privacy policy.
• YouTube (Google Ireland Ltd) hosts some of the videos embedded on our pages. See section 5.
• Mailchimp (The Rocket Science Group LLC, an Intuit company, USA) sends our newsletter and stores the subscriber list. Mailchimp may record whether newsletter emails are opened and which links are clicked; see Intuit's privacy statement.
• Our web hosting and email providers, which store and transmit the website's data on our behalf.

Some of these providers may process data outside the European Economic Area. Where this happens, the transfer is protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an adequacy decision.

We may also disclose personal data where we are legally required to do so, for example to authorities.

5. Cookies and analytics

We use only the cookies needed for the website to work, such as keeping you logged in and remembering your cookie choice. Our website statistics are collected with Matomo, which runs on a server in the EU and is configured not to use cookies. Matomo respects your browser's "Do Not Track" setting, and the statistics are not shared with anyone else.

Embedded YouTube videos use YouTube's privacy-enhanced mode, which does not set cookies until you play a video.

Full details are in our Cookie Policy.

6. How long we keep your data

We keep personal data only for as long as we need it for the purposes described above:

• Account and membership data are kept while you are a member or have an account, and for a reasonable period afterwards so that we can answer questions about past memberships and events.
• Payment and accounting records are kept for as long as Finnish accounting law requires.
• Event registration data are kept for the organisation and follow-up of the event and for our records of past conferences.
• Messages are kept for as long as needed to deal with your enquiry.
• Newsletter subscriptions are kept until you unsubscribe.

When data are no longer needed, we delete or anonymise them.

7. How we protect your data

We use appropriate technical and organisational measures to protect your data, including encrypted (HTTPS) connections, hashed passwords, two-factor authentication for administrators, and access limited to the people who need it for their role in the association. No system is completely secure, however, and we cannot guarantee absolute security.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data erased, where we have no legal reason to keep it;
• restrict or object to our processing of your data;
• receive data you have given us in a portable format;
• withdraw your consent at any time, where processing is based on consent.

You can update most of your account and membership details yourself by logging in. To exercise any of your rights, email us at eupra@euprapeace.org. We will reply within one month.

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with a supervisory authority. In Finland this is the Office of the Data Protection Ombudsman; you may also contact the authority in the EU country where you live or work.

9. Children

Our website and services are intended for adults. We do not knowingly collect personal data from children under 18. If you believe a child has given us personal data, please contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows when it was last changed. For significant changes we will inform our members by email.

11. Contact us

If you have questions about this policy or about how we handle your data, email us at eupra@euprapeace.org or write to the address in section 1.