GDPR & Data Processing

Data controller

Migri Appointments is the controller for the personal data processed through this website and our services. We decide why and how your data is used. For questions about this notice or to exercise your rights, contact info@migriappointments.com.

What personal data we process

• Account data: email address, notification email, and a hashed password used to authenticate you.
• Alert criteria: the Migri offices, appointment types and date ranges you select for monitoring.
• Concierge data: first name, last name, number of people, citizenship, date of birth, gender, phone number, email, optional Migri customer number, and your appointment preferences.
• Billing data: Stripe handles payment card details and billing history. We do not store card numbers.
• Service usage data: IP address, browser type, pages visited, and events related to your account, collected for security, analytics and support.

Legal basis for processing

We process personal data only where GDPR allows us to:

• Performance of a contract: to provide appointment alerts and the Concierge service you signed up for.
• Consent: where you have explicitly agreed, for example to receive marketing emails or to the Concierge data-processing consent checkbox.
• Legitimate interests: fraud prevention, service security, analytics and customer support, balanced against your rights.
• Legal obligation: where required by tax, accounting or applicable law.

How we store your data

All data is stored in encrypted databases and infrastructure hosted within the European Union. Passwords are hashed using industry-standard one-way hashing. Access to Concierge request records and production systems is restricted to authorised team members.

Data retention

• Active accounts: kept for as long as your subscription or account remains active.
• Closed accounts: personal data is deleted within 30 days of account closure, unless we are required to keep it longer by law.
• Email logs and sent alerts: retained for up to 90 days for delivery diagnostics, then removed.
• Concierge records: retained for the duration of the request and any related follow-up, then deleted or anonymised within 12 months after the request is closed.

International transfers

Some processors we use, such as Stripe and email delivery providers, may process data outside the EU. Where this happens, we rely on approved safeguards such as the European Commission's Standard Contractual Clauses to protect your data.

Your GDPR rights

You have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”): ask us to delete your data where there is no overriding legal reason to keep it.
• Restriction: ask us to limit how we use your data in certain circumstances.
• Objection: object to processing based on legitimate interests or direct marketing.
• Data portability: receive your data in a structured, commonly used format and transfer it to another provider.
• Withdraw consent: where processing is based on consent, you can withdraw it at any time.

To exercise any right, email info@migriappointments.com. We aim to respond within 30 days.

Cookies and analytics

We use essential cookies to keep you signed in and secure. Analytics cookies help us understand how the site is used. We do not sell tracking data or use invasive profiling. You can control non-essential cookies through your browser settings.

Processors and subprocessors

We use carefully selected third-party services to run the site, send emails, process payments, store data and keep records. All processors are contractually bound to handle data only on our instructions and to maintain appropriate security.

Security measures

• Encrypted data transmission using TLS/SSL.
• Hashed passwords and row-level access controls in the database.
• Regular access reviews and minimal-privilege principles for staff.
• Monitoring and logging for suspicious activity.

Complaints

If you believe your data has been handled incorrectly, please contact us first. You also have the right to lodge a complaint with your local supervisory authority or the Finnish Data Protection Ombudsman.

Changes to this notice

We may update this GDPR notice as our services or the law changes. The latest version will always be available at this page, with the “Last updated” date shown at the top.