Privacy statement for the register of Save the Children Finland’s Nettivihje.fi service

Updated  30.12.2025

1. Data controller 
Save the Children Finland (Business ID: 0116788-1) 
Address: PO Box 95, 00601 Helsinki 
Visiting address: Koskelantie 38, 00610 Helsinki 
Telephone: +358 (0)10 843 5000 

2. Contact person for register matters 
Save the Children Finland’s data protection officer 
Lawyer Maria Haarajoki 
tietosuoja@pelastakaalapset.fi 
Telephone: 010 843 5000 (weekdays 9–11, 13–15) 

3. Name of the register 
Register of Save the Children Finland’s Nettivihje.fi service. 

4. Legal basis for the processing of personal data and IP addresses 
Protection of the vital interests of a natural person. 

5. Purpose of use of information contained in tips and registered IP address data 
Save the Children Finland’s (SCF) Child Protection and Finnish Hotline function maintains the Nettivihje.fi service, where anyone can report suspected illegal image and video material and activities related to sexual violence against children on the internet. The youth form and the general form can also be used to report sexual harassment or sexual violence that has occurred outside the internet.  

Save the Children Finland works closely with the National Bureau of Investigation (NBI). Information referring to material and/or activities suspected of being illegal is forwarded to the Finnish authorities (e.g. NBI, child welfare services, police) for assessment and possible further action in accordance with jointly agreed practices. In addition, information (URL address) about material located on a foreign server that is assessed as illegal and violating children’s rights is forwarded to the INHOPE network hotline[1] of the country where the material is hosted for possible further action in accordance with national legislation. The aim of the INHOPE network is to promote the removal of illegal material depicting sexual violence against children from the internet through national and international cooperation. 

The IP address of the sender of report forms specified below is stored in the system used by Save the Children Finland, which forms a register. Only SCF’s Child Protection and Finnish Hotline function’s specifically designated employees may, at the request of the police, process the IP address stored in the system for official purposes. After assessing the situation, the police may need the IP address of the sender of the report form to investigate the crime and identify the victim. The IP address of the sender of the report will not be disclosed unless the police request it based on Chapter 4, Section 3, Paragraph 2 of the Police Act. 

Personal data entered on the report form will not be disclosed to the authorities (such as the police and child welfare services) unless specifically requested by the authorities or unless the information provided gives rise to a duty to notify the authorities. 

If SCF suspects that a child has been the victim of a crime, has committed a crime, or has witnessed a crime, the child’s details will be reported to child welfare services if they have been provided when submitting the report. 

The IP address is stored from the following report forms: 

• General form 
• Youth form  

The IP address is not stored when using the anonymous form. 

6. Personal data to be processed 
The IP address of the sender of the specified forms (see section 5). The IP address is only a series of numbers and SCF does not link it to a specific person. 

Any personal data that may be entered or attached to the report form, such as contact details. 

7. Regular sources of information 
The report sender’s IP address is automatically stored from the report forms specified in section five (5) when the form is submitted. 

The sender of the report form may also attach personal data to the form, which will be stored for four (4) months after the report has been processed. 

8. Protection of personal data and data security 
The information contained in the register is treated as confidential. The information in the register that is processed electronically is adequately protected from outsiders by firewalls and other technical security measures. The databases and their backups are in a locked room and can only be accessed by certain pre-designated persons. Manual material containing personal data is processed immediately and destroyed or forwarded to the authorities. The register is only used by persons employed by the controller or companies acting on its behalf whose job description includes its use. Persons belonging to the controller’s organisation have a personal user ID and password for the register. Users are bound by confidentiality and non-disclosure obligations. 

9. Regular disclosure and transfer of personal data and whether we transfer data outside the EU or EEA 
No regular disclosures or transfers. Disclosures and transfers of the personal data recorded on the report form are made if the police specifically request it or if the information provided in the report gives rise to a reporting obligation to the authorities. 

Save the Children Finland works closely with the National Bureau of Investigation. Information referring to material and activities suspected of being illegal is forwarded to the authorities (e.g. NBI, child welfare services, police) for assessment and possible further action in accordance with jointly agreed practices. In addition, information (URL address) about material located on a foreign server that is assessed as illegal and violates children’s rights is forwarded via INHOPE’s ICCAM system[2] to the INHOPE network’s hotline in the country of origin for assessment and possible action in accordance with that country’s legislation. The INHOPE reporting service network includes members located outside the EU or EEA. 

Transfer of data through INHOPE’s ICCAM system is not regular because not all reports are forwarded through the ICCAM system. The ICCAM system is only used to forward reports that are assessed to contain material that can be analysed in the ICCAM system and contain illegal material or material that violates children’s rights. This means that the transfer is necessary for important reasons of public interest (Article 49(1)(d) of the EU General Data Protection Regulation). 

10. Retention period for personal data 
Reports and their content are stored for as long as necessary, but no longer than four (4) months. 

The IP address of the sender of the reeport forms mentioned separately in section five (5) will be stored for four (4) months. 

11. Can I exercise my rights to personal data included in the report or to the registered IP address? 
Due to the nature of the activity and the fact that Save the Children Finland does not link the IP address to its sender, no rights can be assigned to the registered IP address. Similarly, due to the nature of the activity, Save the Children Finland is unable to reliably verify the accuracy of other personal data provided in the report, and therefore no rights under the EU General Data Protection Regulation can be applied to the personal data. 

The Data Protection Ombudsman acts as the supervisory authority for the processing of personal data. 

12. Automated decision-making and profiling 
No automated decision-making or profiling is carried out. 

13. Contact 
All contacts and requests regarding this statement must be made in writing or in person to the contact person named in section two (2) or sent to Pelastakaa Lapset ry, Koskelantie 38, 00610 Helsinki. 

The person making the contact must be prepared to prove their identity with a photo ID. 

14. Changes to the privacy policy 
This privacy policy may be updated from time to time, for example, in the event of changes in legislation. We recommend that you visit our website regularly and take note of any changes to the policy. 

[1] INHOPE (International Association of Internet Hotlines) www.inhope.org 

[2] ICCAM: What Is It & Why Is It Important? https://www.inhope.org/EN/articles/iccam-what-is-it-and-why-is-it-important