Privacy and Data Protection Statement
This is the privacy and data protection statement of Luuppi ry, in accordance with the Personal Data Act (sections 10 and 24) and the EU General Data Protection Regulation (GDPR), applicable to members of Luuppi ry and users of its online services. Created on May 22, 2018. Last amendment on June 10, 2018.
Data Controller
Luuppi ry, Yliopistonkatu 58 B, 33100 Tampere
Email: hallitus@luuppi.fi
Hereinafter referred to as "Luuppi."
Contact Person for the Register
Luuppi's board, hallitus@luuppi.fi
Register Name
Luuppi's member register and online service user register.
Rights of the Data Subject
The data subject, i.e., a member of Luuppi or a user of its online services, has the right under the GDPR to:
- Access information: The right to obtain data about personal information and request access to personal data that Luuppi processes related to you.
- Correct information: The data subject can change their information directly from Luuppi's website through their profile.
- Erase information and be forgotten: Luuppi is obligated to retain information as long as the membership in the association continues. Luuppi may ask the requester to prove their identity if necessary.
- Restrict processing of information: The data subject can request the restriction of processing of their data so that it is processed only with the consent of the data subject. This does not apply to data storage.
- Transfer data from one system to another: The data subject can request that Luuppi transfer the stored information to another controller.
- Object to the processing of information: The data subject can, for personal and specific reasons, object to the processing of their data. This does not apply in situations where Luuppi can demonstrate that there is a significant and justified reason for processing the data.
- Not be subject to automated decision-making: Luuppi does not use information for automated decision-making or profiling.
Legal Basis and Purpose of Processing Personal Data
The purposes and legal bases for processing personal data in Luuppi ry are diverse, covering membership management, event registrations, product sales, and much more. The legal bases vary from contract execution to consent and legal obligations. Data is used for event registrations, maintaining the member directory, identifying online service users, member communications, contacts related to event participation, and orders for products and services. Additionally, data is used for advocacy and planning activities, equipment and clothing lending services, and managing webcam and surveillance camera footage. Processing personal data enables communication targeted at Luuppi members, organizing events, and offering services.
Data Collected from Registered Users
User Data
User data is used to identify you when you interact with our association's online service. We may also send information related to your user account via email.
- Name
- Student number
- Email address
- Password
Member Data
Data is collected to maintain the membership register as required by the Association Act and to keep track of changes related to membership in our register.
- Full legal name
- Place of residence
- Duration and type of membership
Contact Information
Contact information is used when you want us to contact you regarding our activities: invitations to association meetings, contacts during events for transportation, etc. If you do not wish to receive meeting invitations by email, they are also available on the association's notice board.
- Name
- Phone number
- Postal address
- Email address
Demographic Data
We collect this information to plan our advocacy activities and events. Additionally, the data is used for a member statistic visible to members, from which individual persons cannot be identified.
- Subjects at the University of Tampere
- Year of joining
Public Contact Information
This information is used to display you, if you wish, to other users of the online service in event participant lists or publicly in the online service's web directory:
- Display name
- Website
Order History Data
To organize events and sell products for order, such as overalls, we need to collect data about orders and additional order details. In some cases, we may need additional details beyond the purchased product or event for the order.
- Event registrations
- Purchased products
Office Webcam Footage
A video camera captures the right side of our office, the lounge area with sofas and television.
- Real-time footage from Luuppi's office is not stored by Luuppi
- Camera access is available to Luuppi members when logged in
Office Surveillance Camera Footage
A surveillance camera captures the left side of our office, the service area with the attendant's desk.
- Stored footage with restricted access
Regular Sources of Data
Data stored in the register is obtained from the data subject themselves, with the exception of:
- Webcam: A webcam in our office for member use shows who is present in the office, pointing towards the sofas and television on the right side of the office.
- Surveillance camera: The service side of our office, to the left of the door, is captured by a surveillance camera whose footage is stored. Only board members have access to this footage, and a valid reason is required.
Data Disclosures and Transfers Outside the EU/EEA
Data is not disclosed to third parties without the individual's explicit consent.
Principles of Register Protection
Personal data is kept confidential. Luuppi ry and its service provider(s) ensure the security of data to the best of their ability. Paper-based data is stored under lock and key, accessible only to authorized individuals, and is destroyed immediately after use.
Data Retention and Deletion
Data subjects' information is retained only as long as necessary, for example, additional information for orders is not needed after an event and is intended to be deleted within a month of the event's conclusion. Participation or payment information for the event is kept longer for the resolution of any payment disputes.
Upon request by the data subject, we will delete their personal data unless there is a legal or contractual obligation to retain the information, such as data required for maintaining the membership register as long as the individual is a member of the association.