Privacy and Data Protection Statement
This is the privacy and data protection statement of Luuppi ry, in accordance with the Personal Data Act (sections 10 and 24) and the EU General Data Protection Regulation (GDPR), applicable to members of Luuppi ry and users of its online services. Created on May 22, 2018. Last amendment on August 13, 2026.
Data Controller
Luuppi ry, Yliopistonkatu 58 B, 33100 Tampere
Email: hallitus@luuppi.fi
Hereinafter referred to as "Luuppi."
Contact Person for the Register
Luuppi's board, hallitus@luuppi.fi
Register Name
Luuppi's member register and online service user register.
Rights of the Data Subject
The data subject, i.e., a member of Luuppi or a user of its online services, has the right under the GDPR to:
- Access information: The right to obtain data about personal information and request access to personal data that Luuppi processes related to you.
- Correct information: The data subject can change their information directly from Luuppi's website through their profile.
- Erase information and be forgotten: Luuppi is obligated to retain information as long as the membership in the association continues. Luuppi may ask the requester to prove their identity if necessary.
- Restrict processing of information: The data subject can request the restriction of processing of their data so that it is processed only with the consent of the data subject. This does not apply to data storage.
- Transfer data from one system to another: The data subject can request that Luuppi transfer the stored information to another controller.
- Object to the processing of information: The data subject can, for personal and specific reasons, object to the processing of their data. This does not apply in situations where Luuppi can demonstrate that there is a significant and justified reason for processing the data.
- Not be subject to automated decision-making: Luuppi does not use information for automated decision-making or profiling.
Legal Basis and Purpose of Processing Personal Data
The purposes and legal bases for processing personal data in Luuppi ry are diverse, covering membership management, event registrations, product sales, and much more. The legal bases vary from contract execution to consent and legal obligations. Data is used for event registrations, maintaining the member directory, identifying online service users, member communications, contacts related to event participation, and orders for products and services. Additionally, data is used for advocacy and planning activities, equipment and clothing lending services. Processing personal data enables communication targeted at Luuppi members, organizing events, and offering services.
Data Collected from Registered Users
User Data
User data is used to identify you when you interact with our association's online service. We may also send information related to your user account via email.
- Name
- Email address
Member Data
Data is collected and processed to maintain the statutory membership register required by the Associations Act, and, based on the association's legitimate interest, to manage the membership relationship and to track changes related to membership.
- Full legal name
- Place of residence
- Duration and type of membership
Contact Information
Contact information is used when you want us to contact you regarding our activities: invitations to association meetings, contacts during events for transportation, etc. If you do not wish to receive meeting invitations by email, they are also available on the association's website.
- Name
- Email address
Demographic Data
We collect this information to plan our advocacy activities and events. Additionally, the data is used for a member statistic visible to members, from which individual persons cannot be identified.
- Subjects at the University of Tampere
- Year of joining
Public Contact Information
This information is used to display you, if you wish, to other users of the online service in event participant lists or publicly in the online service's web directory:
- Display name
Order History Data
To organize events and sell products for order, such as overalls, we need to collect data about orders and additional order details. In some cases, we may need additional details beyond the purchased product or event for the order.
- Event registrations
- Purchased products
Data Disclosures and Transfers Outside the EU/EEA
Data is not disclosed to third parties, unless it concerns a service provider processing personal data on Luuppi's behalf (a data processor) with whom a data processing agreement compliant with the GDPR has been made.
Luuppi uses the Microsoft Entra ID service for user account management and authentication (logging into the web service). In this context, the user's name and email address are transferred to Microsoft, which acts as a data processor on Luuppi's behalf.
Microsoft may also process data outside the European Economic Area. In such cases, the transfer is based on the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) or the standard contractual clauses approved by the European Commission, as well as Microsoft's EU Data Boundary commitment, under which data from EU-area customers is primarily kept within the EU. More information on Microsoft's privacy practices.
Luuppi uses the Stripe service for payment processing. In this context, the user's email address and information related to the order are transferred to Stripe, which acts as a data processor on Luuppi's behalf. Stripe processes and stores payment card details; Luuppi does not store them itself.
Stripe may also process data outside the European Economic Area (e.g., Stripe Inc., United States). The transfer is based on the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) or the standard contractual clauses approved by the European Commission.
Principles of Register Protection
Personal data is kept confidential. Luuppi ry and its service provider(s) ensure the security of data to the best of their ability. Paper-based data is stored under lock and key, accessible only to authorized individuals, and is destroyed immediately after use.
Data Retention and Deletion
Data subjects' information is retained only as long as necessary, for example, additional information for orders is not needed after an event and is intended to be deleted within a month of the event's conclusion. Participation or payment information for the event is kept longer for the resolution of any payment disputes.
Upon request by the data subject, we will delete their personal data unless there is a legal or contractual obligation to retain the information, such as data required for maintaining the membership register as long as the individual is a member of the association.
