Privacy notice

Badminton Club Backhand ry

Teemu Hietanen
Email: info@bcbporvoo.fi

Requests concerning data protection or the inspection, correction or deletion of personal data must be sent to the email address above.

The register may contain data concerning:

• club members
• people participating in club training, events, competitions or other activities
• guardians of under-age participants
• club coaches, instructors, officials and volunteers
• other people with a relevant connection to the club’s activities.

Personal data is processed for the following purposes:

• administering memberships and maintaining the membership list required by the Finnish Associations Act
• arranging training groups, playing sessions, coaching, events and competitions
• managing registrations, attendance and participation rights
• communicating with members, participants and guardians of under-age participants
• invoicing and monitoring membership fees, training fees and other charges
• managing the club’s accounts and other statutory obligations
• handling competition, licence and insurance matters when necessary
• ensuring the safety, propriety and continuity of the activities
• investigating possible disputes, misuse or legal claims
• planning, developing and compiling statistics on the club’s activities.

Where possible, statistics and development work use data from which an individual cannot be identified.

Depending on the situation, processing is based on one or more of the following:

• a statutory obligation, such as obligations under association and accounting legislation
• a contract or steps taken before entering into a contract, such as registration for a paid training group, event or other activity
• the controller’s legitimate interest based on membership, participation or another relevant relationship with the club
• the data subject’s consent when processing requires it.

Consent-based processing may concern, for example, voluntary photography and publication permissions, separately requested marketing communications or health information necessary for the safety of the activities.

The register may contain data necessary for the activities, including:

• name and date of birth
• contact details such as address, telephone number and email address
• the name and contact details of an under-age participant’s guardian
• information concerning membership, membership category, training group and participation
• registration, attendance, event and competition information
• invoicing, payment and payment-status information
• club duties, roles and access rights
• information concerning communications, contacts, permissions and consents
• necessary information concerning competition licences, insurance or the activities of the sport federation
• information essential for arranging the activities or ensuring safety
• possible photographs, profile photographs and information concerning photography and publication permissions
• necessary identifiers and log data relating to the use of myClub, to the extent available to the club.

As a rule, the club does not collect health information or other special categories of personal data. If processing such data is necessary for safely arranging the activities, processing is limited to necessary information and based on explicit consent or another lawful basis.

Data is mainly obtained:

• from the data subject
• from the guardian of an under-age data subject
• from club coaches, instructors and officials when arranging the activities
• from myClub and the payment and registration functions connected to it
• where necessary, from the sport federation, a competition organiser or another party required for the activities.

The data subject or the guardian of an under-age participant is responsible for the accuracy and updating of the information they provide.

Within the club, personal data is processed only by board members, officials, coaches, instructors or other people who need the data to perform their duties.

The club uses myClub to administer the membership and activity register. Taikala Oy, which maintains myClub, acts as a processor on behalf of the club under a data-processing agreement. Taikala Oy may also process information relating to a myClub user account as a controller under its own privacy notice.

Data may also be processed in invoicing, accounting, payment, communication or other services used by the club. Service providers process data only to provide the service and in accordance with the applicable agreements.

Data may be disclosed when necessary:

• to the sport federation, a competition organiser or an insurance company to handle competition, licence or insurance matters
• to a payment service provider to process payments
• to an accountant or auditor to meet statutory obligations
• to an authority when disclosure is based on law or a lawful request by a competent authority.

Personal data is not sold or disclosed to third parties for commercial purposes.

As a rule, the club does not transfer personal data outside the European Union or European Economic Area.

If a service provider used by the club processes or transfers data outside the EU or EEA, the transfer is carried out using safeguards required by data protection law, such as the European Commission’s standard contractual clauses.

Personal data is retained only for as long as necessary for the purposes described in this notice.

Information concerning membership and participation is retained for the duration of membership or another relationship with the club and afterwards for as long as required to resolve payments, obligations, rights or possible legal claims.

Invoicing, payment and accounting information is retained for the period required by accounting and other applicable legislation.

Consent-based information is retained until the consent is withdrawn or the purpose ends, unless another lawful basis requires continued retention.

Unnecessary and outdated information is deleted or anonymised within a reasonable period. The need for retention is reviewed regularly.

Personal data is protected using appropriate technical and organisational measures.

Use of myClub requires a personal user account. Access rights for club officials are limited according to duties and need and are removed when no longer required.

People processing personal data are bound by confidentiality. Data may not be used for a purpose other than the duty for which access was granted.

Devices, user accounts and other systems containing data are appropriately protected. The club’s service providers are responsible for the technical security of their own systems under their service agreements.

Under applicable data protection law, the data subject has the right to:

• receive information about the processing of their personal data
• access personal data concerning them
• require inaccurate or incomplete data to be corrected
• request deletion when the conditions for deletion are met
• request restriction of processing
• object to processing based on legitimate interest
• receive data they have provided in a transferable format when the conditions for data portability are met
• withdraw consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

A request to exercise these rights must be sent to the email address in section 2. The club may ask the requester to verify their identity before implementing the request.

Not all rights apply in every situation. Their scope depends on the legal basis for processing and the applicable legislation.

The club does not make decisions concerning data subjects solely on the basis of automated processing of personal data or profiling.

The data subject has the right to lodge a complaint with the Office of the Data Protection Ombudsman if they believe that personal data has been processed contrary to data protection law.

Before lodging a complaint, the data subject is asked to contact the club first so that the matter can be investigated.

The club may update this privacy notice when its activities, services or legislation change. The current privacy notice will also be published in myClub.