Privacy Notice - Sidra ry

1. Data Controller

Name: Sidra ry
Business ID (Y-tunnus): 3348402-1
Address: Helsinki, Finland
Contact Email: info@sidrary.fi

2. Categories of Data Subjects

Guardians and participants registering for activities, clubs, or courses.
Volunteers applying for or participating in association operations.
Donors, members, and persons submitting general inquiries through web forms.

3. Purpose and Legal Basis for Data Processing

Personal data is processed exclusively for the legitimate operational purposes of Sidra ry, including:

Managing activity registrations, participant groups, and volunteer rosters (Legal basis: Performance of a contract or taking steps prior to entering into a contract).
Fee invoicing, tracking, and compliance with statutory record-keeping (Legal basis: Legal obligation under the Finnish Accounting Act / Kirjanpitolaki).
Communicating operational updates, event schedules, and emergency notices to guardians and volunteers (Legal basis: Legitimate interest).
Publishing participant photography or video on public association channels (Legal basis: Consent).

4. Data We Collect

Basic contact details: Full name, phone number, email address, postal address.
Participant information: Full name, age or date of birth, emergency contact information, and relevant health/dietary notes provided voluntarily for safety during physical activities or food service.
Volunteer details: Language skills, background/experience, availability, and areas of interest.
Billing records: Payment confirmation status, invoice references, and transaction timestamps (card numbers and sensitive payment credentials are processed directly by third-party payment gateways and are never stored on our servers).

5. Storage and Retention of Data

Personal data is stored in secure, password-protected cloud systems and access is restricted solely to authorized association staff and coordinators who require it to perform their roles.
Retention duration: Operational contact and registration data is retained only for as long as necessary to administer the corresponding activity, term, or volunteer relationship.
Accounting data: Payment transaction and invoicing records are retained for statutory retention periods mandated by the Finnish Accounting Act (typically 6 to 10 years).
Deletion upon request: Participants, guardians, and volunteers may request the deletion of their personal information at any time. Non-statutory records will be removed promptly upon receipt of a written request.

6. Transfers and Disclosures of Personal Data

Sidra ry does not sell, rent, or trade personal data to third parties.
Data is not disclosed to outside parties except where required by law, court order, or official authorities (such as the Finnish Tax Administration).
Technical service providers (such as secure cloud hosting, form services, and payment platforms) process data on our behalf under compliant data processing agreements. We ensure that all processing takes place within the EU/EEA, or under standard contractual clauses ensuring an equivalent level of GDPR protection.

7. Cookies and Technical Data

This website does not utilize non-essential third-party advertising or invasive tracking cookies. Only technical cookies essential for website functionality, form submission security, and session management are used.

8. Rights of the Data Subject

Under the GDPR, you have the right to:

Access and review the personal data Sidra ry holds about you.
Request the correction of incorrect, outdated, or incomplete data.
Request the erasure of your personal data (right to be forgotten), subject to statutory record-keeping limits.
Object to or restrict the processing of your data.
Withdraw any previously given consent (such as media use) at any time without affecting past processing.
Lodge a complaint with the national supervisory authority (in Finland: The Office of the Data Protection Ombudsman / Tietosuojavaltuutetun toimisto, www.tietosuoja.fi) if you consider your data to be processed in violation of applicable data protection law.