Privacy and Data Protection Statement
This is the privacy and data protection statement of Biopsi ry, in accordance with the Personal Data Act (sections 10 and 24) and the EU General Data Protection Regulation (GDPR), applicable to members of Biopsi ry and users of its online services. Created on September 25, 2026. Last amendment on September 25, 2026.
Data Controller
Biopsi ry, Arvo Ylpön katu 34, huone F 108, 33520 Tampere
Email: [email protected]
Hereinafter referred to as "Biopsi."
Contact Person for the Register
Biopsi's board, [email protected]
Register Name
Biopsi's member register and online service user register.
Rights of the Data Subject
The data subject, i.e., a member of Biopsi or a user of its online services, has the right under the GDPR to:
- Access information: The right to obtain data about personal information and request access to personal data that Biopsi processes related to you.
- Correct information: The data subject can change their information directly from Biopsi's website through their profile.
- Erase information and be forgotten: Biopsi is obligated to retain information as long as the membership in the association continues. Biopsi may ask the requester to prove their identity if necessary.
- Restrict processing of information: The data subject can request the restriction of processing of their data so that it is processed only with the consent of the data subject. This does not apply to data storage.
- Transfer data from one system to another: The data subject can request that Biopsi transfer the stored information to another controller.
- Object to the processing of information: The data subject can, for personal and specific reasons, object to the processing of their data. This does not apply in situations where Biopsi can demonstrate that there is a significant and justified reason for processing the data.
- Not be subject to automated decision-making: Biopsi does not use information for automated decision-making or profiling.
Legal Basis and Purpose of Processing Personal Data
The purposes and legal bases for processing personal data in Biopsi ry are diverse, covering membership management, event registrations, product sales, and much more. The legal bases vary from contract execution to consent and legal obligations. Data is used for event registrations, maintaining the member directory, identifying online service users, member communications, contacts related to event participation, and orders for products and services. Additionally, data is used for advocacy and planning activities, equipment and clothing lending services. Processing personal data enables communication targeted at Biopsi members, organizing events, and offering services.
Data Collected from Registered Users
User Data
User data is used to identify you when you interact with our association's online service. We may also send information related to your user account via email.
- Name
- Email address
Member Data
Data is collected and processed to maintain the statutory membership register required by the Associations Act, and, based on the association's legitimate interest, to manage the membership relationship and to track changes related to membership.
- Full legal name
- Place of residence
- Duration and type of membership
Contact Information
Contact information is used when you want us to contact you regarding our activities: invitations to association meetings, contacts during events for transportation, etc. If you do not wish to receive meeting invitations by email, they are also available on the association's website.
- Name
- Email address
Demographic Data
We collect this information to plan our advocacy activities and events. Additionally, the data is used for a member statistic visible to members, from which individual persons cannot be identified.
- Subjects at the University of Tampere
- Year of joining
Public Contact Information
This information is used to display you, if you wish, to other users of the online service in event participant lists or publicly in the online service's web directory:
- Display name
Order History Data
To organize events and sell products for order, such as overalls, we need to collect data about orders and additional order details. In some cases, we may need additional details beyond the purchased product or event for the order.
- Event registrations
- Purchased products
Data Disclosures and Transfers Outside the EU/EEA
Data is not disclosed to third parties, unless it concerns a service provider processing personal data on Biopsi's behalf (a data processor) with whom a data processing agreement compliant with the GDPR has been made.
Biopsi uses the Microsoft Entra ID service for user account management and authentication (logging into the web service). In this context, the user's name and email address are transferred to Microsoft, which acts as a data processor on Biopsi's behalf.
Microsoft may also process data outside the European Economic Area. In such cases, the transfer is based on the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) or the standard contractual clauses approved by the European Commission, as well as Microsoft's EU Data Boundary commitment, under which data from EU-area customers is primarily kept within the EU. More information on Microsoft's privacy practices.
Biopsi uses the Stripe service for payment processing. In this context, the user's email address and information related to the order are transferred to Stripe, which acts as a data processor on Biopsi's behalf. Stripe processes and stores payment card details; Biopsi does not store them itself.
Stripe may also process data outside the European Economic Area (e.g., Stripe Inc., United States). The transfer is based on the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) or the standard contractual clauses approved by the European Commission.
Principles of Register Protection
Personal data is kept confidential. Biopsi ry and its service provider(s) ensure the security of data to the best of their ability. Paper-based data is stored under lock and key, accessible only to authorized individuals, and is destroyed immediately after use.
Data Retention and Deletion
Data subjects' information is retained only as long as necessary, for example, additional information for orders is not needed after an event and is intended to be deleted within a month of the event's conclusion. Participation or payment information for the event is kept longer for the resolution of any payment disputes.
Upon request by the data subject, we will delete their personal data unless there is a legal or contractual obligation to retain the information, such as data required for maintaining the membership register as long as the individual is a member of the association.
