This is the privacy notice of the Finnish Society for Surgery of the Hand in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR). Created on October 28, 2024. Last updated on October 16, 2026.
- Data Controller
Suomen Käsikirurgiyhdistys ry – The Finnish Society for Surgery of the Hand (“Organization”)
Business ID: 1560875-6
c/o Anniina Ukkola, P.O. Box 2000 (PL 2000), Tampere, Finland - Contact Person Responsible for the Register
Leena Kuuramaa, secretary@fssh.fi - Name of the Register
Participant Register of the 3rd Finnish Wrist Arthroscopy Course (FWAC 2027), organized by the Organization. - Purposes and Legal Bases of Processing
Personal data is processed for the following purposes:
– Managing registrations and the course (registration, waiting list, course arrangements, allocation to laboratory groups, communication with participants and certificates of attendance). Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
– Dietary requirements (optional), which may include health-related information such as food allergies, for arranging meals during the course. Legal basis: the participant’s explicit consent given in the registration form (GDPR Art. 6(1)(a) and Art. 9(2)(a)). Consent can be withdrawn at any time.
– Payments and bookkeeping. Legal basis: compliance with a legal obligation under the Finnish Accounting Act (GDPR Art. 6(1)(c)).
– Photographs taken at the course, which may be used in the Organization’s communications, including social media. Legal basis: the Organization’s legitimate interest in communicating about its activities (GDPR Art. 6(1)(f)). Participants may object at any time (see section 12).
– Website security and visitor statistics. Legal basis: legitimate interest (GDPR Art. 6(1)(f)).
– Disclosure of data to partners or sponsors only on the basis of separate, voluntary consent (GDPR Art. 6(1)(a)), which can be withdrawn at any time.
The data is not used for automated decision-making or profiling. - Personal Data Processed
Name, contact details (email address, postal address, phone number), workplace, number of completed wrist arthroscopy procedures (used to allocate participants to the basic or advanced laboratory group), preferred laboratory group, course type, dietary requirements if provided, payment details (payment status, payment reference, card type and the last four digits of the card number), correspondence with the participant, and photographs taken at the course. Full card details are processed only by the payment service provider Stripe and are not stored by the Organization.
Providing the data requested in the registration form is necessary for registering for the course. Without it, registration cannot be completed. Providing dietary requirements is voluntary. - Sources of Data
Data is obtained from the participants themselves through the registration and waiting list forms, by email or in other communication with the Organization. Payment status is received from the payment service provider Stripe. Photographs are taken at the course. - Recipients of Data
Personal data is not disclosed to third parties, including the Organization’s partners or sponsors, without the participant’s separate consent, unless required by law.
Dietary requirements are shared with the catering provider of the course only to the extent necessary for arranging meals.
The Organization uses the following service providers that process personal data on its behalf or as independent controllers for their own part: Stripe (payment processing), and the providers of the website, the registration form system and email services. Service providers may process the data only to the extent necessary for providing their services. - Transfers Outside the EU or EEA
The Organization does not itself transfer personal data outside the EU or EEA. The payment service provider Stripe may process payment data also in the United States. Such transfers are based on the EU–U.S. Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses. - Retention Period
Registration and waiting list data is deleted or anonymised within twelve (12) months after the end of the course. Dietary requirements are deleted within one (1) month after the course. Data that forms part of the Organization’s accounting records (such as payment details) is retained for the period required by the Finnish Accounting Act. Photographs published in the Organization’s communications may be retained for as long as the publication is available, unless the person concerned objects. - Principles of Data Security
Personal data is processed with care and protected by appropriate technical and organisational measures. Access to the data is limited to persons within the Organization who need it for course arrangements and who are obliged to keep it confidential. Data stored in information systems is protected with user credentials and access rights, and the physical and digital security of servers is ensured by the service providers. - Right of Access and Right to Rectification
Every data subject has the right to access their personal data and to request the correction of inaccurate or incomplete data. - Other Rights of the Data Subject
Data subjects also have the right to request the erasure of their data (“right to be forgotten”), to restrict processing, to object to processing based on legitimate interest (including the use of photographs), to receive their data in a machine-readable format (data portability) and to withdraw consent at any time without affecting the lawfulness of processing before the withdrawal. Some rights may be limited where the data must be retained to comply with a legal obligation.
Requests should be sent to secretary@fssh.fi. The Organization may ask the requester to verify their identity and will respond within the time limit set by the GDPR (usually within one month). - Right to Lodge a Complaint
Data subjects have the right to lodge a complaint with a supervisory authority if they consider that their personal data is processed in breach of data protection legislation. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman (tietosuoja.fi/en). - Cookies
The website uses cookies that are necessary for its functioning and security. Consent for any other cookies, such as third-party cookies, is requested separately. - Changes to This Notice
The Organization may update this privacy notice. The date of the latest update is shown at the top of this page.