Privacy Policy

The data controller is Puerto Deportivo De La Kokkola ry (business ID 30763607), Kirstintasku 3, 20200 Turku, Finland.

Data protection enquiries: joyner-alphonsek@gmx.com, or by post to the address above marked 'Data Protection'. Telephone +358 50 368 0927. The association has not appointed a statutory Data Protection Officer as it is not required to do so under Article 37 GDPR; the association secretary is the responsible contact.

Membership register: name, postal address, email, telephone number, membership category, joining date, fee payment status, and (where relevant) vessel name and berth allocation. Maintaining a membership register is a statutory obligation under the Finnish Associations Act (Yhdistyslaki 503/1989, §11).

Course and clinic participants: name, age or date of birth for juniors, guardian contact details, swimming ability declaration, and any medical or accessibility information you choose to disclose for safety purposes.

Volunteers: name, contact details, availability, roles undertaken and, for roles involving minors, confirmation that a criminal record extract has been presented. We record only that a valid extract was seen and the date — we do not retain the extract itself.

Donors and sponsors: name, contact details, amount and date of donation, and bank reference as required by accounting law.

Website contact form: the details you enter and the date of submission.

Website technical data: our site does not use advertising or profiling cookies. Server logs may record IP address, timestamp and requested page for security and operational purposes.

Managing membership and the statutory membership register — legal obligation (Art. 6(1)(c)) and contract (Art. 6(1)(b)).

Delivering courses, clinics and events, including participant safety — contract and legitimate interests (Art. 6(1)(b) and (f)).

Health, medical and accessibility information disclosed for safety — explicit consent (Art. 9(2)(a)). You may withdraw this consent at any time; we will then be unable to accommodate the relevant need.

Accounting, donations and audit — legal obligation (Art. 6(1)(c)), Finnish Accounting Act.

Responding to enquiries — legitimate interests (Art. 6(1)(f)).

Member newsletters and association communications — legitimate interests for members; consent for non-members.

Data is collected directly from you, from a parent or guardian in the case of participants under 18, or generated in the course of your participation (for example course completion records).

We do not sell personal data and we do not disclose it for marketing purposes.

Data may be disclosed to: the association's independent auditor in the course of the annual audit; our banking and payment providers; insurers, where an incident report requires it; and public authorities where required by law.

Where a course or clinic is delivered jointly with a school, municipality or partner association, participant lists are shared only to the extent necessary for safety and supervision, under a written arrangement.

The association's records are held within the EU/EEA. Where a service provider processes data outside the EU/EEA, transfers are made only on the basis of an adequacy decision or Standard Contractual Clauses under Article 46 GDPR.

Membership records: for the duration of membership and ten years thereafter, reflecting the association's need to evidence historical decisions and liability positions.

Accounting records, including donations: ten years from the end of the financial year, as required by the Finnish Accounting Act.

Course participation and instructor certification records: ten years, for insurance and safety-audit purposes.

Incident and near-miss reports: twenty-five years where a minor was involved, in line with safeguarding good practice.

Contact form submissions: twenty-four months.

Health and accessibility information: deleted at the end of the season to which it relates unless you ask us to retain it for the following season.

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21), and the right to withdraw consent at any time where processing is based on consent.

Note that we cannot erase data we are legally required to retain, such as the statutory membership register during membership or accounting records within their retention period.

Requests should be sent to joyner-alphonsek@gmx.com. We respond within one month. We may ask you to verify your identity before disclosing personal data.

If you believe your data has been processed unlawfully, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi).

The membership register and participant records are held in access-controlled systems available only to the board members and volunteers who need them for their role. Paper records are kept in a locked cabinet at the clubhouse. Volunteers handling personal data are briefed on confidentiality before being given access, and access is withdrawn when a role ends.

Participants under 18 are enrolled by a parent or guardian, who provides and may review the data held. Photographs of minors are published only with separate written guardian consent, which may be withdrawn at any time.

Material changes are announced to members and published on this page with a revised date. The version in force is the one published here.