Privacy policy of the Viral Vegans association
Date of preparation: 2 August 2022
Updated: 12 October 2026. This is an unofficial English translation; in case of any discrepancy, the Finnish version prevails.

Data controller
Viral Vegans ry
Business ID: 3273247-6

Contact details for data protection matters:
info@viralvegans.fi

Purpose and legal basis of processing personal data
The processing of the personal data of website users is based primarily on the legitimate interest of Viral Vegans ry (Article 6(1)(f) of the General Data Protection Regulation (EU) 2016/679) in ensuring the functionality and security of our website, developing our website and responding to enquiries we receive through our website. For cookies other than strictly necessary cookies, the legal basis for processing is the consent of the data subject (Article 6(1)(a) of the General Data Protection Regulation).

For members of the association, the primary legal basis for processing personal data is the statutory obligation of Viral Vegans ry to keep a register of its members (Associations Act 503/1989, section 11) in accordance with Article 6(1)(c) of the General Data Protection Regulation.

The processing of personal data is also necessary, as required by Article 6(1)(f) of the General Data Protection Regulation, for the purposes of the legitimate interests of the association, including enabling the provision of services to the association’s members and volunteers and the implementation of, and communication about, campaigns and petitions.

Personal data is processed for the following purposes:
- maintaining the list of members in accordance with section 11 of the Associations Act (503/1989)
- processing membership applications
- managing membership matters, such as communications, the administration of membership fees and other contact
- organizing events as well as discussion and training sessions
- developing our activities, compiling statistics and reporting
- carrying out campaigns and communicating about them
- carrying out petitions and delivering them to the party named in the petition in order to achieve the stated goal

We always ask for your consent before sending electronic direct marketing.

Personal data is not used for automated decision-making that would have legal or similarly significant effects on data subjects.

Data content of the register
The following types of data, among others, may be stored about a data subject:
- Name
- Date of birth
- Municipality of residence
- Information on whether the data subject defines themselves as vegan
- Contact details (e.g. address, phone number, email address)
- Membership number
- Information related to membership fees and other invoices
- Necessary information provided in connection with events, such as allergy information.

The data is obtained primarily from the data subjects themselves.

Regular disclosures of data and categories of recipients
Processing tasks may be outsourced to external service providers in accordance with, and within the limits set by, data protection legislation. We ensure that service providers acting on our behalf process personal data in accordance with this privacy policy.

Information on event participants may be disclosed to the partner organizing the event. Information entered by petition signatories in the petition form (name, municipality, contact details) may be disclosed to our partners who organize and deliver the petition together with us.

Transfer of data outside the EU or EEA
As a rule, Viral Vegans ry does not transfer personal data outside the European Union or the European Economic Area. Some of Viral Vegans ry’s service providers may operate outside the EU or EEA, in which case Viral Vegans ry ensures an adequate level of protection for personal data by means of the standard contractual clauses adopted by the European Commission or another lawful transfer mechanism.

You can read the privacy policy of iRaiser, which provides our donation service, here.

You can read the privacy policy of Calendly, which provides our calendar booking service, here.

Principles for securing the register
Access to the data requires sufficient access rights and multi-factor authentication. Unauthorized access is also prevented by means such as firewalls and technical safeguards. Only the data controller and specifically designated persons have access to the register data. Only designated persons have the right to process and maintain the register data. Users are bound by a duty of confidentiality. The register data is securely backed up and can be restored if necessary.

The purpose of the above measures is to safeguard the confidentiality, availability and integrity of the personal data stored in the register and to ensure that the rights of data subjects are respected.

Rights of the data subject

Right of access
Data subjects have the right to check what data concerning them has been stored in the register. Exercising the right of access is, as a rule, free of charge.

Right to rectification
Data subjects have the right to ask the data controller to correct any erroneous, inaccurate or incomplete data concerning them.

Right to erasure
In certain situations specified in more detail in Article 17 of the General Data Protection Regulation, data subjects have the right to ask the data controller to erase personal data concerning them. Data subjects may request the erasure of their personal data, for example, when the personal data is no longer needed for the purposes for which it was collected or otherwise processed.

Right to restriction of processing
In certain situations specified in more detail in Article 18 of the General Data Protection Regulation, data subjects have the right to ask the data controller to restrict the processing of their personal data. Data subjects may request the restriction of processing, for example, when they have objected to the processing of their personal data and are awaiting verification of whether the legitimate grounds of the data controller override those of the data subject. If processing is restricted, the data controller may store the data but, as a rule, may not otherwise process it.

Right to object to the processing of personal data
On grounds relating to their particular situation, data subjects have the right to object to profiling and other processing operations that the data controller carries out on their personal data, insofar as the processing is based on the legitimate interest of the data controller. If a data subject objects to processing, the data controller may no longer process the personal data unless the data controller can demonstrate that the processing is justified. Where personal data is processed for direct marketing purposes on the basis of legitimate interest, the data subject has the right to object at any time to processing for direct marketing (including profiling related to direct marketing). If the data subject has objected to the processing of their personal data for direct marketing purposes, it may no longer be processed for this purpose.

Right to data portability
Insofar as data subjects have themselves provided the register with data that is processed on the basis of their consent or a contract, they have, as a rule, the right to receive that data in a machine-readable format and the right to transfer it to another data controller.

Right to withdraw consent
Where personal data is processed on the basis of the data subject’s consent, the data subject has the right to withdraw their consent by notifying the data controller. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

Right to lodge a complaint with a supervisory authority
Data subjects have the right to lodge a complaint with the competent supervisory authority if they consider that the data controller has not complied with the applicable data protection regulations in its activities.

Contact
In all questions relating to the processing of personal data and in all situations relating to the exercise of their rights, data subjects should contact the data controller using the contact details given at the beginning of this privacy policy.

Payment service provider
Payment intermediation services are provided by Paytrail Oyj (2122839-7), which acts as the payment service provider in cooperation with Finnish banks and credit institutions. Paytrail Oyj appears as the payee on bank statements and card bills and forwards the payment to the merchant. Paytrail Oyj is authorized as a payment institution.

In the case of complaints, please contact the supplier of the product first.
Paytrail Oyj, Business ID: 2122839-7
Innova 2
Lutakonaukio 7, 40100 Jyväskylä

https://www.paytrail.com/kuluttaja/tietoa-maksamisesta