SUOMEN
GOLFLIITTO

1 General
This Privacy Statement provides the data subject with the information required by the EU Data Protection Regulation (the ”GDPR”).

2 Data controller and contact information

The data controller is the Finnish Golf Union (“FGU”) in accordance with this privacy statement. With regard to communication to the data subjects and the exercise of the data subject’s rights, the member clubs of the FGU are responsible, and they forward the request for information to the FGU.Contact person and contact information of the data controller:

Finnish Golf Union,
Juha Korhonen, Executive Director, tietosuoja@golf.fi

3 Name of the register

The central registry for the management of members of the FGU´s member clubs and golf Green Card holders, the eBirdie service, in which members and Green Card holders who have given their membership or Green Card information to the golf club are registered and synchronized with the FGU´s central registry.

4 The purpose and legal basis of processing data

Below is a listing of the different purposes and legal basis of processing data.

Purpose: Maintaining the list of members of the FGU; The members of the FGU are Golf Clubs, whose members are golfers.
Legal basis: Legitimate interest of the controller; Determination of the FGU´s membership fee for clubs according to the membership situation on 31st of August
Processed data: Name, contact information, member number, gender, handicap and handicap scores, home club and other clubs where the person is a member

Purpose: Provision of services such as; handicapping, Golf Magazine, electronic membership card, competitions and  insurance cover
Legal basis: Execution of the contract or pre-existing measures and / or legitimate interest of the data controller.
Processed data: Name, contact information, member number, gender, handicap and handicap scores, home club and other clubs with the person as a member, Golf magazine subscription information

Purpose: Marketing
Legal basis: Legitimate interest of the data controller and consent for electronic direct marketing.
Processed data: Name, contact information, member number, gender, handicap, home club and other clubs with the person as a member

Purpose: Conducting researches and studies, supporting the general development of the sport (reporting for the Olympic Committee, Ministry of Culture and Education, customer experience development), surveys and statistics
Legal basis: Legitimate interest
Processed data: Name, contact information, member number, gender, handicap, home club and other clubs with the person as a member

Purpose: The national registry of Green Card holders
Legal basis: Legitimate interest and execution of the contract
Processed data: Name, gender, date of birth. contact information, as well as performance-related information such as performance date

Purpose: Transferring member information from member club to another club for guest playing purpose
Legal basis: Legitimate interest and execution of the contract
Processed data: Name, gender, date of birth. contact information, as well as performance-related information such as performance date

5 Storage times of personal data and storage time criteria

Member information is stored during club membership, their up-to-date and necessity of storage is constantly monitored.

After the end of the club membership, the membership status in the registry is changed into “passive”, after which the data is stored in the central registry for three years, after which the data is automatically deleted if the player does not join another club during this period, and thus his data can be found through the online registry.

The data in the Green Card registry is kept for three years, after which the data is deleted manually.

6 Recipients and recipient groups of personal data

FGU discloses the personal data of the register to Otavamedia Oy for the distribution of Golflehti, its reader surveys and other possible magazines provided by Otavamedia to FGU members.

Personal data may also be disclosed to authorities in statutory cases.

7 Transfer of personal data

The controller uses subcontractors to process the data, but the data is not transferred outside the EU or the EEA. In order to ensure appropriate data protection and security, the controller enters into an agreement with the processors of the personal data as required by the GDPR.

8 Sources of personal data

Personal data is transferred to the central registry directly from the FGU member clubs´ registers. The FGU central registry forms a comprehensive register of the FGU member clubs´ members.

The Green Card register is created when clubs enter personal data of the players who have completed the Green Card into the system.

9 The rights of the data subjects

  • Right of inspection and transfer

The data subject has the right to receive confirmation from the controller as to whether or not the data subject’s personal data are processed or whether they have been processed. If the controller processes the personal data of the data subject, the data subject has the right to receive the data of this document as well as a copy of the personal data to be processed or that has been processed. The data controller may charge a reasonable administration fee for additional copies requested by the data subject. If the data subject makes the request electronically and has not requested another form of delivery, the information will be provided in a commonly used electronic format. In addition, the data subject may request the transfer of the data he or she has provided in machine-readable form, based on the GDPR.

  • Correction, deletion of data and opposition to processing

The data subject also has the right to ask the controller to rectify or delete his or her personal data and may refuse to process his or her personal data for direct marketing purposes. The data subject also has the right in certain situations to request a restriction on the processing of his or her personal data or otherwise object to the processing.

  • Right to withdraw consent

If the controller processes the data subject’s personal data on the basis of consent, the data subject has the right to withdraw his or her consent. Withdrawal of consent shall not affect the lawfulness of the processing carried out before its withdrawal.

  • Right to appeal to the supervisory authority

If the data subject considers that the processing of his or her personal data is not lawful, he or she has the right to lodge a complaint with the supervisory authority.

  • Exercise of rights

Registrants can check their own information related to this description from their own golf club, which forwards the check request to the Finnish Golf Association. All other requests mentioned in this leaflet must be submitted to the contact person of the Golf Club Registrar. If necessary, be prepared to prove your identity when exercising the rights of the data subject.

10 PROTECTION OF PERSONAL DATA

Personal information is located primarily on the eBirdie service. Only employees of controllers who are bound by professional secrecy and who need to use the register to perform their duties have a right of access to personal data. HiQ Finland Oy, the system administrator, also has access to the data. A security review of the eBirdie service was conducted in 2017 to ensure that the system is secure for maintaining the registry.

Personal data is also protected by restriction of access rights.

Computers and systems are protected by firewalls and anti-virus software.

The office and archive facilities are locked during office closing hours and covered by alarm systems / security.