Privacy policy

Privacy policy based on the General Data Protection Regulation (GDPR). 

1. Name of the register

Membership register of Colores- the Finnish Colorectal Cancer Association

2. The registrar

Name: Colores – the Finnish Colorectal Cancer Association
Website: www.colores.fi
Adress: Malmin kauppatie 26, 00700 Helsinki
Tel. 010 422 2540
Email: info@colores.fi

2.1 Person in charge of the register

Name: Tiina Kosti
Adress: Malmin kauppatie 26, 00700 Helsinki
Tel. 050 501 2885
Email: tiina.kosti@colores.fi

3. Use of the register

The purpose of the processing of personal data is to carry out the activities of the association and handle memberships. 

Uses of personal data:

• Maintaining name and address information of the members
• Delivery of Cancer-magazine, patient guides and brochures to members and health care units
• Informing and marketing events
• Handeling registrations to events
• Member billing
• Executing member surveys
• Making statistics. Individuals can’t be recognized from the statistics. 
• Peer support activity

Registrants have the right to refuse to receive marketing messages and newsletters from the association. Refusal shall be effected by notification to the registrat by e-mail, telephone or letter.

4. Contents of the register

Due to the Finnish associations act (503/1989) it is obligatory to collect the members full name and recidency to the register. In addition the register contains the following information about the members:

• Contact information (address, phone number and email)
• Gender
• Infomation about the membership (membership number, type of the membership and the start date of the membership)
• Infomation about the membership fee (bills and payments)
• Cancer-magazine subscription
• Volunteer acticity

5. Data sources for the register

The information to be registered in the membership register is obtained through the member’s own notice or by the person applying for membership through the member application form. You can apply for membership on the association’s own website or through the website of cancer organizations. Information entered in the membership register may also be received by telephone, letter, orally, by email or on the membership form.

6. Disclosure and transfer of data outside the EU or the EEA

Information stored in the register is not routinely disclosed outside the association, including outside the EU or the EEA.

7 . Registry security principles

1. Manual information
   Paper membership forms and any other personal information on paper are stored in a locked cabinet in the association’s office room. The office room door is kept locked when employees are not present. Paper membership information will be properly disposed of (on a shredder) once the member has paid his / her first membership fee and after the member has been approved by the board.
2. Electronic information
   The information is processed by an electronic registry service (Yhdistysavain Rekisteri) and for this purpose the information is stored on the servers of the service provider (Avoine Oy). The server space is properly monitored. The electronic membership register is used by the employees of the association who are bound by the content of the register. The register is protected by usernames and passwords.

Additionally, Excel spreadsheets containing personal data are processed on the employees’ computers. Computers are protected by personal passwords and security software.

8. Right of inspection

As a rule, a member entered in the register has the right to verify his or her personal data stored in the register and to request the registrar to correct his or her incorrect information. The request for verification shall be made in writing to the registrar concerned. The necessary action must be taken not later than one month after receipt of the request.

9. Correcting of registry data 

The registrar shall, without undue delay, correct, delete or add inaccurate, unnecessary, incomplete or outdated personal data contained in the register on its own initiative or at the request of the data subject. The request for rectification shall be made to the registrar. The necessary action must be taken not later than one month after receipt of the request.