Privacy policy

1. Data controller and contact person

• Data controller: The Finnish Society for Tribology
• Business ID: 1477982-8
• Address: c/o HAMK Tech / Ville Oksanen / PL 230 / 13101 Hämeenlinna
• Contacts: rekisteri [at] tribologysociety.fi

2. Registered

The register processes the personal data of the Association's current and former personal members, the contact persons of the community members, the contact persons of the Association's customers, and the members and contact persons of organisations related to the Association's activities ("Data Subject").

3. Basis and purpose of processing personal data

The purpose of the Register is the up-to-date management of the Data Subjects' personal data during membership, maintenance and development of the Register, marketing and direct marketing, as well as the management of the documentation of expired memberships in the personal data system ("System").

The processing of personal data is based on the Association's legal obligation to maintain a membership register and, in certain cases, on the implementation of the agreement.

The processing of the full name and domicile of registered members is based on the Associations Act (§11). The processing of other data processed in the register is based on the Data Subject's consent.

4. Processed personal data

For the personal members of the Association, the Register processes personal and contact information as well as other information necessary for membership. This information includes:

• The full name of the Data Subject (all first names and surnames). Information required by the Associations Act
• The Data Subject's domicile (i.e. municipality of residence). Information required by the Associations Act
• The postal address of the Data Subject. The postal address can be the home address of the data subject or the postal address of the workplace. The postal address is used for the delivery of the journal Tribologia – Finnish Journal of Tribology and also for member communications if the member cannot be contacted by email
• Data Subject's email address. The email address can be a private or business address. The registered person's email address is used as the primary member newsletter connection
• The language of communication requested by the Data Subject (Finnish or English) for personal member communications
• Employer of the data subject. Voluntary information

Regarding the contact persons of profitable corporate members and the contact persons of institutional customers, the following personal and contact information are processed in the register:

• Data Subject's first and last name
• Data Subject's work email address for member, customer and marketing communications

The association will deliver a printed copy of the scientific journal Tribologia – Finnish Journal of Tribology to the members of the journal's Nordic Advisory Board, as well as an issue to the responsible author if he or she has given his or her postal address. Regarding these, the register processes the following personal and contact information:

• Data Subject's first and last name
• Postal address of the Data Subject (can be home or work address)

5. Regular sources of information

For individual members, personal data is collected from the Data Subject himself/herself.

With regard to the contact persons of corporate members and customers, the Data Subject's personal and contact information is collected from the corporate member or customer.

Regarding the members of the Nordic Advisory Board of the scientific journal Tribologia – Finnish Journal of Tribology and the responsible authors of the issue, the data subject's personal data and contact information are collected from the Data Subject himself/herself.

The Data Subject is responsible for notifying the Data Controller of their changed data. The Controller may provide the Data Subject with a request to check and update the Data Subject's information, for example, in connection with invoicing or separately.

6. Protection and security of personal data

The member register is located on the Microsoft Teams workspace platform of the University of Tampere. Access to the platform is logged and granted for persons who need to process personal data. These individuals have personal usernames and passwords, and access to the platform's files is ensured through two-factor authentication. The platform's servers are located in the EU.

7. Regular disclosures and transfers of personal data

The association does not disclose the information in the membership register to anyone outside, except for the mailing of the Tribologia journal, the mailing addresses of which are given to the printing house for the purpose of mailing the issue of the journal. The printing house will forward the mailing addresses to Posti for mailing.

8. Transfers of personal data outside the European Union or the European Economic Area

The association may also use other service providers located outside the European Union or the European Economic Area to process personal data. The transfer of personal data outside the European Union or the European Economic Area is always carried out on one of the following legal grounds:

• The European Commission has decided that an adequate level of data protection has been ensured in the recipient country concerned;
• The association has implemented appropriate safeguards for the transfer of personal data using standard data protection clauses adopted by the European Commission. In such a case, the data subject has the right to obtain a copy of the standard clauses in question by contacting the Association as described in the Contacts section; or
• The data subject has given their explicit consent to the transfer of their personal data, or there is another legal basis for the transfer of personal data.

No more access to personal data is provided than is necessary for the implementation of the services. The transfer of personal data outside the European Union or the European Economic Area is always based on the applicable legislation on the processing of personal data and is carried out in accordance with that legislation.

9. Retention period of personal data

Personal data is stored in the register as long as the Data Subject is a member of the Association. After the termination of the membership, personal data is stored for a maximum of ten years after the termination of the membership on the basis of the Association's legitimate interest, i.e. for defending against possible legal claims (Supreme Court ruling 2017:15). Personal data may also be stored for a longer period if applicable legislation or the Association's contractual obligations towards third parties require a longer retention period. Files deleted from the registry go to the platform's (item 6) recycle bin, from where they can be recovered within 90 days.

10. Rights of the Data Subject

The data subject has the right to object to the processing of their personal data for direct marketing purposes at any time. The data subject may give the Association channel-specific consents and prohibitions concerning direct marketing (e.g. prohibit marketing messages sent by email).

In addition, the data subject has the right, in accordance with applicable data protection legislation, at any time to:

• receive information about the processing of their personal data;
• have access to their own data and to check the personal data processed by the Association;
• request the rectification of inaccurate and inaccurate personal data and the completion of the data;
• request the erasure of their personal data;
• withdraw their consent and object to the processing of their personal data to the extent that the processing of personal data is based on the consent of the Data Subject;
• object to the processing of their personal data on grounds related to their personal special situation to the extent that the basis for processing personal data is the Association's legitimate interest;
• receive their personal data in a machine-readable format and transfer the data in question to another controller, provided that the data subject has provided the personal data in question to the Association, the Association processes the personal data in question on the basis of the Sata Subject's consent and the processing is carried out automatically; and
• demand the restriction of the processing of their personal data.

The Data Subject must submit a request for the implementation of the above-mentioned rights in accordance with the Contacts section of this privacy policy. The association may ask the Data Subject to specify their request in writing and to verify the identity of the Data Subject before processing the request. The association may refuse to comply with the request on the grounds laid down in the applicable law.

11. Right to appeal to a supervisory authority

Each Data Subject has the right to lodge a complaint with the relevant supervisory authority or the supervisory authority of the Member State of the European Union where the Data Subject's place of residence or place of work is located, if the Data Subject considers that his or her personal data has not been processed in accordance with applicable data protection legislation.

12. Contacts

Requests concerning the exercise of the data subject's rights, questions about this privacy policy and other contacts should be made by email to rekisteri [at] tribologysociety.fi.

13. Changes to this privacy policy

This privacy policy may be updated from time to time, for example, in the event of changes in legislation. This privacy policy was last updated on 30.11.2025. The Association will notify the Data Subjects of any changes to the privacy policy by email to the email address provided by the Data Subject to the Register. The data subject is deemed to have accepted the amendment to the privacy policy, unless the Data Subject has notified otherwise within 14 days of receiving the notification.