Privacy Policy

Last updated: 23 June 2026

This Privacy Policy (Finnish: tietosuojaseloste) describes how Shoulderskne.ddd ("we", "us", "our") collects, uses, stores, and protects personal data when you visit our website or contact us. We are established in Finland and process personal data in accordance with:

• Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR);
• Finnish Data Protection Act (Tietosuojalaki 1050/2018);
• Finnish Act on the Protection of Privacy in Working Life, where applicable;
• Other applicable Finnish and European Union legislation.

Under Section 28 of the Finnish Data Protection Act, we provide the information required by Articles 13 and 14 of the GDPR in this document.

1. Data Controller and Contact Details

Data controller: Shoulderskne.ddd
Address: Kalastajankatu 14, 65100 Vaasa, Finland
Email: online@shoulderskne.world
Phone: +358 50 338 1045

For all questions relating to personal data processing and the exercise of your rights, please contact us using the details above. We have not appointed a Data Protection Officer (DPO), as our processing activities do not meet the thresholds requiring a DPO under Article 37 of the GDPR. Data protection enquiries are handled directly by the data controller.

2. Register Description

Register name: Website User and Contact Register
Data subjects: Website visitors, contact form users, and event registrants.

3. Personal Data We Collect

3.1 Data You Provide Voluntarily

When you use our contact form or register interest in an event, we may collect:

• Name
• Email address
• Message content and subject of inquiry
• Confirmation of consent to data processing (GDPR consent checkbox)
• Date and time of submission

Providing contact data is voluntary, but we cannot respond to your inquiry without your name, email address, and consent where consent is the legal basis.

3.2 Data Collected Automatically

When you visit our website, our servers and — with your consent — analytics tools may collect:

• IP address (truncated or anonymised where technically feasible)
• Browser type, version, and language settings
• Operating system and device type
• Pages visited, session duration, and navigation paths
• Referring URL and search terms (if applicable)
• Cookie and local storage identifiers (see our Cookie Policy)
• Timestamp of access

3.3 Data We Do Not Collect

We do not intentionally collect special categories of personal data (Article 9 GDPR) such as health data, political opinions, or religious beliefs. Please do not include sensitive personal data in contact form messages unless it is strictly necessary for your inquiry.

4. Sources of Personal Data

Personal data is obtained directly from you (contact form, email, phone) or automatically through your use of the website (server logs, cookies with consent).

5. Purposes and Legal Bases for Processing

We process personal data only when a legal basis under Article 6 GDPR applies:

• Responding to inquiries and event registration — Performance of pre-contractual steps at your request (Art. 6(1)(b) GDPR) and our legitimate interest in communicating with website users (Art. 6(1)(f) GDPR). Our legitimate interest is managing correspondence efficiently; you may object to this processing (see Section 10).
• Website security and abuse prevention — Legitimate interest (Art. 6(1)(f) GDPR) in protecting our systems, detecting fraud, and maintaining service integrity.
• Strictly necessary cookies and local storage — Legitimate interest (Art. 6(1)(f) GDPR) and compliance with the Finnish Information Society Code (917/2014) for essential functionality, including storing your cookie preferences.
• Analytics cookies — Your explicit consent (Art. 6(1)(a) GDPR). You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Marketing cookies and direct marketing — Your explicit consent (Art. 6(1)(a) GDPR), in accordance with the Finnish Marketing Act (Mainoslaki 887/2020) where applicable.
• Legal obligations — Compliance with Finnish accounting, tax, or authority requests (Art. 6(1)(c) GDPR).

We do not use your personal data for automated decision-making or profiling within the meaning of Article 22 GDPR.

6. Recipients and Processors

We do not sell or rent your personal data. Data may be disclosed to the following categories of recipients:

• Hosting and IT service providers — server infrastructure, email delivery, and website maintenance (processors bound by data processing agreements under Article 28 GDPR)
• Analytics providers — only if you have given consent for analytics cookies
• Public authorities — when required by Finnish law, court order, or lawful request from authorities such as the Finnish Tax Administration or law enforcement

Our primary hosting and processing takes place within the European Union or European Economic Area. If data is transferred outside the EU/EEA, we ensure appropriate safeguards under Chapter V GDPR, including Standard Contractual Clauses (SCCs) approved by the European Commission, or an adequacy decision. You may request a copy of applicable safeguards by contacting us.

7. Data Retention

We retain personal data only as long as necessary for the purposes stated above, or as required by Finnish law:

• Contact form submissions: up to 12 months after the inquiry is resolved, unless a longer period is required for legal claims (Finnish Act on Limitations of Actions).
• Event registration data: until the event is completed and follow-up is finished, then deleted within 12 months.
• Analytics data: up to 26 months from collection, then anonymised or deleted.
• Cookie consent records: up to 12 months, stored in local storage on your device and in our records where applicable.
• Server and security logs: up to 90 days, unless needed for an ongoing investigation.
• Accounting-related records: up to 6 years as required by the Finnish Accounting Act (Kirjanpitolaki 1336/1997), if applicable.

After the retention period expires, data is securely deleted or anonymised so that it can no longer identify you.

8. Data Security

We implement appropriate technical and organisational measures under Article 32 GDPR, including:

• HTTPS/TLS encryption for data in transit
• Access controls limiting personal data to authorised personnel only
• Regular review of security practices and service provider compliance
• Confidentiality obligations for anyone processing data on our behalf

No method of transmission over the internet is completely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security. In the event of a personal data breach likely to affect your rights, we will notify you and the Office of the Data Protection Ombudsman as required by Articles 33 and 34 GDPR.

9. Your Rights Under the GDPR and Finnish Data Protection Act

As a data subject, you have the following rights:

• Right of access (Art. 15) — obtain confirmation of whether we process your data and receive a copy.
• Right to rectification (Art. 16) — request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17) — request deletion where data is no longer necessary, consent is withdrawn, or processing is unlawful.
• Right to restriction of processing (Art. 18) — request that we limit processing in certain circumstances.
• Right to data portability (Art. 20) — receive data you provided in a structured, commonly used, machine-readable format where processing is based on consent or contract and carried out by automated means.
• Right to object (Art. 21) — object to processing based on legitimate interests; we will cease processing unless we demonstrate compelling legitimate grounds.
• Right to withdraw consent (Art. 7(3)) — withdraw consent at any time for consent-based processing, including analytics and marketing cookies, without affecting prior lawful processing.
• Right not to be subject to automated decision-making (Art. 22) — not applicable, as we do not conduct such processing.

To exercise your rights, send a request to online@shoulderskne.world. We will respond without undue delay and in any event within one month of receipt, as required by Article 12 GDPR. This period may be extended by two further months for complex requests; we will inform you of any extension. We may request proof of identity before responding to protect your data from unauthorised access.

If you withdraw consent or object to processing, this does not affect the lawfulness of processing carried out before withdrawal or objection.

10. Children's Personal Data

Under Section 5 of the Finnish Data Protection Act, the age from which a child may lawfully give consent to information society services is 13 years. Our website is intended for a general audience and is not directed at children. We do not knowingly collect personal data from children under 13 without parental or guardian consent. If you believe we have collected data from a child under 13, please contact us immediately and we will delete the data without undue delay.

11. Supervisory Authority and Right to Complain

You have the right to lodge a complaint with a supervisory authority if you consider that our processing of your personal data infringes the GDPR or Finnish data protection law. In Finland, the competent authority is:

Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
Lintulahdenkuja 4, 00530 Helsinki, Finland
Website: tietosuoja.fi
Email: tietosuoja@om.fi

You may also lodge a complaint with the supervisory authority in your EU/EEA country of habitual residence or place of work.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or services. The updated version will be published on this page with a revised "Last updated" date. Where changes materially affect your rights, we will provide additional notice where required by law. We recommend reviewing this page periodically.

Back to Home