DATA PROTECTION AND PRIVACY STATEMENT FOR PRO ARTE
FOUNDATION FINLAND’S WEBSITE
This data protection and privacy statement is intended for users of Pro Arte Foundation Finland [“The Foundation”] website and newsletter recipients. This data protection and privacy statement describes how The Foundation collects and processes personal data as part of its work, what personal data are collected, for what purposes personal data are used and how those personal data are protected. The statement also describes the data subjects’ rights
and how a data subject can use their rights.
The Foundation is responsible for ensuring that personal data are processed in compliance with this data protection and privacy statement and the relevant data protection legislation.
1. REGISTER KEEPER
Pro Arte Foundation Finland [“The Foundation”]
Business Identity Code 21485721
2. CONTAC T INFORMATION IN MATTERS RELATED TO THE REGISTER
Pro Arte Foundation Finland
address: Kalevankatu 4, 2nd floor 00100 Helsinki
3. NAME OF REGISTER
Pro Arte Foundation Finland’s newsletter subscriber register contains the following register:
a. Pro Arte Foundation Finland’s e-mail list for newsletters
4. DATA CONTENT OF REGISTER
a. We do not store personal data that comes through feedback forms in the contact information register, we store only the given feedback to develop our operations.
b. The following information about newsletter subscribers can be stored in the register:
- Subscriber’s contact details (first name, surname, address, e-mail address and phone
- Subscriber’s title
- Subscriber’s organization
5. PURPOSE OF PROCESSING AND LEGAL BASIS FOR PROCESSING PERSONAL DATA
a. Personal data are stored to develop The Foundation’s operations and communications. The legal basis for the processing is the registered person’s consent.
b. Personal data are stored in order to send out newsletters to subscribers. The legal basis for the processing is the registered person’s request to be put on the newsletter list. The legal basis for the processing is the registered person’s consent and/or legitimate interest.
6. PERSONAL DATA RETENTION PERIOD
As a rule The Foundation processes personal data only for as long as there is a basis for processing it.
a. Personal data received through the feedback form is not stored.
b. Personal data of people on the newsletter subscription distribution list are stored for as long as the newsletter subscriber wants to remain on the newsletter list. Newsletter subscribers can at any time cancel their subscription through a link in the newsletter.
7. THE REGISTER’S REGULAR SOURCES OF DATA
a. Personal data are acquired from the data subject themself when they complete the newsletter subscription form.
8. REGULAR DISCLOSURE OF INFORMATION
As a rule personal data will not be disclosed to third parties.
9. DISCLOSURE OF INFORMATION OUTSIDE OF THE EU OR ETA
Personal data will not be transmitted or disclosed outside the EU or ETA. The personal data processor Gruppo Software may be located outside of the EU.
10. REGISTER’S PROTECTION PRINCIPLES
The Foundation protects the personal data contained in the register using appropriate technical and organizational measures, which are used to ensure that the processing of personal data complies with the data protection regulations. Unauthorized bodies do not have access to register data. Only the register keeper and people individually designated by the register keeper can gain access to the personal data contained in the register.
Only individually designated individuals have the right to process and maintain the personal data contained in the register. Everyone who is given the right to access the data also undertakes to comply with the duty of confidentiality.
The information systems and computer equipment maintained using information technology in which the register is located are protected by the customary technical safeguards, such as firewalls and user-specific passwords. The computer equipment is kept in locked premises. Manual material is stored in a separate archive in locked premises that can only be accessed by workers with the right to process personal data.
11. REGISTERED DATA SUBJECT’S RIGHTS
Pro Arte Foundation Finland undertakes to implement, either on its own initiative or at the request of the data subject listed in the register and without undue delay, the data subject’s rights as described below. If a request for information affecting the registered person’s rights is not approved, the data subject will be given a reasoned notification stating why the request has not been approved.
11.1. RIGHT OF INSPECTION
The data subject has the right to know what data concerning them is stored in the personal register or that the register does not contain data concerning them.
The data subject should submit an inspection request in a document containing their handwritten signature or verified by some other corresponding method. The request is to be addressed to the register’s contact information address. Inspection requests are free of charge when made at most once a year (12 months).
11.2. RIGHT TO REQUIRE RECTIFICATION OF DATA
If the data subject notices that there is inaccurate or erroneous personal data in the register, the data subject has the right to require such data to be rectified.
Data rectification requests should be made in writing and include enough individual detail to allow implementation of the request: at a minimum the request should give the data subject’s name, details of the inaccurate or erroneous personal data and the completed or corrected data.
The request should be submitted in a document with a handwritten signature or verified by some other corresponding method. The request is to be addressed to the register’s contact information address.
11.3. RIGHT TO REQUIRE RESTRICTION OF PROCESSING OR ERASURE OF DATA
The data subject’s right to require restriction of processing or erasure of data is not an absolute right and only applies in certain circumstances. The data subject has a right to require restriction of the processing of their personal data, for example, in a situation in which the data subject is waiting for the register keeper’s answer to a request to restrict or delete their data.
The data subject has a right to require the register keeper to erase their personal information, for example, if
1) the personal data are no longer needed for the purpose for which they were collected or for which they were processed or
2) the data subject withdraws their consent on which the processing is based and there is no other legal basis for processing their personal data.
Requests to restrict processing of or to erase data are to be addressed to the register’s contact information address.
11.4. RIGHT TO WITHDRAW CONSENT
When personal data are processed on the basis of the data subject’s consent (for example, for direct marketing), the data subject has the right to withdraw their consent. Withdrawal of consent has to be made as easy as giving consent. Requests to withdraw consent are to be addressed to the register’s contact information address.
11.5. RIGHT TO OBJECT TO PROCESSING OF DATA
The data subject has the right to object to the processing of their personal data if the data subject, for example, considers that the register keeper has processed their personal data illegally or that the register keeper has no right to process some of their personal data.
11.6. RIGHT TO COMPLAIN TO THE DATA PROTECTION OMBUDSMAN
The data subject has the right to complain to the data protection ombudsman if they think the register keeper has not adhered to the relevant data protection regulations.
12. CHANGES TO THE DATA PROTECTION AND PRIVACY STATEMENT
Pro Arte Foundation Finland reserves the right to make changes to this data protection and privacy statement in order to comply with its legal responsibilities. Changes can be necessary, for example, because of a change in the relevant laws or of changes in The Foundation’s operations.