Data Protection and Privacy Statement

The statement for our partners and journalists can be found here

DATA PROTECTION AND PRIVACY STATEMENT FOR PRO ARTE
FOUNDATION FINLAND’S WEBSITE

This data protection and privacy statement is intended for users of Pro Arte Foundation Finland [“The Foundation”] website and newsletter recipients. This data protection and privacy statement describes how The Foundation collects and processes personal data as part of its work, what personal data are collected, for what purposes personal data are used and how those personal data are protected. The statement also describes the data subjects’ rights
and how a data subject can use their rights.

The Foundation is responsible for ensuring that personal data are processed in compliance with this data protection and privacy statement and the relevant data protection legislation.

1. REGISTER KEEPER

Pro Arte Foundation Finland [“The Foundation”]
Business Identity Code 21485721

2. CONTAC T INFORMATION IN MATTERS RELATED TO THE REGISTER

Pro Arte Foundation Finland
e-mail: info@ihmehelsinki.fi
address: Kalevankatu 4, 2nd floor 00100 Helsinki

3. NAME OF REGISTER

Pro Arte Foundation Finland’s newsletter subscriber register contains the following register:
a. Pro Arte Foundation Finland’s e-mail list for newsletters

4. DATA CONTENT OF REGISTER

a. We do not store personal data that comes through feedback forms in the contact information register, we store only the given feedback to develop our operations.

b. The following information about newsletter subscribers can be stored in the register:

Subscriber’s contact details (first name, surname, address, e-mail address and phone
number)
Subscriber’s title
Subscriber’s organization

5. PURPOSE OF PROCESSING AND LEGAL BASIS FOR PROCESSING PERSONAL DATA

a. Personal data are stored to develop The Foundation’s operations and communications. The legal basis for the processing is the registered person’s consent.

b. Personal data are stored in order to send out newsletters to subscribers. The legal basis for the processing is the registered person’s request to be put on the newsletter list. The legal basis for the processing is the registered person’s consent and/or legitimate interest.

6. PERSONAL DATA RETENTION PERIOD

As a rule The Foundation processes personal data only for as long as there is a basis for processing it.

a. Personal data received through the feedback form is not stored.

b. Personal data of people on the newsletter subscription distribution list are stored for as long as the newsletter subscriber wants to remain on the newsletter list. Newsletter subscribers can at any time cancel their subscription through a link in the newsletter.

7. THE REGISTER’S REGULAR SOURCES OF DATA

a. Personal data are acquired from the data subject themself when they complete the newsletter subscription form.

8. REGULAR DISCLOSURE OF INFORMATION

As a rule personal data will not be disclosed to third parties.

9. DISCLOSURE OF INFORMATION OUTSIDE OF THE EU OR ETA

Personal data will not be transmitted or disclosed outside the EU or ETA. The personal data processor Gruppo Software may be located outside of the EU.

10. REGISTER’S PROTECTION PRINCIPLES

The Foundation protects the personal data contained in the register using appropriate technical and organizational measures, which are used to ensure that the processing of personal data complies with the data protection regulations. Unauthorized bodies do not have access to register data. Only the register keeper and people individually designated by the register keeper can gain access to the personal data contained in the register.

Only individually designated individuals have the right to process and maintain the personal data contained in the register. Everyone who is given the right to access the data also undertakes to comply with the duty of confidentiality.

The information systems and computer equipment maintained using information technology in which the register is located are protected by the customary technical safeguards, such as firewalls and user-specific passwords. The computer equipment is kept in locked premises. Manual material is stored in a separate archive in locked premises that can only be accessed by workers with the right to process personal data.

11. REGISTERED DATA SUBJECT’S RIGHTS

Pro Arte Foundation Finland undertakes to implement, either on its own initiative or at the request of the data subject listed in the register and without undue delay, the data subject’s rights as described below. If a request for information affecting the registered person’s rights is not approved, the data subject will be given a reasoned notification stating why the request has not been approved.

11.1. RIGHT OF INSPECTION

The data subject has the right to know what data concerning them is stored in the personal register or that the register does not contain data concerning them.
The data subject should submit an inspection request in a document containing their handwritten signature or verified by some other corresponding method. The request is to be addressed to the register’s contact information address. Inspection requests are free of charge when made at most once a year (12 months).

11.2. RIGHT TO REQUIRE RECTIFICATION OF DATA

If the data subject notices that there is inaccurate or erroneous personal data in the register, the data subject has the right to require such data to be rectified.
Data rectification requests should be made in writing and include enough individual detail to allow implementation of the request: at a minimum the request should give the data subject’s name, details of the inaccurate or erroneous personal data and the completed or corrected data.

The request should be submitted in a document with a handwritten signature or verified by some other corresponding method. The request is to be addressed to the register’s contact information address.

11.3. RIGHT TO REQUIRE RESTRICTION OF PROCESSING OR ERASURE OF DATA

The data subject’s right to require restriction of processing or erasure of data is not an absolute right and only applies in certain circumstances. The data subject has a right to require restriction of the processing of their personal data, for example, in a situation in which the data subject is waiting for the register keeper’s answer to a request to restrict or delete their data.

The data subject has a right to require the register keeper to erase their personal information, for example, if
1) the personal data are no longer needed for the purpose for which they were collected or for which they were processed or
2) the data subject withdraws their consent on which the processing is based and there is no other legal basis for processing their personal data.

Requests to restrict processing of or to erase data are to be addressed to the register’s contact information address.

11.4. RIGHT TO WITHDRAW CONSENT

When personal data are processed on the basis of the data subject’s consent (for example, for direct marketing), the data subject has the right to withdraw their consent. Withdrawal of consent has to be made as easy as giving consent. Requests to withdraw consent are to be addressed to the register’s contact information address.

11.5. RIGHT TO OBJECT TO PROCESSING OF DATA

The data subject has the right to object to the processing of their personal data if the data subject, for example, considers that the register keeper has processed their personal data illegally or that the register keeper has no right to process some of their personal data.

11.6. RIGHT TO COMPLAIN TO THE DATA PROTECTION OMBUDSMAN

The data subject has the right to complain to the data protection ombudsman if they think the register keeper has not adhered to the relevant data protection regulations.

12. CHANGES TO THE DATA PROTECTION AND PRIVACY STATEMENT

Pro Arte Foundation Finland reserves the right to make changes to this data protection and privacy statement in order to comply with its legal responsibilities. Changes can be necessary, for example, because of a change in the relevant laws or of changes in The Foundation’s operations.

DATA PROTECTION AND PRIVACY STATEMENT FOR PRO ARTE FOUNDATION FINLAND’S PARTNERS IN COLLABORATION AND JOURNALISTS

1. REGISTER KEEPER

Pro Arte Foundation Finland [“The Foundation”]
Business Identity Code: 21485721

2. CONTACT INFORMATION IN MATTERS RELATED TO THE REGISTER

Pro Arte Foundation Finland
info@ihmehelsinki.fi
address: Kalevankatu 4, 2nd floor 00100 Helsinki

3. NAME OF REGISTER

Pro Arte Foundation Finland’s register of partners in collaboration and journalists

4. DATA CONTENT OF REGISTER

Pro Arte Foundation Finland’s (IHME) register of partners in collaboration and journalists can be used to store information on partners in collaboration or journalists including the following:
a. data on partner in collaboration or journalist (Business Identity Code, address, e-mail address, phone number)
b. details of contact person for partner in collaboration or journalist (name, address, phone number, e-mail address, registered position at organization)
c. billing information for partner in collaboration or journalist
d. details of services ordered

5. PURPOSE OF AND LEGAL BASIS FOR PROCESSING PERSONAL DATA

Personal data are stored to maintain the relationship between The Foundation and its partners in collaboration and journalists, and to perform tasks and duties related to orders and events. Personal data are also processed as part of the planning and development of The Foundation’s own operations. Personal data are further stored to fulfil the register keeper’s statutory responsibilities.

The legal basis for the processing is the collaborative (agreement) or media relationship between The Foundation and its partner in collaboration or journalist, or the register keeper’s legitimate interest in that relationship. Personal data can also be processed in order to fulfil the register keeper’s statutory duties.

6. PERSONAL DATA RETENTION PERIOD

Personal data of partners in collaboration and journalists are as a rule stored for as long as the collaborative or media relationship is in effect. Once the collaborative relationship has ended personal data can be stored for as long as the parties to the agreement have the possibility of making legal claims on each other or for as long as the register keeper’s statutory duty requires it. Journalists can at any time unsubscribe from the mailing list intended for journalists.

7. THE REGISTER’S REGULAR SOURCES OF DATA

Personal data are acquired directly from the registered individual or organization (data subject) when they make the collaboration agreement or when the journalist personally subscribes to the list for the purpose of their work or when The Foundation (IHME) adds them to the list, or later on when the collaborative or provider relationship is an ongoing one. Personal data can also be collected and updated from publicly available sources of information, such as the Finnish Trade Register or company websites.

8. REGULAR DISCLOSURE OF INFORMATION

Personal data will not be disclosed as a rule to anyone outside The Foundation or its partners in collaboration or other service providers acting on its behalf. The Foundation only uses high-quality third-party service providers to assist it in its processing of personal data, and with whom it has made a GDPR-compliant agreement on the processing of personal data.

9. DISCLOSURE OF INFORMATION OUTSIDE OF THE EU OR ETA

Personal data will not be not transmitted or disclosed outside the EU or ETA. Gruppo Software may process personal data outside of the EU. Gruppo Software undertakes to use methods that comply with the EU’s General Data Protection Regulation (GDPR).

10. REGISTER’S PROTECTION PRINCIPLES

The Foundation protects the personal data contained in the register with appropriate technical and organizational measures which are used to ensure that the processing of personal data complies with the data protection regulations. Unauthorized bodies do not have access to register data. Only the register keeper and people individually designated by the register keeper can gain access to the personal data contained in the register.

Only individually designated individuals have the right to process and maintain the personal data contained in the register. Everyone who is given the right to access the data also undertakes to comply with the duty of confidentiality.

The information systems and computer equipment maintained using information technology in which the register is located are protected by the customary technical safeguards, such as firewalls and user specific passwords. The computer equipment is kept in locked premises. Manual material is stored in a separate archive in locked premises that can only be accessed by workers with the right to process personal data.

11. REGISTERED DATA SUBJECT’S RIGHTS

Pro Arte Foundation Finland undertakes to implement, either on its own initiative or at the request of the data subject listed in the register and without undue delay, the data subject’s rights as described below. If a request for information affecting the registered person’s rights is not approved, the data subject will be given a reasoned notification stating why the request has not been approved.

11.1. RIGHT OF INSPECTION

The data subject has the right to know what data concerning them is stored in the personal register or that the register does not contain data concerning them.
The data subject should submit an inspection request in a document containing their handwritten signature or verified by some other corresponding method. The request is to be addressed to the register’s contact information address. Inspection requests are free of charge when made at most once a year (12 months).

11.2. RIGHT TO REQUIRE RECTIFICATION OF DATA

If the data subject notices that there is inaccurate or erroneous personal data in the register, the data subject has the right to require such data to be rectified.
Data rectification requests should be made in writing and include enough individual detail to allow implementation of the request: at a minimum the request should give the data subject’s name, details of the inaccurate or erroneous personal data and the completed or corrected data. The request should be submitted in a document with a handwritten signature or verified by some other corresponding method. The request is to be addressed to the register’s contact information address.

11.3. RIGHT TO REQUIRE RESTRICTION OF PROCESSING OR ERASURE OF DATA

The data subject’s right to require restriction of processing or erasure of data only applies in certain circumstances. The data subject has a right to require restriction of the processing of their personal data, for example, in a situation in which the data subject is waiting for the register keeper’s answer to a request to restrict or delete their data. The data subject has a right to require the register keeper to erase their personal information, for example, if
1) the personal data are no longer needed for the purpose for which they were collected or for which they were processed or
2) the data subject withdraws their consent on which the processing is based and there is no other legal basis for processing their personal data.

Requests to restrict processing of or to erase data are to be addressed to the register’s contact person.

11.4. RIGHT TO WITHDRAW CONSENT

When personal data are processed on the basis of the data subject’s consent (for example, for direct marketing), the data subject has the right to withdraw their consent. Withdrawal of consent has to be made as easy as giving consent. Requests to withdraw consent are to be addressed to the register’s contact person.

11.5. RIGHT TO OBJECT TO PROCESSING OF DATA

The data subject has the right to object to the processing of their personal data if the data subject, for example, considers that the register keeper has processed their personal data illegally or that the register keeper has no right to process some of their personal data.

11.6. RIGHT TO COMPLAIN TO THE DATA PROTECTION OMBUDSMAN

The data subject has the right to complain to the Data Protection Ombudsman if they think the register keeper has not adhered to the relevant data protection regulations.

12. CHANGES TO THE DATA PROTECTION AND PRIVACY STATEMENT

Pro Arte Foundation Finland reserves the right to make changes to this data protection and privacy statement in order to comply with its legal responsibilities. Changes can be necessary, for example, because of a change in the relevant laws or of changes in The Foundation’s operations.