Privacy policy

1. Controller

Arktikum Service co

2. Controller’s representative & contact person

Hannele Koskiniemi, Managing Director
+358 40 721 3926
hannele.koskiniemi@arktikum.fi

Arktikum Museum and Arctic Science Centre
Pohjoisranta 4, FI-96200
Rovaniemi, FINLAND

3. Purpose and lawful basis for personal data processing

Implementation of email communications for Arktikum, Arctic Centre, Regional Museum of Lapland and other organisations operating in the Arktikum.
Joining the register is voluntary, and personal data in the register are maintained based on the consent of the data subject.

Privacy and data processing:
EU General Data Protection Regulation (2016/679)
Data Protection Act (in force as of 1 January 2019)

4. Data content of the register and categories of data subjects and personal data

Email address
First name
Last name
Company

5. Transfers of personal data – recipients

We do not disclose personal data to third parties except as permitted or obligated by legislation valid at the time.

6. Transfer of data to third countries outside the EU or EEA

We do not transfer personal data to third countries outside the EU or EEA.

7. Data retention periods

Data may be deleted at the Customer’s request or after the termination of the customer relationship.

8. Principles of data protection

Employees who process the personal data of customers are bound by a statutory obligation of secrecy. The obligation of non-disclosure and secrecy continues even after the end of the employment relationship. The security of the register and the confidentiality, integrity and availability of personal data are ensured by appropriate technical and organisational safeguards.

9. Rights of data subjects

Requests to exercise your rights as the data subject must be made in writing to the controller’s contact person. Instructions and forms for each type of request
are available on the City of Rovaniemi website at www.rovaniemi.fi/tietopyynnöt.

9.1. Right of access to personal data (Article 15)

Data subjects have the right to access and inspect their personal data in the register. Data subjects also have the right to receive the personal data they have provided to the controller in a structured, commonly used and machine-readable format.

9.2. Right to rectification and erasure (Article 16)

Data subjects have the right to require that the controller rectify, without undue delay, any inaccurate and incorrect personal data of the data subject. Requests for rectification must be made in writing to the controller.

9.3. Right to lodge a complaint with the supervisory authority (Article 77)

If the data subject believes that their personal data is processed in violation of data protection regulations or the controller refuses to exercise a requested right, the customer is given a written response on the grounds for the refusal. The customer has the right to refer the matter to the Data Protection Ombudsman at:

Office of the Data Protection Ombudsman
PO Box 800, FI-00531 Helsinki
FINLAND

Detailed instructions on how to lodge a complaint are found on the website of the Office of the Data Protection Ombudsman at https://tietosuoja.fi/en/home.

9.4. Right to be notified of a data breach (Article 34)

Data subjects have the right to be notified by the controller without undue delay when a personal data breach is likely to pose a high risk to the rights and freedoms of individuals.

9.5. Other rights related to personal data processing (Articles 17– 22)

Right to withdraw consent

Data subjects have the right to withdraw their consent to processing at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Right to be forgotten

In certain exceptional situations, the data subject may have the right to obtain the erasure of their personal data from the City’s register without undue delay, provided that

the personal data are longer necessary in relation to the purposes for which
they were collected or otherwise processed;
the data subject withdraws consent on which the processing is based and there
is no other legal ground for the processing;
the personal data have been unlawfully processed;
the personal data have to be erased for compliance with a legal obligation in
Union or Member State law.

However, this right does not apply when the processing of personal data is based on the law or the exercise of official authority vested in the City.

Right to restriction of processing

In certain situations, the data subject may have the right to request the restriction of processing of their personal data until their data have been appropriately verified and rectified or completed.

Right to data portability

This right does not apply to personal data registers of the City of Rovaniemi as the personal data have been collected for the performance of a task carried out in the public interest or the exercise of official authority vested in the controller.