Processing of personal data in Osallistuvavantaa.fi

Personal data is processed for the purpose of organizing a raffle among the survey’s respondents. The survey shall be carried out in such a way that personal data will not be asked for in the same survey as the other response data. The respondents’ registration information and email addresses are required in order for respondents to be invited to a resident pool or other event, or in order to gather feedback from them. If the survey involves a raffle or registration for an event, municipality residents will be directed to respond to a different survey where they can provide their names and contact information.

If a name is requested, the respondent's personal data is required for processing (Registration for an event or occasion, participation in a raffle or forwarding information about feedback given). Personal data is required in order to know the number of participants for an event, participant information for an event, contact information for mailing or information about who has submitted an opinion on a plan. The personal data can be connected to the respondent during registration and when providing feedback. Personal data shall not be connected to responses in raffles.

We will never use the data for other purposes such as direct marketing or commercial purposes.

The processing of the personal data necessary for organizing Osallistuvavantaa.fi surveys and raffles is based on Chapter 2, Article 6(1)(e) of the GDPR, that is, processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

With regard to special personal data, health information (food allergies) may be processed. This is necessary when organizing events with catering.
The provision of special diet information is voluntary.
Mother tongue, which may reveal race or ethnicity, is processed in order to enable possible interpretation services.

Special personal data is processed on the basis of Chapter 2, Article 9(2)(a) of the GDPR, that is, the data subject has given explicit consent to the processing of this personal data.

The data is received from the survey respondents themselves, and the provision of personal data is voluntary.

First name (individualization of event participants and recording participation information)
Last name (individualization of event participants and recording participation information)
Email address (for contacting or sending invitations to resident pools or other events as well as sending a possible feedback survey or notice of winning a raffle)
Age (possible gathering of statistics) 
Mother tongue (possible gathering of statistics)
Gender (possible gathering of statistics)
Possible special diet (event catering)
Location data from a mobile phone? (respondent if responding to a map survey and consenting to being located)

In addition to the personal data itself, respondents’ background data is also sometimes collected, e.g. area of residence, family type, family background, marital status, labor market status, school grade level or educational level. However, these are requested on such an approximate level that they do not qualify as personal data. In some exceptional cases, this information may lead to a situation where a person can be identified by combining the responses.

It is necessary to provide personal data if the respondent wishes to take part in a raffle or register for an event – it must be possible to notify the participant of their participation and/or winning the raffle. Personal data is also significant when the respondent is providing feedback on a plan. 

We will only disclose your personal data to another party if the data transfer is based on law or if you have given your consent to the disclosure of your data. You can cancel your consent to the disclosure of your data to outside parties at any time. The data will not be disclosed to outside parties for other purposes such as direct marketing or commercial purposes.

To ensure your privacy, we have protected your personal data with the help of various technological and organizational measures. For example, only the employees that need the data to perform their work are allowed to handle the data and only to the extent required by any individual task. In the customer-information system, this is monitored with the help of logfiles, among other things. Paper documents are stored in the city’s various archives, on safe premises that are inaccessible to outside parties.

The employees are bound by confidentiality and professional secrecy, which continues also after termination of employment. 

In cases where a party processes personal data on behalf of the City of Vantaa, the level of appropriate information security and data protection has been agreed on in the contract made with the processor. The processor of personal data refers to a party that processes personal data on behalf of the City of Vantaa, for example, a service provider.

As a general rule, data is processed only within the EU or EEA, but the processor may also transfer data outside the EU or EEA countries. Nevertheless, the transfer is only allowed when it meets the demands of the data protection legislation and contract that ensure a sufficient level of protection of personal data.

Personal data is transferred to the United States (the data is processed to the extent necessary in Microsoft Office’s cloud service). The transfer is based on the EU Commission's decision, ratified on July 10, 2023, on the sufficient level of the U.S. data protection. The U.S. companies to which data is transferred are certified and committed to the data protection measures agreed between the EU and the U.S.

It is possible that, regardless of protection, your personal data may exceptionally end up as a target of a breach of data as well as in the possession of an outside party. In these cases, we will take immediate measures to rectify the situation, and we will inform the data protection ombudsman if the breach of data security causes any risk to you. The notification will be made, at the latest, within 72 hours of noticing the breach of data security. If the breach of data security presents a high risk, we will also inform you about it.

Data will be stored and deleted in accordance with the City of Vantaa’s information management plan. The duration of storing documents specified in the information management plan is based on legislation, the National Archives of Finland's regulations for permanently stored documents, as well as the Association of Finnish Local and Regional Authorities’ recommendations for temporarily stored documents. After the end of the data storage period, the data will be deleted.

The data contained in Osallistuvavantaa.fi is backed up every day in a professional-level backup system. The backups are stored for 30 days.

In addition, some personal data is stored in the City of Vantaa’s OneDrive, from which the data is immediately deleted when no longer required for the organization of the activities.

Your data will not be used for profiling or automatic decision-making.

The data subject refers to the person whose personal data is being processed. If we process your personal data, you have the right to 
-    check how your data is processed
-    demand that inaccurate or faulty data be corrected
-    demand that your data be removed
-    request that handling of your data be restricted
-    object to the handling of your data
-    get your data and transfer it to another controller as well as cancel your consent at any time, to the extent that processing is based on your consent.

You can submit a personal data inspection request through the e-services, in person at Vantaa-Info, or by mailing the inspection request to the City of Vantaa’s Registry. You can find more detailed instructions on the city’s Data Protection webpage.

If you wish to exercise the data subject's other rights or ask for additional information on the processing of personal data, please contact the person mentioned below in section 14. We will case-specifically verify the preconditions for exercising your rights. Exercising your rights may require verification of your identity.

We will execute information requests without undue delay, but, at the latest, within a month of receiving the request. The deadline can be extended by at most two months, when required, by accounting for the complexity and amount of data of the request. If the deadline is extended, we will inform you about it.

As a general rule, exercising your rights is free of charge. We may, however, charge a reasonable fee, corresponding with the administrative costs, for implementing the request, or decline to perform the measure, if the request is obviously ungrounded, unreasonable, or recurrent. If there is a charge for executing your request, we will contact you. If we decline to perform the measure, we will inform you in writing about the grounds for the refusal as well as about the option to submit the matter to be handled by the data protection ombudsman or to exercise other legal remedies.

If you suspect that your personal data is being illegally processed, you can submit an appeal to the data protection ombudsman. Further information on and instructions for submitting an appeal is provided by the contact person mentioned in section 14, the city's data protection officer, the data protection ombudsman's office website, and phone consultation:

Data protection ombudsman's office / www.tietosuoja.fi
Street address: Lintulahdenkuja 4, 00530 Helsinki
Mailing address: P.O. Box 800, 00531 Helsinki
Email: tietosuoja(at)om.fi 
Phone (switchboard): 029 566 6700
Phone (consultation for private persons): 029 566 6777
 

Additional information on processing personal data is provided by the contact person below. Please note that email is not a safe medium for processing personal data. Be sure not to send, for example, your identity number or any sensitive information by email.

Contact person
Urban Culture and Wellbeing data protection officer
kaku.tietosuoja@vantaa.fi

The data controller is the City of Vantaa’s Urban Culture and Wellbeing Committee. You will find the contact information of the data controller and the data protection officer below:

Controller                    
The City of Vantaa                     
Urban Culture and Wellbeing Committee                
Business ID: 0124610-9
Asematie 7, 01300 Vantaa            

Data protection officer
tietosuojavastaava@vantaa.fi

Registry    
Mailing address: P.O. Box 1100, 01030 Vantaan kaupunki
Street address: Tikkurila Vantaa-info, Dixi, Ratatie 11, 2nd floor, 01300 Vantaa.
Phone (switchboard): 09 839 11
Fax: 09 8392 4163, email: kirjaamo@vantaa.fi