Processing of personal data for conducting the Involvement Survey 2025

Information regarding names, addresses and mother tongue is processed for the purposes of mailing the survey form and reminder letter. In addition, a thank-you letter and movie ticket will be sent to those who respond to the survey.

The answers provided on the survey will be used for the development of involvement and influencing opportunities in accordance with Section 22 of the Local Government Act.

We will never use the data for other purposes such as direct marketing or commercial purposes.

The data controller for the involvement survey study is the City of Vantaa, who will be responsible for the processing, analysis and storage of the materials produced by the study. The study’s implementer and the recipient of the materials is Tutkimustie Oy, from whom the City of Vantaa has commissioned the survey. Tutkimustie Oy’s subcontractors Dun & Bradstreet Finland Oy and Postituspalvelu Navakka Ky are responsible for the acquisition and processing of the name and address information for the paper survey forms.

The processing of the personal data necessary for carrying out the involvement survey is based on fulfilling a statutory obligation. Pursuant to the Local Government Act, the city council must ensure diverse inclusion and influencing opportunities and methods for the municipality’s residents and users of services, and the involvement survey is part of this.

Legal basis of processing:

Statutory task. Pursuant to Section 22 of the Local Government Act, all municipality residents and users of services have the right to participate and make an impact on the municipality’s activities. In accordance with the GDPR, Chapter 2, Article 6(1)(c), processing is necessary for fulfilling the statutory obligation of the controller. In addition,

the processing of the personal data collected for participation in the raffle is based on consent.

For the purposes of mailing the survey forms, the first name, last name and address information as well as mother tongue of 2,000 randomly selected adult Vantaa residents will be collected from the Digital and Population Data Services Agency’s database. Dun & Bradstreet Finland Oy is responsible for collecting the data and delivering the data to Postituspalvelu Navakka Ky for the purposes of mailing the survey, reminder letter and thank-you letter.

Other personal data collected in the survey include

- age
- sex
- family type
- country of birth
- mother tongue
- area of residence at the major region level
- how long the respondent has lived in Vantaa
- possessory relation of accommodation
- educational level
- labor-market status
- respondent's experience of the household’s income level and
- respondent's experience of their state of health.

This data is given voluntarily by the participant through their responses to the survey.

Responding to the Involvement Survey 2025 is not mandatory.

We will only disclose your personal data to another party if the data transfer is based on law or if you have given your consent to the disclosure of your data. You can cancel your consent to the disclosure of your data to outside parties at any time. The data will not be disclosed to outside parties for other purposes such as direct marketing or commercial purposes.

In cases where a party processes personal data on behalf of the City of Vantaa, the level of appropriate information security and data protection has been agreed on in the contract made with the processor. The processor of personal data refers to a party that processes personal data on behalf of the City of Vantaa, such as a service provider.

To ensure your privacy, we have protected your personal data with the help of various technological and organizational measures. For example, only the employees that need the data to perform their work are allowed to handle the data and only to the extent required by any individual task. The processors of personal data are under a non-disclosure agreement, which will continue after the end of the employment relationship. In addition, excluding the mailing phase, the personal data is pseudonymized, meaning that the survey forms have been coded using ID numbers and no individual respondent can be linked to the name and address information without decoding. When this coded contact information list is deleted (see section 10), the identification of the respondents is permanently prevented.

The data will be processed in cloud services located in Finland and the EU. Domainkeskus Oy: Web service (OmaTutkimustie web service and Tutkimustie Oy’s email services) hosting and maintenance services. Server location: EU.

Microsoft Office 365: United States of America.

When using Microsoft’s cloud services, data may also be transferred to the United States of America. On July 10, 2023, the European Commission decided on the sufficiency of the protection of personal data (Commission implementing decision (EU) 2023/1795, so-called adequacy decision pursuant to GDPR Article 45). Based on the data protection adequacy decision, data can be transferred from the EU and EEA to US companies participating in the arrangement without a separate basis for transfer pursuant to GDPR Article 46. Microsoft Corporation has been certified under the Data Privacy Framework.

It is possible that, regardless of protection, your personal data may exceptionally end up as a target of a breach of data as well as in the possession of an outside party. In these cases, we will take immediate measures to rectify the situation, and we will inform the data protection ombudsman if the breach of data security causes any risk to you. The notification will be made, at the latest, within 72 hours of noticing the breach of data security. If the breach of data security presents a high risk, we will also inform you about it.

The name and address information as well as mother tongue information collected from the sample of 2,000 people from the Digital and Population Data Services Agency will be deleted from the systems of Dun & Bradstreet after the sampling in January 2026 and from the systems of Navakka Ky within two (2) months of the receipt of the data. The anonymous statistical data derived from the survey’s responses will be stored in the systems of the City of Vantaa permanently.

Your data will not be used for profiling or automatic decision-making.

The data subject refers to the person whose personal data is being processed. If we process your personal data, you have the right to

- check how your data is processed
- demand that inaccurate or faulty data be corrected
- demand that your data be removed
- request that handling of your data be restricted
- object to the handling of your data
- get your data and transfer it to another controller as well as cancel your consent at any time, if processing is based on your consent.

You can submit a personal data inspection request through the e-services, in person at Vantaa-Info, or by mailing the inspection request to the City of Vantaa’s Registry. You can find more detailed instructions on the city’s Data Protection webpage.

If you wish to exercise the data subject's other rights or ask for additional information on the processing of personal data, please contact the person mentioned below in section 15. We will case-specifically verify the preconditions for exercising your rights. Exercising your rights may require verification of your identity.

We will execute information requests without undue delay, but, at the latest, within a month of receiving the request. The deadline can be extended by at most two months, when required, by accounting for the complexity and amount of data of the request. If the deadline is extended, we will inform you about it.

As a general rule, exercising your rights is free of charge. We may, however, charge a reasonable fee, corresponding with the administrative costs, for implementing the request, or decline to perform the measure, if the request is obviously ungrounded, unreasonable, or recurrent. If there is a charge for executing your request, we will contact you. If we decline to perform the measure, we will inform you in writing about the grounds for the refusal as well as about the option to submit the matter to be handled by the data protection ombudsman or to exercise other legal remedies.

If you suspect that your personal data is being illegally processed, you can submit an appeal to the data protection ombudsman. Further information on and instructions for submitting an appeal is provided by the contact person mentioned in section 15, the city's data protection officer, the data protection ombudsman's office website, and phone consultation:

Data protection ombudsman's office / www.tietosuoja.fi
Street address: Lintulahdenkuja 4, 00530 Helsinki
Mailing address: P.O. Box 800, 00531 Helsinki
Email: tietosuoja(at)om.fi
Phone (switchboard): 029 566 6700
Phone (consultation for private persons): 029 566 6777

Additional information on processing personal data is provided by the contact person below. Please note that email is not a safe medium for processing personal data. Be sure not to send, for example, your identity number or any sensitive information by email.

Contact person

Mari Lehtoruusu, Chief Community Involvement Specialist, Urban Culture and Wellbeing Department, shared services
mari.lehtoruusu@vantaa.fi
Tel. +358 40 1626 934

The data controller is the City of Vantaa’s Urban Culture and Wellbeing Committee. You will find the contact information of the data controller and the data protection officer below:

Controller

The City of Vantaa
Urban culture and wellbeing committee
Business ID: 0124610-9
Asematie 7, 01300 Vantaa

Data protection officer tietosuojavastaava@vantaa.fi

Registry

Mailing address: P.O. Box 1100, 01030 Vantaan kaupunki
Street address: Tikkurilan Vantaa-info, Dixi, Ratatie 11, 2nd floor, 01300 Vantaa.
Phone (switchboard): 09 839 11
Fax: 09 8392 4163, email: kirjaamo(at)vantaa.fi