1. Data Controller
Business Finland Oy/Visit Finland (Business ID: 2725690-3)
Visiting address: Porkkalankatu 1, 00180 Helsinki, Finland
Switchboard: +358 (0)29 50 55000
2. Point of contact
Please e-mail: dataprotection@businessfinland.fi
3. Name of register
Visitfinland.com visitors
Note: The privacy statement for Business Finland Oy/Visit Finland’s organizational clients, professionals and stakeholders is available behind separate link. See Business Finland's general client, stakeholder and marketing register.
4. Purpose of personal data processing and basis for processing
Processing tasks may be outsourced to third party service providers in accordance with the data protection legislation and the boundaries imposed by same.
4.1. Category of data subjects: Consumers visiting visitfinland.com
Data utilized for:
-
Arranging competitions, sweepstakes, polls, or other similar activities that require communication with the participants
-
For publishing and distributing information on Finnish travel opportunities and Visit Finland’s services
Basis for processing:
- Contract
- Data controller’s legitimate interest
- Consent in case of location data
4.2. Category of data subjects: Journalists, social media influencers and freelancers such as journalists, photographers, content creators (media representatives)
Data utilized for:
- Media representatives may leave their contact details and areas of interest to the data controller by filling in the media request form, enabling the data controller to identify potential media representatives interested in participating to media visits organized by Visit Finland/Business Finland Oy.
Basis for processing:
-
Public interest, contract, data controller’s legitimate interest
Processing tasks may be outsourced to third party service providers in accordance with the data protection legislation and the boundaries imposed by same.
5. Data content of register
For example, the following type of information regarding the data subject may be stored:
Name of person
Email address
Address
Telephone number
Country of residence
Age
Regarding media representatives we also collect:
Title
Requestor type
Country of residence
Details regarding the represented media outlet
Knowledge of English language
Prerequisites for travelling such as information on driver’s license and travel insurance
Experience about Finland
Detailed questions related to travel arrangements and travel preferences
Visibility the media representative is able to offer about Finland
In addition, we log use of the website visitfinland.com and thus collect technical information on the visitor’s use of the site, such as the time of the use and IP Address.
6. Cookies
To make this website work properly and to provide a good user experience, we sometimes place cookies on your device. A cookie is a small text file that a website saves on your computer or mobile device when you visit the site. We use cookies to collect information about users so that we can tailor your user experience, provide the best possible functionality, and develop our services. We can use both first-party and third-party cookies. You can control your cookie preferences at any time. Read more about how we use cookies here.
7. Personal data retention period
Information shall be erased periodically, at least every 3 years, provided that there is no longer any need to process the event information.
The erasing shall take place by means of deleting the information in its entirety, by rendering the data passive so that the data are no longer processed and access to the data is restricted, by means of encrypting or overwriting.
8. Regular sources of information
From the persons themselves or based on the use of the website www.visitfinland.com.
9. Regular disclosures of information and recipient categories
Information may be disclosed within the framework of the Act on Innovaatiorahoituskeskus Business Finland and Business Finland Oy (1146/2017) to Innovaatiorahoituskeskus Business Finland.
Data may be disclosed to Business Finland’s co-operation partners for non-commercial purposes, for the purpose of arranging visits and events and for sending out various event/visit invitations.
If you have contacted us in order to show your interest to participate in media visits, we may provide your contact details for example to regional destination management organisations and tourism industry enterprises involved in the media visit preparations.
10. Transfer of data outside of the EU or EEA
Personal data may be transferred outside of the European Union or the European Economic Area in accordance with the data protection legislation and within the boundaries imposed by same. If no decision regarding an adequate level of data protection has been issued in relation to the target country, the transfer shall occur by means of employing the standard clauses approved by the European Commission.
The data controller may transfer personal data outside of the EU and the European Economic Area in accordance with the data protection legislation and within the boundaries imposed by same to the employees working in the data controller’s own oversees network, to the data controller’s subsidiaries and subcontractors and to its service providers retained for data processing.
11. Principles for protecting the register
Manual material
Any material to be retained on paper is stored in locked facilities equipped with access control. The data controller’s personnel have undertaken confidentiality obligations.
Data to be processed electronically
Personnel access to the electronic data content of the register has been protected with personal user IDs and passwords. Utilization of some of the data content of the register has been restricted to a limited group of users. The environment has been protected with appropriate firewalls and other technical safeguards.
The purpose of the above-mentioned measures is to secure the confidentiality, availability and integrity of the personal data to be stored in the register, as well as the implementation of data subjects’ rights.
12. Automated decision-making
The information in the register shall not be utilized for decision-making entailing legal effects for the person and that is based on automated data processing, such as profiling.
13. Data subject’s right to object to the processing of personal data
The data subject shall have the right, in connection with their personal specific circumstances, to object to profiling pertaining to themselves and to other processing measures directed by the data controller at the data subject’s personal data to the extent the data processing is based upon the data processor’s legitimate interests.
The data subject may present their claim regarding the objection in accordance with section 16 of this privacy policy. In conjunction with the claim, the data subject must specify the specific circumstances based on which they are objecting to the processing. The data controller may refuse to carry out the request pertaining to the objection on the grounds stipulated for under the legislation.
14. Data subject’s right to object to direct marketing
The data subject may issue the Data Controller consents or prohibitions pertaining to direct marketing on a channel-specific basis, including profiling taking place for direct marketing purposes.
15. Other data subject’s rights pertaining to the processing of personal data
Data subject’s right to obtain access to the information (Right of Access)
The data subject shall have the right to inspect which data concerning them has been stored in the register. The inspection request must be submitted in accordance with the instructions set forth in this privacy policy. The right of access may be denied upon grounds stipulated in the law. As a point of departure, exercising one’s right of access in an ordinary manner is free of charge.
Data subject’s right to require the rectification or erasure of data or restriction of processing
To the extent the data subject is able to act for themselves, the data subject shall, without any undue delay, after becoming aware of the error, or, having detected the error themselves, rectify, erase or supplement any piece of information found in the register being contrary to the purpose of the register, erroneous, unnecessary, deficient or outdated.
To the extent, the data subject is not able to rectify the information themselves, the correction request shall be submitted in accordance with section 16 of this privacy policy.
The data subject shall also have the right to require the data controller to restrict the processing of their personal data, for instance in circumstances where the data subject is awaiting the data controller’s response to their request regarding the correction or erasure of their personal data.
Data subject’s right to lodge a complaint with the supervisory authority.
The data subject shall have the right to lodge a complaint with the competent supervisory authority, if the data controller has not complied with the applicable data protection regulation in its operations.
16. Contacts
In all questions concerning the processing of personal data and situations related to the exercise of the data subject’s rights, the data subject should contact the data controller. The data subject may exercise their rights by contacting dataprotection@businessfinland.fi.
17. Versions
This privacy policy was updated on October 14, 2022.
The data controller follows the developments in legislation and will develop its operations constantly, and consequently, retains the right to update this privacy policy.