Data protection description – Customer and stakeholder register

This data protection notification contains data for a data subject (natural person) in accordance with Articles 13 and 14 of the European Union's (EU) General Data Protection Regulation (EU) 679/2016. This notification is given to the data subject when collecting personal data.

1. Controller and contact persons

Statistics Finland
Postal address: FI-00022 STATISTICS FINLAND
Street address: Työpajankatu 13, Helsinki
Telephone: +358 29 551 1000 (switchboard)
Contact person: Minna Purja-Roman tel. +358 29 551 3653
Email: asiakashallinta1@stat.fi

2. Person responsible for data protection:

Person responsible for data protection: Elina Tavast
Telephone: +358 29 551 1000 (switchboard)
Email: tietosuoja@stat.fi

3. Purpose and legal basis for the processing of personal data

Purpose of use: management of customer and stakeholder relations (contacts with customers, agreement management, invoicing, event management and communication). Processing of data concerning Statistics Finland’s personnel in the register is based on that the person is a contact person for a customer relation or a member of some stakeholder group.

According to Article 6(1) of the EU’s General Data Protection Regulation, the legal bases for the processing of personal data are:

  • Consent given by data subjects: newsletters, releases, event and marketing communication (point (a))
  • Agreement or subscription to which the data subject is a party (point (b))
  • Compliance with a legal obligation (point (c)), based on: Act on Statistics Finland (48/1992), Sections 3 and 4, Statistics Finland's Rules of Procedure (1 April 2022), Section 7 Shared tasks of service areas, Sub-paragraph 2.
  • Legitimate interest (point (e)) based on, for example, Section 4.1 of the Data Protection Act (1050/2018)

4. Storage period of personal data

The register data are stored according to the archive formation plan.

  • Data related to tenders, agreements, invoicing and user licences, validity period + up to 10 years
  • Customer and stakeholder data, validity period + up to 10 years
  • Data related to event and marketing messages, 2 years
  • Subscriptions to newsletters and releases, validity

5. Personal data to be processed

The register contains personal data related to the management of Statistics Finland's customer and stakeholder relations. For all data subjects, the name or email address is used as the identification data for the persons.

The following data on representatives of customers and stakeholders are stored in the register:

  • Additional information supplementing identification data, such as job title, employer, function classification and telephone number
  • Personal identity code (from 1 May 2020) of private individuals for billing purposes
  • Essential contact history: meetings and contacts (incl. emails)
  • Role and involvement in stakeholder cooperation
  • Order and agreement data of data materials and other services
  • Applied and granted user licences to Statistics Finland's data materials
  • Customer feedback
  • Participation in events, functions and trainings arranged by Statistics Finland.
  • Data on subscriptions to releases and newsletters.

For Statistics Finland's personnel, the following data are stored in the register:

  • Role and involvement in implementing Statistics Finland's stakeholder cooperation and supplying data materials and other services
  • Participation in events, functions and trainings arranged by Statistics Finland.
  • Data on subscriptions to releases and newsletters.

6. Regular data sources

The data stored in the register are received from customers, for example, from messages sent with web forms, by email and by telephone, from agreements, electronic licence service, customer meetings and other situations where customers release their data.

Data on the contact persons of enterprises and other organisations can also be collected from public sources, such as web pages and directory services.

The data on Statistics Finland's personnel have been gathered from Statistics Finland's operative systems.

7. Processors and recipients of personal data

As regards the maintenance and development of the system, Innofactor Software participates as the service provider in the processing of personal data. The Government ICT Centre Valtori is responsible for the functioning of the information technology environment. Information relevant to events may be disclosed to event organisers on a case-by-case basis, and some of the information can be processed in the service provider's systems (e.g. ClickDimensions, Webropol, Lyyti, Mailjet, Handi). In addition, personal data are processed case-specifically in studies on the quality and realisation of the service. In terms of payment and invoicing traffic data, the Finnish Government Shared Services Centre for Finance and HR (Palkeet) takes part in the processing of the data. 

8. Disclosure of data

Data are not normally released to third parties.

9. Data transfer outside the EU or EEA countries

As a rule, personal data are not transferred outside the EU/EEA, but some system technical maintenance activities can be performed outside the area.

10. Automatic decision-making

Personal data are not used for automated decision-making or profiling that would affect the rights or freedoms of data subjects.

11. Principles applied in the protection of the data in the register

Statistics Finland as the controller has implemented the necessary technical and organisational measures and also requires them from processors of personal data.

12. Rights of data subjects

The data subjects have the right to obtain information from the controller on whether their personal data are processed. The data subjects also have the right to request:

  • Personal data concerning them
  • The controller to rectify or delete erroneous or outdated data
  • Restrict the processing of their personal data.

Further information about the rights of data subjects can be found on Statistics Finland’s website https://www.stat.fi/meta/tietosuoja/index_en.html.

13. Right to appeal to the supervisory authority

If you think your personal data are processed unlawfully, you can submit a complaint to the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman
Street address: Lintulahdenkuja 4, FI-00530 Helsinki
Postal address: P.O.Box 800, FI-00530 Helsinki
Email tietosuoja(at)om.fi
Switchboard +358 29 566 6700
Registrar's Office +358 29 566 6768

Further information about submitting a complaint is available on the website of the Office of the Data Protection Ombudsman at www.tietosuoja.fi/en.