This post is also available in: Suomi
Privacy Statement – GoTavastia Website
1. Name of the privacy notice: GoTavastia Website
Regional Council of Häme
3. Contact person for matters related to the register and data protection officer:
Hannu Terävä, Regional Council of Häme
Niittykatu 5, FI-13100 Hämeenlinna
tel. +358 50 502 6074
4. Name of the register: GoTavastia Customer Register
5. Data subjects:
Persons who have entered a competition on the website and given consent to save their data; persons who have subscribed to the newsletter; or persons who have given consent in any other context.
6. Legal basis for processing:
The legal basis for processing personal data is consent.
7. Purpose of processing personal data:
Personal data is appropriately retained to enable contacting in the future. Personal data may be used for marketing and communication purposes related to the region’s travel destinations as well as for sharing other potentially interesting news. Data subjects may receive information on matters related to the competition or Kanta-Häme travel marketing.
8. Personal data retention periods:
Name and contact details are all kept and archived digitally.
Data in the register is disclosed to the HAMK Smart Research Unit and the Elinvoimaa Hämeeseen ry association, for travel marketing purposes, where data is kept in accordance with the data protection policies of the respective organisation.
9. Regular sources of data:
Personal data is collected directly from data subjects in connection with entering a competition. Furthermore, personal data may be collected during events or through the website’s online form, for instance, when subscribing to the newsletter, provided that the person in question consents to such storing.
10. Regular disclosures of data:
Personal data is disclosed to third parties. However, the purpose for personal data processing will remain the same.
Personal data is disclosed to the following organisations:
HAMK Smart Research Unit
P.O. Box 230 (Visamäentie 35 A), FI-13101 Hämeenlinna
Telephone: +358 3 6461, e-mail address: firstname.lastname@example.org
Elinvoimaa Hämeeseen ry
11. Transfer of data outside the EU or EEA:
No data is transferred outside the EU or EEA.
12. Principles of register protection:
Data is saved in the information system in an appropriate manner. Users have personal user IDs. Access is granted only to those persons who are entitled to access and use the data in the system in order to perform their duties. With regard to data disclosures, receiving organisations must ensure the same level of data protection.
The lawful processing of personal data is ensured by categorisation of data and with operating methods that are in compliance with the data handling rules concerning data set.
13. Rights of the data subject:
The EU General Data Protection Regulation (2016/679) provides the data subject with the following rights:
Right to withdraw consent
The data subject shall have the right to withdraw his or her consent at any time (Article 7).
Right of access by the data subject
The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed. The data subject shall have the right to access to the personal data concerning him or her. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the data controller may charge a fee or refuse to act on the request. (Article 12 and Article 15).
Right to rectification
The data subject shall have the right to obtain from the data controller the rectification of inaccurate personal data concerning him or her contained in the register (Article 16). A request for rectification shall be submitted in writing.
Right to erasure
The data subject shall have the right to request the erasure of personal data concerning him or her where one of the following grounds applies (Article 17):
- the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
- the data subject withdraws consent on which the processing is based and there is no other legal ground for the processing;
- the data subject objects to the processing, and there are no overriding legitimate grounds for the processing
- the personal data have been unlawfully processed;
- the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
Right to restriction of processing
The data subject shall have the right to obtain restriction of processing where one of the following applies (Article 18):
- the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
- the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
- the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
- the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.
Right to data portability
Where the processing is based on consent and carried out by automated means, the data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a data controller, in a machine-readable format (Article 20).
Requests to exercise these rights are to be submitted in writing to:
Regional Council of Häme