Privacy notice: Processing personal data when organising events - Häme University of applied sciences
Privacy notice: Processing personal data when organising events
Opiskelijoita kierreportaissa
students on the stairs

Privacy notice: Processing personal data when organising events

Processing personal data when organising events

12.03.2020

Privacy notice: Processing personal data when organising events: joint informative document for data subjects (Articles 13 and 14 of the General Data Protection Regulation [2016/679]).

Purposes of processing personal data

Personal data is used for event management and event communication.

Personal data can also be used for collecting event feedback.

Photos can be taken in designated and marked locations (for example photo wall or other specific place). If people come to these locations, it is interpreted that they have given their consent for photos to be taken and published. The photos may be used for event marketing, reporting and publications. The photos may also be used for communicating and marketing similar events.

If the event has live streaming and/or is recorded, this will be stated on registration form, event website, confirmation e-mail and at the event. The audience will not be recorded. However, if it is possible that part of the audience will be streamed or recorded, this will be informed at the beginning of the event. In this case, it will be informed which area may be streamed or recorded. It will be stated on the registration form, event website and confirmation e-mail where the recording and live streaming will be published and how long it can be accessed.

If there are refreshments at the event, the participants will be asked about special diets so this alternative can made be available at the event. Information gathered on other special needs is used only for organising the event. Extra caution is taken when handling this data.

Personal data can be collected by using registration form, questionnaires and interviews.

Legal basis for processing

Consent is the legal basis for processing personal data. Project events: Public interest is the legal basis.

Personal data content and retention periods of the register

The personal data retention period is based on the type of the event. The retention period for project events depends on the funder’s requirements (maximum period is 15 years). This table is an example of the personal data categories collected during events. All of this data is not collected during all of the events. Only necessary data is collected.

Data category name Retention period
Name 1 year (except projects: 15 years)
Employer 1 year (except projects: 15 years)
Contact details 1 year (except projects: 15 years)
Participation details 1 year (except projects: 15 years)
Live streaming and recordings (video, voice) 6 months
Photos taken at the event Can be shared to social media services of the event. Retention: 15 years.
Special diet (at some events) 1 week
Personal special needs 1 week
Consent to share contact details with other participants or sponsors. 1 year (except projects: 15 years)
Feedback collected concerning the event 1 year (except projects: 15 years)
Information needed to arrange the event and event services 1 year (except projects: 15 years)

Data subjects

The register contains personal data related to people registered and/or attending the event.

Regular sources of data

Personal data is collected directly from data subjects.

Regular disclosures of data

The number of special diets will be submitted in advance to the restaurants.

Attendance information can be shared and transferred only if there is consent.

Principles of data protection of the register

A Manual material

Paper printouts are stored in a locked space and destroyed properly.

B Data processed through automated data processing

Data is stored in an information system. Users have personal user IDs. Access is granted only to those persons working for the data controller who are entitled to access and use the data in the system in order to perform their duties.

Automated decision-making

No automated decision-making is performed on the recorded data.

Transfer of data outside the EU or EEA

Data is not transferred outside the EU or EEA.

It is possible to access live streaming and recordings outside the EU/ETA area.

Rights of the data subject

The EU General Data Protection Regulation (2016/679) provides the data subject with the following rights:

Right to withdraw consent

The data subject shall have the right to withdraw his or her consent at any time. (Article 7)

Right of access by the data subject

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed. The data subject shall have the right to access to the personal data concerning him or her. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the data controller may charge a fee or refuse to act on the request. (Article 12 and Article 15)

Right to rectification

The data subject shall have the right to obtain from the data controller the rectification of inaccurate personal data concerning him or her contained in the register (Article 16). A request for rectification shall be submitted in writing. Persons in an employment relationship (with HAMK or HAMI) are able to do rectification suggestions concerning their recorded working hours, which are then approved by their supervisor or salary administration personnel.

Right to erasure

The data subject shall have the right to request the erasure of personal data concerning him or her where one of the following grounds applies (Article 17):

  • the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
  • the data subject withdraws consent on which the processing is based and there is no other legal ground for the processing;
  • the data subject objects to the processing, and there are no overriding legitimate grounds for the processing (Article 21);
  • the personal data have been unlawfully processed;
  • the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.

Right to restriction of processing

The data subject shall have the right to obtain restriction of processing where one of the following applies (Article 18):

  • the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
  • the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
  • the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
  • the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.

Right to data portability

Where the processing is based on consent and carried out by automated means, the data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a data controller, in a machine-readable format. (Article 20)

Requests to exercise these rights are to be submitted:

Häme University of Applied Sciences Ltd
Data protection officer
P.O. Box 230 (Visamäentie 35A)
FI-13101 Hämeenlinna, Finland

email: tietosuojavastaava@hamk.fi . You can also send the message via secured e-mail https://www.securedmail.eu/ .

Right to lodge a complaint

The data subject shall have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Contact person for matters related to the register

Birgitta Pirhonen, +358 40 821 5477

Data controller

Häme University of Applied Sciences Ltd, Häme Vocational Institute Ltd and HAMK Academy Ltd
P.O. Box 230 (Visamäentie 35A), FI-13101 Hämeenlinna
13101 Hämeenlinna

Telephone: +358 3 6461, e-mail address: hamk@hamk.fi

Data protection officer

Kari Kataja
dpo@hamk.fi

Häme University of Applied Sciences Ltd
data protection officer
P.O. Box 230
FI-13101 Hämeenlinna

HÄME UNIVERSITY OF APPLIED SCIENCES