EU General Data Protection Regulation
Art. 12 to 14
Date: 29.11.2023
The organization responsible for the processing of personal data is the University of Helsinki.
Contact information:
University of Helsinki
P.O.Box 3
00014 Helsingin yliopisto
Contact person for the processing described in this notice is: Laura Forsman, viikkifooddesignfactory@helsinki.fi.
2. Contact details for the Data Protection Officer
You can contact the Data Protection Officer by email: tietosuoja@helsinki.fi
3. Who are the parties involved in the processing and what are their responsibilities?
The Food SystemiCity programme is implemented together with Aalto University, VTT, Natural Resources Institute Finland (Luke) and Metropolia University of Applied Sciences for 1.2.2023-31.12.2025. However, each of these organizations is responsible for their own data collection and processing, and no personal data is transferred between them.
4. Why do we process your personal data and what is the lawful basis for processing?
The purpose for the processing of your personal data is to implement the publicly funded Food SystemiCity programme, which includes, e.g., co-creation workshops and mentoring for the participating companies, organizations and individuals, the organization of events and communication through newsletters. The programme is funded by European Regional Development Fund, which also requires documentation of the project activities and participants for reporting purposes.
The legal basis for processing is:
5. What personal data do we process?
We process the following data:
- Name
- Contact details
- Organization / professional affiliation and position / job title
- Gender (voluntary information, for following up the gender mainstreaming goals of the programme)
- Dietary preferences (for catering purposes in case of event registration)
6. Sensitive data
No sensitive data is processed in this project.
7. What are the sources for personal data?
Personal data is collected through event registration, newsletter sign up and/or programme application forms.
8. Do we disclose your personal data to third parties?
We use third party platforms for collecting event registration data (e.g. Lyyti.fi), to facilitate matchmaking in events (e.g. Conversation starter), and to send newsletters (Mailchimp). The data provided to these platforms includes email and name, in case of event registration also affiliation, job title / position, and dietary preferences.
The project funder, EU, represented by Uudenmaanliitto, has the right to inspect the project documentation to verify the accuracy of the project reporting and correct use of funds.
9. For how long do we process and retain your personal data?
Personal data is retained at most up to 10 years, and at the least until end of project reporting duties are completed.
10. Transfers of personal data to countries outside the EU/European Economic Area
Newsletter subscription data (name and email) is collected and processed through the global, US-based Mailchimp platform (part of the Intuit corporation). Information about Mailchimp and permission to process the data is requested on the newsletter subscription form.
Mailchimp annually certify with the EU-U.S. Data Privacy Framework. The EU Commission have stated that the United States ensures an adequate level of protection for personal data transferred to US companies participating in the EU-U.S. Data Privacy Framework.
11. What rights do you have?
The contact details in matters concerning the rights of the participant is the contact point mentioned in section 1 of this notice.
When the processing is based on your consent, you have the right to withdraw your consent any time. The withdrawal of your consent does not affect the lawfulness of processing based on consent before the withdrawal.
You have the right to know whether we process your personal data and what data we process about you. You have also the right to request for the access to that data.
You have the right to request for the rectification of inaccurate personal data concerning you. You also have the right to have incomplete personal data completed.
You have the right to request for the erasure of your data from our systems. The data will be erased in the following cases:
a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed
b) You withdraw your consent on which the processing was based and there is no other legal ground for the processing
c) You object for the processing and there are no overriding legitimate grounds for the processing
d) The personal data have been unlawfully processed
e) The personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject to
You do not have the right to erasure, if the processing is necessary:
a) For compliance with a legal obligation which requires processing by law
b) For the performance of a task carried out in the public interest or in the exercise of official authority
c) For archiving purposes in the public interest, scientific of historical research purposes or statistical purposes if the erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing
d) For the establishment, exercise or defense of legal claims
You have the right to request for the restriction of processing. This means that we store the data but do not process it in any other way.
You have this right when:
a) The accuracy of the personal data is contested by you. Then the processing will be restricted until the accuracy of the data is verified.
b) The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead
c) We no longer need the data for the purposes of the processing, but you need the data for the establishment, exercise or defense of legal claims
d) You have objected to processing that is based on legitimate interest. Then the processing will be restricted for the time it is verified whether the legitimate ground for the controller override those of the data subject.
When the processing is done by automatic means and the processing is based on your consent or a contract between you and the University, you have the right to have your data that you have provided, in a structured, commonly used and machine-readable format and have the right to transmit this data to another controller.
When it is technically feasible, you have the right to have the data transmitted directly to the other controller.
You can always contact us if you have any questions or concerns about the processing of your personal data. However, you have also the right to lodge a complaint with the Data Protection Ombudsman’s Office if you think your personal data has been processed in violation of applicable data protection laws.
Contact details:
Office of the Data Protection Ombudsman
Visiting address: Ratapihantie 9, 6. krs, 00520 Helsinki
Postal address: PL 800, 00521 Helsinki
Switchboard: 029 56 66700
E-mail: tietosuoja@om.fi.