Customer and stakeholder data processed in the external relations management of Uniarts Helsinki

Published 31.1.2020 | Updated 3.8.2026

1. Controller

University of the Arts Helsinki (Uniarts Helsinki)
Postal address: P.O. Box 1, 00097 Uniarts
Phone number: +358 294 47 2000 (switchboard)

2. Unit and person in charge of processing personal data

Director of Communications and External Relations Eveliina Olsson, firstname.lastname@uniarts.fi, +358 50 598 6492

3. Contact person for the processing of personal data

Senior Advisor Marja-Leena Pétas-Arjava, firstname.lastname@uniarts.fi, +358 50 526 1958

4. Data protection officer

Find contact details for Uniarts Helsinki’s data protection officer on the data protection homepage.

5. Name of the register and brief description

Customer and stakeholder register

This privacy notice describes our data protection policy concerning personal data that is collected and processed in connection with Uniarts Helsinki’s customer and stakeholder activities.

6. Purpose and legal basis for the processing of personal data

According to the Universities Act, the mission of Uniarts Helsinki is to promote independent academic research as well as academic and artistic education, to provide research-based higher education and to educate students to serve their country and humanity at large.
In carrying out its mission, Uniarts Helsinki must, in accordance with the Universities Act, promote lifelong learning, interact with the surrounding society and promote the impact of research findings and artistic activities on society.

The purpose of processing personal data is managing Uniarts Helsinki’s customer and stakeholder relations to promote interaction in society, increase the impact of university activities and to ensure and improve the quality of the university’s fee-based services.

Personal data is processed for carrying out communication relating to Uniarts Helsinki’s activities, providing information on the university’s artistic activities, sending invitations to the university’s events, managing registrations, managing invoices, inspections required by sanctions regulation, collecting feedback, carrying out and reporting fundraising activities (incl. scouting potential donors), managing customer and stakeholder relations and for carrying out other communication and marketing activities of the university.

The stakeholder and customer groups of Uniarts Helsinki include various operators in the field of arts, Uniarts Helsinki’s alumni, donors, event attendees, customers of adult education, corporate customers of the Events Service and various other national and international partners.

Uniarts Helsinki’s right to process personal data is based on:

• Agreements.
• Consent.
• The legitimate interest of the university, in so far as the matter concerns newsletters and other communication material that the person has personally subscribed to.

Consent: We ask for your consent to receive marketing messages when you register for, e.g. studies or some other event. You can cancel your consent at any time without stating the reason. The instructions on how to cancel one’s consent are provided in each marketing message.

Agreement: The lawful basis for processing your personal data is an agreement (and an agreement-based customer relationship) when you have, for example, registered for an event organised by the university or when you have acquired educational services from the university.

Data controller’s legitimate interest: You may receive marketing messages and other information about the university’s activities and events based on your earlier customer status. We may also send you other news about the university’s activities and information that may interest you. In this case, the lawful basis for processing your personal data is the university’s legitimate interest. You can choose to no longer receive the newsletters at any time by following the instructions on how to unsubscribe provided in each newsletter.

Joining the alumni network is voluntary and the related personal data is collected for managing alumni memberships, relations, activities and communication and for marketing the alumni activities and services of Uniarts Helsinki. The data may also be used to produce statistical information for the use of Uniarts Helsinki.

The required data on donors is collected in connection with their donations. The personal data is used in communication to donors, including in sending donor newsletters and invitations to stakeholder events. Donor information may also be published and remain available permanently (e.g. the name of the donor may be published on the university’s website), if the donor in question has given their consent for the publishing of the information when making a donation.

As for receipts and permanently stored information, the basis for processing personal data is the legal obligation of the data controller (Section 7 and 10 of the Accounting Act (1336/1997).

7. What data do we process?

In connection with customer or stakeholder activities, Uniarts Helsinki processes the personal data of the following groups: Uniarts Helsinki’s alumni, donors, customers (companies, associations, public organisations) of our service business as well as private individuals who are our customers.

Uniarts Helsinki processes the following personal data in connection with its customer and stakeholder register:

• Basic (identifying) information of the data subject:
  • Name.
  • Email address, postal address, phone number.
  • Date of birth or personal identity code (only in deeds of donation).
  • Possible bank account information.
• Possible job-related information:
  • Occupation, title and/or job.
  • Start and end year of employment, line of work.
  • Name of the organisation, company or community.
  • Address of the organisation, general email address and web address of the organisation.
• Information on alumni activities and degrees.
• Information concerning marketing impact (Subscriptions and interests).
• Electronic identification data (IP addresses, cookies).
• Information on donations:
  • Sum, date and purpose of the donation.
  • Donor’s bank account number.
  • Consent/refusal to have the donor’s name mentioned in Uniarts Helsinki’s communication
  • Consent/refusal to have the sum and purpose of the donation mentioned in Uniarts Helsinki’s communication.
  • Consent to have their data processed in a customer and stakeholder register after the campaign (name details, sum of the donation).
• Information on the customer relationship:
  • Campaigns and events attended by the person and other possible special observations.
• Communication between the data subject and the data controller.
• Possible consent to direct marketing.

Our processing of personal data depends on the forms of cooperation you are involved in with us.

We do not make use of automated decision-making or profiling as referred to in the GDPR in our processing of personal data.

8. Where do we get data?

Information on donors is collected from the data subjects themselves through deeds of donation and copies of bank statements showing bank transfers made to Uniarts Helsinki’s account.

As for alumni, they personally give the alumni network the information they choose (including information on studies and degrees) and update their own information in the system independently by logging in to the system or by asking an admin to do this for them.

In the context of other services, the data is primarily collected from the data subjects themselves based on their registrations or other contact with them.

Personal data may also be collected and updated by using other registers maintained by Uniarts Helsinki when a legal right to do so exists and by using the Finnish Trade Register, online services and applications of companies, authorities and companies providing services concerning personal data as well as by using publicly available online sources.

9. To which parties do we disclose and transfer data and do we transfer data outside the EU or the EEA?

In addition to legislation on personal data protection, our operations at Uniarts Helsinki are governed by the Act on Openness of Government Activities (621/1999). According to the principle of public access, the information held by the university is public, unless otherwise provided by law. Therefore, the publicity of personal data processed by Uniarts Helsinki is determined by the Act on the Openness of Government Activities.

Uniarts Helsinki discloses personal data to the following recipients:

• Data on donations is disclosed to the Finnish Ministry of Education and Culture, tax authorities and/or the National Police Board in accordance with legislation and instructions.
• As regards donors, Uniarts Helsinki has a legal obligation to provide the Tax Administration information on the donor and the amount of the donation that has been determined tax-deductible under Section 98 a in the Act on Income Tax.
• For personal data processing, we work with subcontractors. We have outsourced the maintenance of the information system that we use for processing data on customers and stakeholders to a third-party service provider.

We have taken steps with our subcontractors to ensure your data protection and data security of personal data by concluding data-processing agreements.

We transfer personal data outside the EU/EEA. We have taken appropriate security measures in connection with the transfer. We use the standard contractual clauses adopted by the EU.

10. How do we protect data and for how long do we store it?

As the controller, Uniarts Helsinki has taken the necessary technical and organisational measures and also requires the same from the service providers it uses.

We take reasonable steps to ensure that the data subject’s personal data being stored in the register is not outdated, erroneous or incompatible with the purpose of processing. We immediately rectify or erase such data.

Personal data is stored for as long as is necessary for fulfilling the purpose for which it was collected and processed or for as long as is required by law or regulations.

Data on Uniarts Helsinki’s staff and students is stored in accordance with the related privacy notices and Uniarts Helsinki’s information management plan.

Data concerning alumni and stakeholder activities is erased after the termination of the partnership. The university’s CRM system Gruppo Software is used via the Internet over a protected connection from the server machines of the provider. The use of the system requires a user ID and a password. All users of the CRM system are members of the Uniarts Helsinki staff. The system has a main user and four other Admin users. Each user has a personal user ID and a password, the access rights of which expire when the person in question leaves the University Services or the duties for which they have been given access rights. Data not used during a period of 24 months is erased from the system.

To comply with the obligations relating to the Accounting Act, documents connected to donations (incl. deeds of donation) are stored for 10 years. However, as regards correspondence concerning the payment of governmental matched funding, summary lists relating to donations and donors, and reports and appendices relating to fundraising campaigns, the material is stored permanently.

11. What are your rights as a data subject?

Data subjects have the following rights:

• Right to have access to their data.
• Right to receive information on the processing of their personal data.
• Right to have erroneous or inaccurate personal data rectified.
• Right to have data erased.
  • Not applicable if the basis for processing is a statutory duty or a duty in the public interest.
• Right to restrict processing.
• Right to object processing i.e. to ask that data is not processed.
• Right to have data transferred from one system to another.
  • Applicable when the processing is based on an agreement or consent.
• Right to withdraw their consent.
  • Applicable when the processing is based exclusively on consent.
  • The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
• Right to receive information on a personal data breach that results in a high risk.
• Right not to be subject to a decision based on automated processing.

Data subjects have the right to lodge a complaint especially to the supervisory authority of their permanent place of residence or work if they find that the processing of personal data violates the EU’s General Data Protection Regulation 2016/679. Data subjects also have the right to employ administrative appeals and other legal remedies (https://tietosuoja.fi/en/notification-to-the-data-protection-ombudsman).

12. Who can you contact?

All questions and comments on the processing of personal data as described in this privacy notice can be directed to the contact person mentioned in section 3, who may forward the matter to the data protection officer, if necessary. If you find that your rights mentioned in section 11 are not being fulfilled, you can contact the university’s data protection officer mentioned in section 4 directly.

13. Your responsibility

You are responsible for the information that you deliver or make available to Uniarts Helsinki, and you must make sure that the information is accurate.

14. Amendments to the privacy notice

When this privacy notice is updated, the date of the new version will be edited to the beginning of the notice. If the university makes changes to the content of this privacy notice, it may take appropriate steps to inform you in a manner consistent with the significance of the changes.