Open search

Privacy notice for audio recordings, visual recordings and photographs

Articles 13 and 14 of the EU General Data Protection Regulation. Information for data subjects. Drawn up on 14 July 2025.

|

1. Controller

University of the Arts Helsinki (Uniarts Helsinki)
Postal address: P.O. Box 1, 00097 Uniarts
Phone number: +358 294 47 2000 (switchboard)

2. Unit and person in charge of processing personal data

Communications Services, Director of Communications and External Relations Eveliina Olsson, eveliina.olsson@uniarts.fi, +358 294 47 2000 (switchboard)

3. Contact person for the processing of personal data

Sibelius Academy Communications Services, Communications Planner Riikka Hänninen, riikka.hanninen@uniarts.fi, +358 294 47 2000 (switchboard)

4. Data protection officer

Find contact details for Uniarts Helsinki’s data protection officer on the data protection homepage.

5. Name of the register and brief description

Privacy notice for audio recordings, visual recordings and photographs

This privacy notice applies to all audio recordings, visual recordings and photographs used for communications and marketing purposes by Uniarts Helsinki, taken in connection with various works, events, concerts and performances organised as part of Uniarts Helsinki’s activities. These recordings and photographs may include students, other performers, staff and audiences from outside the university community.

The purpose of processing personal data is to use, and possibly archive, audio and visual recordings and photographs taken at Uniarts Helsinki events for communications and marketing purposes.
The processing of your personal data is based on the controller’s legitimate interest. Article 6(1)(f) of the EU General Data Protection Regulation (EU 679/2016). This legitimate interest exists because a relevant and appropriate relationship is established between you and the university through event registration, which is comparable to a customer relationship. Based on this, the university may inform you about upcoming events.

Processing may also be based on Article 6(1)(b) of the GDPR, where it is necessary for the performance of a contract or for taking steps prior to entering into a contract.

If the activity is subject to a fee, processing may also be based on a legal obligation (e.g. taxation, accounting) under Article 6(1)(c) of the GDPR.

Processing of health-related data (e.g. allergies) requires your explicit consent under Article 9(2)(a) of the GDPR.

In some cases, the legal basis may be vital interests, for example if a participant is injured during an event, course or conference and personal data must be provided to medical personnel (EU 679/2019 Article 6.1[d]).

The basis for processing personal data for photographs used in Uniarts Helsinki’s marketing and communications materials, advertisements, websites, social media platforms and various promotional materials is the data subject’s written consent. Photographs may also be used for journalistic purposes.

We also process special categories of personal data in connection with event participation (e.g. dietary information may include health-related data). The legal basis for processing such data is the data subject’s consent.

We do not use automated decision-making or profiling as referred to in the GDPR in our processing of personal data.

7. What data do we process?

Uniarts Helsinki also processes the following personal data:

  • First and last name of the person.
  • Contact information of the person.
  • Audio or visual recording or a photograph of the person.

8. Where do we get data?

Personal data is gathered directly from the data subjects by using a consent form.

Personal data is also obtained through photography, video recording and/or audio recording that is occurring at an event.

9. To which parties do we disclose or transfer data and do we transfer data outside the EU or the EEA?

For personal data processing, we work with subcontractors. We have outsourced the storage location of audio and visual recordings and photographs to a third-party service provider administering and protecting the server on which personal data is stored. We have taken care of your data protection with our subcontractors by drafting processing agreements for the processing of personal data.

We do not transfer data outside the EU or the EEA.

10. How do we protect data and for how long do we store it?

Your data is processed only by the employees of Uniarts Helsinki or by the persons working under the mandate of and on behalf of Uniarts Helsinki who have the right to process personal data.

As the controller, Uniarts Helsinki has taken the necessary technical and organisational measures and also requires the same from the service providers it uses.

Retention periods for data are based on applicable legislation and the information management plan of Uniarts Helsinki.

Audio and/or visual recordings and photographs from events are stored in Uniarts Helsinki’s designated storage location for 5 years, after which the recordings and photographs are automatically archived.

We take reasonable steps to ensure that the data subject’s personal data being stored in the register is not outdated, erroneous or incompatible with the purpose of processing. We immediately rectify or erase such data.

11. What are your rights as a data subject?

Data subjects have the following rights:

  • Right to have access to their data.
  • Right to receive information on the processing of their personal data.
  • Right to have erroneous or inaccurate personal data rectified.
  • Right to have data erased.
    • Not applicable if the basis for processing is a statutory duty or a duty in the public interest.
  • Right to restrict processing.
  • Right to object processing i.e. to ask that data is not processed.
  • Right to have data transferred from one system to another.
    • Applicable when the processing is based on an agreement or consent.
  • Right to withdraw their consent.
    • Applicable when the processing is based exclusively on consent.
    • The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
  • Right to receive information on a personal data breach that results in a high risk.
  • Right not to be subject to a decision based on automated processing.

The data subject also has the right to lodge a complaint with the Data Protection Ombudsman’s Office if they find that the processing of their personal data is an infringement of the valid data protection legislation (https://tietosuoja.fi/en/notification-to-the-data-protection-ombudsman).

12. Who can you contact?

If you have any questions or comments about the processing of your personal data as described in this privacy notice, please contact the contact person mentioned in section 3, who will, if necessary, refer the matter to the data protection officer. If you consider that your rights set out in section 11 are not being fulfilled, you may contact the university’s data protection officer mentioned in section 4 directly.