Privacy notice for the customer register of event registration at Uniarts Helsinki’s Theatre Academy

Published 31.1.2020 | Updated 10.8.2026

1. Controller

University of the Arts Helsinki (Uniarts Helsinki)
Postal address: P.O. Box 1, 00097 Uniarts
Phone number: +358 294 47 2000 (switchboard)

2. Unit and person in charge of processing personal data

Uniarts Helsinki’s Theatre Academy, Production Manager Nina Numminen, firstname.lastname@uniarts.fi, +358 294 47 2000 (switchboard)

3. Contact person for the processing of personal data

Uniarts Helsinki’s Theatre Academy, Coordinator Rosa Sedita, firstname.lastname@uniarts.fi, +358 294 47 2000 (switchboard)

4. Data protection officer

Find contact details for Uniarts Helsinki’s data protection officer on the data protection homepage.

5. Name of the register

Event customer register

6. Purpose and legal basis for the processing of personal data

Artistic activities at Uniarts Helsinki Theatre Academy provide students with possibilities to learn how to work as artists as part of their university studies. Student groups organise events that are open to the public as part of their studies and artistic activities.

Attendees in events are required to sign up, and an attendance fee is charged from everyone except for students and staff members of Uniarts Helsinki and certain other special groups. Registrations and attendance fee payments are managed using an event customer register. This helps ensure that only as many audience members attend each event as the capacity of the premises permits. The attendance fees are paid on the sales platform, and the data is entered in Uniarts Helsinki’s event customer register.

The customer register contains event-specific lists of individuals coming to certain event and information about the price categories of the tickets acquired. When a person who has acquired a ticket arrives at an event, they sign up and, if necessary, prove that they are entitled to a discount ticket or a free ticket.

In many processes, the submission of personal data is a necessary prerequisite for handling the matter.

Uniarts Helsinki’s right to process personal data is based on:

• The processing of personal data is based on the legitimate interest of Uniarts Helsinki on the basis of a customer relationship for the following purposes: establishing statistics on attendance, processing the price categories of the attendance fee and event communication.

It is not possible to register for events or purchase attendance rights without providing personal data.

We do not use automated decision-making or profiling as referred to in the GDPR in our processing of personal data.

7. What data do we process?

In connection with the customer register, Uniarts Helsinki processes the following personal data of a person registering for an event:

• Basic information about the data subject: name. The data subject’s contact information: email address, phone number*.
• Possible other data collected with the data subject’s explicit consent: information about the ticket price category that the data subject is entitled to (standard price / students / pensioners / theatre and dance professionals / students or staff members of Uniarts Helsinki, Aalto ARTS and Tampere University’s Programme in Theatre Arts / attendees with season invitations, invited guests).

Providing the personal data marked with an asterisk is a prerequisite for establishing our customer relationship. Without the personal data needed, we cannot provide the service.

8. Where do we get data?

We receive information from the person entering the personal data in the event customer register.

9. To which parties do we disclose and transfer data and do we transfer data outside the EU or the EEA?

For personal data processing, we work with subcontractors. We have outsourced the IT administration of the event register to a third-party service provider administering and protecting the server on which personal data is saved. We have taken care of your data protection with our subcontractors by drafting processing agreements for the processing of personal data.

We do not transfer personal data outside the EU/EEA.

10. How do we protect data and for how long do we store it?

As the controller, Uniarts Helsinki has taken the necessary technical and organisational measures and also requires the same from the service providers it uses.

We take reasonable steps to ensure that the data subject’s personal data being stored in the register is not outdated, erroneous or incompatible with the purpose of processing. We immediately rectify or erase such data.

Only those employees who are authorised to process the customer data due to their job duties are entitled to use the system containing personal data. Hourly-paid persons in charge of event registrations and event attendance payments and permanent staff members who are authorised to use the system have personal usernames and passwords that they use to log into the system. The data is gathered in databases protected with firewalls, passwords and other technical means. The databases and their backup copies are situated in locked spaces, and the data can only be accessed by certain designated persons.

The customer register contains data on the persons who have signed up as attendees and paid for their attendance for each specific event. The data is erased from the customer register after a period of two years.

11. What are your rights as a data subject?

Data subjects have the following rights:

• Right to have access to their data.
• Right to receive information on the processing of their personal data.
• Right to have erroneous or inaccurate personal data rectified.
• Right to have data erased.
  • Not applicable if the basis for processing is a statutory duty or a duty in the public interest.
• Right to restrict processing.
• Right to object processing i.e. to ask that data is not processed.
• Right to have data transferred from one system to another.
  • Applicable when the processing is based on an agreement or consent.
• Right to withdraw their consent.
  • Applicable when the processing is based exclusively on consent.
  • The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
• Right to receive information on a personal data breach that results in a high risk.
• Right not to be subject to a decision based on automated processing

Data subjects have the right to lodge a complaint especially to the supervisory authority of their permanent place of residence or work if they find that the processing of personal data violates the EU’s General Data Protection Regulation 2016/679. Data subjects also have the right to employ administrative appeals and other legal remedies.

12. Who can you contact?

If you have any questions or comments about the processing of your personal data as described in this privacy notice, please contact the contact person mentioned in section 3, who will, if necessary, refer the matter to the data protection officer. If you consider that your rights set out in section 11 are not being fulfilled, you may contact the university’s data protection officer mentioned in section 4 directly.

13. Your responsibility

You are responsible for the data that you deliver or make available to Uniarts Helsinki. You must make sure that the information is true and accurate and in no way misleading.

14. Amendments to the privacy notice

When this privacy notice is updated, the date of the new version will be edited to the beginning of the notice. If we make changes to the content, we may take appropriate steps to inform you in a manner consistent with the significance of the changes.