Privacy notice for the customers and musicians of Uniarts Helsinki’s event service Primo

Published 3.2.2020 | Updated 10.8.2026

1. Controller

University of the Arts Helsinki (Uniarts Helsinki)
Postal address: P.O. Box 1, 00097 Uniarts
Phone number: +358 294 47 2000 (switchboard)

2. Unit and person in charge of processing personal data

Sibelius Academy’s event service Primo, Production Manager Miisa Järvi, firstname.lastname@uniarts.fi, +358 40 710 4334

3. Contact person for the processing of personal data

Producer Susanna Torvinen, firstname.lastname@uniarts.fi, +358 50 526 1970

4. Data protection officer

Find contact details for Uniarts Helsinki’s data protection officer on the data protection homepage.

5. Name of the register and brief description

Rukkis / Customer and musician register of the event service Primo

The event service Primo cooperates with customers (companies and communities) for which it produces music programme for various events. In addition to processing the personal data of its customers, the event service also processes the personal data of musicians booked by the event service to perform in customers’ events.

6. Purpose and legal basis for the processing of personal data

The purpose of processing information about companies and their contact persons is to attend to a customer relationship, and the purpose of processing information about performers is to book performers via the event service for customers’ events and to prepare and implement performance agreements:

• Processing a customer’s invitation to tender and making an event production offer to the customer.
• Contacting the performers of the event.
• Concluding an event agreement with the customer.
• Concluding performance agreements with the performers.
• Invoicing the customer.
• Paying performers’ fees.

We store the customers’ contact information also after the event to be able to serve them better. From the customer data, we see, for example, what kind of music programme has been produced for customers for previous events so that we are able to offer them new alternatives. We also see what kind of music performances they usually like.

The contact information of musicians and ensembles is stored so that they can be contacted in performance-related matters.

We send our customers newsletters and invite our regular customers to various events.

Uniarts Helsinki’s right to process personal data is based on:

• Implementation of the agreements made.
• Legitimate interest in handling customer relations.

We do not use automated decision-making or profiling as referred to in the GDPR in our processing of personal data.

7. What data do we process?

Uniarts Helsinki processes the following personal data in connection with its customer and musician register:

• Information about the customer’s contact person / name of the company or community as well as the name, email address, phone number and address of the contact person.
• Information about the customer relationship and the agreement / information about past and current agreements and orders/bookings.
• Basic information about the performer/ ensemble or band / the name, email address, phone number and address of the contact person.
• Personal data related to payment of fees: these have been described as part of the privacy notice regarding the processing of the personal data of persons whose relationship with the university does not involve employment or studying.

Providing the information listed above is a prerequisite for establishing a contractual and/or customer relationship and for concluding a performer agreement. Without the personal data needed, we cannot provide the service.

8. Where do we get data?

Personal data is gathered from the data subjects themselves.
We get information directly from the customers and musicians. Customers provide information when they contact the event service Primo. Musicians give their information when offering their services.

9. To which parties do we disclose and transfer data and do we transfer data outside the EU or the EEA?

We do not disclose information from the register to third parties. In our service, we use subcontractors with which we have concluded agreements on the processing of personal data.

We do not transfer personal data outside the EU/EEA.

10. How do we protect data and for how long do we store it?

Your data is processed only by the employees of Uniarts Helsinki or by the persons working under the mandate of and on behalf of Uniarts Helsinki who have the right to process personal data.

As the data controller, Uniarts Helsinki has taken the necessary technical and organisational measures and also requires the same from the service providers it uses.

We take reasonable steps to ensure that the data subject’s personal data being stored in the register is not outdated, erroneous or incompatible with the purpose of processing. We immediately rectify or erase such data.

We store data for as long as is necessary for the purpose for which the personal data is used. Both the customers and the performers may ask for their data to be erased from our register. We annually check our customer and performer data and erase outdated data (data that has not been used in a period of three years).

11. What are your rights as a data subject?

Data subjects have the following rights:

• Right to have access to their data.
• Right to receive information on the processing of their personal data.
• Right to have erroneous or inaccurate personal data rectified.
• Right to have data erased.
  • Not applicable if the basis for processing is a statutory duty or a duty in the public interest.
• Right to restrict processing.
• Right to object processing i.e. to ask that data is not processed.
• Right to have data transferred from one system to another.
  • Applicable when the processing is based on an agreement or consent.
  • The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
• Right to withdraw their consent.
  • Applicable when the processing is based exclusively on consent.
• Right to receive information on a personal data breach that results in a high risk.
• Right not to be subject to a decision based on automated processing

Data subjects have the right to lodge a complaint especially to the supervisory authority of their permanent place of residence or work if they find that the processing of personal data violates the EU’s General Data Protection Regulation 2016/679. Data subjects also have the right to employ administrative appeals and other legal remedies.

12. Who can you contact?

If you have any questions or comments about the processing of your personal data as described in this privacy notice, please contact the contact person mentioned in section 3, who will, if necessary, refer the matter to the data protection officer. If you consider that your rights set out in section 11 are not being fulfilled, you may contact the university’s data protection officer mentioned in section 4 directly.

13. Your responsibility

You are responsible for the data that you deliver or make available to Uniarts Helsinki. You must make sure that the information is true and accurate and in no way misleading.

14. Amendments to the privacy notice

When this privacy notice is updated, the date of the new version will be edited to the beginning of the notice. If we make changes to the content, we may take appropriate steps to inform you in a manner consistent with the significance of the changes.