Privacy Policy for the John Nurminen Foundation Group’s customer and supporter register

This privacy policy (hereinafter the “Privacy Policy”) for the John Nurminen Foundation and its subsidiary Baltic Sea Services Oy’s (“JNS” or “we”) customer and supporter register was created on 24 May 2018 and was last updated on 10 May 2023. The updates are described in more detail in Section 12. Amendments to the Privacy Policy

In this Privacy Policy, we provide a detailed description of how JNS collects and processes the personal data of contact persons for our customers, donors and other supporters, and of employees working with our potential customers’ and partners’ sponsorship and sustainability issues. You can also find more information about your rights with regard to the processing of your personal data.

JNS respects your privacy and is committed to processing your personal data in an appropriate manner in compliance with both this Privacy Policy and the European Union’s (“EU”) General Data Protection Regulation (2016/679) and other applicable legislation (together “Data Protection Legislation”).

1. Controller

The John Nurminen Foundation is the controller of any data processing described in this policy that is not related to book and product sales or e-commerce:

John Nurminen Foundation
Pasilankatu 2
00240 Helsinki, Finland

Baltic Sea Services Oy, a subsidiary of the John Nurminen Foundation, is the controller of data processing that relates to book and product sales and e-commerce:
Baltic Sea Services Oy
Pasilankatu 2
00240 Helsinki, Finland
myynti(a)balticseaservices.fi

2. Contact person

Anni Kujala
Pasilankatu 2
00240 Helsinki
rekisteri(a)jnfoundation.fi
+358 50 467 6740

3. Name of the register

John Nurminen Foundation and Baltic Sea Services Oy customer and supporter register

4. The purpose of and legal basis for processing your personal data

We process personal data for the purposes described below, such as managing and developing customer, donor or supporter relations, and for targeting our communications and marketing to both private persons and communities and their contact persons. We collect only the personal data that is necessary in relation to the purposes for which it is being processed.

The purpose of processing your personal data is:
– Carrying out and managing an agreement, for example, when you order products from JNS’s webstore
– Product delivery, invoicing and debt collection
– Customer service
– Managing monthly and other donations, and fulfilling accounting obligations
– Publishing the information you wish to appear in the donor register
– Sending supporter reports and other communications about the use of donation funds
– Sending information to collection organisers about the total amount collected and the donors who participated in commemorative and anniversary collections
– Developing our activities and customer experience
– Designing and developing our products and services
– Organising events
– Collecting feedback
– Sending information about JNS’s ongoing projects
– Organising promotional prize draws and competitions, and their associated communications
– Customer acquisition, direct marketing and marketing communications for the purpose of acquiring donations

Customer relationship management

The legal basis for processing personal data for customer relationship management, managing donor and supporter relations, and keeping in contact with partners is either JNS’s legitimate interest or to enable JNS to implement agreements.

In connection with customer relationship management, the primary purpose of processing personal data is to carry out business transactions between the customer and JNS, for example, when you make a donation or order products from the Foundation’s online store. Personal data can be processed for purposes such as invoicing, customer service, product delivery or collecting overdue invoices.

In connection with the management of donor and partner relations, we also process personal data for publishing the information specified by the donor in a public donor register or providing information about how donations have been used.

Competitions and prize draws

Within the framework of our activities, we organise a variety of competitions and prize draws on our website, in our communication channels (such as social media) and on our partners’ premises. In this case, the legal basis for the processing of your personal data is JNS’s legitimate interest in running promotional prize draws and/or competitions, and sending associated communications or carrying out other related activities after you have entered a competition or prize draw arranged by us, or when you have given us your permission to publish content submitted at exhibitions, on our website, or in another of our communication channels (including social media). When you enter a prize draw, we may ask for your consent to direct digital marketing.

Direct marketing

We may process your personal data for direct marketing purposes and to target marketing, in which case the legal basis for processing data is JNS’s legitimate interest. In this case, we may contact you by phone or letter in order to market things such as fundraisers or activities. You have the right to prohibit the processing of your personal data for direct marketing purposes at any time.

Direct digital marketing

We process your personal data for direct digital marketing with your consent. In this case, we may contact you by email in order to market things such as fundraisers or activities. Our direct digital marketing also includes our newsletter, which contains information about progress on JNS’s projects and other current topics that we believe will be of interest to you.

We may also send direct digital marketing on the basis of an earlier customer relationship or an authorisation based on your position. In this case, the legal basis for processing your personal data is JNS’s legitimate interest.

Based on our legitimate interest, your personal data may also be used for profiling, for example, for marketing purposes. JNS does not make any automated decisions that would have legal implications.

At any time, you have the right to object to the processing of your personal data for the purposes of direct marketing or profiling for direct marketing.

We also use cookies and other similar technologies on our website and in our newsletters, to ensure the functionality of our website, to develop and improve our user experience, and to target relevant marketing. You can read more about the cookies we use, their purpose and retention periods in our Cookie Policy.

5. What personal data do we collect and from where?

We collect the following personal data in our customer and supporter register:
– person’s name
– age/year of birth
– position and company/organisation
– contact details (such as address, email address and telephone number)
– the start and end time of the customer relationship and/or other contact, and the contact method
– invoicing details and payments
– customer history, notes about the customer relationship and notes about meetings
– donation information and information required to process bequests
– school and grade in connection with our Taksvärkki collection
– information about subscription to the newsletter mailing list
– information about consent to/prohibition of direct marketing
– other information necessary for organising and developing events, such as dietary requirements and restrictions
– other information necessary for a competition or prize draw, such as a photo submitted by a competition or prize draw entrant and the name of the photographer
– any other information necessary for accepting donations, customer account management and partnerships.

As a rule, we mainly collect data for the customer and supporter register from you yourself, for example, when you give us information via online forms or social media services, by email or telephone, in agreements, via event registrations and payment information, when entering a competition or prize draw, and at customer meetings or other events at which you disclose your information.

Personal data may also be collected from public sources or from companies that provide services for updating and obtaining personal data. These include Posti’s consumer register update service, Suomen Asiakastieto Oy’s decision-maker register and Profinder’s corporate and consumer information registers.

In addition, we collect personal information using cookies and other similar technologies on our website and in our newsletters.

6. Will your personal data be disclosed or transferred to third parties?

We only transfer your personal data when it is necessary to carry out one of the aforementioned purposes. JNS may transfer your personal data to parties involved in the provision, maintenance and development of JNS’s services, communications and marketing, or to its other partners, and these parties may process your personal data for the purposes described in this Privacy Policy.

Our partners for customer service and marketing include Sanoma Media Finland Oy, Barona Oy, Gainer Oy and LiveRing Oy. Your data may also be transferred to other subcontractors and service providers that are responsible for IT, software, accounting and other similar services. JNS will enter into the necessary contractual arrangements with third parties to ensure that your personal data is processed in accordance with Data Protection Legislation.

If you make a donation to a commemorative or anniversary collection, we will send your name to the collection organiser. Your personal data may also be disclosed to third parties in certain situations, such as those in which its disclosure is required by law or official regulations.

Please note that third parties may process the information collected via cookies and social media plugins on our website.

JNS or its service providers may use companies located outside the EU or European Economic Area (“EEA”) to process personal data or provide services. Personal data will only be transferred out of the EU or EEA when there are justified grounds for doing so and in compliance with Data Protection Legislation.

7. Joint controllers

When JNS administers pages on Facebook and Instagram, JNS and Meta Platforms Ireland Ltd (“Facebook”) are the joint controllers of JNS’s Facebook and Instagram pages, as applicable. Your personal data will be used for purposes such as keeping you informed about JNS’s work/events and how donations have been used; running competitions and prize draws; marketing and collecting feedback; purchasing and measuring the performance of Facebook advertisements; and better targeting communications. The legal basis for processing your personal data is JNS’s legitimate interest.

JNS collects data through its Facebook and Instagram pages in the form of, for example, likes and other reactions, comments, visits, post visibility, and personal data submitted in connection with competitions. The information that JNS receives from Facebook is the person’s user name, public profile picture, and any other data that has been marked as public. Data subjects may provide other personal data in comments on social media pages or via messaging services.

Where applicable, we are also joint controllers with Facebook with respect to the cookies used in Facebook’s social media plugins and certain services relating to Facebook’s advertising networks. You can read more about cookies and social media plugins in our Cookie Policy.

In Facebook’s privacy policy, you can read how and on what legal basis Facebook processes your data, and how you can exercise your rights under data protection legislation. We have signed a joint controller agreement with Facebook that describes JNS’s and Facebook’s responsibilities with respect to the data we collect. Please note that if you wish to exercise your rights under data protection legislation with respect to data processed by Facebook, you should contact Facebook.

You can restrict the processing of your personal data by unliking and/or unfollowing a page. You can also request a conversation to be deleted from a messaging service. You can also choose not to accept non-essential cookies when you visit our website, or withdraw your previously given consent.

8. How is your personal data processed and protected?

JNS processes your personal data only for the aforementioned purposes and only for the purposes for which the data was originally collected. The protection of your personal data is important to us, and we comply with both good data management practices and the due diligence and obligations laid down in Data Protection Legislation. We adhere to generally accepted technical and organisational measures to prevent any unauthorised or unlawful processing or misuse of personal data, and to protect personal data from loss, alteration or deletion. The electronically processed personal data contained in the register is protected by means of firewalls, passwords and other technical means that are generally used and accepted in the information security industry. Workstations and IT systems are protected using personal usernames and passwords. Our workstations also utilise two-factor authentication. Manually maintained material is located in facilities to which unauthorised access is prevented. Access to the personal data contained in the register is granted only to designated employees of the Foundation or of an enterprise acting for or on behalf of the Foundation, and only to the extent that is required to carry out the task at hand. Our employees have signed a non-disclosure agreement.

9. For how long will your personal data be retained?

We comply with statutory retention periods, and will retain your personal data only for as long as is necessary, and to the extent that is required, to carry out the purposes for which the personal data is being processed as defined in this Privacy Policy (for example, for the duration of a contractual term).

10. What are your rights as a data subject?

As a data subject, you have the following rights with regard to your personal data in the customer and supporter register:

– The right to access and verify your data: You have the right to receive confirmation from us about whether or not your personal data is being processed; and if your personal data is being processed, you have the right to access and verify all of the personal data being held about you in the customer and supporter register.
– The right to correct, delete and restrict the processing of your data: You have the right to require us to correct any inaccurate, unnecessary, incomplete or outdated personal data without undue delay. You have the right to request us to delete any of your personal data that is no longer required for the purpose for which it was originally collected or processed, or if you suspect that your personal data is being processed illegally, or if your personal data must be deleted to comply with a legal obligation (that applies to the controller). You also have the right to request a restriction on the processing of your data. Please note that deleting or restricting the use of your personal data may, for instance, result in a deterioration in your customer service experience, that you can no longer be a monthly donor, or that you no longer receive our newsletters or information on our project progress.
– The right to object to the processing of your data: When the basis for processing personal data is JNS’s legitimate interest, you have the right to object to the processing of your personal data with respect to a specific personal situation. The exception to this is when JNS can demonstrate that there is a very important and justified reason that overrides the data subject’s interests, or if processing is necessary for the preparation, presentation or defence of a legal claim. However, you always have the right to object to the processing of your personal data for direct marketing purposes (including profiling) without any justification. Please note that objecting to the processing of your personal data may, for instance, result in a deterioration in your customer service experience, that you can no longer be a monthly donor, or that you no longer receive our newsletters or information on our project progress.
– The right to transfer data from one system to another: You have the right to transfer the personal data you supplied to JNS to another controller. This transfer right covers automatically processed personal data whose processing is based on your consent or an agreement to which you are a party. JNS will send the data in a machine-readable and commonly used format to you, and will also send the data directly to the other controller if this is technically possible.
– The right to withdraw consent: If your personal data is being processed on the basis of your consent, you may withdraw your consent to such processing at any time by contacting us.

If you would like to exercise any of the rights described above, would like to receive more information about the processing of your personal data, or have any comments on its processing, you can contact us at any time by sending an email to rekisteri(a)jnfoundation.fi.

11. Lodging a complaint with the supervisory authority

JNS always aims to resolve any disputes regarding the processing of your personal data directly with you. If you believe that JNS has not processed your personal data in accordance with applicable Data Protection Legislation, you have the right to lodge a complaint with the competent supervisory authority. The contact details for the supervisory authority are:

Office of the Data Protection Ombudsman
P.O. Box 800
00531 HELSINKI
Visiting address: Lintulahdenkuja 4, 00530 Helsinki
email: tietosuoja@om.fi
telephone exchange: +358 (0)29 56 66700
www.tietosuoja.fi.

12. Amendments to the Privacy Policy

We continuously strive to develop our services and privacy protection, and therefore reserve the right to change this Privacy Policy by placing a notification of change on this page. The Privacy Policy may also be updated in order to reflect changes in legislation. We recommend that you revisit this Privacy Policy on a regular basis.

The following updates have been made to this Privacy Policy:

– Update 30 November 2021 We revised and clarified the purposes of processing personal data, and added that we may also collect personal data from public sources.
– Update 31 January 2023 We added that personal data may also be collected from companies that provide services for updating and obtaining personal data.
– Update 10 May 2023 We combined the privacy policies for our customer and supporter register and our competitions and prize draws register, and the name of the document was changed to the “Privacy policy for the John Nurminen Foundation Group’s customer and supporter register”. We clarified from which public sources personal data is obtained, and to whom our customer service and marketing partners may disclose personal data.

Privacy Policy for the John Nurminen Foundation’s stakeholder register

This privacy policy (hereinafter the “Privacy Policy”) for the John Nurminen Foundation’s (“JNS” or “we”) stakeholder register was created on 29 May 2018 and updated on 30 November 2021. In this Privacy Policy, we provide a detailed description of how JNS collects and processes the personal data of representatives of our various stakeholders. You can also find more information about your rights with regard to the processing of your personal data.

JNS respects your privacy and is committed to processing your personal data in an appropriate manner in compliance with both this Privacy Policy and the European Union’s (“EU”) General Data Protection Regulation (2016/679) and other applicable legislation (together “Data Protection Legislation”).

1. Controller

John Nurminen Foundation
Pasilankatu 2
00240 Helsinki, Finland
info(a)jnfoundation.fi

2. Contact person for the privacy policy and person responsible for data protection

Anni Kujala
Pasilankatu 2
00240 Helsinki
rekisteri(a)jnfoundation.fi
+358 50 467 6740

3. Name of the register

John Nurminen Foundation stakeholder register

4. The purpose of and legal basis for processing your personal data

We process personal data in order to manage and develop communications and collaborative partnerships with, for example, the contact persons for our project partners, government ministries, authorities and service providers, media representatives, Baltic Sea Action Day partners, as well as members of steering groups appointed to our projects. In order to acquire new partners for sustainability projects, JNS may also reach out to employees of potential partner companies whose responsibilities include stakeholder engagement, sponsorship, or sustainability issues. We collect only the personal data that is necessary in relation to the purposes for which it is being processed. The purpose of processing your personal data is:

– Sending information about JNS’s ongoing projects
– Keeping you informed about JNS’s activities
– Sending out press releases and media invitations
– Convening steering group meetings
– Sending invitations to JNS’s events and meetings
– Managing other collaborator and stakeholder relations
– Managing Baltic Sea Action Day events, activities and other contacts
– Contacting new and potential partners and partner companies.

The legal basis for processing stakeholders’ personal data is JNS’s legitimate interest and to enable JNS to implement agreements. JNS does not make any automated decisions that would have legal implications.

We may also process data about employees of our stakeholder organisations for direct marketing purposes. Our direct marketing mainly covers our newsletter, which is sent either by email or post, and contains information about progress on JNS’s projects and other current topics that we believe will be of interest to our stakeholders and their employees. The Foundation’s newsletter is only sent to those people who have subscribed to it. Consent is the basis for processing personal data in this context. You have the right to prohibit the processing of your personal data for direct marketing purposes at any time.

We also use cookies and other similar technologies on our website and in our newsletters, to ensure the functionality of our website, to develop and improve our user experience, and to target relevant marketing. You can read more about the cookies we use, their purpose and retention periods in our Cookie Policy.

5. What personal data do we collect and from where?

We collect the following personal data in our stakeholder register:

– person’s name
– position and company/organisation
– contact details (such as address, email address and telephone number)
– information about consent to/prohibition of direct marketing
– information about subscription to the newsletter mailing list
– the start and end time of the contact, and the contact method
– notes about the stakeholder relationship and notes about meetings
– any other necessary information relating to cooperation
– any other information necessary for organising and developing events, such as dietary requirements and restrictions.

As a rule, we mainly collect data for the stakeholder register from you yourself, for example, when you give us information via online forms or social media services, by email or telephone, in agreements, or during meetings and other events at which stakeholders disclose information. We may also collect personal data from public sources and, for non-commercial purposes, from third parties on the basis of, for instance, recommendations.

In addition, we collect personal information using cookies and other similar technologies on our website and in our newsletters.

6. Will your personal data be disclosed or transferred to third parties?

We only transfer your personal data when it is necessary to carry out one of the aforementioned purposes.

JNS may transfer your personal data to parties involved in the provision, maintenance and development of JNS’s services and communications, or to its other partners, and these parties may process your personal data for the purposes described in this Privacy Policy. Your data may also be transferred to other subcontractors and service providers that are responsible for IT and other similar services. JNS will enter into the necessary contractual arrangements with third parties to ensure that your personal data is processed in accordance with Data Protection Legislation.

In principle, your personal data will not be disclosed to third parties without your consent. However, your personal data may be disclosed to third parties without your consent in some situations, such as situations in which its disclosure is required by law or official regulations. If necessary, we may also provide funding organisations, such as the European Union, with lists of event participants, so that the funders can confirm that a project’s objectives have been realised and fulfil their legal obligations.
Please note that third parties may process the information collected via cookies and social media plugins on our website.

JNS or its service providers may use companies located outside the EU or European Economic Area (“EEA”) to process personal data or provide services. Personal data will only be transferred out of the EU or EEA when there are justified grounds for doing so and in compliance with Data Protection Legislation.

7. Joint controllers

When JNS administers pages on Facebook and Instagram, JNS and Facebook Ireland Ltd (“Facebook”) are the joint controllers of JNS’s Facebook and Instagram pages, as applicable. Your personal data will be used for purposes such as keeping you informed about JNS’s work/events and how donations have been used; running competitions and prize draws; marketing and collecting feedback; purchasing and measuring the performance of Facebook advertisements; and better targeting communications. The legal basis for processing your personal data is JNS’s legitimate interest. Data used in competitions will be processed in accordance with a separate privacy policy that will be issued for each competition.
JNS collects data through its Facebook and Instagram pages in the form of, for example, likes and other reactions, comments, visits, post visibility, and personal data submitted in connection with competitions. The information that JNS receives from Facebook is the person’s user name, public profile picture, and any other data that has been marked as public. Data subjects may provide other personal data in comments on social media pages or via messaging services. This information will not be combined with other data held in personal data registers without informing the data subject or without the data subject’s consent.

Where applicable, we are also joint controllers with Facebook with respect to the cookies used in Facebook’s social media plugins and certain services relating to Facebook’s advertising networks. You can read more about cookies and social media plugins in our Cookie Policy.

In Facebook’s privacy policy, you can read how and on what legal basis Facebook processes your data, and how you can exercise your rights under data protection legislation. We have signed a joint controller agreement with Facebook that describes JNS’s and Facebook’s responsibilities with respect to the data we collect. Please note that if you wish to exercise your rights under data protection legislation with respect to data processed by Facebook, you should contact Facebook. You can restrict the processing of your personal data by unliking and/or unfollowing a page. You can also request a conversation to be deleted from a messaging service. You can also choose not to accept non-essential cookies when you visit our website, or withdraw your previously given consent.

8. How is your personal data processed and protected?

9. For how long will your personal data be retained?

10. What are your rights as a data subject?

As a data subject, you have the following rights with regard to your personal data in the stakeholder register:

– The right to access and verify your data: You have the right to receive confirmation from us about whether or not your personal data is being processed; and if your personal data is being processed, you have the right to access and verify all of the personal data being held about you in the stakeholder register.
– The right to correct, delete and restrict the processing of your data: You have the right to require us to correct any inaccurate, unnecessary, incomplete or outdated personal data without undue delay. You have the right to request us to delete any of your personal data that is no longer required for the purpose for which it was originally collected or processed, or if you suspect that your personal data is being processed illegally, or if your personal data must be deleted to comply with a legal obligation (that applies to the controller). You also have the right to request a restriction on the processing of your data. Please note that deleting or restricting the use of your personal data may, for instance, result in you no longer receiving our newsletters or invitations to our events.
– The right to object to the processing of your data: When the basis for processing personal data is JNS’s legitimate interest, you have the right to object to the processing of your personal data with respect to a specific personal situation. The exception to this is when JNS can demonstrate that there is a very important and justified reason that overrides the data subject’s interests, or if processing is necessary for the preparation, presentation or defence of a legal claim. However, you always have the right to object to the processing of your personal data for direct marketing purposes without any justification. Please note that an objection to the processing of your personal data may, for instance, result in you no longer receiving our newsletters or invitations to our events.
– The right to transfer data from one system to another: You have the right to transfer the personal data you supplied to JNS to another controller. This transfer right covers automatically processed personal data whose processing is based on your consent or an agreement to which you are a party. JNS will send the data in a machine-readable and commonly used format to you, and will also send the data directly to the other controller if this is technically possible.
– The right to withdraw consent: If your personal data is being processed on the basis of your consent, you may withdraw your consent to such processing at any time by contacting us.

If you would like to exercise any of the rights described above, would like to receive more information about the processing of your personal data, or have any comments on its processing, you can contact us at any time by sending an email to rekisteri(a)jnfoundation.fi.

11. Lodging a complaint with the supervisory authority

12. Amendments to the Privacy Policy

John Nurminen Foundation Recruitment and manuscript filing system

Following its entry into force on 25 May 2018 the provisions of the EU General Data Protection Regulation are applied to all organisations processing and holding personal data. The key aim of the new Regulation is to strengthen the rights and the conditions for consent of data subjects in relation to the processing of personal data. In this Privacy Statement issued by the John Nurminen Foundation (hereinafter also the Foundation), we describe in detail what personal data we collect and for what purposes personal data are used. The Privacy Statement also provides further information on the rights of data subjects.

1. Controller

John Nurminen Foundation
Pasilankatu 2
00240 Helsinki
rekisteri(a)jnfoundation.fi

2. Contact person for the Privacy Statement

Anni Kujala
Pasilankatu 2
00240 Helsinki
rekisteri(a)jnfoundation.fi
+358 50 467 6740

3. Name of filing system

John Nurminen Foundation Recruitment and manuscript filing system

4. For what purposes and on what legal grounds we can use your personal data

We process personal data for the purpose of managing the application process of persons who apply for a position with the John Nurminen Foundation or submit a manuscript for publishing. Furthermore, we can process personal data in connection with diverse statistical purposes in which case personal data is, as a rule, pseudonymised in such a manner that the personal data can no longer be attributed to a specific data subject.
The collecting of personal data of data subjects is always limited to what is necessary in relation to the purposes for which they are processed.

Applications for positions
Personal data is processed for purposes of carrying out and managing recruitment activities, processing applications, assessing the applicant’s suitability, and carrying out communications related to the application and recruitment. The legal basis for the processing of personal data in accordance with the EU General Data Protection Regulation is the legitimate interest pursued by the controller.

Manuscript submissions
Personal data is processed for purposes of evaluating and managing the publishing project, reviewing the manuscript and carrying out communications. The legal basis for the processing of personal data in accordance with the EU General Data Protection Regulation is the legitimate interest pursued by the controller.

5. What data are recorded

We may store the following personal data of applicants: Identifiable information such as name, personal identity code, home address, email address, and telephone number.

Recruitment: Other information, such as education (e.g. name of degree and institution), work experience (e.g. previous employers, position held, duration of employment), language proficiency, possible information pertaining to suitability assessments, position applied for, and other information provided by the applicant.

Manuscript: Other information, such as education, previous published works, and the manuscript.

6. How long data are retained

We retain personal data only as long as necessary for the processing purposes specified in this Privacy Statement. The retention period may be longer due to the provisions of the Accounting Act or other statutory requirements binding upon us.

We store open applications for a maximum of 12 months and applications submitted in response to an announced vacancy for a maximum of 6 months.

7. From what sources personal data are collected

We collect personal data primarily from data subjects themselves by means of the application and a possible interview. We may also obtain information from other sources to the extent permitted by law. In the case of recruitment, this may include data from a third party performing the suitability assessment. In such cases, we will always ask for your consent before collecting your data.

8. Regular destinations of disclosed data and transfer of data outside the EU or EEA

We can transfer personal data to our own filing systems to be processed for the purposes specified in section 4.

Apart from our own filing systems, personal data are not disclosed or transferred to entities other than those contracted by the Foundation for the production, development or maintenance of services and communications, except in accordance with an agreement, separate explicit consent and/or specific statutory requirements. We can transfer personal data outside the EU or EEA in compliance with the conditions laid down in the provisions of the EU General Data Protection Regulation.

9. How your personal data are secured

Protection of privacy is paramount for us, and we exercise great care in the processing operations of personal data contained in the filing system. We adhere to generally accepted standards of technology and operational security in order to prevent any unauthorised or unlawful processing or misuse and to protect personal data from loss, alteration or destruction.

The electronically processed data contained in the filing system are protected by means of firewalls, passwords and other technical means generally accepted in the information security industry. Manually maintained material is located in facilities to which unauthorised access is prevented. Access to the data contained in the filing system is granted only to designated employees of the Foundation or of an enterprise acting for or on behalf of the Foundation.

10. Your rights as a data subject

In comparison to the provisions of the repealed Data Protection Directive, the rights of data subjects are specified in more detail in the EU General Data Protection Regulation. The Regulation also confers a number of new rights on data subjects. As a data subject, you have the following rights to your personal data held by the Foundation:

a) Right of access to your personal data. You have the right to know whether we are processing your personal data and to review your personal data we may have collected, if any.

b) Right to rectification of inaccurate or incomplete data. If the data are inaccurate, incomplete or imprecise, you have the right to request your personal data to be rectified, e.g. by means of providing a supplementary statement.

c) Right to erasure, i.e. right to be forgotten. You may request your personal data to be erased under the following conditions:

The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed and there are no overriding legitimate grounds for the retention of your personal data.

You withdraw your consent on which the processing is based and there is no other legal ground for the processing.

You object to the processing and there are no overriding legitimate grounds for the processing.

The personal data have been unlawfully processed.

The personal data of a minor have been collected in relation to the offer of information society services directly to a child.

d) Right to restriction of processing. You have the right to obtain from the controller restriction of processing if you contest the accuracy of the personal data or the lawfulness of processing, or you have objected to processing.

You have the right to object to processing on the grounds of your legitimate interests or fundamental rights and freedoms. You have the right at any time to object to the processing of your personal data for the purposes of direct marketing or profiling associated with direct marketing.

e) Right to data portability. If the processing of personal data is based on consent or on a contract and the processing is carried out only by automated means, you have the right to receive the personal data in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller.

If you choose to exercise any of the data subject rights referred to above, every request submitted by a data subject is considered on a case-by-case basis. Please note that in certain cases the retention and processing of personal data may be necessary for the purposes of statutory compliance, resolution of disputes or performance of contractual obligations.

The request for exercising data subject rights must be submitted in writing to the contact person for the Privacy Statement (Section 2 of this Privacy Statement). Where necessary, we may ask you to specify the request in more detail and to provide additional information necessary to confirm your identity before further consideration of the request. We will inform you of action taken on the request without undue delay and in any event within the time limit set in the EU General Data Protection Regulation (i.e. usually within one month).

Communication and contact with the Foundation or the supervisory authority

If you have any queries about the Privacy Statement, do not hesitate to contact via email (rekisteri(a)jnfoundation.fi) or by post (Pasilankatu 2, 00240 Helsinki) our contact person for the Privacy Statement.

You also have the right to lodge a complaint with the competent supervisory authority, should you consider that we have processed your personal data in violation of any of the applicable statutory data protection requirements. In Finland, the competent supervisory authority is the Office of the Data Protection Ombudsman (www.tietosuoja.fi).

11. Changing the Privacy Statement

We continuously strive to develop our services and privacy policies, and, therefore, reserve the right to change this Privacy Statement by placing a notification of change on this page. The Privacy Statement can also be updated in order to reflect changes in legislation. We recommend that you revisit this Privacy Statement on a regular basis.

Privacy Policy for the John Nurminen Foundation Group’s customer and supporter register

1. Controller

2. Contact person

3. Name of the register

4. The purpose of and legal basis for processing your personal data

5. What personal data do we collect and from where?

6. Will your personal data be disclosed or transferred to third parties?

7. Joint controllers

8. How is your personal data processed and protected?

9. For how long will your personal data be retained?

10. What are your rights as a data subject?

11. Lodging a complaint with the supervisory authority

12. Amendments to the Privacy Policy

Privacy Policy for the John Nurminen Foundation’s stakeholder register

1. Controller

2. Contact person for the privacy policy and person responsible for data protection

3. Name of the register

4. The purpose of and legal basis for processing your personal data

5. What personal data do we collect and from where?

6. Will your personal data be disclosed or transferred to third parties?

7. Joint controllers

8. How is your personal data processed and protected?

9. For how long will your personal data be retained?

10. What are your rights as a data subject?

11. Lodging a complaint with the supervisory authority

12. Amendments to the Privacy Policy

John Nurminen Foundation Recruitment and manuscript filing system

1. Controller

2. Contact person for the Privacy Statement

3. Name of filing system

4. For what purposes and on what legal grounds we can use your personal data

5. What data are recorded

6. How long data are retained

7. From what sources personal data are collected

8. Regular destinations of disclosed data and transfer of data outside the EU or EEA

9. How your personal data are secured

10. Your rights as a data subject

11. Changing the Privacy Statement

Search