Privacy Policy

Published 11.11.2024
Updated 03.03.2025

Feedback and questions: info@virtuaalimuseomuste.fi

Legal basis for processing personal data

The legal basis for processing of the personal data is established in a contract, e.g. when a user has ordered a service or product provided of Virtuaalimuseo Muste. Processing is also based on statutory obligations, such as accounting and reporting obligations. Processing for customer relationship management and marketing is based on the legitimate interest of Virtuaalimuseo Muste. In addition, processing of the personal data may be based on consent, e.g. newsletter subscription.

Purpose of personal data processing

The customer and stakeholder registers are compiled and used in accordance with data protection legislation and other legislation applicable at the time in question. The register is used for the following purposes:

– fulfilling statutory obligations,
– customer communications, marketing and support,
– planning, executing, developing and quality assurance of products and services.

Data content of the register

The register stores only information that is essential to Virtuaalimuseo Muste’s functions and services. This personal information that is either publicly available (e.g. as a representative of an organisation) or provided by the customer, such as:

– name or nickname,
– organisation,
– email address or other contact information,
– other provided information such as date of birth,
– saved permissions such as cookie and language settings,
– survey responses,
– customer feedback.

In addition, the website collects the following information:
– data collected by the analytics system,
– customer communications information such as following links,
– website, from which Virtuaalimuseo Muste’s site has been accessed,
– IP address,
– location,
– session ID, time and duration,
– device information and individual ID.

Various purpose-driven groupings and profilings may be recorded (e.g. newsletter subscriber, business partner).

Personal information required for the newsletter is saved into a Google Forms database, from which they are moved into a Cardu newsletter service. At this point, the original information is removed from Google Forms. This transition happens approximately 4 times a year. The newsletter saves the following information:

– newsletter subscription consent,
– email address,
– name (optional),
– organisation (optional).

It is possible to unsubscribe from the newsletter at any time by contacting: info@virtuaalimuseomuste.fi

Regular sources of information

The information stored in the personal data systems is mainly obtained from the individuals themselves or via a stakeholder representing them. In addition, information may also be collected and updated from public data sources such as websites or public registers maintained by third parties.

Regular disclosure of data

The data in Virtuaalimuseo Muste’s register is not disclosed to third parties, for example for direct marketing or research purposes. In order to provide the services, data may be disclosed to established and relevant partners a contractual relationship with the museum.

Data are not, as a rule, disclosed or transferred outside the EU Member States. Some providers of the electronic services used are from the United States. In these contexts, the transfer of personal data to the United States takes place on the basis of the EU-US Data Privacy Framework.

Protection of the register

Only those persons who need the information in their work have access to the personal data. Information systems are protected technically by commonly used methods, e.g. personal passwords.

Rights of the data subject

Individuals have the right to check what information about them has been stored in the register, and to request the correction of incorrect, inaccurate or incomplete information about them. In addition, individuals have the right to request that information about them be erased (the right to be forgotten). Individuals also have the right at any time to withdraw their consent to the processing of their personal data. The withdrawal of consent has no effect on processing carried out before the withdrawal.

Inspection requests must be made in writing to the address: info@virtuaalimuseomuste.fi

Right of complaint

Data subjects have the right to file a complaint with the data protection authority if they consider that the processing of personal data violates the EU’s General Data Protection Regulation.