Privacy notice: Activities for children and young people at Espoo libraries
Personal data is only collected where necessary to carry out the library’s activities.
Published on 31 May 2021
1. Data controller
City of Espoo
2. Person responsible for the register
Library Services Manager, services for children and young people
3. Contact person of the register
Library Services Manager, services for children and young people
4. Data protection officer
Data Protection Officer of the City of Espoo
Address: P.O. Box 12, 02070 City of Espoo
Tel. +358 9 81621 (switchboard)
Email: tietosuoja@espoo.fi
5. For what purpose is personal data processed?
Personal data is only collected where necessary to carry out the library’s activities. Such activities may include competitions with prizes or activities during which works are created and consent is requested to display the works (for minors, guardians’ consent is requested). Personal data may be used for communication, for example to announce competition results. The data is destroyed when it is no longer needed.
Personal data and contact information collected in connection with registration for school and day care centre activities are used for planning and organising library group visits. All registration data is deleted annually at the end of the school year.
6. On what grounds is personal data processed?
Article 6(1)(a) of the General Data Protection Regulation of the European Union: the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
7. What data is processed?
Data is collected from voluntary participants with their consent. The data collected include: name, address, telephone number, email address, residential area, age, school or day care centre, or some of these details. Only the data that is necessary for each activity is collected.
PUBLIC ACCESS TO AND CONFIDENTIALITY OF DATA: The data is only public if this is stated in the competition description. As a general rule, only the names of competition winners or those whose works are on display are public.
8. What are the sources of data?
Personal data is obtained directly from the data subjects. The provision of personal data is voluntary.
9. Will data be disclosed or transferred outside the city?
Data will not be disclosed to parties external to the city.
10. Will data be transferred outside the EU/EEA?
The data will not be transferred outside the EU or the EEA.
11. How long is data stored?
The data is stored only for as long as it is necessary for the activities.
12. How is data protected?
The data is stored in digital storage spaces managed by the City of Espoo.
13. Rights of the data subject
Further instructions on submitting information requests referred to in the General Data Protection Regulation: Data protection / Rights of the data subject
13.1 How can I access my data?
You have the right to obtain from the data controller a copy of the personal data that is subject to processing. The data controller must provide the data without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests.
If the data controller does not take action on the request of the data subject, the data controller must inform the data subject without delay, and at the latest within one month of receipt of the request, of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
Requests from the data subject and any resulting actions are free of charge. However, where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the data controller may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request.
13.2 When can I request rectification of my data?
You have the right to have inaccurate, incomplete, outdated or unnecessary personal data that we store either rectified or completed by us.
13.3 When can I request erasure of my data?
You have the right to have the data controller erase your personal data without undue delay under certain conditions. The data subject does not have the right to erasure if the processing of data is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. In these cases, the data will only be erased after the statutory time limit.
13.4 When can I request restriction of processing of my data?
If the data concerning you is inaccurate, you have the right to request that its processing be restricted until its accuracy has been verified.
13.5 Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority if you feel that the processing of your personal data is in infringement of data protection legislation. You can lodge a complaint with the Office of the Data Protection Ombudsman: www.tietosuoja.fi(external link, opens in a new window)