Privacy Notice Personal data register for the resource reservation system e-service

Date of publication of the Privacy Notice: 19 October 2023

City of Espoo

Sports Director

Liaison Manager

P.O. Box 34, 02070 CITY OF ESPOO 

Data Protection Officer of the City of Espoo.

Address: PO BOX 12, 02070 City of Espoo

Tel. +358 9 81621 (switchboard)

Email tietosuoja@espoo.fi

The resource reservation system is an e-service system.

A reservation and registration system has been deployed in the resource reservation system to maintain applications, reservations and course enrolments entered by customers or an official. The purpose of the processing of personal data is to maintain customer information related to the following services:

· Boat berths, registering for their application queue

· School facilities (excluding sports halls), applications for them

· Sports facilities (including school sports halls), applications for them

· Youth facilities, applications for them

· Course enrolments for guided exercise

· Registrations for leisure activities for young people, information relating to meals and health data in connection with certain activities.

The personal data are additionally used for reporting on the services, including:

· Permanent reservation reports

· Utilisation rate of facilities

· Course numbers, classification

· Number of visitors to facilities

· Number of bookings by facility, customers

· Various reports related to invoicing

· Ämmäsmäki, person’s first and last name, electronic key for access control of boat storage places

· Security in the marina when a boat berth holder's contact information is needed

The service folder in the register is personal. For electronic identification, the person’s online banking IDs or a mobile certificate is alternatively required.

Key legislation:  Act on the Promotion of Sports and Physical Activity 390/2015, Youth Act 1285/2016, Municipalities Act 410/2015

• Article 6(1)(b) GDPR: Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract

• Article 6(1)(c) GDPR:  processing is necessary for compliance with a legal obligation to which the controller is subject

• Special categories of personal data

o Special categories of personal data: Under section 6 of the Data Protection Act, Article 9(1) of the General Data Protection Regulation does not apply to any processing of data that is provided by law or that derives directly from a statutory duty set out for the controller by law.

o Article 9(2)(a) GDPR: data subject's consent

The e-service register consists of personal data and information related to service use. The following personal data concerning customers are collected:

· name

· personal identification code

· address

· telephone number

· email

· customer group (instructor-led exercise) itemised:

- children and young people aged under 18

- students

- adults

- seniors

- aged over 68

- special group

- unemployed

· method of sending customer mail (post, email, text message)

· additional information provided by the customer on a voluntary basis, incl. special diets, allergies, etc.

The personal data of a person responsible for a child aged under 18 or an accountable person of an institution or other community are registered to the necessary extent.

For business and association customers, the name, business ID or association ID, address, telephone number, e-mail, registration number and/or registration municipality are recorded.

Additionally the name, address, email, telephone number, method of sending customer mail (post, email, text message) of contact persons of companies/associations.

The following data concerning service matters are stored:

· application matters initiated by users

· data entered by users (forms and attachments, references)

· events related to the progress of matters (status and event identifier details, messages)

· decision information

· messages sent from the system (email/SMS)

· event information for bookings and registrations, information on valid bookings and registrations

· matters requiring action (incl. unpaid fees) and notes related to them

Paper forms to be retained and used as the basis for processing:

· applications for time slots, course and camp registrations, cancellations of places on courses received by email to cancel course fees

PUBLICITY AND SECRECY OF DATA:

Some of the data are secret

GROUNDS FOR SECRECY:

Section 24(1) of the Act on the Openness of Government Activities

We obtain personal data, including the person’s name and personal identity code, through the identification service login (SUOMI.FI E-IDENTIFICATION) or from data provided by the customer to an official. Contact information (email, phone, and address) are required fields. Data concerning companies and associations are obtained from the customer if necessary. In service matters the data are obtained from the data subject.

Personal data will only be disclosed in response to a specific request for information to persons who have the right to access them (EU General Data Protection Regulation, Act on the Openness of Government Activities).

Customer invoicing documents are transferred electronically from the system to the information system of the City of Espoo’s financial administration service (JoTo - ERP), including the personal data contained in the invoicing documents and grounds for invoicing: customers’ personal identity codes/business IDs/Register of Associations numbers as well as name and address data.

For reporting purposes, the necessary data are transferred from the system to the reporting system (Microsoft Power Bi).

Data are transferred from the system to the city’s decision-making system for the purposes of making decisions.

The supplier of the resource allocation system is TSS Prime Oy.

As a rule, personal data will not be transferred outside the EU or the European Economic Area.

Microsoft Power Bi personal data are transferred outside the European Union or the European Economic Area. 

For more information, visit Microsoft website:

European Union Model Clauses - Microsoft Compliance | Microsoft Docs(external link, opens in a new window).

The data are retained and destroyed in compliance with the City of Espoo’s archive formation plan/information management plan. Personal data are stored in the system for 25 months after the customer relationship ends. Special categories of personal data, such as information on special diets, are only stored for as long as processing them is necessary.

The personal data are processed in a way that ensures their appropriate security, including safeguards (Article 5(1)(f) GDPR).

Each employee can only process the personal data they need in their duties.

Electronic administration systems: The e-service use register is protected from unauthorised access by firewalls and other technical safeguards. System users have a duty of non-disclosure.

Manual documents: The required printouts, including lists of participants, booking reports and original boat berth lease agreements, are stored in a locked cabinet.

The EU General Data Protection Regulation guarantees you different rights in the processing of your personal data. To read more about your rights and how to use them, see Data protection | City of Espoo on Espoo's website.