Privacy Notice – OmaEspoo Service Portal
Publication date of the privacy notice: 18 November 2025
1. Purpose and legal basis for processing personal data
Personal data is used in Espoo generally for producing, planning, and evaluating activities and services, as well as for statistical purposes. Personal data collected and generated during transactions is processed in Espoo’s internal work management system, where customer contacts and requests are handled.
In this service, personal data is processed on the following legal bases:
- Tasks carried out in the public interest or in the exercise of official authority. Act on the Provision of Digital Services (306/2019), Section 5. Administrative Procedure Act (434/2003), Section 8.
2. What data is processed and where is it obtained?
The service processes the following personal data of Espoo’s customers:
- Name information, email addresses, phone numbers
- IP addresses of logged-in customers
- Personal identity codes of logged-in customers, which are necessary to process for user identification
- Personal data entered by customers in their requests
The data varies depending on the type of message or form. We receive the data from the customers themselves and from the Suomi.fi service administered by the Digital and Population Data Services Agency (DVV).
3. How long is the data retained?
Personal data is retained only as long as necessary for the provision of the service or as required by legislation. Retention periods are determined in accordance with Section 21 of the Information Management Act. For this service, data is retained as follows:
- Contacts and responses generated in digital counselling and other general counselling, as well as other information related to the service event, are retained for five years from the resolution of the service request.
- Data related to the school transport complaint process is retained for five years. If necessary, data is retained longer for the duration required by the handling of the complaint.
- Log data concerning actions performed in the system by logged-in users is retained for five years.
4. Parties processing or receiving the data
4.1 Parties processing data on behalf of Espoo
Personal data is processed by officials and employees of the City of Espoo, as well as external parties from whom Espoo purchases services or with whom Espoo maintains the OmaEspoo service portal. We select as contractual partners only those processors of personal data who follow good data processing practices and meet the requirements of the General Data Protection Regulation. Compliance with data protection requirements is ensured through written agreements.
In this service, we use the following external party: Sofigate Oy. The contractual partner may have subcontractors approved by Espoo.
4.2 Disclosure to other organisations
Data is disclosed to requesting authorities in accordance with the Act on the Openness of Government Activities. Personal data may be disclosed to authorities and other parties defined by law within the limits permitted and required by legislation. Data may also be disclosed to service providers of the controller with whom agreements have been made for the provision of services belonging to the controller. The publicity of information delivered to authorities is defined by the Act on the Openness of Government Activities or by possible special laws.
5. Is data transferred outside the EU/EEA?
Data is not transferred outside the EU/EEA.
6. Rights of the data subject
The EU General Data Protection Regulation guarantees you various rights concerning the processing of your personal data. You can learn about your rights and how to exercise them on Espoo’s website: Tietosuoja City of Espoo.
7. Controller
The controller is the City of Espoo..
7.1 Contact person for the register
If you have questions or wish to request clarification regarding the processing of personal data, you may contact the register’s contact person:
Katariina Eskola, Senior Specialist
Puh. +358 9 81621
katariina.eskola@espoo.fi