Processing of personal data in the Timit system

Date of publication: 4 September 2024.

City of Espoo

Reetta Björkroth, Transport Manager

City of Espoo, Logistics, Transport Manager
Address: P.O. Box 620, 02070 City of Espoo
Tel. +358 9 81624000
Email: henkilokuljetukset@espoo.fi

Data Protection Officer of the City of Espoo
Address: P.O. Box 12, 02070 City of Espoo
Tel. +358 9 81621 (switchboard)
Email: tietosuoja@espoo.fi

Personal data is processed for the purpose of providing transport services for schoolchildren, children attending early childhood education, and disabled and severely autistic children attending basic education. Transport services are provided as part of the city’s other activities, in accordance with the Basic Education Act, the Act on Early Childhood Education and Care, the Act on Disability Services and Assistance and the Act on Special Care for People with Intellectual Disabilities.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

The system is used for processing personal data that is necessary for providing transport services under the Basic Education Act, the Act on Early Childhood Education and Care, the Act on Disability Services and Assistance and the Act on Special Care for People with Intellectual Disabilities. Such data includes a person’s name, address, contact information, school or other unit, assistive devices and family’s contact information as well as any additional information required to provide transport services, such as transport dates and times.

Data is obtained from the person who makes decisions on transport services in the Growth and Learning Sector. In addition, data is obtained directly from the clients or their families.

Data will be disclosed to the transport companies providing group and individual transport services.

The data will not be transferred outside the EU or the EEA. When an employee logs in to the system, the system obtains a verification of the user ID from the cloud service provider’s service outside the EU/EEA.

Data is stored for the duration of the provision of services and for about one year thereafter, for example for the purpose of ELY Centre reporting.

Personal data is processed with due care and precision. The restriction of processing was taken into consideration in the design of the system so that data is only available to the extent that is necessary for the performance of one’s tasks.

The devices and servers used for processing data are appropriately protected (physical and technical protection).

1. How can I access my data?

Further instructions on submitting information requests referred to in the General Data Protection Regulation: Data protection

You have the right to obtain from the data controller a copy of the personal data that is subject to processing. The data controller must provide the data without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests.

If the data controller does not take action on the request of the data subject, the data controller must inform the data subject without delay, and at the latest within one month of receipt of the request, of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Requests from the data subject and any resulting actions are free of charge. However, where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the data controller may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request.

1. When can I request rectification of my data?

You have the right to have inaccurate, incomplete, outdated or unnecessary personal data that we store either rectified or completed by us.

3. When can I request erasure of my data?

You have the right to have the data controller erase your personal data without undue delay under certain conditions. The data subject does not have the right to erasure if the processing of data is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. In these cases, the data will only be erased after the statutory time limit.

4. When can I request restriction of processing of my data?

If the data concerning you is inaccurate, you have the right to request that its processing be restricted until its accuracy has been verified.

5. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority if you feel that the processing of your personal data is in infringement of data protection legislation. You can lodge a complaint with the Office of the Data Protection Ombudsman: www.tietosuoja.fi