Processing of personal data: Centre of Excellence for Sustainable Development

Espoon kaupunki, the City of Espoo

PL 1, 02070 ESPOON KAUPUNKI

Director of Sustainable Development, the City of Espoo Centre of Excellence for Sustainable Development

kestava@espoo.fi

The centre’s contact information can be found on the website www.espoo.fi.

tietosuoja@espoo.fi

The purpose of processing personal data in the register is to provide information and invitations to stakeholders of the City of Espoo’s Centre of Excellence for Sustainable Development and to maintain a register of contact information. The data may be used to coordinate cooperation, develop partnerships, communicate about events, send newsletters, support project activities and marketing, and maintain contact in connection with the activities of the Centre of Excellence for Sustainable Development. The register is also used to manage the contact information of cooperation networks, project partners, event participants and other stakeholders in the city’s CRM system.

Article 6(1)(a) of the General Data Protection Regulation of the European Union: the data subject has given consent to the processing of his or her personal data for one or more specific purposes

Article 6(1)(e) of the General Data Protection Regulation of the European Union: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

Data processed in the register may include information about the City of Espoo’s partners, stakeholders, project partners, event participants, members of networks, newsletter subscribers, and other individuals interested in the activities.

The register contains the following personal data:

• name
• position or title
• organisation
• email address
• telephone number
• participation in events, networks and projects
• notes relating to communications
• areas of interest and cooperation
• newsletter subscription details

In connection with events, data necessary for organising the event may also be processed, such as information about special dietary requirements. Information about special dietary requirements is processed only for the duration of the event and is deleted after the event

Data may be collected directly from the data subject in connection with event registrations, enquiries, newsletter subscriptions, meetings, and other forms of cooperation. Data may also be collected from public sources, such as organisations’ websites and other publicly available sources.

Personal data may be disclosed to project partners when this is necessary for the implementation of an event, network or project. The data may also be used for project reporting to funders, to the extent required by reporting obligations. Otherwise, personal data is not disclosed outside the city.

Data will not be transferred outside the EU or the European Economic Area (EEA).

Personal data will be stored for as long as it is necessary for the operations of the City of Espoo or until the data subject themselves denies the data processing.

Personal data is stored in information systems approved by the City of Espoo, as well as in the city’s CRM system.

Each user has personal access rights to the files, and their use is monitored. Access rights are granted on a task-specific basis. Each user must accept the City of Espoo’s user and non-disclosure agreement concerning data and information systems. Personnel are trained in data protection and the appropriate processing of personal data.

Further instructions on submitting information requests referred to in the General Data Protection Regulation: https://www.espoo.fi/en/city-espoo/data-protection#section-7317

You have the right to obtain from the controller a copy of the personal data that is subject to processing. The controller shall provide the data without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests.

If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay, and at the latest within one month of receipt of the request, of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Requests from the data subject and any resulting actions are free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request.

You have the right to have inaccurate, incomplete, outdated or unnecessary personal data that we store either rectified or completed by us.

You have the right to have the controller erase your personal data without undue delay under certain conditions. The data subject does not have the right to erasure if the processing of data is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In these cases, the data will only be erased after the statutory time limit.

If the data concerning you is inaccurate, you have the right to request that its processing be restricted until its accuracy has been verified.

You have the right to lodge a complaint with a supervisory authority if you feel that the processing of your personal data is in infringement of data protection legislation. You can lodge a complaint with the Office of the Data Protection Ombudsman: www.tietosuoja.fi.