Processing of personal data, privacy notice for Youth Services’ camping equipment lending service

The City of Espoo and its contracted supplier Espoon Partiotuki offer a camping equipment lending service mainly to Espoo-based youth associations and organisations, such as scout groups, the city’s Youth Services, and youth activity groups. The purpose of the service is to lend various types of equipment for camping and other outdoor activities, including tents, skis and canoes.

 

20 February 2023

  1. Data controller

City of Espoo

  1. Person responsible for the register

Manager of Youth Services

  1. Contact person of the register

Youth Work Coordinator

  1. Data Protection Officer

Data Protection Officer of the City of Espoo

Address: P.O. Box 12, 02070 City of Espoo

Tel. +358 9 81621 (switchboard)

Email address: tietosuoja@espoo.fi

  1. For what purpose is personal data processed?

The City of Espoo and its contracted supplier Espoon Partiotuki offer a camping equipment lending service mainly to Espoo-based youth associations and organisations, such as scout groups, the city’s Youth Services, and youth activity groups. The purpose of the service is to lend various types of equipment for camping and other outdoor activities, including tents, skis and canoes. Equipment may also be lent to other communities. The service is not intended for private individuals.

 

  1. On what grounds is personal data processed?
  • Article 6(1)(b) of the General Data Protection Regulation of the European Union: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
  • Article 6(1)(e) of the General Data Protection Regulation of the European Union: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
  1. What data is processed?

As the processor of personal data, Espoon Partiotuki is responsible for the equipment booking process and maintains the booking calendar/system. For the purpose of key management, an authorisation form for maintenance equipment is also filled in.

Information for the webshop’s booking confirmation is provided by the contact person:

  • First name 
  • Last name 
  • Telephone number 
  • Email address 
  • Organisation’s name and business ID 

Equipment handover form (printable document), maintained by Espoon Partiotuki:

  • Information from the booking confirmation
  • Customer’s signature

Authorisation form for maintenance equipment, a document between the City of Espoo and Espoon Partiotuki concerning agreed instructions and practices, maintained by the contact person of the register:

  • Employee’s name
  • Signature

 

PUBLIC ACCESS TO AND CONFIDENTIALITY OF DATA:

Data may be partly confidential.

GROUNDS FOR CONFIDENTIALITY:

Section 24 of the Act on the Openness of Government Activities.

  1. What are the sources of data?

Personal data is obtained directly from the data subject.

The representative of the organisation concludes an agreement after registration in the webshop.

  1. Will data be disclosed or transferred outside the city?

Data will not be transferred.

  1. Will data be transferred outside the EU/EEA?

Data will not be transferred.

  1. How long will data be stored?

Data will be stored for the duration of the customer relationship.

The customer relationship ends when the equipment has been returned and can be lent to another customer. This takes account of the possible need for repairs/compensation.

The authorisation form for maintenance equipment is stored for the duration of the employment relationship.

  1. How is data protected?

Espoon Partiotuki is responsible for ensuring information security and data protection in the webshop.

Paper forms are stored in a locked cabinet.

  1. Rights of the data subject

Further instructions on submitting information requests referred to in the General Data Protection Regulation. Clients´ right of access to personal data

13.1 How can I access my data?

You have the right to obtain from the data controller a copy of the personal data that is subject to processing. The data controller must provide the data without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests.

If the data controller does not take action on the request of the data subject, the data controller must inform the data subject without delay, and at the latest within one month of receipt of the request, of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Requests from the data subject and any resulting actions are free of charge. However, where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the data controller may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request.

13.2 When can I request rectification of my data?

You have the right to have inaccurate, incomplete, outdated or unnecessary personal data that we store either rectified or completed by us.

​​​​​​​13.3 When can I request erasure of my data?

You have the right to have the data controller erase your personal data without undue delay under certain conditions. The data subject does not have the right to erasure if the processing of data is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. In these cases, the data will only be erased after the statutory time limit.

​​​​​​​13.4 When can I request restriction of processing of my data?

If the data concerning you is inaccurate, you have the right to request that its processing be restricted until its accuracy has been verified.

​​​​​​​13.5 Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority if you feel that the processing of your personal data is in infringement of data protection legislation. You can lodge a complaint with the Office of the Data Protection Ombudsman: www.tietosuoja.fi(external link, opens in a new window).