Savonlinna Opera Festival protects the privacy of data subjects and observes EU’s General Data Protection Regulation (2016/679) as well as other applicable data protection legislation (collectively “data protection legislation”) and good data processing practices in all processing of personal data. Data protection is part of all of Savonlinna Opera Festival's business operations.
“Personal data” refers to all information concerning a natural person (“data subject”), which can be used to directly or indirectly identify him/her, in accordance to what has been set out in the data protection regulation. Information, which cannot be used to directly or indirectly identify a data subject, is not personal data.
2. Data controller
Controller of the register: Savonlinna Opera Festival Patrons’ Association (Business ID: 0207403-8) and Savonlinnan Oopperajuhlat Oy (Business ID: 0638386-6)
Contact details: Olavinkatu 27, 57130 Savonlinna, phone (015) 476 750
Data controller’s contact person: Tarja Halonen (firstname.lastname@example.org)
Requests concerning direct marketing shall be sent to: email@example.com
3. Purposes and legal reason for processing personal data
Personal data is processed for e.g. the following purposes:
• For ordering and invoicing Savonlinna Opera Festival services and products
• for the production, maintenance, development and quality assurance of services
• for confirming the safety of services and preventing and investigating unauthorised use as well as for risk management
• for the management of regulatory obligations
• for the planning and development of business and operations and for the product development of products
• for the monitoring of service-related customer support, personalised customer service and targeted customer communications and service use
• for the marketing and targeting of marketing to customers, potential customers and the media
• for the advertisement based on service communications and service contracts of Savonlinna Opera Festival’s online contractual co-partners
• for communications with shareholders and members
Legal reasons for processing personal data:
The legal reason for processing personal data of data subjects is the contractual relationship between Savonlinna Opera Festival and the data subject, which is based on the ordering of a service or product offered by Savonlinna Opera Festival.
The processing of personal data is also based on legal obligations, such as accounting obligations and regulatory reporting obligations.
Processing for the purpose of customer relationship management and direct marketing is based on Savonlinna Opera Festival’s legitimate reason.
In addition, electronic direct marketing and subscription to Savonlinna Opera Festival's newsletter, as well as the storage of personal data collected via Savonlinna Opera Festival's website for direct marketing may be based on consent.
4. Processed personal data groups and data content and data sources
The following information is processed about the data subject:
|Personal data Group
||Examples of data content
|Identification and contact details
||Data subject’s name, address, country of residence, phone number and email address.
|Data concerning the customer relationship
||Customer number, electronic client identifier, language, account number, billing and payment details and other customer relationship details
|Customer transaction details and contract details
|Data about the agreement between Savonlinna Opera Festival and the data subject; event, service, product and order details and customer feedback as well as contacts and reclamations between the data subject and Savonlinna Opera Festival.
|Consents and refusals provided by the data subject
||Details concerning the consent provided by the data subject for electronic direct marketing and for processing personal data, as well as details concerning the refusals provided by the data subject on the withdrawals of the previously mentioned consents.
|Behavioural data and technical identifier details
|The monitoring of the data subject’s online behavior and Savonlinna Opera Festival service us, for example, with cookies or other similar technical identifiers. Collected data may include, for example, the user’s IP address, visited pages, browser type, website address, session time and duration.
|Data from shareholder and share list or member list
||Data on the data subject’s number of shares or membership and history data concerning ownership.
Personal data, which provision is essential for managing the obligations based on the agreement concluded between Savonlinna Opera Festival and the data subject, as well as for producing Savonlinna Opera Festival's services, are notified in each case to the data subject.
In principle, personal data is collected from the data subject him-/herself, for example, in connection with making an offer, concluding a customer agreement or during the customer account period, in connection with marketing or via online forms. The data subject may have also provided information to Savonlinna Opera Festival in connection with e.g. A competition or draw, in connection with using the website or subscribing to the newsletter.
Personal data can also be collected from the community on behalf of who the data subject operates. In addition, data can also be collected and updated in situations permitted by legislation from registers maintained by third parties, such as from the Population Registration Office.
5. Storage of personal data
The retention period and retention criteria of data depends on the personal data group, according to the purpose of the specific personal data group.
Personal data shall be processed for the duration of the customer and agreement relationship and for the necessary time after the end of the customer and agreement relationship.
Savonlinna Oopperajuhlat Oy’s share and shareholder data, and the member list of Savonlinna Opera Festival Patrons’ Association is constantly updated, and the information is permanently retained. The data of newsletter subscribers is stored until the data subject cancels his/her subscription. Data concerning potential customers is stored for the duration of active marketing and its design.
In terms of communities, the retention of personal data of a data subject is bound to, how long such data subject operates as the community representative for Savonlinna Opera Festival. Personal data is removed within reasonable time after the end of the role.
When personal data is no longer needed for the purposes defined above, the information is removed within reasonable time, unless legislation obliges Savonlinna Opera Festival to store the information for a longer period.
6. Recipients of personal data
Savonlinna Opera Festival may transfer personal data internally between Savonlinna Opera Festival Patrons’ Association and Savonlinnan Oopperajuhlat Oy.
The following parties, among others, shall participate in the processing of personal data:
• Emaileri Oy
• Mediamaestro Oy
• Webropol Oy
Personal data shall not be disclosed for the direct marketing or opinion survey and market research, or other similar purposes of other parties.
In addition, personal data can be disclosed to:
• Lippupiste Oy
In special circumstances, personal data can be disclosed to authorities in situations obliged or entitled by legislation.
In addition, Savonlinna Opera Festival may have to disclose personal data in emergency or other sudden situations in order to protect human lives and health, as well as property. Savonlinna Opera Festival may also have to disclose the personal data of data subjects, if Savonlinna Opera Festival is a party in a court trial or other procedure that takes place at a dispute settlement body.
If Savonlinna Opera Festival is part of a merger, business acquisition or other business restructuring, it may have to disclose the personal data of data subjects to third parties. The data subject’s data protection shall be ensured in such arrangements too, and they shall be informed to the data subject in an appropriate manner, if necessary.
In principle the disclosure of data shall take place via electronic data transfer connections, but information can also be disclosed by other means, such as by phone or by post.
7. Transfer of personal data outside the European Union or the European Economic Area
In principle, personal data is not transferred outside the European Union or the European Economic Area. The service supplier may, however, have the right to transfer personal data outside the EU or EEA area to a third country to the extent that it is necessary for implementing services and to the extent that the service supplier uses subcontractors for implementing the service, and such subcontractors are located outside the EU or EEA. Model contract clauses on the transfer of personal data outside the EU/EEA that have been approved by the European Union are applied to the transfers of personal data.
8. Principles concerning the protection of personal data and the security of processing
Savonlinna Opera Festival processes personal data in a way, which aims to ensure appropriate security of the personal data, including protection from unauthorised processing and accidental loss, destroy or damage.
Savonlinna Opera Festival uses appropriate technical and organisational protection methods to safeguard this, including firewalls, encryption technologies, the use of secure device rooms, appropriate access control, guidance of staff and subcontractors that participate in the processing of personal data.
Agreements and other document material that must be stored as original copies shall be kept in locked facilities, and access control is limited to only authorised parties.
All parties that process personal data are subject to confidentiality in matters concerning the processing of data subjects’ personal data on the basis of confidentiality terms set out in the Employment Contracts Act and agreements.
9. Rights of data subjects
The data subjects have rights set out by data protection legislation.
Right to access data and review data
The data subject has the right to receive confirmation on whether the data subject’s personal data is processed.
The data subject has the right to review and see data concerning him-/herself, and upon request has the right to receive such data in writing or electronic format.
Right to correct and remove information
The data subject has the right to demand incorrect or inaccurate data to be rectified. In addition, the data subject has the right to request for his/her data to be removed in situations referred to in data protection legislation.
The data controller shall remove, rectify and supplement any incorrect, unnecessary, incomplete or expired personal data that it observes at its own initiative in terms of the purposes of processing.
Right to transfer data and limit processing as well as refuse processing
In situations referred to in data protection legislation, the data subject has the right to request for his/her data to be transferred to another data controller.
In addition, the data subject has the right in accordance with requirements set out by the data protection legislation to request the limitation of personal data processing. In situations, where personal data that has been suspected to be incorrect cannot be rectified or removed, or there is uncertainty concerning the request to remove, Savonlinna Opera Festival shall limit access to the data in accordance with the data protection legislation.
The data subject has the right to refuse the use of data for certain processing. The data subject has the right to deny the transfer and processing of his/her data for direct marketing purposes.
Right to withdraw consent
If the processing of personal data is based on a separate consent given by the data subject, the data subject has the right to withdraw his/her consent concerning the processing of personal data. Withdrawal shall not affect any processing that has been completed before the withdrawal.
Implementation of rights
Any requests concerning the data subjects’ rights shall be made in writing or electronically using the contact details mentioned above. Sufficient identification details must be included in the request. The request shall be responded to within reasonable time and according to opportunities within one month from presenting the request and verifying the identity. Savonlinna Opera Festival may ask more additional information, where necessary, in order to fulfil the previously mentioned requests. If the data subject’s request cannot be accepted, denial shall be informed to the data subject in writing.
10. Right to lodge a complaint with a supervisory authority
The data subject has the right to lodge a complaint with a data protection officer, if the data subject considers that his/her personal data has been processed in violation of currently prevailing legislation. In the European Union, such complaint can be lodged with the data protection officer in the residential or employment state or in the state where the stated violation has taken place.