Privacy statement – Messuklubi (Fair Club) customer register
Prepared May 18th, 2018. Latest change: May 13th, 2020.
1. Controller
Messukeskus, Finnish Fair Corporation
Messuaukio 1, 00520 Helsinki, Finland
Tel. +358 40 450 3250
Business ID: 01163223
2. Contact person responsible for the file
Messukeskus customer service
Messuaukio 1, 00520 Helsinki, Finland
Tel. +358 40 450 3250
customer.service@messukeskus.com
3. Name of the file
Customer register for Messuklubi, the Finnish Fair Corporation’s customer loyalty programme
4. Legal basis and purpose of processing personal data
The legal basis for processing personal data in accordance with the EU General Data Protection Regulation is the person’s consent (documented, voluntary, individual, informed and unambiguous). A further basis is the agreement by which the data subject became a member of Messuklubi.
The purpose of processing personal data is marketing in conventional forms, such as direct marketing, digital means and text messages if the customer has not restricted marketing communications. In addition, personal data is used for the purposes of contacting customers, maintaining customer relationships, profiling customer segments and collecting data that is essential to the Finnish Fair Corporation’s business.
5. Contents of the data file
The data saved in the file includes: the person’s name, contact details (phone number, email address, address), year of birth, gender, customer number, information on interests as provided by the customer and as deduced based on the customer’s behaviour, IP address of the internet connection, cookies from the websites, location data and information about the use of tickets, IDs/profiles on social media services, information about services ordered and changes therein, invoicing information, behavioural data related to marketing messages and online content, information about visits to Messukeskus, and other information related to the customer relationship and services ordered. The data is processed for as long as the data subject is a member of Messuklubi. At the data subject’s request, data processing can cease at an earlier time.
The Messuklubi register is intended for people aged over 13, so the register does not contain the personal data of people aged under 13.
6. Regular sources of data
The data saved in the file is obtained from the customer by means such as online forms, email, phone, social media services, solutions located at Messukeskus, such as electronic entry gates, contracts, customer meetings, complaints and other situations in which the customer discloses its data. Contact details and customer data may also be collected during various competitions and through various means of marketing communications. Direct marketing restrictions are saved on the basis of a separate notification submitted by the customer.
Marketing communications means the content of websites and their use (for example, webpage visits, clicks and other actions taken by the data subject on the websites), information provided by the data subject through online forms, the data subject’s reactions to newsletters (such as opening of newsletters, clicks, entering websites, reading time). In addition, marketing communications means social media channels, such as Facebook, Instagram, LinkedIn, Twitter and other social media channels. Through these channels, we can obtain, for example, information on the data subject’s profile, the various segments to which the social media platform has categorised the data subject and information on the data subject’s reactions to the controller’s activities in social media channels.
7. Regular disclosure of data and transfer of data outside the EU or the EEA
We may transfer or disclose personal data to our partners if this is necessary for purposes corresponding to this privacy statement. Such partners may include marketing partners, IT partners and others. In such circumstances, personal data is processed in accordance with applicable legislation.
We may also use third-party service providers, such as providers of payment services, debt collection services and analytics services, to conduct certain tasks involving processing of personal data on our behalf.
We may also transfer or disclose personal data to other companies within our Group and to the successor business as a consequence of matters such as merger and acquisition transactions, the sale of the business, mergers, demergers, bankruptcy or receivership.
We will not otherwise sell or disclose your data to external parties. We will also not transfer data outside the EEA other than in circumstances permitted by data protection legislation. Personal data may also be transferred or disclosed to the authorities if the applicable law so demands.
Data may be published insofar as this has been agreed with the data subject.
8. Principles for securing the file
Due care is exercised when the file is processed, and data processed using IT systems is protected appropriately. When data from the file is stored on internet servers, the physical and digital information security of the hardware is arranged appropriately. The controller takes care to ensure that the saved data, server access rights and other information critical to the security of personal data is processed confidentially and only by the employees or partners whose duties require it.
Employees who process data in the customer file are bound by a duty of confidentiality. Data is communicated or disclosed to third parties only if there is a duty of notification prescribed by law, such as the customer’s own request or a statutory request made by the authorities. The system is protected by technical means.
9. Your rights as a data subject
Right of inspection
The Finnish Fair Corporation offers you the right to inspect the personal data that we process about you. You can contact us in writing and ask us to tell you which personal data we process about you and the grounds for processing the data. The Finnish Fair Corporation is entitled to verify the identity of the enquirer. If less than 12 months has elapsed since your previous information request, we may require a fee to be paid for the work involved in realising the request.
Right to demand correction of data
You are also entitled to correct or supplement data that is incorrect, inaccurate, incomplete, out of date or unnecessary.
Right to demand erasure of data
You may also ask us to erase your personal data from our system. We will take the action you request unless we have a justified reason to refrain from erasing the data, such as fulfilling our obligations under legislation. The data may not be immediately erased from all of our backup systems or corresponding systems.
Right of objection
You may also request restrictions on the processing of your personal data if the data is processed for purposes other than providing our services or fulfilling obligations arising under law. You may also object to your personal data being processed in the future, even if the processing is based on consent that you have previously granted. Objecting to the processing of personal data may result in more restricted opportunities to use our website and services.
Right to restrict data processing
You may ask us to restrict the processing of certain pieces of your personal data. Requests to restrict data processing may result in more restricted opportunities to use our website and services.
Right to transfer data from one system to another
You are entitled to obtain your personal data from us in a structured and widely used format so you can transfer the data to a different controller.
You may exercise your right by sending an email to customer.service@messukeskus.com
or by contacting us at the addresses specified above. Users who have registered for our services should primarily send their requests from the email address that is registered under the user data for the Service in question, and the response to the request will be sent to the same email address.
In addition to the foregoing rights and your other rights, legislation also guarantees you the right to submit a complaint to the supervisory authority, particularly in the Member State where you are permanently resident or working, or where the alleged contravention of the GDPR has taken place. The supervisory authority in Finland is the Data Protection Ombudsman.