PRIVACY NOTICE
International House Tunturi-Lappi and Pello Project
Privacy notice in accordance with the General Data Protection Regulation of the European Union (EU 2016/679).
1. Name of the register
International House Tunturi-Lappi and Pello Project
2. Data controller
Municipality of Kittilä, Municipal Executive Board
Valtatie 15
99100 Kittilä
Finland
Tel. +358 400 356 500 / switchboard
kirjaamo@kittila.fi
This privacy notice describes the processing of personal data in connection with the International House Tunturi-Lappi and Pello Project.
The Municipality of Kittilä acts as the data controller for the processing of personal data carried out directly by the project.
For personal data processed in the EURA 2021 system, the data controller is the Ministry of Economic Affairs and Employment of Finland. The role of the Municipality of Kittilä and the project in the EURA 2021 system is described in more detail in Section 7.
3. Person responsible for the register
Director of Administration of the Municipality of Kittilä.
4. Contact person for the register
Elina Koivuniemi, Project Manager
elina.koivuniemi@kittila.fi
Tel. +358 40 355 1558
5. Data Protection Officer appointed by the organisation
tietosuojavastaava@kittila.fi
Tel. +358 400 356 431
6. Purposes and legal bases for processing personal data
The International House Tunturi-Lappi and Pello Project develops a service model for international jobseekers, employees, entrepreneurs and employers in the Tunturi-Lappi and Pello region.
Personal data is processed in order to implement the project activities, provide customer services, organise events, communicate with individuals and organisations participating in the project, and fulfil the project’s monitoring, evaluation and reporting obligations.
The purpose and legal basis for processing personal data depend on the context, purpose and system in which the data is processed.
The processing of personal data in the EURA 2021 system is based on legislation governing the implementation of the EU’s regional and structural policy programme and on the project’s monitoring and reporting obligations. The processing of participant data in EURA 2021 is not based on the data subject’s consent.
Webropol is mainly used for receiving event registrations and conducting surveys related to the project. When registering for an event, the participant accepts the storage of their personal data in the Webropol system. Providing the information necessary to process the registration is a prerequisite for registration.
Personal data is collected and processed only to the extent necessary for the relevant purpose.
7. Data content of the register and systems used
Personal data processed by the project is stored electronically. The project does not maintain a paper-based register containing personal data.
The systems used for processing personal data and their purposes are described below. This privacy notice will be updated if new systems are introduced for processing personal data during the project.
7.1 EURA 2021 – individual project participants
Purpose of the system
EURA 2021 is a digital service used for the administration, monitoring and reporting of projects funded by the EU’s regional and structural policy funds.
Personal data concerning individuals participating in the International House Tunturi-Lappi and Pello Project is processed for participant monitoring, reporting on project results and impacts, and for implementing the project.
Data controller
The data controller of the EURA 2021 system is the Ministry of Economic Affairs and Employment of Finland.
The Municipality of Kittilä acts as the beneficiary of the project. The Municipality of Kittilä processes personal data in the EURA 2021 system to the extent required for implementing the project and complying with the terms of the funding decision.
The project implementer ensures that persons participating in the project provide the required personal data to the system and, where necessary, assists participants in entering the data.
Personal data processed
The following data is processed in the EURA 2021 system concerning persons participating in the project:
- project code
- personal identity code
- gender
- surname and first names
- street address, postal code and city or municipality
- email address
- information concerning age
- possible information on a non-disclosure order
- participation start date
- highest level of education
- labour market status at the beginning of participation
- participation end date
- labour market status at the end of participation
- information on a qualification completed or vocational qualification achieved during participation in the project.
The participant’s identity is verified in accordance with the requirements of the EURA 2021 system.
Sources of personal data
The participant provides their initial and final participation information through the EURA 2021 participant service. The service is accessed using Suomi.fi electronic identification.
Where necessary, the project implementer assists the participant in entering the information in accordance with EURA 2021 instructions.
Purpose and legal basis for processing
Personal data is processed for participant monitoring, reporting project results and impacts, implementation of the project, evaluation, financial management and audits.
The processing is based on legislation governing the implementation of the EU’s regional and structural policy programme. The national legal basis is laid down in the Act on the Financing of Regional Development and European Union Regional and Structural Policy Projects (757/2021), and the EU-level legal basis is Regulation (EU) 2021/1060 of the European Parliament and of the Council.
The processing of participant data in EURA 2021 is not based on the participant’s consent.
Recipients and disclosure of personal data
Personal data in the EURA 2021 system may be processed, to the extent necessary for project implementation, by authorised employees of the Municipality of Kittilä and by authorised users of the competent authorities.
Personal data may be disclosed in situations provided for by law, for example to Statistics Finland and to parties carrying out programme evaluation and auditing.
Statistical data related to project monitoring may be submitted to the European Commission without personal identifiers.
The Municipality of Kittilä may not disclose personal data processed in the EURA 2021 system to unauthorised third parties.
Retention of personal data
Personal data in the EURA 2021 system is retained in accordance with applicable legislation and the data management plan of the system.
Documents created in the system are retained for at least 20 years after the project has been closed. Some documents created in the system are retained permanently.
7.2 EURA 2021 – participating companies and other organisations
Purpose of the system
Information about companies and other organisations participating in the project is stored in the EURA 2021 system in order to meet the project’s monitoring and reporting obligations.
Information concerning a company or other organisation is generally not personal data. Information concerning an organisation’s contact person is personal data.
Data controller
The data controller of the EURA 2021 system is the Ministry of Economic Affairs and Employment of Finland.
Personal data processed
The following information concerning a participating organisation and its contact person is processed:
- name of the organisation
- Business ID
- type of organisation
- name of the organisation’s contact person
- email address of the contact person.
Sources of personal data
The information is obtained from the company or other organisation participating in the project, its contact person and information generated during implementation of the project.
Purpose and legal basis for processing
The data is processed for project implementation, monitoring and reporting in accordance with legislation governing the EU’s regional and structural policy programme.
Recipients and disclosure of personal data
Data is processed in the EURA 2021 system in accordance with applicable legislation, access rights and the EURA 2021 privacy policy of the Ministry of Economic Affairs and Employment.
The data may be processed, to the extent necessary for project implementation, by authorised employees of the Municipality of Kittilä and by authorised users of the competent authorities.
Data may also be disclosed to authorities and parties carrying out audit and evaluation tasks where permitted by applicable legislation.
Retention of personal data
Data is retained in accordance with the data management plan of the EURA 2021 system and applicable legislation.
Documents created in the EURA 2021 system are retained for at least 20 years after the project has been closed. Some documents created in the system are retained permanently.
7.3 Webropol – event registrations and surveys
Purpose of the system
Webropol is mainly used by the project to receive registrations for events organised by the project and, where necessary, to conduct surveys related to project activities.
Data controller
Municipality of Kittilä.
Webropol Oy acts as a processor of personal data on behalf of the Municipality of Kittilä.
Personal data processed
Depending on the event and registration requirements, the following data may be processed in Webropol:
- name
- email address
- telephone number
- organisation
- job title
- information related to the event and participation
- possible special dietary requirements
- other information provided by the participant that is necessary for organising the event.
Only personal data necessary for organising the relevant event is collected during registration.
The data processed in surveys depends on the purpose of each survey. Personal data is collected only where processing is necessary for conducting the survey.
Sources of personal data
The data is obtained directly from the data subject when they complete a Webropol registration or survey form.
Purpose and legal basis for processing
Personal data provided during event registration is processed for receiving the registration, managing participants, organising the event and communicating information related to the event.
The processing is based on the data subject’s consent in accordance with Article 6(1)(a) of the General Data Protection Regulation. When registering, the participant accepts the storage of their personal data.
Providing the personal data necessary for registration is a prerequisite for processing the registration. If the participant does not provide the necessary information or accept its storage, the registration cannot be processed.
Providing information about possible special dietary requirements is voluntary. The information is used only for arranging event catering.
Information concerning special dietary requirements may contain health-related information and therefore fall within the special categories of personal data referred to in Article 9 of the General Data Protection Regulation. Where special dietary information contains data belonging to a special category of personal data, its processing is based on the data subject’s explicit consent.
For surveys, the purpose and legal basis for processing personal data are determined according to the purpose of the survey and the information collected.
Recipients of personal data
Personal data may be processed only by those project and Municipality of Kittilä employees whose duties require them to process the information.
Webropol acts as a service provider and processor of personal data on behalf of the Municipality of Kittilä.
Retention of personal data
Personal data is retained only for as long as necessary for the purpose for which it was collected.
Personal data related to event registration is deleted when it is no longer required for organising the event, communication related to the event, or fulfilling the project’s monitoring and reporting obligations.
Information concerning special dietary requirements is deleted once it is no longer required for arranging catering for the relevant event.
The retention period for survey data depends on the purpose of the survey. Information that enables identification of an individual is deleted when it is no longer necessary for the purpose for which it was collected.
7.4 Facebook and Instagram – project social media channels
Purpose of the services
The International House Tunturi-Lappi and Pello Project has Facebook and Instagram accounts used for project communications, providing information about events and services, increasing awareness of project activities and interacting with the project’s target groups and other stakeholders.
Data controller and service provider
The Municipality of Kittilä is responsible for the processing of personal data carried out by it as administrator of the project’s Facebook and Instagram accounts.
Facebook and Instagram are services provided by Meta. Meta also processes users’ personal data in accordance with its own privacy policies.
Personal data processed
The following information may be processed in connection with the project’s Facebook and Instagram channels:
- user’s name and username
- publicly visible profile information
- comments and other content published by the user
- reactions and other interaction with project posts
- private messages sent to the project and their content
- other information provided voluntarily by the user through Facebook or Instagram.
As a general rule, the project does not transfer personal data obtained through social media services into a separate register.
Sources of personal data
Data is obtained from the user when they interact with the project’s Facebook or Instagram channel, for example by commenting, reacting to publications or sending a private message.
Purpose of processing
Personal data is processed for the purpose of project communications and interaction and for responding to user enquiries.
Users are not requested to provide personal identity codes, health data or other confidential information or data belonging to special categories of personal data through Facebook or Instagram.
If an enquiry requires processing personal data that is not appropriate to handle through social media, the user will be directed to another communication channel used by the project.
Recipients of personal data
Data relating to the project’s Facebook and Instagram accounts may be processed by project and Municipality of Kittilä employees whose duties include maintaining the channels, communications or responding to user enquiries.
Comments, reactions and other information published publicly may be visible to other users of the service.
Meta processes users’ personal data in accordance with its own privacy policies.
Retention of personal data
Private messages sent to the project are processed only for as long as necessary to handle the enquiry.
If the matter requires further processing in another Municipality of Kittilä system, the information necessary for handling the matter may be processed in that system in accordance with its purpose and retention rules.
Meta is responsible for the retention of personal data processed by Meta in accordance with its own privacy policies.
7.5 PAR – project client information system
Purpose of the system
The PAR system is used to manage the personal data and client processes of individual clients participating in longer-term guidance provided by the International House Tunturi-Lappi and Pello Project and for monitoring, statistics and reporting related to the project’s client services.
Participation in the project’s services and longer-term guidance is voluntary. A client’s personal data is stored in the PAR system with their consent.
The system may contain clients’ basic information, information concerning the progress of the client relationship, meetings, services and measures provided as part of the client service, and notes necessary for managing the client relationship.
The system may also be used to produce statistical information for project monitoring, evaluation and reporting in a form that does not allow individual clients to be identified.
Data controller
Municipality of Kittilä.
The Municipality of Kittilä is responsible for the client data stored in the PAR system by the International House Tunturi-Lappi and Pello Project, including determining which personal data is stored in the system and who is authorised to process it.
Personal data processed
The following information may be processed where necessary for the client relationship and provision of services:
- name and other basic information necessary to identify the client
- contact details
- information concerning the client’s municipality of residence or municipality of domicile
- the client’s language of communication and other background information necessary for providing services
- information concerning the beginning, end and progress of the client relationship
- information concerning services, guidance and advice provided to the client
- information concerning meetings and contacts
- information concerning the objectives and progress of the client process
- necessary notes generated during client work
- information necessary for monitoring the client relationship and project reporting.
Only personal data necessary for providing services to the client, managing the client process, implementing project activities or fulfilling the project’s monitoring and reporting obligations is recorded in the system.
Personal data belonging to special categories of personal data or other sensitive information is not recorded in the system unless its processing is necessary for handling the client’s matter and there is an appropriate legal basis for processing under applicable data protection legislation.
Sources of personal data
Personal data is mainly obtained directly from the client in connection with customer service, advice, guidance and other interactions with the project.
Information may also be obtained from another authority, service provider or cooperation partner where there is a legal basis for obtaining and processing the information, such as legislation, the client’s consent or another appropriate legal basis.
Purpose and legal basis for processing
Personal data is processed to assess the client’s service needs, provide advice and guidance, monitor the longer-term client process and agreed measures, communicate with the client, and monitor and report on project activities.
The processing of personal data in the PAR system is based on the data subject’s consent in accordance with Article 6(1)(a) of the General Data Protection Regulation.
Participation in the services provided by the International House Tunturi-Lappi and Pello Project is voluntary. Before personal data is stored in the PAR system, the client is informed about what personal data will be stored, the purposes for which the data will be used and how they can exercise their rights concerning the processing of their personal data.
The client may withdraw their consent to the processing of their personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
Recipients and disclosure of personal data
Personal data stored in the PAR system may only be processed by members of the project team whose duties require them to process the relevant client data.
Personal data is not disclosed to third parties unless there is a legal right or obligation to disclose it or another appropriate legal basis for the disclosure.
Statistical information may be produced from client data for project monitoring, evaluation and reporting in a form that does not allow individual clients to be identified.
Retention of personal data
Client data stored in the PAR system is retained only for as long as processing is necessary for the client relationship, project activities or the project’s monitoring and reporting obligations, or for as long as required by applicable legislation, the Municipality of Kittilä’s information management plan or other requirements binding on the Municipality.
Personal data that is no longer required is deleted after the applicable retention period has expired.
Protection of personal data
The PAR system and the data stored in it are located on the Municipality of Kittilä’s closed network drive. The system is stored in a folder that can only be accessed by members of the International House Tunturi-Lappi and Pello project team.
Access to the PAR system is additionally protected by a password.
Access rights are restricted to project team members whose duties require the processing of client data. Access rights are removed when an employee’s duties change or the need to process personal data ends.
Employees processing client data are subject to confidentiality obligations.
8. Sources of personal data
Personal data is mainly obtained directly from the data subject.
In the EURA 2021 system, information may also be obtained from official sources and the Suomi.fi identification service in accordance with the system’s privacy practices.
In Webropol, personal data is obtained from the registration or survey form completed by the data subject.
Personal data stored in the PAR system is mainly obtained directly from the client in connection with customer service, advice, guidance and other interactions with the project. Information may also be obtained from other parties where there is an appropriate legal basis for obtaining and processing the information.
On Facebook and Instagram, information is obtained from the user when they interact with the project’s social media channels.
Information concerning a contact person of a company or other organisation may also be obtained from the organisation they represent.
9. Recipients or categories of recipients of personal data
Personal data for which the Municipality of Kittilä acts as data controller may only be processed by project and Municipality of Kittilä employees whose duties require such processing.
Service providers used for processing personal data may act as processors on behalf of the Municipality of Kittilä in accordance with applicable agreements.
Recipients and access rights relating to data in the EURA 2021 system are determined in accordance with legislation governing the system and access rights defined by the Ministry of Economic Affairs and Employment.
Personal data may be disclosed to public authorities where there is a legal obligation or legal right to disclose the information.
For statistical and reporting purposes, data is processed, where possible, in a manner that does not allow an individual to be identified.
10. Transfer of personal data outside the EU or EEA
Data in the EURA 2021 system is not transferred outside the European Union or European Economic Area.
According to Webropol, personal data processed in the service is not transferred to or processed outside the European Union or European Economic Area.
11. Retention period for personal data
Personal data is retained only for as long as its processing is necessary for the purpose for which it was collected or for as long as required by legislation, project funding conditions, data management plans or other requirements binding on the data controller.
System-specific retention periods and retention principles are described in Section 7.
12. Systems used to maintain the register and principles of data protection
Personal data processed by the project is handled and stored electronically. The project does not maintain a paper-based register containing personal data.
Personal data is processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.
The processing of personal data follows the principles of purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.
Access rights to systems are granted on the basis of work duties and removed when duties change or the need to process personal data ends.
Systems and devices are protected by usernames, passwords and other technical and organisational safeguards used by the Municipality of Kittilä and the relevant service providers.
Access to Webropol is restricted to employees whose duties require the processing of the data.
The PAR system and the data stored in it are located on the Municipality of Kittilä’s closed network drive in a folder that can only be accessed by members of the International House Tunturi-Lappi and Pello project team. Access to the PAR system is additionally protected by a password. Access rights are removed when an employee’s duties change or the need to process personal data ends.
The EURA 2021 system is protected in accordance with the security measures of the system and its data controller. Access rights are granted according to work duties.
Administration rights for the project’s Facebook and Instagram accounts are limited to employees whose duties include project communications through social media.
Employees processing personal data are subject to confidentiality obligations.
13. Right of access
The data subject has the right to access personal data concerning them.
Requests concerning personal data processed by the Municipality of Kittilä as data controller may be submitted:
- to the contact person for the register by post in a signed or otherwise verified document; or
- by visiting the data controller in person.
More detailed instructions and the request form are available on the Municipality of Kittilä website under the section concerning data protection.
Requests concerning personal data processed in the EURA 2021 system must be submitted in accordance with the EURA 2021 privacy practices to the Ministry of Economic Affairs and Employment.
14. Right to rectification
The data subject has the right to request that the data controller rectify inaccurate or incorrect personal data concerning them without undue delay and, where necessary, complete incomplete personal data.
Requests concerning personal data processed by the Municipality of Kittilä as data controller must be submitted in accordance with the Municipality of Kittilä’s instructions.
Rectification of personal data processed in the EURA 2021 system is carried out in accordance with the instructions of the EURA 2021 system and the Ministry of Economic Affairs and Employment.
15. Right to lodge a complaint with a supervisory authority
The data subject has the right to lodge a complaint with the supervisory authority if they consider that the processing of personal data concerning them infringes the General Data Protection Regulation.
In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.
This right is based on Article 77 of the General Data Protection Regulation.
16. Other rights of the data subject and consequences of not providing personal data
The rights of the data subject depend on the purpose and legal basis of the processing.
Depending on the processing situation, the data subject may have the right to:
- request deletion of their personal data
- request restriction of processing
- object to the processing of their personal data
- receive personal data they have provided in a structured, commonly used and machine-readable format and transfer it to another controller
- withdraw their consent where processing is based on consent.
These rights are not absolute in all situations, and their applicability depends on the purpose and legal basis of the processing.
The processing of participant data in the EURA 2021 system is not based on the participant’s consent.
The processing of personal data in connection with Webropol event registration is based on consent. If the participant does not provide the personal data necessary for organising the event or does not accept its storage, the registration cannot be processed.
The processing of client data stored in the PAR system is based on the client’s consent. Participation in the project’s services and longer-term guidance is voluntary. The client may withdraw their consent to the processing of their personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
Providing information about a possible special dietary requirement is voluntary, and failure to provide this information does not prevent participation in an event.
Participation in voluntary surveys is voluntary unless another legal basis for processing is stated in connection with the survey.
17. Risks related to personal data processing and their management
Potential risks related to personal data processing include, for example:
- usernames or access credentials becoming available to an unauthorised person
- a device being lost or accessed by an unauthorised person
- personal data being accidentally sent or disclosed to the wrong recipient
- access rights that are unnecessarily broad
- a data breach affecting a system or service.
Risks are managed through the Municipality of Kittilä’s data protection and information security practices, access control, user identification, device protection, staff instructions and the technical and organisational safeguards of service providers.
Access rights are limited according to work duties and removed when duties change or the need to process personal data ends.
