The data controller’s informing
the data subject
EU´s General Data Protection Regulation,
(2016/679), Articles 13 and 14
19.5.2021
Information about personal data filing system
1. Name of the filing system
Tampere museums Ceepos webshop
2. Purpose of personal data processing
Personal data is collected e.g. for the delivery of orders, the correct allocation of payments, the
verification of the customer’s transaction history and transaction rights, reporting, and
marketing.
Information about users of the software is collected to determine access rights and to monitor
usage. The software creates logfiles containing personal information for the purpose of
resolving issues with the software’s usage history and other problem cases.
3. Data controller
City of Tampere, business ID FI02116752
4. Individual responsible for the filing system: name, position and contact information
Juha Ahonen Culture director
City of Tampere
PO Box 487, FI-33101 Tampere
tel. +358 3 565 611 (City switchboard)
https://www.tampere.fi/tampereen–kaupunki/yhteystiedot–ja–asiointi.html
5. Filing system contact person and contact information
Saana Karlsson, Service responsible, museumshop Vapriikki
6. Processing of personal data is outsourced on agreement
☒ No
☐ Yes Further information on outsourced processing when necessary
7. Legal basis for the processing of personal data
A)
☒ Public interest / Exercise of official authority
Please specify:
☐ Legal obligation
Governing legislation:
☒ Consent
☐ Performance of a contract
B)
☐ The filing system belongs to an obligatory function of the public administration
☒ The filing system belongs to a voluntary function of the public administration
C)
Data in the filing system are used for automated individual decision-making, including
profiling
☒ No
☐ Yes
Please specify:
Personal data, data sources and data disclosure
8. Personal data in the filing system
Categories of data subjects and special categories of personal data
Possible personal data stored in our registers:
General customer register: customer number, first name, last name, local address, post office,
telephone number, e-mail address, order history, username, and direct marketing
authorization.
Order register: contact information, ordered products.
Mailing lists: email address.
Personal data will be stored in our register until deleted manually. Order information is
retained until deleted manually or on a scheduled basis. Electronic receipt records are retained
until deleted manually, but for at least six years
9. Filing system data maintenance systems (name(s) of system(s) or application(s))
Ceepos cash system/Museums webshop
10. Filing system contains hard copy (paper) material
☒ No
☐ Yes
11. Data sources
Payment transactions are handled via external systems that are integrated into the webshop.
The main repositories are webshop customers as they make purchases, registrations, and
payments.
Data protection principles
The storage, archiving, deletion and other processing of data are governed by file plans, data
protection guidelines and information security guidelines. Only authorised persons have access
to data processed by electronic means. Each individual accepts a Non-disclosure/Secrecy
agreement (an agreement on the non-disclosure and use of data and information systems)
when granted user rights.
12. Disclosure of personal data
Regular disclosure of personal data
☒ No
☐ Yes
Please specify to whom or to what entity:
Grounds for disclosure of data
Personal information will not be disclosed to third parties. Personal data may be transferred to
other systems of the same administrator, such as the cash register system, accounting,
invoicing, and access control. Depending on the payment service provider, the customer’s
contact information is transferred to the payment system when the order is paid in order to
facilitate problem situations and the return of payments
13. Transfer of personal data to a third country or to an international organisation (outside
the EU or European Economic Area (EEA))
☒ No
☐ Yes
Please specify where: Personal data will not be transferred outside the EU or the EEA.
14. Personal data storage periods/criteria for determining storage period
Storage is governed by the City of Tampere file plans.
15. Data subject´s rights
The rights of the data subject and instructions on how to exercise them are described at www.tampere.fi/tietosuojaselosteet and are also available at the City registry office.