Privacy policy

The data controller’s informing
the data subject


EU´s General Data Protection Regulation,
(2016/679), Articles 13 and 14

19.5.2021

Information about personal data filing system

1. Name of the filing system

Tampere museums Ceepos webshop

2. Purpose of personal data processing

Personal data is collected e.g. for the delivery of orders, the correct allocation of payments, the
verification of the customer’s transaction history and transaction rights, reporting, and
marketing.

Information about users of the software is collected to determine access rights and to monitor
usage. The software creates logfiles containing personal information for the purpose of
resolving issues with the software’s usage history and other problem cases.

3. Data controller

City of Tampere, business ID FI02116752

4. Individual responsible for the filing system: name, position and contact information

Juha Ahonen Culture director

City of Tampere
PO Box 487, FI-33101 Tampere
tel. +358 3 565 611 (City switchboard)

 https://www.tampere.fi/tampereen–kaupunki/yhteystiedot–ja–asiointi.html

5. Filing system contact person and contact information

Saana Karlsson, Service responsible, museumshop Vapriikki

6. Processing of personal data is outsourced on agreement

☒ No

☐ Yes Further information on outsourced processing when necessary

7. Legal basis for the processing of personal data

A)

☒ Public interest / Exercise of official authority

Please specify:

☐ Legal obligation

Governing legislation:

☒ Consent

☐ Performance of a contract

B)

☐ The filing system belongs to an obligatory function of the public administration

☒ The filing system belongs to a voluntary function of the public administration

C)

Data in the filing system are used for automated individual decision-making, including
profiling

☒ No

☐ Yes

Please specify:

Personal data, data sources and data disclosure

8. Personal data in the filing system

Categories of data subjects and special categories of personal data
Possible personal data stored in our registers:

General customer register: customer number, first name, last name, local address, post office,
telephone number, e-mail address, order history, username, and direct marketing
authorization.

Order register: contact information, ordered products.

Mailing lists: email address.

Personal data will be stored in our register until deleted manually. Order information is
retained until deleted manually or on a scheduled basis. Electronic receipt records are retained
until deleted manually, but for at least six years

9. Filing system data maintenance systems (name(s) of system(s) or application(s))
Ceepos cash system/Museums webshop

10. Filing system contains hard copy (paper) material

☒ No

☐ Yes

11. Data sources

Payment transactions are handled via external systems that are integrated into the webshop.
The main repositories are webshop customers as they make purchases, registrations, and
payments.

Data protection principles
The storage, archiving, deletion and other processing of data are governed by file plans, data
protection guidelines and information security guidelines. Only authorised persons have access
to data processed by electronic means. Each individual accepts a Non-disclosure/Secrecy
agreement (an agreement on the non-disclosure and use of data and information systems)
when granted user rights.

12. Disclosure of personal data

Regular disclosure of personal data

☒ No

☐ Yes

Please specify to whom or to what entity:

Grounds for disclosure of data

Personal information will not be disclosed to third parties. Personal data may be transferred to
other systems of the same administrator, such as the cash register system, accounting,
invoicing, and access control. Depending on the payment service provider, the customer’s
contact information is transferred to the payment system when the order is paid in order to
facilitate problem situations and the return of payments

13. Transfer of personal data to a third country or to an international organisation (outside
the EU or European Economic Area (EEA))

☒ No

☐ Yes

Please specify where: Personal data will not be transferred outside the EU or the EEA.

14. Personal data storage periods/criteria for determining storage period

Storage is governed by the City of Tampere file plans.

15. Data subject´s rights

The rights of the data subject and instructions on how to exercise them are described at www.tampere.fi/tietosuojaselosteet and are also available at the City registry office.