Updated on 17 May 2018
Information about the controller
Annankatu 16 b 35-36 00120 Helsinki, Finland
Contact person in matters concerning the processing of personal data:
Principles of the processing of personal data
In accordance with the EU’s General Data Protection Regulation (GDPR), Ornamo ensures that the processing of personal data in its operation is lawful and transparent in terms of data subjects.
Information in registers is stored appropriately and carefully. Ornamo carries out the necessary technical and organisational measures to protect all personal data against unauthorised access to the data and accidental or unlawful disposal, amendment, assignment, transfer or any other unlawful processing.
Personal data are only collected in the scope necessary for Ornamo’s operation and, similarly, they are only used for purposes that are necessary and lawful with regard to Ornamo’s operation. Data subjects are informed of the collection of personal data in ways required by the Regulation.
At its own initiative, Ornamo also endeavours to keep the personal data in its possession up to date and to erase personal data, within a reasonable amount of time, after their processing no longer has justification or processing grounds based on the EU’s General Data Protection Regulation, such as an obligation based on the law, a data subject’s consent, or the controller’s legitimate interest, or an agreement.
Legal basis for the processing of personal data
The legal basis for the processing of personal data under Article 6 of the EU’s General Data Protection Regulation is
- consent from a member, employee or cooperation partner (“data subjects”);
- preparation or enforcement of an agreement;
- an obligation based on the law; or
- a legitimate interest of the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
In accordance with the Regulation, the legitimate interests pursued by the controller or by a third party are assessed with regard to the data subject’s fundamental rights and freedoms. The controller’s legitimate interests are involved in matters essential for the fulfilment of the association’s purpose, such as when we look for new members to recruit or cooperation partners important for the operation of the association, when we endeavour to cooperate with data subjects, and when we communicate to data subjects matters that are significant for your operation and presumably also for data subjects themselves.
Ornamo’s cooperation partners refer to Ornamo’s contractual partners, stakeholders and other operators in the design industry with whom we are or aim to be engaged in cooperation.
Purposes of processing personal data
The purposes of processing include the following situations:
- Management, administration, development, and quality assurance of a membership, employment or cooperation relationship, implementation of member services, and ensuring business and service events.
- Analysis and classification of relationships with members or cooperation partners, management and development of data entities, targeting of communication and marketing, and management of campaign and contact history.
- Implementation, analysis, reporting and development of Ornamo’s operation and service and product range.
Contents of the register
Details on a member, employee or cooperation partner:
- Phone number
- E-mail address
- Date of birth
- Other personal data provided by the person
Sources of personal data
Data related to a member, employee or cooperation partner are collected from the person in question upon registration with Ornamo or the employment relationship, when products and services are used, in the Internet service’s My details section, in the context of the membership service, and otherwise directly from the member, employee or cooperation partner.
Data are also updated from the Population Register and other public information services.
Disclosure of personal data
Ornamo can disclose personal data for justified purposes, in accordance with valid legislation. Details on a member or cooperation partner can be disclosed to parties that belong to the following groups:
- Service providers who take part in the implementation of the website and our services, such as providers of a payment service
- To cooperation partners, for marketing purposes if consent for this has been obtained
- To public authorities, in case this is required by the law, Ornamo’s interests or the interests of a third party.
Disclosure of personal data to third parties and outside the EU or the EEA
As a rule, personal data are not disclosed to third parties, and data are not disclosed outside the EU or the European Economic Area without the permission of the person in question.
Personal data can be transferred outside the EU or the European Economic Area if Ornamo saves or commissions a party to save personal data in a cloud service its uses, whose server is physically located outside the EU or the EEA. Even in these respects, Ornamo as the controller agrees to
ensure that data protection in cloud services is of a high quality and even otherwise in compliance with the EU’s General Data Protection Regulation.
Rights of data subjects
Data subjects have the following rights, among others, with regard to the processing of personal data (Articles 15-22 of the EU’s General Data Protection Regulation):
Data subjects have the right to verify personal data stored on them in the register from the controller. Data subjects have the right to request that data concerning them in the register be erased or rectified. They also have the right to restrict and object to the processing of data concerning themselves.
Requests concerning the enforcement of such rights must be made in writing and addressed to the contact person of the register. If necessary, the controller can ask the person submitting the request to verify his or her identity. The controller shall respond to the data subject within the time stipulated in the EU’s General Data Protection Regulation (within one month, as a rule).