Privacy Notice

This Privacy Notice contains the information to be provided to data subjects pursuant to Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR). This notice was originally prepared on 21 May 2018 and updated on 31 August 2026.

1. Name of the Register

Customer Register of the National Museum of Finland

2. Controller and Contact Details of the Controller

Name: Finnish Heritage Agency

Postal address: P.O. Box 913, FI-00101 Helsinki, Finland

Registry Office: +358 295 33 6080

Email: kirjaamo@museovirasto.fi

3. Contact Details of the Data Protection Officer

Email: tietosuoja@museovirasto.fi

4. Purpose of Processing of Personal Data and Legal Basis for Processing

Purpose of Processing

Personal data are processed in connection with:

• customer service of the National Museum of Finland;
• performance of contracts;
• service development;
• marketing; and
• communications.

Legal Basis for Processing

• Personal data relating to customers are obtained with the customer’s consent (Article 6(1)(a) GDPR).
• Personal data relating to customers are processed on the basis of a customer relationship (Article 6(1)(b) GDPR).
• Personal data relating to customers are processed for the performance of a task carried out in the public interest (Article 6(1)(e) GDPR; Section 4(1)(2) of the Data Protection Act (1050/2018); Sections 2(4)-(6) of the Act on the Finnish Heritage Agency (510/2025)).

5. Categories of Personal Data Processed

We may collect, among other things, the following information from our customers:

• First name and surname
• Telephone number
• Email address
• IP address
• Customer feedback
• Ordered products and services
• Information on eligibility for discounts (for example, student tickets or pensioner tickets)
• Information on consents provided
• Organisation information
• Country information

Information on the processing of personal data relating to events is provided in the Finnish Heritage Agency’s Privacy Notice for Events, available at: Privacy Notice for Events(ulkoinen linkki)

All privacy notices of the Finnish Heritage Agency are available at: https://www.museovirasto.fi/fi/palvelut-ja-ohjeet/tietosuoja

6. Recipients or Categories of Recipients of Personal Data

Personal data may be processed by employees of the Finnish Heritage Agency whose duties include customer service functions related to the National Museum of Finland.

With regard to paid services, data are regularly disclosed to Palkeet (the Government Shared Services Centre for Finance and HR) for invoicing purposes.

Personal data are also processed in connection with event management, including invitations and registrations.

In addition, personal data may be disclosed to data processors with whom the Finnish Heritage Agency has concluded a data processing agreement.

7. Transfers of Personal Data to Third Countries or International Organisations

The National Museum of Finland / Finnish Heritage Agency does not transfer personal data contained in the Customer Register of the National Museum of Finland to third countries or international organisations.

8. Retention Period of Personal Data or Criteria Used to Determine the Retention Period

Visitors to National Museum of Finland Sites

Personal data contained in customer information are retained for a maximum of six (6) months following the date of the visit for service development purposes, after which the data are deleted or anonymised.

If a customer has provided consent to direct marketing, the personal data processed for that purpose will be deleted or anonymised no later than six (6) months after the date of the visit. Customers have the right to withdraw their consent at any time.

Newsletter Subscribers

Where a customer subscribes to a newsletter, the customer’s name and contact details will be retained until the customer unsubscribes from the newsletter.

Marketing

Personal data are retained in accordance with the consent provided for marketing purposes.

Customer Feedback

Personal data are retained in accordance with the Archives Act (529/2026) and the related information management plan (records management plan). For example, messages received through feedback forms on the National Museum of Finland’s website are retained for three (3) years.

9. Protection of Personal Data

Personal data contained in the Customer Register of the National Museum of Finland are processed confidentially.

The National Museum of Finland / Finnish Heritage Agency has implemented the necessary technical and organisational measures and requires the same from its data processors.

Personal data are accessible only to persons whose duties require access to such information.

10. Rights of the Data Subject

Requests concerning the exercise of the rights described below should be submitted to:

kirjaamo@museovirasto.fi

Right of Access

Data subjects have the right to obtain confirmation as to whether personal data concerning them are being processed and to access the personal data we hold about them.

If you identify inaccuracies or omissions in your personal data, you may request that the data be rectified or supplemented.

Right to Object

Data subjects have the right to object at any time to the processing of their personal data where they consider that their personal data have been processed unlawfully or that there are no lawful grounds for processing certain personal data.

Right to Object to Direct Marketing

Data subjects have the right at any time to prohibit the use of their personal data for direct marketing purposes.

We do not sell or otherwise disclose personal data to third parties for their own direct marketing purposes.

We purchase online advertising services, among others, from Facebook and Google. These companies do not receive your personal data, and such advertising does not constitute direct marketing. Instead, it is based on cookies. For more information, please see the section concerning cookies.

Right to Erasure

If you consider that the processing of certain personal data concerning you is not necessary for the performance of our tasks, you have the right to request the deletion of such data.

We will review your request and either delete the data or provide a reasoned explanation as to why the data cannot be deleted.

If you disagree with our decision, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

You also have the right to request restriction of processing of the contested data until the matter has been resolved.

If a data subject considers that the processing of their personal data is not lawful, the data subject has the right to lodge a complaint with the Office of the Data Protection Ombudsman.

11. Source of Personal Data and, Where Applicable, Whether the Data Originate from Publicly Available Sources

Personal data are obtained directly from the data subject.

12. Automated Decision-Making and Profiling

The personal data contained in the register are not subject to automated decision-making or profiling.