Privacy Policy

Welcome to read the Privacy Policy of Kuvataiteen talo ry. Below we have set out our privacy practices in relation to the website www.kuvataidetalo.fi. If you cannot find the answer to your question below, you can reach us by e-mail at info@kuvataiteentalo.fi.

Purpose and scope of the Privacy Statement

Kuvataiteen talo ry is committed to protecting your privacy and personal data. This Privacy Policy describes how we collect and use your personal data and your legal rights, in particular under the EU General Data Protection Regulation (GDPR).

This notice applies to Kuvataiteen talo ry when they process personal data within the EU about the following categories of persons:

Current, former and potential members of the public, member organisations and their representatives, artists and contacts and representatives of other organisations
people who visit our website or leave their contact details, for example, to subscribe to our newsletter, leave feedback, complete a survey, or enter a competition or event organised by us.
other stakeholders who have contact with us, such as suppliers, partners, etc.

Registry controller

The registry controller, i.e. the party responsible for the collection and processing of personal data in accordance with this Privacy Policy, is Kuvataiteen talo ry, whose visiting address is Töölönkatu 11, 00100 Helsinki. In matters relating to data protection, we can also be contacted by e-mail at info@kuvataiteentalo.fi.

Processing of personal data

The processing of your personal data is mainly related to a communication or other professional relationship. We process your data for the following purposes, among others:

newsletter subscription and delivery
managing a customer, supplier or other business relationship
marketing and development of exhibitions, events and services
providing the information you have requested from us
enabling communication between us, including collecting and responding to feedback and surveys
improving the customer experience and developing our customer understanding
maintaining and developing our website
edellä mainittuihin tarkoituksiin liittyvä analysointi, profilointi, raportointi, segmentointi ja tilastointi

Legal basis for processing personal data

We will only process your personal data where permitted by law. Our legal basis for processing your personal data is:

your consent; or
compliance with a legal obligation
The legitimate interests of the Visual Art house in managing its customer, member and other relationships, including the communication and marketing of our events and services.
Implementing a contract between a member, client or partner of the Visual Art House and carrying out pre-contractual measures, such as processing membership fees.

The data we process

We may process the following types of information about you for the purposes described above:

Basic information such as your name, profession, the organisation you represent and contact details such as address, telephone number and email address
Information about the service relationship, e.g. the products and services you are interested in and which services of the Visual Art House you have used
Information related to your use of our electronic services, e.g. registration information required for access, such as username and password; service usage data; information collected by cookies and similar methods, such as the type of browser or device you use, your browsing history on our website, your IP address, links in emails or on our website that you have clicked, materials you have downloaded from our website, or the website from which you have accessed our website.
Information relating to communications and meetings, e.g. requests for feedback and contact, electronic forms, marketing activities targeted at you, or meetings and events you have attended.
Profile and classification data, e.g. marketing segments and profiles generated from the data described above.

The information we collect

The personal data we process is:

obtained from you, for example, when you use our website, register as a user of our services, request information from us, complete a form, purchase, order or offer products or services, attend our events or otherwise communicate with us, including by telephone or electronically;
obtained from your employer or an organisation you represent in connection with a business or other relationship between us and your employer/organisation;
collected automatically by electronic means such as through the use of cookies, for example, when you participate in our e-marketing campaign or use our website or other electronic services; or
collected from other lawful sources, such as public registers of associations and businesses, public authorities, post offices, telephone companies, direct marketing companies or other similar public or commercial registers.

Cookies

Cookies are small files that may be stored on your device when you visit our website. They tell us, for example, what type of device you are using to access our website and whether you have visited our website before. You can opt out of cookies at any time by using the pop-up window in the bottom left-hand corner of your screen.

We use cookies to develop our website, to gather information about visits to our website and to tailor our services and products to your interests and needs. However, you can control the purposes for which we may use the information we collect through your cookie settings. For example, we will not use information for targeting and marketing without your consent.

If you have only allowed the necessary cookies, we will ask for your consent again after 6 months. Your other cookie settings will be valid for 12 months. If you delete cookies from your browser, we will ask for your consent again the next time you visit our website. If more than one person uses the same device and browser, the cookie settings made by one user will also apply to the other users, unless cookies are deleted from the browser after use.

Kuvataiteen talo ry Cookie Policy.

Sharing information

We may share your personal information with service providers who process information for our purposes. Such service providers may include IT, technology or other similar service providers who store and maintain our information, and any marketing or other professional services providers.

Such service providers may process your personal data only to the extent necessary for the performance of the service we obtain from them. We require that any personal data we provide to them is kept confidential and appropriately protected by all our service providers. They must also comply with applicable data protection laws, the Visual Art House data protection and security requirements, and the terms of their service contract.

In some exceptional cases, the Visual Art House may also disclose your personal data to third parties if required by law or when necessary to fulfill our legitimate interests.

We may also share your information within the Visual Art House with employees who need the information to perform their job functions.

Location of data processing

We may use certain data processing tools made by companies located outside the European Economic Area, such as in the United States. Your personal data may be transferred to and processed in such countries. The level of data protection in these countries may not be comparable to that in the EU. For example, it cannot be excluded that your personal data may be permanently processed, analyzed and archived by US authorities for surveillance purposes. We have no control over these processing operations.

We use the following services to process your data:

Service	Purpose	Location	Read more
Hubspot	Customer relationship management, marketing, events	EU, US and other countries (EU standard contractual clauses) Hubspot partner page	Hubspot’s Privacy Policy
Google	Email, document management, calendar, visitor tracking	EU	Google Cloud & GDPR
Cookiebot	Cookies	EU	Cookiebot Privacy Policy
Meta	Marketing, marketing optimisation, visitor tracking	EU	Meta’s privacy policy

Data retention period

We will only keep your personal data for as long as necessary for the purpose for which it is used or as long as required by applicable law. In determining the appropriate retention period, we will take into account the amount, nature and confidentiality of the information, any harm that may result from its unlawful use or disclosure, the original purpose for which it was collected, and the requirements of the law.

If you are a member of the Visual Art House or a customer, we may process your data for as long as the relationship is in force and for up to 5 years thereafter, unless there is justification to keep the data longer.

If you receive marketing communications from us, we may process your data until you inform us that you no longer wish to be on our marketing list.

If you visit our website, we may process your data for up to 2 years after your last visit. For details of the length of time we use cookies on our website, please see the cookie settings page.

Rights relating to personal data

You have certain rights regarding your personal data, including the following rights:

Information and access: you can request access to your data, you have the right to be informed about the processing of your personal data and the right to request a copy of your data.
Rectification: you can request the rectification or completion of incorrect or inaccurate personal data.
Deletion: you may have the right to request the deletion of your data.
Restriction: you may have the right to request a restriction on the processing of your data. Restriction means that personal data subject to restriction may only be stored and not otherwise processed. Restriction of processing is typically only a temporary measure and can be lifted once we have processed your request.
Objection: you may have the right to object to the processing of data concerning you for certain purposes. You may have the right to object to the processing of your personal data for certain purposes, such as direct marketing, research or statistical purposes.
Transferring your data: you may have the right to transfer your data to another system. Data portability means the right to receive personal data in a structured, commonly used and machine-readable format so that the data can be easily transferred to another controller.

If you wish to inspect or correct your data, request the erasure of your data, restrict or object to the processing of your data or request the transfer of your data, please leave your request above under “Who is the controller?” in the contact details provided in the section above.

These rights are not absolute. They do not apply in all circumstances and may be subject to exceptions or limitations. For example, the right of access may be denied if requests are repeatedly made within a short period of time or if access would compromise the privacy of another person or the confidentiality of company information.

You do not have to pay a fee to access your information or exercise any of your other rights. However, we may charge a reasonable fee for complying with your request if it is manifestly unfounded or unreasonable. Alternatively, we may refuse the request.

We may ask you for additional information to confirm your identity and to ensure that you are entitled to access your information or exercise any other rights you may have. This is an appropriate safeguard to ensure that personal information is not disclosed to a person who does not have the right to receive it.

Withdrawal of consent

In situations where the processing of your data is based on your consent, you have the right to withdraw your consent to such processing at any time. To withdraw your consent, please contact us above under “Who is the registry controller?”. at the contact details indicated in the section above. Upon receipt of your notice of withdrawal of consent, we will stop processing your data for that purpose, unless we have another legal basis for processing the data.

Complaints

If you are not satisfied with our response or if you feel that we have not handled your personal data properly, you have the right to lodge a complaint with the data protection supervisory authority. The competent supervisory authority is most likely to be the supervisory authority in your country of residence or the supervisory authority in the country where the potential breach of law occurred.

Changes to this Privacy Policy

We reserve the right to update this Privacy Policy at any time. The current version of this Privacy Policy is available on our website. We recommend that you review this Privacy Statement from time to time to review any changes.