1.  General

This Privacy Policy describes how Savonlinna Opera Festival Patrons’ Association (Business ID: 0207403-8) and Savonlinnan Oopperajuhlat Oy (Business ID: 0638386-6), (”Savonlinna Opera Festival”) process personal data; what personal data Savonlinna Opera Festival collects, what purposes is the data used for and which parties can the data be disclosed to, as well as how can the data subject influence the processing. The Privacy Policy also provides information on the obligations that Savonlinna Opera Festival observes in the processing of personal data.

Savonlinna Opera Festival protects the privacy of data subjects and observes EU’s General Data Protection Regulation (2016/679) as well as other applicable data protection legislation (collectively “data protection legislation”) and good data processing practices in all processing of personal data. Data protection is part of all of Savonlinna Opera Festival’s business operations.

This Privacy Policy shall apply to all event services offered by Savonlinna Opera Festival and other services offered by Savonlinna Opera Festival, both at the event venue and on the website, as well as in social media services and events organised by Savonlinna Opera Festival. In addition, this Privacy Policy shall apply to the processing of personal data in services used by Savonlinna Opera Festival customers (consumer and company), potential customers, co-partners, service suppliers and media representatives and contact persons, Savonlinna Opera Festival Patrons’ Association’s members, Savonlinna Oopperajuhlat Oy’s shareholders and others referred to above.

“Personal data” refers to all information concerning a natural person (“data subject”), which can be used to directly or indirectly identify him/her, in accordance to what has been set out in the data protection regulation. Information, which cannot be used to directly or indirectly identify a data subject, is not personal data.

2.  Data controller

Controller of the register: Savonlinna Opera Festival Patrons’ Association (Business ID: 0207403-8) and Savonlinnan Oopperajuhlat Oy (Business ID: 0638386-6)

Contact details: Olavinkatu 27, 57130 Savonlinna, phone (015) 476 750

Data controller’s contact person: Tarja Halonen (firstname.lastname@operafestival.fi)

Requests concerning direct marketing shall be sent to: marketing@operafestival.fi

3.  Purposes and legal reason for processing personal data

Personal data is processed for e.g. the following purposes:

• For ordering and invoicing Savonlinna Opera Festival services and products
• for the production, maintenance, development and quality assurance of services
• for confirming the safety of services and preventing and investigating unauthorised use as well as for risk management
• for the management of regulatory obligations
• for the planning and development of business and operations and for the product development of products
• for the monitoring of service-related customer support, personalised customer service and targeted customer communications and service use
• for the marketing and targeting of marketing to customers, potential customers and the media
• for the advertisement based on service communications and service contracts of Savonlinna Opera Festival’s online contractual co-partners
• for communications with shareholders and membersLegal reasons for processing personal data:

The legal reason for processing personal data of data subjects is the contractual relationship between Savonlinna Opera Festival and the data subject, which is based on the ordering of a service or product offered by Savonlinna Opera Festival.

The processing of personal data is also based on legal obligations, such as accounting obligations and regulatory reporting obligations.
Processing for the purpose of customer relationship management and direct marketing is based on Savonlinna Opera Festival’s legitimate reason.

In addition, electronic direct marketing and subscription to Savonlinna Opera Festival’s newsletter, as well as the storage of personal data collected via Savonlinna Opera Festival’s website for direct marketing may be based on consent.

4.  Processed personal data groups and data content and data sources

Savonlinna Opera Festival only collects such personal data from data subjects, which is essential and necessary in terms of the purposes described in this Privacy Policy.
The following information is processed about the data subject:

Personal data, which provision is essential for managing the obligations based on the agreement concluded between Savonlinna Opera Festival and the data subject, as well as for producing Savonlinna Opera Festival’s services, are notified in each case to the data subject.

In principle, personal data is collected from the data subject him-/herself, for example, in connection with making an offer, concluding a customer agreement or during the customer account period, in connection with marketing or via online forms. The data subject may have also provided information to Savonlinna Opera Festival in connection with e.g. A competition or draw, in connection with using the website or subscribing to the newsletter.

Personal data can also be collected from the community on behalf of who the data subject operates. In addition, data can also be collected and updated in situations permitted by legislation from registers maintained by third parties, such as from the Population Registration Office.

5.  Storage of personal data

Savonlinna Opera Festival shall store personal data for as long as it is necessary to implement the purposes defined in the Privacy Policy, unless legislation requires personal data to be stored for longer (for example, responsibilities and obligations related to special legislation, accounting obligations or reporting obligations), or unless Savonlinna Opera Festival needs the data for preparing, presenting or defending a legal claim, or for the settlement of a similar dispute situation.

The retention period and retention criteria of data depends on the personal data group, according to the purpose of the specific personal data group.

Personal data shall be processed for the duration of the customer and agreement relationship and for the necessary time after the end of the customer and agreement relationship.

Savonlinna Oopperajuhlat Oy’s share and shareholder data, and the member list of Savonlinna Opera Festival Patrons’ Association is constantly updated, and the information is permanently retained. The data of newsletter subscribers is stored until the data subject cancels his/her subscription. Data concerning potential customers is stored for the duration of active marketing and its design.

In terms of communities, the retention of personal data of a data subject is bound to, how long such data subject operates as the community representative for Savonlinna Opera Festival. Personal data is removed within reasonable time after the end of the role.

When personal data is no longer needed for the purposes defined above, the information is removed within reasonable time, unless legislation obliges Savonlinna Opera Festival to store the information for a longer period.

6.  Recipients of personal data

Savonlinna Opera Festival may transfer personal data internally between Savonlinna Opera Festival Patrons’ Association and Savonlinnan Oopperajuhlat Oy.
According to this privacy policy, Savonlinna Opera Festival may subcontract the processing of personal data to service suppliers or subcontractors. Savonlinna Opera Festival shall ensure with sufficient contractual obligations that personal data is processed appropriately and in accordance with legislation.
The following parties, among others, shall participate in the processing of personal data:

• Emaileri Oy
• Mediamaestro Oy
• Webropol Oy
• Microsoft

Personal data shall not be disclosed for the direct marketing or opinion survey and market research, or other similar purposes of other parties.

In addition, personal data can be disclosed to:

•  Lippupiste Oy

In special circumstances, personal data can be disclosed to authorities in situations obliged or entitled by legislation.

In addition, Savonlinna Opera Festival may have to disclose personal data in emergency or other sudden situations in order to protect human lives and health, as well as property. Savonlinna Opera Festival may also have to disclose the personal data of data subjects, if Savonlinna Opera Festival is a party in a court trial or other procedure that takes place at a dispute settlement body.

If Savonlinna Opera Festival is part of a merger, business acquisition or other business restructuring, it may have to disclose the personal data of data subjects to third parties. The data subject’s data protection shall be ensured in such arrangements too, and they shall be informed to the data subject in an appropriate manner, if necessary.

In principle the disclosure of data shall take place via electronic data transfer connections, but information can also be disclosed by other means, such as by phone or by post.

7.  Transfer of personal data outside the European Union or the European Economic Area

In principle, personal data is not transferred outside the European Union or the European Economic Area. The service supplier may, however, have the right to transfer personal data outside the EU or EEA area to a third country to the extent that it is necessary for implementing services and to the extent that the service supplier uses subcontractors for implementing the service, and such subcontractors are located outside the EU or EEA. Model contract clauses on the transfer of personal data outside the EU/EEA that have been approved by the European Union are applied to the transfers of personal data.

8.  Principles concerning the protection of personal data and the security of processing

Savonlinna Opera Festival processes personal data in a way, which aims to ensure appropriate security of the personal data, including protection from unauthorised processing and accidental loss, destroy or damage.
Savonlinna Opera Festival uses appropriate technical and organisational protection methods to safeguard this, including firewalls, encryption technologies, the use of secure device rooms, appropriate access control, guidance of staff and subcontractors that participate in the processing of personal data.

Agreements and other document material that must be stored as original copies shall be kept in locked facilities, and access control is limited to only authorised parties.
All parties that process personal data are subject to confidentiality in matters concerning the processing of data subjects’ personal data on the basis of confidentiality terms set out in the Employment Contracts Act and agreements.

9.  Rights of data subjects

The data subjects have rights set out by data protection legislation.

Right to access data and review data

The data subject has the right to receive confirmation on whether the data subject’s personal data is processed.
The data subject has the right to review and see data concerning him-/herself, and upon request has the right to receive such data in writing or electronic format.

Right to correct and remove information 

The data subject has the right to demand incorrect or inaccurate data to be rectified. In addition, the data subject has the right to request for his/her data to be removed in situations referred to in data protection legislation.
The data controller shall remove, rectify and supplement any incorrect, unnecessary, incomplete or expired personal data that it observes at its own initiative in terms of the purposes of processing.
Right to transfer data and limit processing as well as refuse processing
In situations referred to in data protection legislation, the data subject has the right to request for his/her data to be transferred to another data controller.

In addition, the data subject has the right in accordance with requirements set out by the data protection legislation to request the limitation of personal data processing. In situations, where personal data that has been suspected to be incorrect cannot be rectified or removed, or there is uncertainty concerning the request to remove, Savonlinna Opera Festival shall limit access to the data in accordance with the data protection legislation.

The data subject has the right to refuse the use of data for certain processing. The data subject has the right to deny the transfer and processing of his/her data for direct marketing purposes.

Right to withdraw consent

If the processing of personal data is based on a separate consent given by the data subject, the data subject has the right to withdraw his/her consent concerning the processing of personal data. Withdrawal shall not affect any processing that has been completed before the withdrawal.

Implementation of rights

Any requests concerning the data subjects’ rights shall be made in writing or electronically using the contact details mentioned above. Sufficient identification details must be included in the request. The request shall be responded to within reasonable time and according to opportunities within one month from presenting the request and verifying the identity. Savonlinna Opera Festival may ask more additional information, where necessary, in order to fulfil the previously mentioned requests. If the data subject’s request cannot be accepted, denial shall be informed to the data subject in writing.

10.    Right to lodge a complaint with a supervisory authority

The data subject has the right to lodge a complaint with a data protection officer, if the data subject considers that his/her personal data has been processed in violation of currently prevailing legislation.  In the European Union, such complaint can be lodged with the data protection officer in the residential or employment state or in the state where the stated violation has taken place.

11.  Changes to the privacy policy

Savonlinna Opera Festival continuously develops its services, and for this reason may have to change and update this Privacy Policy. Changes may also be based on amendments to legislation concerning data protection. We recommend reviewing the content of the Privacy Policy on a regular basis. If the changes involve any new purposes for the processing of personal data, Savonlinna Opera Festival shall inform them in advance and, if necessary, shall ask for consent.

The Privacy Policy has been published on 25th May 2018.