Privacy policy

This is the register and privacy policy of Suomen Kansanmusiikkiliitto ry in accordance with the Finnish Personal Data Act (Sections 10 and 24) and the EU General Data Protection Regulation (GDPR). Drawn up 27 May 2018.

1. Data controller
Suomen Kansanmusiikkiliitto ry, Hämeentie 34 D, 00530 Helsinki
www.kansanmusiikkiliitto.fi
(09) 8731320, toiminnanjohtaja@kansanmusiikkiliitto.fi

2. Contact person responsible for the register
Päivi Ylönen-Viiri
toiminnanjohtaja@kansanmusiikkiliitto.fi, 0500 431913

3. Name of the register:
Membership register
Employee registers

4. Legal basis and purpose of the processing of personal data
The legal basis for the processing of personal data is
– Information provided by the data subject themselves upon registration
– The contractual relationship between the data subject and the data controller
– The fulfilment of the data controller's statutory obligations
– The data controller's legitimate interest, based on a customer or employment relationship between the data subject and the data controller
The legal basis for the processing of personal data under the EU General Data Protection Regulation is the person's consent. The data is not used for automated decision-making or profiling.

5. Data content of the register
The data stored in the membership register consists of: names and address details. For some individuals, the register also contains an email address, a phone number and a date of birth.
The employees of Suomen Kansanmusiikkiliitto update the membership register. The aim is to keep the name and address details of members and magazine subscribers up to date. The data of persons whose membership has ended is deleted within three years.
Employee registers and the register of invoicing customers
The payroll and bookkeeping of Suomen Kansanmusiikkiliitto are handled by Tilitoimisto Leerma. A personal data processing agreement is concluded with them. Materials are delivered between the accounting firm and Suomen Kansanmusiikkiliitto in person or by email.
The Fivaldi invoicing software is password-protected and has an activity log.
Tilitoimisto Leerma has effective safeguards in place.

6. Regular data source
The details of new persons are obtained primarily via the online form or by phone.

7. Regular disclosures of data and transfer of data outside the EU and the EEA
Once a year, members and magazine subscribers are sent an invoice. The invoices are printed at Suomen Kansanmusiikkiliitto and sent by post. Reminder invoices are printed at the end of the year for those members who have not paid. Payment data is retrieved electronically from the banking software into the membership register. Twice a year, executive director Päivi Ylönen-Viiri produces payment lists of members who have paid, at the same time as she remits to the member organisations their shares of the membership income. The first is in the autumn and the second after the turn of the year.
Suomen Kansanmusiikkiliitto discloses to its own member organisations the address details of each member association's own individual members. Agreements are concluded with the member organisations specifying to which of their representatives data may be delivered.
For the mailing of each issue of the Kansanmusiikki magazine, Suomen Kansanmusiikkiliitto delivers an address file electronically to the printing house in Forssa. A separate file for addresses mailed within Finland and for addresses mailed abroad.

Data is not disclosed outside the EU or the EEA.

8. Principles of register protection
The register is processed with due care, and data processed by means of information systems is appropriately protected. When register data is stored on internet servers, the physical and digital security of the hardware is appropriately taken care of. The data controller ensures that stored data, server access rights and other data critical to the security of personal data are handled confidentially and only by those employees whose job description includes such handling.

9. Right of inspection and right to demand rectification of data
Every person in the register has the right to inspect the data stored about them in the register and to demand the rectification of any inaccurate data or the completion of incomplete data. If a person wishes to inspect the data stored about them or to demand its rectification, the request must be sent in writing to the data controller. The data controller may, where necessary, ask the person making the request to prove their identity. The data controller will respond to the customer within the time limit laid down in the EU General Data Protection Regulation.

10. Other rights related to the processing of personal data
A person in the register has the right to request the erasure of personal data concerning them from the register. Requests must be sent in writing to the data controller.