


KUJ:lla on nollatoleranssi häirintää kohtaan. Mahdollisissa häirintätapauksissa voit ottaa yhteyttä luottamuksellisesti häirintäyhdyshenkilöihimme:
Netta Jokinen
044 974 5353
netta.jokinen@aalto.fi
KUJ Ry Privacy Statement
Event Signup Register
EU General Data Protection Regulation 2016/679
1. Controller of the register and contact information
Controller: Kulttuurijaosto Ry (KUJ Ry)
Business ID: 2267196-4
Address: Konemiehentie 4, 02150, Espoo
Email: kuj@ky.fi
Phone: +358 44 236 5035
Contact person: Arttu Hakkarainen, Communications Responsible
Email: arttu.o.hakkarainen@aalto.fi
2. Name of the register
Event Signup Register
3. Data subjects
This register includes personal data of individuals attending KUJ Ry’s events (“Data
subjects”).
4. Legal basis and purpose of gathering personal data
The legal basis for gathering personal information, complying with the EU GDPR, is the
legitimate interest of the controller of the register.
The purpose of the register is to collect and process the personal data needed to organize
the event.
5. Data content
The register contains information that are necessary to organize the event. This includes
at most the following data, depending on the type of event organized:
Data subject’s first and last name;
Data subject’s email address;
Data subject’s phone number;
Data subject’s special diets;
Data subject’s preferred communication language; and/or
Alternating event-specific information.
6. Regular sources of information
Personal data is collected from the data subjects themselves.
7. Regular disclosures and transfers of personal data
Personal data is not disclosed or transferred regularly.
Personal data can be disclosed to KUJ Ry’s cooperation partners to organize the events.
Personal data can be disclosed to KUJ Ry’s cooperation partners for other than event-
related purposes only with the data subject’s consent.
Personal data can be transferred to other service providers to execute the personal data
system (“System”). The service provider executing the technical maintenance of the
member register may transfer personal data in accordance with applicable privacy
legislation and this Privacy Statement.
8. Transfers of personal data outside of EU or the EEA
Personal data won’t be transferred outside the European Union or the European Economic
Area by KUJ Ry. However, KUJ Ry may use a service provider that is located outside of
the EU or the EEA. The transfer of personal data outside of EU or the EEA is always
carried out on one of the following legal grounds:
The European Commission has decided that an adequate level of data protection has
been ensures in the recipient country;
KUJ Ry has implemented the appropriate safeguards for the transfer of personal data
using standard terms of privacy approved by the European Commission. The data subject
has the right to obtain a copy of these standard clauses by contacting KUJ Ry’s contact
regarding privacy; or
The data subject has consented to the transfer of their personal data, or there is a lawful
ground for the transfer.
Access to the personal data is limited to what is necessary to carry out the services. The
transfer of personal data outside of the EU or the EEA is always based on current
legislation on the processing of personal data and is carried out in accordance with that
legislation.
9. Protection of personal data and information security
All digitally handled personal data is stored securely in KUJ Ry’s System. Access to the
System is limited to only authorized individuals that need the access to handle their work
assignments. These individuals use their personal usernames and passwords to access
the System.
Personal data is secured from outsiders, and the use of member data is supervised.
Personal data sent outside the KUJ Ry is encrypted. Workstations and storages are
secured.
Google LLC (US41503674) and Kide.app (2623329-1) are used to store the register.
These organizations are responsible for the technical maintenance and protection of the
event signup register.
10. Retention period of data
Personal data is stored only for as long as necessary, and data will be deleted from the
register within a reasonable time after the event has ended. For a normal event this
usually means two weeks after the event has ended. If some of the information is still
required after this for exceptional reasons such as collecting delayed payments, can the
data of the affected data subjects be retained until the situation has passed.
In certain circumstances, for example when required by law, personal data will be retained
for a maximum of 10 years after the event has ended based on KUJ Ry’s legitimate
interest. Personal data may be stored for longer time periods if the applicable legislation or
KUJ Ry’s contractual obligations require it.
11. Data subject’s rights
The data subject has the right to object to the processing of his/hers personal data for
direct marketing purposes at any given time. The data subject may provide KUJ Ry with
channel-specific consents and restrictions (e.g. prohibit marketing via email).
In addition, the data subject has per se following rights at any time in accordance with
applicable data protection legislation:
receive information about the processing of his/hers personal data;
have access to his/hers own personal data and inspect his/hers personal data processed
by KUJ Ry;
demand correction and supplementation of inaccurate or incorrect personal data;
demand the removal of own personal data;
withdraw his/hers consent and object to the processing of personal data insofar as the
processing of personal data is based on consent;
receive his/hers personal data in digital form and transfer those to another service provider
given that the data subject has delivered the data to KUJ Ry personally, KUJ Ry processes
the personal data in question based on consent and the processing is automatic; and
demand the processing of his/hers personal data to be restricted.
The data subject must submit the request for execution of the above-mentioned according
to section 13 of this Privacy Statement. KUJ Ry may ask the data subject to specify the
request in writing and verify the data subject’s identity before processing the request. KUJ
Ry may refuse to execute the request based on applicable legislation.
12. Right to complain to supervising authority
Each data subject has the right to complain to the relevant supervising authorities or to the
supervisory authorities of the Member State of the European Union where the data
subject’s resident or workplace is located if the data subject sees that his/hers personal
data has not been processed according to applicable data protection legislation.
13. Contact information
Requests considering the data subject’s rights, questions about this Privacy Statement
and other contacts should be sent via email to the contact person.
Contact person: Arttu Hakkarainen, Communications responsible
Email: arttu.o.hakkarainen@aalto.fi
The data subject may also contact us personally or in writing at the address below:
Kulttuurijaosto Ry (KUJ Ry)
Konemiehentie 4
02150, Espoo
14. Changes to this Privacy Statement
This Privacy Statement has been implemented by the Executive Board of KUJ Ry on
20.1.2025. It may be updated from time to time, for example, due to changes in legislation.
The Privacy Statement was last updated on 20.1.2025.