Data File Description in accordance with Section 10 of the Personal Data Act (523/99) and the EU General Data Protection Regulation (GDPR).

Date of preparation: May 21, 2018.

1 Data Controller

Vapa Media Oy
2764681-3
Paasivuorenkatu 4 B, 5th floor
00530 Helsinki

myynti@vapamedia.fi
+358 50 5004566

2 Name of the Registry

Vapa Media News Letter Registry

3 Contact Person for Matters Concerning the Registry

myynti@vapamedia.fi
+358 50 5004566

4 Purpose of Personal Data Processing and Retention Period

The purpose of the registry is to facilitate Vapa Media Oy’s general marketing communications via an electronic newsletter. Individuals in the registry may receive information via email about Vapa Media’s current affairs, events, training sessions, products, or services.

The data controller will retain the data only for as long as necessary for the purpose of the registry.

5 Data Contents of the Registry

The registry stores the name, email address, and organization represented by the individual, as provided by the individual.

6 Sources of Information

A person listed in the registry has either

• submitted their contact information via the form at www.vapamedia.fi
• represents a company that is a client or partner of Vapa Media, in which case the source of the information is Vapa Media Oy’s customer registry
• has otherwise given their consent to be added to the registry.

A person may remove their information from the newsletter registry at any time via the link provided in the newsletter.

7 Tietojen luovutus ja siirto

Tietoja ei luovuteta ilman rekisteröidyn lupaa muuten kuin lain sallimissa ja velvoittamissa rajoissa tai viranomaisten vaatimusten edellyttämällä tavalla.

8 Protection of the Database

Individuals who process data in the database are bound by a duty of confidentiality and have received training on how to use the database. Vapa Media uses the U.S.-based MailChimp email service for its newsletter communications. Access to the database is restricted by usernames and passwords. Access rights are granted only to individuals who are bound by a duty of confidentiality and have been trained in the use of the database, and whose access rights are related to their position and duties.

Personal data is transferred outside the European Union via MailChimp, but MailChimp has committed to protecting the data in accordance with the General Data Protection Regulation by May 25, 2018. MailChimp has already been protecting personal data in accordance with the Personal Data Act prior to this date.

9 Rights of the Data Subject

The data subject has the rights listed in this section. Requests regarding the rights listed below must be made in writing and submitted, signed, to the data controller:

Vapa Media
Bulevardi 21
00180 Helsinki

Right of Access to Data

The data subject has the right, upon request, to receive information in accordance with Article 15 of the General Data Protection Regulation regarding the personal data concerning him or her that the controller is processing.

Right to Rectification

The data subject has the right, pursuant to Article 16 of the General Data Protection Regulation, to request that the controller rectify any inaccurate or incorrect personal data concerning the data subject. If necessary, the data subject has the right to have incomplete personal data completed by providing the controller with additional information regarding the matter.

Right to Erasure

If personal data is no longer necessary for the purposes set forth in this Privacy Policy, the data subject has withdrawn the consent on which the processing of the data was based, or the data controller has processed the personal data unlawfully, the data subject has the right to have their personal data erased from the database.

Right to Restriction of Processing

The data subject has the right to request that the controller restrict the processing of personal data in the cases specified in Article 18 of the General Data Protection Regulation.

Right to File a Complaint with the Supervisory Authority

If a data subject believes that the processing of their personal data violates the General Data Protection Regulation, they have the right to file a complaint with the supervisory authority, which in this case is primarily the Data Protection Ombudsman.

10 Amending the Privacy Notice

The data controller reserves the right to update and amend the Privacy Notice. If required by law, we will notify the data subjects of such changes.