Accessibility tools
AI-translated page—pardon any small errors!
Privacy notice and record of processing activities pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council. Updated 30.8.2026.
Helsingin Teatterisäätiö / Helsingin Kaupunginteatteri (Y-tunnus 0116521-0)
Ensi Linja 2
00530 Helsinki
Hereinafter, the abbreviation “HKT” is occasionally used to refer to the data controller.
Olli Eljaala
Telephone +358 50 379 9648
Email olli.eljaala@hkt.fi
Helsinki City Theatre customer service register
The register contains personal data concerning visitors, participants, HKT’s former, current and potential customers, and representatives of HKT’s staff, stakeholders and partners.
As a rule, the processing of personal data is based on a contract between the customer and HKT (such as a ticket purchase or loyalty programme membership) and HKT’s legitimate interests. We process your data on the basis of consent only when we have separately requested your permission to do so (such as for electronic direct marketing or cookies).
We process your personal data to comply with statutory obligations for the following purposes:
We process your personal data to fulfil obligations under a contract between us or, at the data subject’s request, to take steps prior to entering into a contract, including in the following situations:
In certain processing contexts, HKT has conducted balancing tests in accordance with the guidance of the Office of the Data Protection Ombudsman to assess the use of legitimate interests as a legal basis:
The development of HKT’s operations is based on the purposes set out in the rules of Helsingin Teatterisäätiö and our legitimate interest in maintaining and improving our theatre services.
The register is used to develop HKT’s operations, process customer service requests, deliver products and services ordered by customers, and manage customer relationships. The data is used for statistical purposes and to provide more personalised, targeted content in our online services and marketing campaigns. Personal data is processed within the limits permitted and required by data protection legislation.
The register comprises sub-registers including the following:
Sub-registers based on orders, bookings, participation, membership or purchases:
Sub-registers based on website visits:
Sub-registers based on electronic communications:
HKT uses the data in the register in its own operations to send admission tickets, electronic notifications, event information, booking details and customer mailings, and to process customer service requests, for example at the box office, via customer service chat and instant messaging services, by telephone or by email. The data in the register may be used to issue refunds for cancelled performances. HKT uses partners to maintain customer and service relationships and to provide technical monitoring and maintenance of information systems. Some register data may be transferred to a partner’s servers due to technical requirements.
The customer service register and its sub-registers contain information including the following:
Special categories of personal data and sensitive information:
The health-related information listed above, such as accessibility requirements or special dietary requirements for interval refreshments, is processed only at the customer’s own initiative and for the purpose of providing the service requested by the customer. This data is processed solely to ensure the customer’s safety and health and the accessibility of our services, and it is not used to profile customers. Bank details are processed only to issue ticket refunds resulting from cancelled performances and are not retained or used for any other purpose.
Customer data is regularly obtained:
We retain customer data only for as long as necessary to fulfil the purposes specified in section 5 above, in accordance with the legislation in force at the time. You can read more about the retention practices for personal data stored in the ticketing system’s customer data register in our ticketing partner’s own privacy statement.
We apply the principle of data minimisation to data retention and determine retention periods according to the sub-register and purpose of use:
Contact details of individuals invited to and registered for events that are stored in separate event management and registration systems, such as Lyyti, are anonymised in the relevant system no later than one year after the event has ended, and other personal data no later than seven days afterwards. Please note, however, that if the registration results in an actual ticket or right of admission to a performance, this participation data will be stored in the theatre’s main ticketing system and will be subject to the 10-year retention period stated above.
In sub-registers relating to website visits, log data is pseudonymised or anonymised either immediately when it is recorded or no later than 60 days after the logged event, unless a longer period is required to investigate potential misuse and ensure information security or by the technical implementation of a specific service.
You have the right to request the deletion of your data in accordance with section 15 of this notice. Please note, however, that we cannot delete personal data insofar as its retention is necessary to comply with statutory requirements or fulfil our outstanding contractual obligations, such as honouring a ticket purchased for a forthcoming performance.
We use partners such as technical service providers, many of which also act as processors of personal data. Access to the register requires access rights and passwords for HKT’s or its partner’s information systems. Within HKT’s organisation, access to the register is restricted to individuals whose duties require them to use the data in the register.
Our partners often use third parties, or subprocessors, that help us provide our services and process personal data. We ensure that all processors and subprocessors we use are committed to complying with the requirements of the EU General Data Protection Regulation (GDPR). In many cases, a subprocessor’s or processor’s Data Processing Agreement (DPA) is incorporated into their terms of service, which we accept when using the service.
Our main processors and subprocessors are listed below. Any changes to this list will be updated on this page.
| Name of subprocessor/processor | Purpose of processing | Location of data processing | Basis for transfer (outside the EU/EEA) |
|---|---|---|---|
| Amazon Web Services Inc. * | Cloud services (e.g. AWS) | EU/EEA, United States | EU–US Data Privacy Framework |
| Apple Inc. * | Cloud services, communications infrastructure (e.g. push notification service) | EU/EEA, United States | EU–US Data Privacy Framework |
| Automattic Inc. | Security, performance, operational reliability and monitoring of WordPress websites | EU/EEA, United States | EU–US Data Privacy Framework |
| Bluesky PBLLC | Decentralised social media platform, communications, content management | EU/EEA, United States | EU–US Data Privacy Framework |
| Cookie Information A/S | Consent management | EU/EEA | Data is processed within the EU/EEA |
| Custobar Oy | Customer data management, marketing automation, CRM services | EU/EEA, United States | European Commission Standard Contractual Clauses (SCCs) |
| Defiant, Inc. (Wordfence) | WordPress website security (firewall, malware scanning) | EU/EEA, United States | European Commission Standard Contractual Clauses (SCCs) |
| Fidelius Online S.R.L. | SMS delivery infrastructure | EU/EEA | Data is processed within the EU/EEA |
| Giosg.com Oy | Live chat services, chatbots, website personalisation, analytics | EU/EEA | Data is processed within the EU/EEA |
| Google LLC * | Cloud services (hosting), analytics, advertising | EU/EEA, United States | EU–US Data Privacy Framework |
| Grano Oy | Media bank service | EU/EEA, United States | European Commission Standard Contractual Clauses (SCCs) |
| Kaapelin Mediakeskus Oy | Provision of IT services (hosting, DNS services) | EU/EEA | Data is processed within the EU/EEA |
| Knowit Oy | IT consulting, software development, digital services | EU/EEA, United States | European Commission Standard Contractual Clauses (SCCs) |
| Liana Technologies Oy | Communications and marketing platforms (e.g. email, press releases) | EU/EEA | Data is processed within the EU/EEA |
| LinkedIn Corporation | Professional networking, recruitment, marketing | EU/EEA, United States | EU–US Data Privacy Framework |
| Lippupiste Oy | Event tickets, customer management, marketing, consulting | EU/EEA | Data is processed within the EU/EEA |
| Lyyti Oy | Event management, registrations, communications | EU/EEA, United States | European Commission Standard Contractual Clauses (SCCs) |
| Mailjet SAS * | Email delivery and management | EU/EEA, United States | EU–US Data Privacy Framework |
| Meltlake Oy | Technical support and consulting for the intranet | EU/EEA, United States | EU–US Data Privacy Framework |
| Meta Platforms, Inc. * | Social media services, advertising, analytics | EU/EEA, United States | EU–US Data Privacy Framework |
| Microsoft Corporation * | Cloud services (e.g. Azure, Microsoft 365) | EU/EEA, United States | EU–US Data Privacy Framework |
| Nodium | Technical support, maintenance and development of digital services | EU/EEA, United States | European Commission Standard Contractual Clauses (SCCs) |
| Planeetta Internet Oy | Web hosting, cloud services | EU/EEA, United States | European Commission Standard Contractual Clauses (SCCs) |
| SendGrid (Twilio Inc.) * | Email delivery and management (e.g. transactional and marketing emails) | EU/EEA, United States | EU–US Data Privacy Framework |
| Seravo Oy | WordPress hosting, maintenance, development | EU/EEA, United States | European Commission Standard Contractual Clauses (SCCs) |
| Sodexo Oy | Catering services, interval refreshments, facilities services (e.g. cleaning, property maintenance) | EU/EEA, United States | European Commission Standard Contractual Clauses (SCCs) |
| X Corp. | Social media platform, marketing, communications, analytics | EU/EEA, United States | EU–US Data Privacy Framework |
| Yumpu (i-Magazine AG) | Hosting, distribution, embedding and analytics for digital publications (e.g. magazines and annual reports). | EU/EEA, United States | European Commission Standard Contractual Clauses (SCCs) |
* indicates a subprocessor engaged by one of our processors to carry out specific processing activities on our behalf. Please note that many technology and service partners may also act as independent or joint data controllers in relation to other processing activities. These typically include social media platforms, lippu.fi, which maintains its own customer register, and global service providers such as Apple and Google when a customer uses device-level features or is signed in to the company’s own ecosystem.
Personal data may be transferred outside the European Union when necessary to ensure the technical implementation of HKT’s or its partner’s services (see section 9). When data is transferred outside the European Union, we ensure an adequate level of protection for personal data as required by law.
The data in the customer service register is used exclusively by HKT, except when HKT uses an external partner (see section 9) to provide a service. HKT works with Lippupiste Oy for ticket sales. Insofar as data obtained through ticket sales is stored in Lippupiste Oy’s own customer register and processed for its own commercial purposes, Lippupiste Oy acts as an independent data controller. Further information about Lippupiste Oy’s processing of personal data is available in its own privacy notice. If we merge or otherwise reorganise our operations, customers’ personal data may be disclosed within the new organisation.
We do not make automated decisions as referred to in Article 22 of the GDPR that would have legal or similarly significant effects on you. However, we may use profiling to target marketing, for example on the basis of purchase history or website behaviour, so that we can offer you more relevant content. In addition, our website’s security systems may automatically analyse web traffic and IP addresses to prevent misuse.
We may collect information about the user’s device through cookies and other similar technologies, such as the browser’s local storage. A cookie is a small text file stored by the browser on the user’s device. Cookies often contain an anonymous, unique identifier that enables us to identify and count the browsers visiting our website. Some functional cookies are essential for our services to work and therefore do not require the user’s consent.
Third parties may place cookies on the user’s device when the user visits our services in order to compile visitor statistics across different websites or provide features such as customer service chat. Third parties are entities outside HKT, such as measurement and tracking service providers. Some third-party cookies are non-essential.
Detailed information about the cookies used on this website is available on our Cookie Policy page.
Our website uses caching to load pages faster and improve your user experience. The cache creates temporary copies of website content, such as images, scripts and user session data, so that your browser can display them more quickly on subsequent visits. This includes using the browser’s local cache as temporary storage. Once you have made your consent choices through our consent management platform, our website will adapt its behaviour accordingly. We also use an external distributed content delivery network (CDN) to deliver static content such as images.
Our services may also contain links to other websites and social networking services, but we are not responsible for the privacy practices or content of these external websites. We recommend reviewing the privacy terms of these services.
Location data from the user’s device may be used to provide location-based services, such as regional content and targeted advertising, provided that the user has given explicit consent to the use of location data or the location data has been anonymised.
Location data is determined using available positioning methods, such as GPS, WLAN access points and mobile network base station locations. The user may withdraw their consent at any time through the device and application settings.
We are committed to providing our users with choices and control over their privacy. Below, we list the various ways in which users can influence the collection and processing of their data.
The data subject has the right to access the personal data concerning them that has been stored in the register. You can submit a request for access by email to info@hkt.fi or by post to:
Helsingin Kaupunginteatteri / Tietosuoja
Ensi Linja 2
00530 Helsinki
Please be prepared to verify your identity when submitting your request so that we can ensure the security of your data.
A request for access may also be submitted in person at Ensi Linja 2, 00530 Helsinki.
The data subject has the right to request the rectification of inaccurate data by notifying us by email at info@hkt.fi or by post at the address above.
The data subject has the right to opt out of electronic marketing communications by using the link at the end of each message or by notifying us by email at info@hkt.fi.
Users can block all cookies by changing their browser settings. Non-essential cookies relating to matters such as website analytics can be blocked by changing the settings below. Blocking cookies may affect the functionality of our services and/or prevent the use of some services, such as viewing videos embedded on the website.
Users can clear cookies through their browser settings. By clearing cookies regularly, the user changes the identifier used to create their profile. However, clearing cookies does not completely stop data collection; instead, it resets the profile based on previous behavioural data.
Users can consent to the use of location data through their device and application settings. These settings also allow users to withdraw their consent at any time.
The data subject has the right to request that the data controller erase their data from its systems (“right to be forgotten”) by notifying us by email at info@hkt.fi or by post at the address above.
The data subject has the right to request that the data controller transfer their data to another system in a commonly used, machine-readable format. This right applies only to data that the data subject has personally provided to the data controller. Requests for data portability should be submitted by email to info@hkt.fi or by post to the address above.
The data subject has the right to object to profiling carried out for direct marketing purposes by notifying us by email at info@hkt.fi or by post at the address above.
If you believe that the processing of your personal data infringes data protection legislation, you have the right to lodge a complaint with the Data Protection Ombudsman (www.tietosuoja.fi).
Manual materials relating to the register are stored in secure premises. Digitally stored and processed data is held in databases protected by firewalls, passwords and other technical safeguards. The databases are located in premises monitored around the clock. Within HKT’s organisation, access to the register is restricted to individuals whose duties require them to use the data in the register.
We continuously develop our services and reserve the right to amend this privacy notice by announcing changes through our services. Changes may also be based on amendments to legislation. We recommend reviewing the content of this privacy notice regularly. The current version of this privacy notice is available at https://hkt.fi/kayttoehdot.
Helsingin Teatterisäätiö Sr / Helsinki City Theatre (Business ID 0116521-0)
Ensi Linja 2
00530, Helsinki
Hereinafter, the data controller may also be referred to as “HKT”.
Name: Eemil Hallikas, Technical Facilities Manager
Telephone: +358 50 3424 200
Email: eemil.hallikas@hkt.fi
Helsinki City Theatre’s recording CCTV systems
The person responsible for the data file and persons authorised by them
The primary purpose of CCTV surveillance is to prevent crime and vandalism. It also aims to improve the safety of customers and staff and to protect property held by the organisation. The data is used to investigate criminal offences and incidents involving damage and, where necessary, to identify persons who have been present on the premises.
The data file contains footage recorded by surveillance cameras. The material is recorded in digital and analogue formats. Cameras are located at the entrances, in customer areas and at other locations considered technically important within properties and theatres owned or leased by HKT. The recordings capture persons moving through or present in areas covered by CCTV surveillance.
The data file consists of analogue or digital recordings transmitted by cameras installed in locations deemed necessary by the organisation. Stickers and signs at the premises indicate that recording CCTV surveillance is in operation.
Data is retained for a maximum of 2 weeks, after which it is erased as the system overwrites old footage with new footage. A recording may be retained beyond this period if it is required to complete the investigation or processing of a case involving disruptive behaviour, harassment, inappropriate conduct, a criminal offence, an occupational accident or an occupational safety matter that arose before the end of the retention period.
Recordings are handled confidentially. They are processed by HKT personnel responsible for CCTV surveillance and by our partners for servicing and maintenance purposes.
Data contained in the data file is not transferred outside the EU or the European Economic Area.
Data is not regularly disclosed to any third parties. Data may be disclosed to the police or other authorities in cases where a criminal offence has occurred or is suspected to have occurred, provided that the statutory requirements for disclosure are met.
The data is protected through access management and access rights. Access to the data file is restricted to HKT employees who require the data in the course of their duties and to our partners for servicing and maintenance purposes.
CCTV surveillance is indicated by separate signs. This privacy notice is available upon request.
Right of access and rectification
The data file contains automatically and technically recorded information that, as a rule, does not contain inaccurate data. Unnecessary or outdated recordings are automatically deleted within approximately 2 weeks.
Data subjects have the right to access the personal data concerning them that has been stored in the data file. Requests for access must be submitted in writing, signed and sent to:
Helsinki City Theatre / Tietosuoja
Ensi Linja 2
00530 Helsinki
After submitting a sufficiently detailed and specific request for access, the person has the right to access personal data concerning them contained in the recordings, subject to the rights and restrictions set out in greater detail in the General Data Protection Regulation. The response to the request will be sent by post to the person who submitted it.
Right to lodge a complaint with a supervisory authority
We aim to resolve any disagreements directly with the data subjects in the first instance. If a data subject considers that we have not processed personal data lawfully, they may lodge a complaint with the data protection authority.
We continually develop our services and reserve the right to amend this privacy notice by announcing the changes through our services. Amendments may also be made in response to changes in legislation. The current version of this privacy notice is available at https://hkt.fi/kayttoehdot/
These Terms of Use apply to the use of the website (hkt.fi) of Helsingin Teatterisäätiö / Helsinki City Theatre (hereinafter HKT). The website serves as HKT’s digital service platform, providing information about the theatre’s programme and activities and directing users to ticket sales channels. By using the website, you agree to accept and comply with these terms.
The website’s content, including its texts, images, logos and visual design, is protected by copyright law and other intellectual property rights. The rights to the materials belong to HKT or other rights holders. The website content may be used for ordinary web browsing, information searches and communication. However, unauthorised commercial use, reproduction or bulk collection of the website content—for example, to train AI models, conduct data mining or for other commercial automation—is expressly prohibited without HKT’s prior written consent. Press releases and materials specifically intended for the media may be freely used for communications and journalistic purposes.
Media and press: Images intended for news coverage and publications concerning the theatre are available in the Media Bank (productions currently in the programme) and the Image Bank Archive (productions no longer in the programme). The media and content creators may use these images freely for this purpose, provided that the photographer is credited in accordance with good practice. Republishing, editing or commercially using any other content on the website requires HKT’s prior written consent, which must be requested using the contact details provided in the Media Bank.
The website and its features, such as online service forms and feedback channels, must be used in accordance with applicable legislation and accepted standards of online conduct. Improper or inappropriate use refers to any activity that infringes the rights of HKT, its staff or other users, or compromises the security of the service.
Users must not:
Audience comments:
The website collects and publishes audience feedback and experiences relating to the theatre’s programme. The following terms apply to audience comments:
Users are responsible for the information security of their own devices and telecommunications connections. HKT reserves the right to block website access for users who violate these terms, take any necessary legal action and report misuse to the relevant authorities.
Ticket sales and customer programmes are governed by separate terms and conditions. Tickets are sold through separate ticket sales channels, such as lippu.fi or the theatre’s own sales outlets:
The website and its features are provided on an “as is” basis. HKT endeavours to keep the information on the website accurate and up to date but does not guarantee its completeness or the uninterrupted availability of the service.
HKT uses artificial intelligence and automation responsibly in accordance with HKT’s AI principles. Further information about the use of AI at the theatre is available on HKT’s AI page.
To improve the website’s accessibility and its ability to serve international audiences, machine translation and AI-assisted translation tools may be used in the website’s foreign-language versions. Although attention is paid to translation quality, HKT cannot guarantee that automatically generated translations will be entirely error-free, and they may contain linguistic or conceptual inaccuracies. In the event of any ambiguity or discrepancy, the website’s original Finnish-language text will always take precedence and serve as the legally binding source of information.
HKT continuously develops its online services and reserves the right to amend these Terms of Use without separate prior notice. These Terms of Use and the use of the website are governed by Finnish law.
If you have any questions about this website or its Terms of Use, or wish to report a technical issue, please contact us by email at: info@hkt.fi.
Helsinki Theatre Foundation (Helsinki City Theatre, hereinafter “HKT” or the “Organiser”), Ensi linja 2, 00530 Helsinki.
Competitions and related prize draws organised in connection with HKT’s marketing campaigns are open to individuals aged 18 or over. Prize draws organised in connection with surveys are open to individuals aged 15 or over. No purchase of an HKT product or service is required to enter. Employees of the Organiser and their family members are not eligible to enter competitions or prize draws.
Entries must be submitted in accordance with the instructions provided for each competition or prize draw. Each person may enter a campaign prize draw only once. Competitions and prize draws are not endorsed, sponsored or administered by any third party, such as a social media platform.
The entry period for each competition or prize draw will be specified separately in the campaign post or entry instructions. Entries, reactions or sign-ups registered after the entry period has ended will not be included in the prize draw. The Organiser is not responsible for any inability to enter due to IT-related or other technical issues.
The prize will be specified separately for each campaign (such as a complimentary ticket package for an HKT performance or another product prize). The winner will be selected at random from among the entrants using a computer program or a prize draw.
The Organiser will notify the winner personally (e.g. by email or private message) and/or in a post on the relevant social media platform. If the winner cannot be reached within a reasonable period, a posted prize is returned as undeliverable due to incorrect contact details, or the entrant is found to have acted in breach of these rules or the law, a new winner will be selected. As a rule, the prize will be delivered within one week of the winner being determined.
The Organiser reserves the right to disqualify and remove from the prize draw any entrants who attempt to abuse the entry process or improperly influence the results.
By accepting the prize, the winner releases the Organiser from all liability and costs that may arise from entering the competition or accepting and using the prize. However, this release does not limit any statutory rights afforded to consumers under consumer protection legislation.
The Organiser’s liability towards entrants is limited to the quantity and value of the prize offered in the competition or prize draw. The winner is responsible for any other costs associated with accepting or redeeming the prize.
The Organiser is responsible for paying the statutory lottery tax on the prizes referred to in these rules. Prizes cannot be exchanged for cash or another product. By entering a competition or prize draw, entrants agree to comply with these rules and the Organiser’s decisions concerning them. The Organiser reserves the right to amend these rules by announcing any changes on its website.
Personal data collected in connection with a competition or prize draw will be processed solely for the purposes of conducting the prize draw and notifying the winner. The data may be used for direct marketing only if the entrant has provided separate consent for this purpose (e.g. by joining the Teatteriin club or subscribing to HKT’s newsletter). By entering a competition or prize draw, entrants grant the Organiser the right to publish the winner’s first and last name on HKT’s website, social media channels and in marketing materials.