Accessibility tools
AI-translated website—pardon any small errors!
In the event of any ambiguity or discrepancy, the original Finnish-language text on the website will always take precedence and constitute the legally binding source of information.
Privacy notice and record of processing activities pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council. Updated 30.8.2026.
Helsingin Teatterisäätiö / Helsingin Kaupunginteatteri (Y-tunnus 0116521-0)
Ensi Linja 2
00530 Helsinki
Hereinafter, the abbreviation “HKT” may be used to refer to the data controller.
Olli Eljaala
Telephone +358 50 379 9648
Email olli.eljaala@hkt.fi
Helsinki City Theatre Customer Service Register
The register contains personal data relating to visitors, participants, HKT’s former, current and prospective customers, as well as representatives of HKT’s staff, stakeholders and partners.
As a rule, the processing of personal data is based on an agreement between the customer and HKT (such as a ticket purchase or membership in the customer loyalty programme) and on HKT’s legitimate interests. We process your data on the basis of consent only when we have specifically requested your permission to do so (such as for electronic direct marketing or cookies).
We process your personal data to comply with legal obligations for the following purposes:
We process your personal data to fulfil our contractual obligations or, at your request, to take steps before entering into an agreement, including in the following situations:
For certain processing activities, HKT has carried out balancing tests in accordance with the guidelines of the Office of the Data Protection Ombudsman to assess the use of legitimate interests as the legal basis:
The development of HKT’s operations is based on the purposes set out in the rules of Helsingin Teatterisäätiö and on our legitimate interest in maintaining and improving our theatre services.
The register is used to develop HKT’s operations, process customer service requests, deliver products and services ordered by customers, and manage customer relationships. The data is used for statistical purposes and to provide more personalised, targeted content in our online services and marketing campaigns. Personal data is processed within the limits permitted and required by data protection legislation.
The register comprises, among others, the following sub-registers:
Sub-registers based on orders, bookings, participation, membership or purchases:
Sub-registers based on website visits:
Sub-registers based on electronic communications:
HKT uses the register data in its own operations to send admission tickets, electronic communications, event information, booking details and customer mailings, and to process customer service requests at, for example, the box office, via customer service chat, instant messaging services, telephone or email. The register data may be used to issue refunds for cancelled performances. HKT uses partners to maintain customer and service relationships and to carry out technical monitoring and maintenance of information systems. Some register data may be transferred to a partner’s servers due to technical requirements.
The Customer Service Register and its sub-registers contain, among other things, the following data:
Special categories of personal data and sensitive data:
Health data listed above, such as accessibility requirements or special dietary requirements for interval refreshments, is processed only at the customer’s own initiative and in order to provide the service requested by them. Such data is processed solely to ensure the customer’s safety and health and the accessibility of the services, and it is not used for customer profiling. Bank details are processed only to issue ticket refunds due to cancelled performances and are not retained or used for any other purpose.
Customer data is regularly obtained:
We retain customer data only for as long as necessary to fulfil the purposes specified in section 5 above, in accordance with applicable legislation. For more information about the retention practices concerning personal data stored in the ticketing system’s customer data register, please see our ticketing partner’s own Privacy Statement.
We apply the principle of data minimisation to data retention and determine retention periods according to the sub-register and purpose of use:
The contact details of people invited to or registered for events that are stored in separate event management and registration systems, such as Lyyti, are anonymised in the relevant system no later than one year after the event ends, and all other personal data no later than seven days after the event ends. Please note, however, that if registration results in the issue of an actual ticket or right to attend a performance, the participation data will be stored in the theatre’s main ticketing system, where the 10-year retention period specified above applies.
In sub-registers relating to website visits, log data is pseudonymised or anonymised either immediately when it is recorded or no later than 60 days after the log event, unless investigating possible misuse to ensure information security or the technical implementation of a specific service requires otherwise.
You have the right to request the deletion of your data in accordance with section 15 of this notice. Please note, however, that we cannot delete personal data where its retention is necessary to comply with statutory requirements or fulfil outstanding contractual obligations, such as honouring a ticket purchased for a future performance.
We use partners such as technical service providers, many of whom also act as processors of personal data. Access to the register requires access rights and passwords for HKT’s or its partner’s information systems. Within HKT’s organisation, access to the register is restricted to individuals whose duties require them to use the data it contains.
Our partners often use third parties, or subprocessors, who help us provide our services and process personal data. We ensure that all processors and subprocessors we use are committed to complying with the requirements of the EU General Data Protection Regulation (GDPR). In many cases, a subprocessor’s or processor’s Data Processing Agreement (DPA) is incorporated into the terms of service that we accept when using the service.
Our principal processors and subprocessors are listed below. Any changes to this list will be updated on this page.
| Name of subprocessor/processor | Purpose of processing | Location of data processing | Basis for transfer (outside the EU/EEA) |
|---|---|---|---|
| Amazon Web Services Inc. * | Cloud services (e.g. AWS) | EU/EEA, United States | EU–US Data Privacy Framework |
| Apple Inc. * | Cloud services, communications infrastructure (e.g. push notification service) | EU/EEA, United States | EU–US Data Privacy Framework |
| Automattic Inc. | Security, performance, operational reliability and monitoring of WordPress websites | EU/EEA, United States | EU–US Data Privacy Framework |
| Bluesky PBLLC | Decentralised social media platform, communications, content management | EU/EEA, United States | EU–US Data Privacy Framework |
| Cookie Information A/S | Consent management | EU/EEA | Data is processed within the EU/EEA |
| Custobar Oy | Customer data management, marketing automation, CRM services | EU/EEA, United States | European Commission Standard Contractual Clauses (SCCs) |
| Defiant, Inc. (Wordfence) | WordPress website security (firewall, malware scanning) | EU/EEA, United States | European Commission Standard Contractual Clauses (SCCs) |
| Fidelius Online S.R.L. | SMS delivery infrastructure | EU/EEA | Data is processed within the EU/EEA |
| Giosg.com Oy | Live chat services, chatbots, website personalisation, analytics | EU/EEA | Data is processed within the EU/EEA |
| Google LLC * | Cloud services (hosting), analytics, advertising | EU/EEA, United States | EU–US Data Privacy Framework |
| Grano Oy | Media bank service | EU/EEA, United States | European Commission Standard Contractual Clauses (SCCs) |
| Kaapelin Mediakeskus Oy | Provision of IT services (hosting, DNS services) | EU/EEA | Data is processed within the EU/EEA |
| Knowit Oy | IT consulting, software development, digital services | EU/EEA, United States | European Commission Standard Contractual Clauses (SCCs) |
| Liana Technologies Oy | Communications and marketing platforms (e.g. email, releases) | EU/EEA | Data is processed within the EU/EEA |
| LinkedIn Corporation | Professional networking, recruitment, marketing | EU/EEA, United States | EU–US Data Privacy Framework |
| Lippupiste Oy | Event tickets, customer management, marketing, consulting | EU/EEA | Data is processed within the EU/EEA |
| Lyyti Oy | Event management, registration, communications | EU/EEA, United States | European Commission Standard Contractual Clauses (SCCs) |
| Mailjet SAS * | Email delivery and management | EU/EEA, United States | EU–US Data Privacy Framework |
| Meltlake Oy | Technical support and consulting for the intranet | EU/EEA, United States | EU–US Data Privacy Framework |
| Meta Platforms, Inc. * | Social media services, advertising, analytics | EU/EEA, United States | EU–US Data Privacy Framework |
| Microsoft Corporation * | Cloud services (e.g. Azure, Microsoft 365) | EU/EEA, United States | EU–US Data Privacy Framework |
| Nodium | Technical support, maintenance and development of digital services | EU/EEA, United States | European Commission Standard Contractual Clauses (SCCs) |
| Planeetta Internet Oy | Web hosting, cloud services | EU/EEA, United States | European Commission Standard Contractual Clauses (SCCs) |
| SendGrid (Twilio Inc.) * | Email delivery and management (e.g. transactional emails, marketing emails) | EU/EEA, United States | EU–US Data Privacy Framework |
| Seravo Oy | WordPress hosting, maintenance, development | EU/EEA, United States | European Commission Standard Contractual Clauses (SCCs) |
| Sodexo Oy | Catering services, interval refreshments, facilities services (e.g. cleaning, property maintenance) | EU/EEA, United States | European Commission Standard Contractual Clauses (SCCs) |
| X Corp. | Social media platform, marketing, communications, analytics | EU/EEA, United States | EU–US Data Privacy Framework |
| Yumpu (i-Magazine AG) | Hosting, distribution, embedding and analytics of digital publications (e.g. magazines, annual reports). | EU/EEA, United States | European Commission Standard Contractual Clauses (SCCs) |
* indicates a subprocessor engaged by one of our processors to carry out specific processing activities on our behalf. Please note that many technology and service partners may also act as independent data controllers or joint controllers in relation to other processing activities. These typically include social media platforms, lippu.fi, which maintains its own customer register, and global service providers such as Apple and Google when customers use device-level features or are signed in to the company’s own ecosystem.
Personal data is transferred outside the European Union where this is necessary to ensure the technical implementation of HKT’s services or those of its partner (see section 9). When data is transferred outside the European Union, we ensure an adequate level of personal data protection as required by law.
The data in the Customer Service Register is used solely by HKT, except where HKT uses an external partner (see section 9) to provide a service. HKT uses Lippupiste Oy as its ticketing partner. Where data obtained through ticket sales is stored in Lippupiste Oy’s own customer register and processed by it for its own commercial purposes, Lippupiste Oy acts as an independent data controller. For more information on how Lippupiste Oy processes data, please see its own Privacy Notice. If we merge or otherwise reorganise our operations, customers’ personal data may be disclosed within the new organisation.
We do not make automated decisions as referred to in Article 22 of the GDPR that would have legal or similarly significant effects on you. However, we may use profiling to target marketing (for example, based on purchase history or website behaviour) so that we can offer you more relevant content. In addition, our website’s security systems may automatically analyse web traffic and IP addresses to prevent misuse.
We may collect information about a user’s device by using cookies and other similar technologies, such as the browser’s local storage. A cookie is a small text file stored by the browser on the user’s device. Cookies often contain an anonymous, unique identifier that allows us to identify and count the browsers visiting our website. Some functional cookies are essential for our services to work and therefore do not require the user’s consent.
Third parties may place cookies on a user’s device when the user visits our services in order to compile statistics on visitor numbers across different websites or provide functions such as customer service chat. Third parties are entities outside HKT, such as providers of measurement and tracking services. Some third-party cookies are non-essential.
Detailed information about the cookies used on this website is available on our Cookie Policy page.
Our website uses caching to load pages faster and improve your user experience. Caching creates temporary copies of website content, such as images, scripts and user session data, so that your browser can display them more quickly on subsequent visits. This includes using the browser’s local cache as temporary storage. Once you have made your consent choices through our consent management platform, our website will adapt its behaviour accordingly. We also use an external distributed content delivery network (CDN) to deliver static content such as images.
Our services may also contain links to other websites and social networking services, but we are not responsible for the privacy practices or content of these external websites. We recommend reviewing the privacy terms of these services.
Location data from a user’s device may be used to provide location-based services, such as regional content and targeted advertising, provided that the user has given explicit consent to the use of location data or the location data has been anonymised.
Location data is determined using available positioning methods, such as GPS, WLAN access points and mobile network base station locations. Users can withdraw their consent at any time through their device and application settings.
We are committed to giving our users choices and control over their privacy. Below, we list the different ways in which users can influence the collection and processing of their data.
Data subjects have the right to access the personal data stored about them in the register. You can submit an access request by email to info@hkt.fi or by post to:
Helsingin Kaupunginteatteri / Tietosuoja
Ensi Linja 2
00530 Helsinki
Please be prepared to verify your identity when submitting your request so that we can ensure the security of your data.
An access request may also be submitted in person at Ensi Linja 2, 00530 Helsinki.
Data subjects have the right to request the rectification of inaccurate data by emailing info@hkt.fi or writing to the postal address above.
Data subjects have the right to opt out of electronic marketing communications by using the link at the end of each message or by emailing info@hkt.fi.
Users can block all cookies by changing their browser settings. Non-essential cookies relating to, among other things, website analytics can be blocked by adjusting the settings below. Blocking cookies may affect the functionality of our services and/or prevent the use of some services, such as viewing videos embedded on the website.
Users can clear cookies through their browser settings. By clearing cookies at regular intervals, users change the identifier used to create their profile. However, clearing cookies does not stop data collection entirely; rather, it resets the profile based on previous behavioural data.
Users can consent to the use of location data through their device and application settings. These settings also allow users to withdraw their consent at any time.
Data subjects have the right to request that the data controller erase their data from its systems (“the right to be forgotten”) by emailing info@hkt.fi or writing to the postal address above.
Data subjects have the right to request that the data controller transfer their data to another system in a commonly used, machine-readable format. This right applies only to data provided to the controller by the data subject. Requests for data portability should be submitted by email to info@hkt.fi or by post to the address above.
Data subjects have the right to object to profiling carried out for direct marketing purposes by emailing info@hkt.fi or writing to the postal address above.
If you believe that your personal data has been processed in breach of data protection legislation, you have the right to lodge a complaint with the Data Protection Ombudsman (www.tietosuoja.fi).
Manual materials relating to the register are stored in secure premises. Digitally stored and processed data is held in databases protected by firewalls, passwords and other technical measures. The databases are located in premises monitored around the clock. Within HKT’s organisation, access to the register is restricted to individuals whose duties require them to use the data it contains.
We continuously develop our services and reserve the right to amend this Privacy Notice by announcing the changes through our services. Amendments may also be based on changes in legislation. We recommend reviewing the contents of this Privacy Notice regularly. The current version of this Privacy Notice is available at https://hkt.fi/kayttoehdot.
Helsingin Teatterisäätiö Sr / Helsinki City Theatre (Business ID 0116521-0)
Ensi Linja 2
00530, Helsinki
Hereinafter, the data controller is also referred to as “HKT”.
Name: Eemil Hallikas, Technical Facilities Manager
Telephone: +358 50 3424 200
Email: eemil.hallikas@hkt.fi
Helsinki City Theatre’s recording CCTV systems
The person responsible for the register and persons authorised by them
The primary purpose of CCTV monitoring is to prevent crime and vandalism. It also aims to improve the safety of customers and staff and to protect property in the company’s possession. The data in the register is used to investigate crimes and incidents involving damage and, where necessary, to identify persons who have entered or moved around the premises.
The register contains footage recorded by CCTV cameras. The material is recorded in digital and analogue formats. Cameras have been installed at the entrances, customer areas and other locations considered technically important in properties and theatres owned or leased by HKT. The register contains footage of persons entering, moving around or remaining in areas covered by CCTV monitoring.
The register consists of analogue or digital recordings transmitted by cameras installed in locations deemed necessary by the company. Stickers and signs are used to notify people that recording CCTV is in operation on the premises.
Data is retained for a maximum of 2 weeks, after which it is destroyed when the system records new footage over the old footage. A recording may be retained beyond this period if necessary to complete the investigation or processing of an incident involving disturbance, harassment, inappropriate conduct, a criminal offence, an occupational accident or an occupational safety matter that came to light before the end of the retention period.
Recordings are handled confidentially. They are processed by the persons responsible for CCTV monitoring at HKT and by our partners for servicing and maintenance purposes.
Data contained in the register is not transferred outside the EU or the European Economic Area.
Data is not regularly disclosed to any third party. Data may be disclosed to the police or other authorities in cases where a criminal offence has occurred or is suspected to have occurred, provided that the statutory requirements for disclosure are met.
The data is protected through access control and user permissions. Access to the register is limited to HKT employees who require the data to perform their duties and to our partners for servicing and maintenance purposes.
CCTV monitoring is indicated by separate signs. This privacy notice is available upon request.
Right to access and rectify data
The register contains data recorded automatically by technical means and, in principle, does not contain inaccurate information. Unnecessary or outdated recordings are automatically deleted within approximately 2 weeks.
Data subjects have the right to access the personal data concerning them that has been stored in the register. Requests for access must be submitted in writing, signed and sent to:
Helsingin Kaupunginteatteri / Tietosuoja
Ensi Linja 2
00530 Helsinki
After submitting a sufficiently detailed and specific request for access, a person has the right to obtain the data concerning them contained in the recordings, subject to the rights and restrictions specified in greater detail in the General Data Protection Regulation. The response will be sent by post to the person who submitted the request.
Right to lodge a complaint with a supervisory authority
We aim to resolve any disputes directly with the data subjects in the first instance. If a data subject considers that we have not processed personal data lawfully, they may lodge a complaint with the data protection authority.
We continuously develop our services and reserve the right to amend this privacy notice by announcing any changes through our services. Amendments may also be made due to changes in legislation. The current version of this privacy notice is available at https://hkt.fi/kayttoehdot/
These terms of use apply to the use of the website (hkt.fi) of the Helsinki Theatre Foundation / Helsinki City Theatre (hereinafter HKT). The website serves as HKT’s digital service platform, providing information about the theatre’s programme and activities and directing users to ticket sales channels. By using the website, you agree to comply with these terms.
The website’s content, including its texts, images, logos and visual identity, is protected by copyright law and other intellectual property rights. The rights to the material belong to HKT or other rights holders. The website’s content may be used for ordinary web browsing, information retrieval and communication. However, the unauthorised commercial use, reproduction or bulk collection of website content for purposes such as training AI models, data mining or other commercial automation is expressly prohibited without HKT’s prior written consent. Press releases and materials specifically intended for the media may be freely used for communication and journalistic purposes.
Media and press: Images intended for news coverage and publications relating to the theatre are available in the Media Bank (productions currently in the programme) and the Image Bank Archive (past productions). The media and content creators may use these images freely for this purpose, provided that the photographer is credited in accordance with good practice. Republishing, editing or commercially using any other content on the website requires HKT’s prior written consent, which must be requested using the contact details provided in the Media Bank.
The website and its functions, such as online forms and feedback channels, must be used in accordance with applicable legislation and good online practice. Improper or inappropriate use includes any activity that infringes the rights of HKT, its staff or other users, or compromises the security of the service.
Users must not:
Audience comments:
The website collects and publishes audience feedback and experiences relating to the theatre’s programme. The following terms apply to audience comments:
Users are responsible for the information security of their own devices and telecommunications connections. HKT reserves the right to block access to the website by any user who breaches these terms, take any necessary legal action and report misuse to the authorities.
Ticket sales and customer programmes are subject to separate contractual terms in addition to these terms of use. Tickets are sold through separate ticket sales channels, such as lippu.fi or the theatre’s own sales outlets:
The website and its functions are provided on an “as is” basis. HKT strives to keep the information on the website up to date and accurate but does not guarantee its completeness or the uninterrupted availability of the service.
HKT uses artificial intelligence and automation responsibly in accordance with HKT’s AI principles. Further information about the use of AI at the theatre is available on HKT’s AI page.
To improve the website’s accessibility and its ability to serve international audiences, machine translation and AI-assisted translation tools may be used in the website’s foreign-language versions. Although attention is paid to the quality of translations, HKT cannot guarantee that automatically generated translations are entirely free of errors, and they may contain linguistic or conceptual inaccuracies. In the event of any ambiguity or discrepancy, the original Finnish-language text on the website will always take precedence and serve as the legally binding source of information.
HKT continuously develops its online services and reserves the right to amend these terms of use without separate prior notice. These terms of use and the use of the website are governed by Finnish law.
If you have any questions about this website or its terms of use, or wish to report a technical issue, please contact us by email at: info@hkt.fi.
Helsinki Theatre Foundation (Helsinki City Theatre, hereinafter “HKT” or the “Organiser”), Ensi linja 2, 00530 Helsinki.
Competitions and related prize draws organised in connection with HKT’s marketing campaigns are open to individuals aged 18 or over. Prize draws organised in connection with surveys are open to individuals aged 15 or over. No purchase of an HKT product or service is necessary to enter. Employees of the Organiser and members of their families are not eligible to enter competitions or prize draws.
Entries to competitions and prize draws must be submitted in accordance with the instructions provided for each campaign. Each person may enter a campaign’s prize draw only once. Competitions and prize draws are not endorsed, sponsored or administered by any third party, such as a social media platform.
The entry period for each competition or prize draw will be specified separately in the campaign post or entry instructions. Responses, reactions or sign-ups registered after the entry period has ended will not be included in the draw. The Organiser accepts no responsibility for entries prevented by IT-related or other technical issues.
The prize will be specified separately for each campaign (such as a package of complimentary tickets to an HKT performance or another product prize). The winner will be selected at random from among the entrants using a computer program or random draw.
The Organiser will notify the winner personally (e.g. by email or private message) and/or in a post on a social media platform. If the winner cannot be reached within a reasonable period, a posted prize is returned as undeliverable due to incorrect contact details, or the entrant is found to have acted in breach of these rules or the law, a new winner will be selected. As a rule, the prize will be delivered within one week of the winner being determined.
The Organiser reserves the right to disqualify and remove from the draw any entrants who attempt to misuse the entry process or improperly influence the results.
By accepting the prize, the winner releases the Organiser from all liability and costs that may arise from entering the competition or accepting and using the prize. However, this release does not limit any statutory rights granted to consumers under consumer protection legislation.
The Organiser’s liability towards entrants is limited to the quantity and value of the prize offered in the competition or prize draw. The winner is responsible for any other costs associated with accepting or claiming the prize.
The Organiser is responsible for paying the statutory lottery tax on the prizes referred to in these rules. Prizes cannot be exchanged for cash or another product. By entering a competition or prize draw, entrants agree to comply with these rules and the Organiser’s decisions concerning them. The Organiser reserves the right to amend these rules by announcing any changes on its website.
Personal data collected in connection with a competition or prize draw will be processed solely for the purposes of conducting the draw and notifying the winner. The data may be used for direct marketing only if the entrant has provided separate consent for this purpose (e.g. when joining the Teatteriin club or subscribing to HKT’s newsletter). By entering a competition or prize draw, entrants grant the Organiser the right to publish the winner’s first and last name on HKT’s website, social media channels and in marketing materials.