Data protection

PRIVACY POLICY OF THE CUSTOMER SERVICE REGISTER

Privacy Statement and Processing Activities in accordance with Regulation 2016/679 of the European Parliament and of the Council. Updated 26.3.2026.

1. DATA CONTROLLER

Helsinki Theatre Foundation / Helsinki City Theatre (Business ID 0116521-0)
First Line 2
00530 Helsinki

Hereinafter, the controller is sometimes referred to as ‘HKT’

2. CONTACT PERSON IN A MATTER CONCERNING THE REGISTER

Olli Eljaala
Phone +358 50 379 9648
Email olli.eljaala@hkt.fi

3. NAME OF THE REGISTER

Helsinki City Theatre’s customer service register

4. GROUNDS FOR KEEPING THE REGISTER

The register contains personal data on visitors, participants, past, current and potential customers of HKT, as well as representatives of HKT’s personnel, stakeholders and partners.

As a rule, the processing of personal data is based on the consent given by the person. Consent to the processing of personal data in Finland can be given by a person who is 13 years of age or older.

We process your personal data on the basis of a legal obligation for the following purposes:

• compliance with the obligations laid down in the Act, such as the Accounting Act (1336/1997). This includes, among other things, the processing of customers’ payment data as part of HKT’s financial management and reporting to the authorities.

We process your personal data in order to fulfil our obligations under a contract between us, or to take pre-contractual measures at the request of the data subject, e.g. in the following situations:

• Provision of services, such as the provision of event, facility, meeting and catering services, as well as measures related to the management of these. This includes, for example, the processing of the customer’s contact information and ticket information in order to ensure access to the performance in accordance with the agreement and to inform of any changes.
• Fulfilment and management of contractual obligations and rights related to the customer relationship and the loyalty program. Corporate governance includes, for example, offering benefits to registered members and communicating with them about the loyalty program.
• Processing requests for quotations and other inquiries related to, for example, upcoming events, renting premises or the terms and conditions of the customer relationship programme before entering into a possible contract.
• Billing, including managing due dates and reminders for contract-based payments.

In certain contexts of processing, HKT has, in accordance with the instructions of the Office of the Data Protection Ombudsman, assessed the use of legitimate interest as a legal basis by means of balancing tests:

• With regard to the customer data register of the ticket sales system, HKT and our partners process personal data on the basis of legitimate interest in the contexts in which personal data is processed for the implementation of customer communications and the development of HKT’s operations.
• In the sub-registers related to website visits, the processing of personal data, such as IP addresses, is based on legitimate interest in the contexts when personal data is processed in order to prevent misuse and fraud, to ensure the functionality and information security of information systems, and to develop HKT’s operations, for example, in the production of statistical data.
• With regard to the subscriber registers of the media release and event invitation systems, the processing of personal data is based on legitimate interest in contexts where the processing is related to the development of HKT’s operations and the provision of information about HKT’s operations.

According to the rules of the Helsinki Theatre Foundation, the development of HKT’s operations is one of HKT’s tasks. HKT’s operations are based on the Act on Municipal Cultural Activities 166/2019.

5. PURPOSE OF PROCESSING PERSONAL DATA AND THE PURPOSE OF THE REGISTER

The purpose of the register is to develop HKT’s operations, process customer service requests, deliver products and services ordered by customers, and manage customer relationships. The data is used for statistical purposes and to produce more personalised, targeted content in our online services and marketing campaigns. Personal data is processed within the limits permitted and required by data protection legislation.

The register consists of the following sub-registers, among others:

Sub-registers based on order, booking, participation, membership or purchase:

• Customer information and reservation registers of the ticket sales system
• Subscriber registers of the newsletter system
• Registers of the loyalty program (“loyalty club”)
• Event invitation system subscriber registers
• Subscriber registers of the media release system
• Joint registers of social media platforms, including registers of participants and winners of competitions
• Event registration lists, incl. audience outreach registers
• Registers of customer surveys and surveys

Sub-registers based on site visits:

• Cookie Consent Platform Registers
• Web traffic monitoring and analytics systems, including Google Analytics
  (Google Privacy Policy)
• Customer service chat system
• Website publishing systems, including viewer comment databases and log files
• Digital marketing systems incl. remarketing lists

Sub-registers based on electronic communication:

• Email systems, including customer service forms, contact requests and service messages

The data in the register is used in HKT’s own operations to send tickets, electronic communications, event information, reservation information and customer mailings, as well as to process customer service requests, for example, at the ticket office, customer service chat, instant messaging services, by phone or email. The information in the register can be used to pay compensation for a cancelled performance. HKT uses partners to maintain the customer and service relationship and to carry out the technical supervision and maintenance of information systems. Some of the register data may be transferred to the partner’s servers due to technical requirements.

6. DATA CONTENT OF THE REGISTER

The customer service register and its subregisters contain the following information, among others:

• Person’s first and last name
• Gender
• Date of birth
• Person’s nickname or username
• Contact information and VAT number of the organisation that the person represents
• Email address
• Postal address
• Phone number
• Information about reserved and/or purchased products
• Information about mailing list memberships and non-mailing
• Information on consent to the processing of personal data
• Booking number
• Customer ID
• A person’s feedback text, reply, viewer comment, question, message, or service request
• About health status
• Bank details
• IP address
• IT index numbers and hashes
• Information about the browser and operating system
• Information about the use of the browser during the session
• Information about URLs
• Recording time and log data

7. REGULAR SOURCES OF INFORMATION IN THE CUSTOMER SERVICE REGISTER

Information about the customer is regularly obtained:

• From the customer directly in the system, by email, phone, form or other similar means

• Entered by a data processor or in connection with automated batch data transfer or other similar automatic updates by HKT’s partner (see section 9)

• Through cookies or other similar technologies

8. DATA RETENTION PERIOD

We only store your data for as long as is necessary to fulfil the purposes set out in section 5 above in accordance with the legislation in force at the time.

You can read more about the practices for storing personal data stored in the customer data register of the ticket sales system in our ticket agent partner’s own privacy statement.

We will retain your personal data that you have provided to us in connection with the purchase of a ticket, booking or participation in an event for a maximum period of 10 years in order to comply with our financial and legal obligations. This is based on, among other things, the requirements laid down in the Accounting Act and the Debt Limitation Act, according to which we must retain accounting material and prepare for possible contractual and tort claims.

Joining the loyalty program constitutes a separate contractual relationship, based on which we store the personal data required by the program until the customer relationship ends.

However, you have the right to request that your data be erased (see section 15). Please note that we cannot delete the personal data processed during your customer relationship to the extent that it is necessary to maintain the customer relationship or fulfil our contractual obligations.

The contact information of event participants stored in the event management system will be anonymised no later than one year after the end of the event, and other personal data will be anonymised no later than seven days after the end of the event.

In sub-registers related to website visits, log data is pseudonymised or anonymised either immediately in connection with the recording of the log data or no later than 60 days after the log transaction, unless otherwise required for the investigation of possible misuses, the creation of statistical summary reports or the technical implementation of an individual service.

9. PROCESSORS OF PERSONAL DATA

We use partners such as technical service providers, many of whom also act as processors of personal data. The right to use the register requires access rights to HKT’s or its partner’s information systems and passwords. Within HKT’s organisation, access rights to the register are limited to persons whose work tasks require the use of the data in the register.

Our partners often use third parties, i.e. sub-processors, who help us provide our services and process personal data. We ensure that all subprocessors and processors we use are committed to complying with the requirements of the EU General Data Protection Regulation (GDPR). In many cases, the Subprocessor or Processor’s Data Processing Agreement (DPA) is integrated into their Terms of Service, which we accept when using the Service.

Below is a list of our key processors and sub-processors. Changes to this list will be updated on this page.

(*) means that we are dealing with a sub-processor who has been engaged by one of our processors to carry out certain processing activities on our behalf. Please note that in some cases, the same party may also act as an independent processor for other processing activities.

10. TRANSFER OF DATA OUTSIDE THE EU OR THE EUROPEAN ECONOMIC AREA

Personal data will be transferred outside the European Union if this is necessary to ensure the technical implementation of HKT or its partner (see section 9). When data is transferred outside the European Union, we ensure an adequate level of protection of personal data as required by law.

11. REGULAR DISCLOSURE OF DATA

The information in the customer service register is only available to HKT, except when HKT uses an external partner (see section 9) to provide the service. In connection with ticket sales, HKT’s external ticket sales partner uses personal data for its own purposes in connection with the provision of services, to the extent that the data obtained through ticket sales is stored in the ticket sales partner’s own ticket sales system and customer register, and the ticket sales partner processes personal data for its own commercial purposes. If we merge or otherwise restructure our operations, the customer’s personal data may be disclosed within the new organization.

12. AUTOMATED DECISION-MAKING AND PROFILING

Profiling may be used in our marketing campaigns and in the security settings of our website.

13. COOKIES AND BROWSING TRACKING

We may collect information about the user’s terminal device through cookies and other similar technologies, such as the browser’s local data storage. A cookie is a small text file that the browser saves on the user’s device. Cookies often contain an anonymous, unique identifier that allows us to identify and count the browsers that visit our site. Some functional cookies are necessary for our services to function. Therefore, they do not require the user’s consent.

Third parties may place cookies on the user’s terminal device when the user visits our services in order to compile statistics on the number of visitors to different websites or to implement functionalities such as customer service chat. Third parties refer to parties outside HKT, such as providers of measurement and monitoring services. Some third-party cookies are non-essential.

You can find detailed information about the cookies used on this website on our Cookie Policy page.

Our site uses caching to load pages faster and improve your user experience. The cache creates temporary copies of website content, such as images, scripts, and user session data, so that your browser can display them more quickly on subsequent visits. This includes using the browser’s local cache as temporary storage. Once you have made your consent choices through our consent management platform, our website will adjust its behaviour accordingly. In addition, we use an external distributed content delivery network (CDN) to serve static content, such as images.

Our services may also contain links to other sites and social networks, but we are not responsible for the privacy practices or content of these third-party sites. We recommend that you review the privacy terms of these services.

14. LOCATION INFORMATION

The location data of the user’s terminal device may be used to provide location-based services, such as providing regional content and displaying targeted advertising, provided that the user has given their explicit consent to the use of location data or if the location data has been made anonymous.

Location information is determined using available positioning methods, such as GPS and the locations of Wi-Fi hotspots and cellular access points. The user can withdraw their consent at any time in the settings of the terminal device and application.

15. RIGHTS OF THE DATA SUBJECT

We are committed to providing our users with choices and controls regarding their privacy. Below, we list the different ways in which our users can influence the collection and processing of data.

Right of access to and rectification of data

The data subject has the right to check what information about him or her has been stored in the register. The inspection request must be sent in writing and signed to the following address:

Helsinki City Theatre / Privacy Policy
First Line 2
00530 Helsinki

or

by email to info@hkt.fi

The inspection request can also be submitted in person at Ensi Linja 2 / 00530 Helsinki.

The data subject has the right to demand the correction of incorrect data by notifying the above postal address in writing or by e-mail info@hkt.fi

Right to object to electronic communications

The data subject has the right to prohibit electronic marketing communications via the link at the end of each message or by notifying them by e-mail info@hkt.fi

Blocking and clearing cookies

The user has the option to block the use of all cookies by changing the settings of their browser. Non-necessary cookies, such as those related to website analytics, can be blocked by modifying the settings below. Disabling the use of cookies may affect the functionality of our services and/or prevent the use of some of our services, such as the visibility of videos embedded on the website.

The user can clear cookies in the browser settings. By clearing cookies at regular intervals, the user changes the identifier, which is used to create a profile of the user. However, clearing cookies does not completely stop data collection, but rather resets the profile based on previous behavioral data.

Consent to the use of location data

The user can give their consent to the use of location data in the settings of the terminal device and the application. The settings also allow the user to withdraw their consent at any time.

Right to erasure

The data subject has the right to demand that the controller delete his or her data from all of the controller’s systems by notifying the data controller in writing to the postal address above or by e-mail info@hkt.fi

Right to data portability

The data subject has the right to demand that the controller transfer their data to another system in a commonly used transfer format. The right only applies to information that the data subject has provided to the controller. Requests for data portability should be notified in writing to the postal address above or by e-mail info@hkt.fi

Right to object to automated decision-making and profiling

The data subject has the right to object to profiling carried out for direct marketing purposes by notifying the above-mentioned postal address in writing or by e-mail info@hkt.fi

16. PRINCIPLES OF REGISTER PROTECTION

Manual materials concerning the register are stored in protected facilities. The data stored and processed digitally is stored in databases that are protected by firewalls, passwords and other technical means. The databases are located in facilities that are monitored around the clock. Within HKT’s organisation, access rights to the register are limited to persons whose work tasks require the use of the data in the register.

17. CHANGES TO THE PRIVACY POLICY

We are constantly developing our services and reserve the right to change this privacy policy by announcing it in our services. The changes may also be based on changes in legislation. We recommend that you review the content of the privacy policy regularly. The current version of this Privacy Policy can be found at the URL https://hkt.fi/kayttoehdot

CAMERA SURVEILLANCE PRIVACY POLICY

1. DATA CONTROLLER

Helsinki Theatre Foundation Sr / Helsinki City Theatre (Business ID 0116521-0)
First Line 2
00530, Helsinki
Hereinafter, the controller is sometimes referred to as ‘HKT’.

2. PERSON RESPONSIBLE FOR REGISTER MATTERS

Name: Eemil Hallikas, Technical Property Manager
Phone: +358 50 3424 200
Email: eemil.hallikas@hkt.fi

3. NAME OF THE REGISTER

Helsinki City Theatre’s recording camera surveillance systems

4. RIGHTS TO THE REGISTER

Person responsible for the register and persons authorised by him or her

5. PURPOSE OF USE OF THE REGISTER AND GROUNDS FOR PROCESSING

The primary goal of camera surveillance is to prevent crime and vandalism. The aim is also to improve the safety of customers and staff and to protect the assets held by the company. The register data is used to investigate criminal and accidental events and, if necessary, to identify people who have moved around the premises.

6. DATA CONTENT OF THE REGISTER

The register contains footage recorded by surveillance cameras. Material is accumulated in digital and analogue formats. Cameras have been placed at the entrances of properties/theatres owned and leased by HKT, in customer areas and in other locations considered technically important. The registers record the persons moving and staying in the areas covered by camera surveillance.

7. REGULAR SOURCES OF INFORMATION

The register consists of analogue or digital recordings transmitted by cameras installed in places deemed necessary by the company. Camera surveillance recording at the site has been announced with stickers and signs indicating this.

8. DATA RETENTION PERIOD

The data is stored for a maximum of 2 weeks, after which the data is destroyed so that the system saves new image data on top of the old image data. The recording may be stored after the deadline if it is necessary to complete the processing of a harassment, harassment, inappropriate behaviour, crime, occupational accident or occupational safety matter that has been investigated before the end of the time limit.

9. PROCESSORS OF PERSONAL DATA

The recordings are treated confidentially. The recordings are processed by HKT’s persons responsible for camera surveillance and our partners for service and maintenance purposes.

10. TRANSFER OF DATA OUTSIDE THE EU OR THE EUROPEAN ECONOMIC AREA

The data in the register will not be disclosed outside the EU or the European Economic Area.

11. REGULAR DISCLOSURE OF DATA

As a rule, the information is not disclosed anywhere. Data may be disclosed to the police or other authorities in cases where a crime has been committed or is suspected of having been committed in which the legal conditions for disclosing data are met.

12. PRINCIPLES OF REGISTER PROTECTION

The data is protected by means of access control and access rights. The register can only be accessed by those persons employed by HKT and our partners for service and maintenance purposes who need the data in their work duties.

13. INFORMING THOSE STORED IN THE REGISTER

Video surveillance is announced on separate signs. The register description is available on request.

14. RIGHTS OF THE DATA SUBJECT

Right of access to and rectification of data

The register contains automatically and technically stored information that, as a rule, does not contain incorrect information. An unnecessary or outdated recording will be automatically deleted within approximately 2 weeks.

The data subject has the right to check what data concerning him or her has been stored in the register. The inspection request must be sent in writing and signed to the following address:

Helsinki City Theatre / Privacy Policy
First Line 2
00530 Helsinki

After making a sufficiently detailed and specific request for access, the person has the right to access the information contained in the recordings concerning him or her, with the rights and restrictions specified in more detail in the General Data Protection Regulation. The response to the inspection request will be sent to the person who submitted the inspection request by post.

Right to lodge a complaint with an authority

We aim to resolve any disputes primarily directly with the data subjects. If the data subject considers that we have not processed the personal data lawfully, the data subject may lodge a complaint with the data protection authority.

15. CHANGES TO THE PRIVACY POLICY

We are constantly developing our services and reserve the right to change this privacy policy by announcing it in our services. The changes may also be based on changes in legislation. The current version of this Privacy Policy can be found at the URL https://hkt.fi/kayttoehdot/

TERMS OF USE OF THE SITE

1. Terms of Use

These terms of use apply when using the Helsinki City Theatre’s website (URL https://hkt.fi). By opening the Helsinki City Theatre’s website, the user agrees to comply with the terms of use presented on this page and accepts the practices presented in the privacy policy. If the user does not accept the terms and conditions in their entirety, they are not entitled to use the website. The services on this website that require the processing of personal data are intended for people aged 13 and over and require acceptance of the privacy policy. Consent to the processing of personal data in Finland can be given by a person who is 13 years of age or older.

2. Use of the Site and Copyright

The material on the Helsinki City Theatre’s website is protected by the Copyright Act and international copyright treaties. The copyright of the material belongs to the theatre or other information producers. The user may not use, modify, copy, reproduce, display, perform, sell, loan, transfer, forward or otherwise exploit any material on the website without the express written permission of the Helsinki City Theatre.

The Site may only be used for personal and non-commercial purposes, and the above restrictions do not apply to the partial storage of material contained in the Site on a computer or the printing of material for the individual’s own personal use.

Copyright infringement may lead to a criminal sanction and liability for damages.

3. Unauthorized Use

The user may not submit material to the website that infringes the copyrights of third parties.

The user may not use the services of the website for purposes that are unlawful or contrary to good practice, such as:

– sending spam, chain letters, messages, mass e-mails (spamming) or other similar duplication purposes,

– use a false identity or false email address, or otherwise misrepresent the identity of the user or the origin of the message;

– send the material without verifying that the material does not contain viruses or other similar software,

– attempt to prevent or impede the use of other users’ services,

– submit inappropriate material, which is considered to be language that is considered obscene, illegal, racist towards a group of people, offensive or threatening.

4. Site Rights

Helsinki City Theatre has the right to change the terms of use, content, services on the website, discontinue the service or block the user’s access to the website at any time. Helsinki City Theatre has the right, but not the obligation, to monitor the material on the websites and to remove, move and comment on it if it considers the material to be in violation of the law or these terms of use.

5. Limitation of Liability

When using the services of the website for which no fee is charged, the Helsinki City Theatre is not responsible for the quality of the website or its suitability for a specific purpose. Helsinki City Theatre is not responsible for the content and accuracy of the information presented on the website.

Helsinki City Theatre is not responsible for the functionality of the texts, images, sound files, animations, links and other functions contained on the website, for any damage caused by their use or non-operation, or for any data security risks caused to users by them. Helsinki City Theatre is also not liable for damage caused by the website when the damage is directed at property and copyright rights other than those belonging to the theatre or other rights of third parties.

The content provided by the users of the site represents the users’ own opinions and not the opinions, statements or recommendations of the Helsinki City Theatre.

Helsinki City Theatre is not responsible for the content of pages to which the Helsinki City Theatre’s website has a link and which have been created and published by others.

These limitations of liability apply to all kinds of indirect and direct damages, regardless of the basis of the claim for compensation and the negligence of the Helsinki City Theatre itself.

6. Cookies

These pages use cookies. Their purpose is to ensure the technical functionality of the website. The user can prevent the use of all cookies by changing the settings of their browser. Cookie settings can also be modified on this page. Disabling cookies can slow down the loading of pages and prevent you from using certain parts of the website.

On behalf of the Helsinki City Theatre, third parties may serve ads to users based on their previous visits to the site. For these remarketing campaigns, third parties, such as Google (Google’s Privacy Policy), may use cookies on the site to record users’ visits. User demographic information may be aggregated for advertising targeting. The cookies on the website can also be used for statistical analysis of visits. Other third parties also use cookies to implement additional functionality and analytics on our website.

You can adjust your behavioral advertising settings at the address below under My Ads:
http://www.youronlinechoices.com/fi/

You can manage your preferences related to Google’s use of advertising-related cookies at:
https://www.google.com/settings/ads/onweb/?hl=fi

7. Contacts

If you have any questions or problems with this website, please contact us at info@hkt.fi

RULES OF COMPETITIONS AND LOTTERIES

1. Organizer:

Helsinki City Theatre / Helsinki Theatre Foundation, Ensi Linja 2, 00530 HELSINKI (hereinafter referred to as the “Organiser” or “HKT”).

2. Eligibility

Competitions organised in connection with the organiser’s marketing campaigns and related lotteries are open to natural persons aged 18 or over. Lotteries organised in connection with surveys are open to natural persons aged 15 or over. Participation in the lottery does not require the purchase of HKT’s product or service. However, employees of the organizer and their family members cannot participate in the lottery.

3. Participation in competitions or lotteries

Competitions or lotteries can be entered in accordance with the participation instructions given in connection with the lottery related to the marketing or survey campaign. A person can only participate in the lottery for each promotion once. Contests and sweepstakes are not endorsed or administered by any third party.

4. Period of participation

The entry period is indicated separately for each competition campaign update or for the instructions for participating in the lottery. Reactions, answers or entries registered after the entry period will not be taken into account for the draw of the winner of each campaign lottery. The organiser is not responsible for any obstacles to participation in competitions or lotteries due to IT reasons.

5. Prizes

The prize is a free ticket package to a performance at the Helsinki City Theatre. It is won by a computer program by a person or persons randomly selected from among the participants.

6. Notification of the winner and receipt of the prize

The organiser will announce the winners in a competition post on the social media platform and/or by email and/or private message. If the notification of the win is not successful, or the prize is returned to the Organiser due to incorrect contact information or other delivery obstacles, or it becomes apparent that the winner has acted in violation of these rules or the law, a new random winner will be selected in their place. The prize will be delivered within a week after the winner or winners have been announced.

The organiser has the right to remove from the competition or lottery any participants who attempt to abuse the participation arrangements in order to change the results.

7. Organiser’s responsibility

The winner of the prize releases the Organiser from all liability and costs that may arise from participation in the lottery, the competition or the receipt or use of the prize. However, this discharge from liability does not weaken the consumer’s rights under the Consumer Protection Act.

The organiser’s liability towards the participants is limited to the amount and value of the prize that is the subject of the lottery or competition. The winner is responsible for all other costs that may be incurred in connection with the acceptance or implementation of the prize.

The Organiser pays the statutory lottery tax on the prizes mentioned in these rules. The prize cannot be exchanged for cash or another product. By participating in the lottery or competition, the participant agrees to comply with these rules and the decisions of the Organizer. The Promoter reserves the right to make changes to the rules by announcing them on their website.

8. Processing and use of personal data for direct marketing or other purposes

The personal data collected in connection with the competition or lottery will only be used for the purpose of implementing and informing about the competition or lottery, except if the competition or lottery is organised among members of the Organiser’s loyalty programme (“Loyalty Club”) or the participant registers in HKT’s customer service register and/or as a member of the customer loyalty programme in connection with the competition or draw. By participating in the competition or lottery, the participant grants the Organiser the right to publish the winner’s first name and last name on the hkt.fi website, the Organiser’s social media pages and the Organiser’s marketing publications.