EU General Data Protection Regulation 2016/679
Prepared on: 23 August 2023

Controller

Valteri School
PO Box 101
40049 VALTERI

Contact persons responsible for register matters:

Person responsible:
Communications Manager Sanna Yli-Patola
Tel.  +358 295 33 5319, sanna.yli-patola@valteri.fi

Data protection officer:
tietosuoja@valteri.fi

Name of the register

Communications and marketing register

Purpose of processing personal data

We use obtained email addresses and phone numbers to manage Valteri’s marketing communications to customers and to acquire potential customers by providing them with targeted communications and information about Valteri’s services, in-service training and products. For example:

  • We provide information on discretionary government grants as part of potential project partnerships.
  • We provide information on in-service training for teaching and student welfare personnel.
  • We provide information about our services and networking events.
  • We keep customers and contacts up to date on Valteri’s free and paid guidance services and materials related to learning and school support.
  • The media register is used to provide information about events, e.g. by sending press releases to journalists, photographers and editors about events and services organised by Valteri.

Basis for processing personal data and data sources

The data in the register are collected from the following data sources:

On the basis of customer relationship:
Organisations that have purchased services, education and products provided by Valteri and/or their employees and contacts.

On the basis of consent:
Subscribers to Valteri’s newsletter, persons who have provided their contact information to Valteri through event registration or a similar context. Data provided via the Valteri website (newsletter subscribers and persons who order free specialist material).

The data in the register are collected from the following public data sources:

On the basis of apparent authority:
The data are collected from the public websites of organisations working in the field of children and young people’s learning and support. The data include the contact information of persons working in education and training, wellbeing services counties (health and social services), rehabilitation and pupil support.

For the media register, contact information is collected from the public websites of organisations that engage in the professional publishing of news and editorial communications (newspapers, member magazines, communication, trade magazines, TV, radio).

See also the separate privacy statements for the Valteri Shop (link, in Finnish) and the Valteri Image Bank (link, in Finnish).

Data content of the register

  • Communications and marketing register (data marked with * is mandatory)
    name*, title, organisation/employer, post office/municipality, email address*, telephone number, language*
  • Media register (all data are mandatory)
    name, title, email address, phone number, employer, locality, language

Storage period of the personal data

The storage periods of personal data in the register collected on the basis of customer relationship are based on legislation and Valteri’s records management plan, which defines the storage periods of data generated in the provision of services/education and the sale of products. Otherwise, personal data collected in the register will be stored only for as long and to the extent necessary and permitted by law in relation to the original or compatible purposes for which the personal data were collected.

Principles for the protection of the register

The use of the register has been instructed and access to the personal data register is restricted by access rights so that only those Valteri employees who are entitled to access and use the personal data stored in the system for their work tasks and who need this data for their work are authorised to do so.

The service providers have taken appropriate technical and organisational measures to protect the personal data against accidental or unlawful loss, disclosure, misuse, alteration, destruction or unauthorised access.

The information system used to process the personal data is adequately technically protected and access to it is protected by appropriate methods, including personal user accounts and passwords. The register data are backed up and, if necessary, restored securely, and the destruction of personal data is carried out in a secure manner.

There are no manual (paper) data in the register.

Disclosure and transfer of personal data

The data are not disclosed to third parties outside of Valteri.

The data may be hosted in a cloud service on the service provider’s server within the EU or EEA within the limits allowed by the EU General Data Protection Regulation.

Rights of the data subject

According to the EU General Data Protection Regulation (EU) 2016/679, the person whose data are processed (= data subject) has various rights depending on the basis for processing their personal data.

The data subject has the right to obtain confirmation as to whether or not personal data concerning them are being processed (Right of access by the data subject, Article 15), and, where that is the case, what personal data concerning them have been stored.

The data subject also has the right to request that inaccurate personal data be rectified.

Only in certain exceptional cases does the data subject have the right to have their personal data erased completely from registers (right to be forgotten, Article 17). Data subjects who have subscribed to the newsletter can also unsubscribe via the link at the end of the newsletter.

The data subject has the right to request restriction of the processing of their personal data or to object to the processing of their personal data for purposes such as direct marketing and related profiling.

The rights of the data subject are exercised by first contacting the relevant contact person of the controller, whose contact details can be found at the beginning of this statement.

If you believe that we are processing your personal data in breach of applicable data protection legislation, you have the right to lodge a complaint with the national data protection authority (link)

Automated decision-making and/or profiling

The data contained in the register may be used to target communications to specific professions, specific areas (e.g. a wellbeing services county) or orderers of specific types of services/products, etc.
No other automated decision-making or profiling is carried out on the basis of the data.