Privacy policy

The Finnish National Gallery complies in its operations with laws regarding the data protection of digital services. 

Register name  

Finnish National Gallery's Art Trip customer register  

Controller  

The register is maintained by the Finnish National Gallery, which was established by the National Gallery Act (889/2013).  

Contact information of the controller  

Data protection issues and questions regarding the rights of data subjects should be addressed in writing to the controller of the register, address Finnish National Gallery, Registry office, Kaivokatu 2, 00100 Helsinki, or by email to the address kirjaamo(at)kansallisgalleria.fi .  

Purpose of the register  

The purpose of the register is to process, deliver, document and archive customer orders for the Finnish National Gallery's Art Trip Service, provide customer support, receive payment for orders, improve the user experience of the site and develop operations, collect customer feedback, general statistical purposes, send the newsletter subscribed to by the customer, and marketing approved by the customer and/or authorised by law.  

Legal basis for the processing of personal data  

The Finnish National Gallery's way of processing personal data is based on the EU General Data Protection Regulation 2016/679 and the Finnish Data Protection Act 1050/2018.   

The grounds for the processing of personal data are those listed in Article 6 of the EU General Data Protection Regulation, which, with regard to the Art Trip Service, are consent, agreement, legitimate interest or legal obligation. When legitimate interest is the basis, there exists a customer relationship or other meaningful relationship between the Art Trip Service and the data subject.  

Impact assessments related to necessity and proportionality requirements have been carried out for all processing of personal data. Data are retained as permitted by law and for as long as the functional connection to the original purpose remains. The starting point is to minimise data retention times so that unnecessary data are not retained.  

What data are collected  

The data collected in the register may be  

  • provided by the data subject;  
  • received or collected to carry out the functions of the Service; and/or  
  • stored in connection with the use of the Service.  

The data provided by the data subject to the Finnish National Gallery's Art Trip Service may include the following: 

  • first and last name; 
  • user name; 
  • company name;
  • email address and phone number; 
  • street address, postal code, city and country; 
  • information about processed orders (ordered products, order total, discount codes); 
  • payment method for orders (NOT payment card information);  
  • permissions, consents and information about preferred language or other similar choices;
  • interests, favourites, and topic preferences; and/or 
  • other information provided by the data subject, such as information entered into forms and data fields.  

Data observed and derived from the use of the Art Trip Service website:  

  • data collected by online services analytics systems;  
  • customer communication data, such as data on link clicks;  
  • the website from which one arrives at the Art Trip Service website;  
  • device identifiers, such as device model and unique device and/or cookie identifier;  
  • data collection channel: internet browser, mobile browser, application and browser version;  
  •  IP address; 
  • device operating system;  
  • session identifier, session time and duration;
  • location data; and/or  
  • data associated with the user based on the use history of the Art Trip Service, which are derived from observed usage and/or information provided by the user, for example demographic information, interests and other grouping of users.  

Cookie policies  

We use cookies on our website. Read more about the Finnish National Gallery's cookie policy below at Finnish National Gallery – Privacy policy. 

If desired, the user can delete the cookies stored in the browser or prohibit the reception of cookies in the browser settings. At the same time, it is possible to enable the Do Not Track function and set the browser to reject third-party cookies.  

Of the above data, the following are collected through third-party technology services used to implement the Art Trip Service:  

Vimeo (video playback): 
• browser type and version, device type, IP address and referrer (page on which the video is embedded);
• interaction data such as when the video was started, how long it was watched and when it was stopped;
• cookie identifiers and behavioural data (including before the video is played);
• technical cookies used to deliver content and improve the viewing experience. 

Shopify (e-commerce platform): 
• customer visit, browsing and purchase transaction data, including shopping cart contents and cancelled orders;
• browser technical data, IP address, device operating system;
• segmentation and analysis data derived from order history and purchase preferences. 

SkyPilot (digital content delivery): 
• technical transaction data such as IP address, time of content download, device type and session;
• application-level API logs and data streams related to the provision or downloading of content. 

How personal data are stored  

We follow good data security practices and use appropriate administrative, physical and technical safeguards to protect facilities, communications, servers and databases, to control access and to back up data. Personal data are stored only on secure servers, with limited and justified access managed by administrator users to designated individuals only.  

The Finnish National Gallery has valid partnership agreements with partners in accordance with the Data Protection Regulation. This ensures the secure and appropriate use of personal data even in situations where partners have justified access to the personal data.  

The Art Trip service operates on the Shopify platform, and Shopify is the processor of personal data within the meaning of the Data Protection Regulation. 

The Art Trip Service and the personal data processor Shopify store personal data in accordance with valid legislation and good data protection practices applicable to the industry. Personal data will only be retained for as long as necessary to fulfil the purposes specified in this privacy policy.   

If a customer of the Art Trip Service has subscribed to the newsletter and/or accepted marketing, the Art Trip Service uses Brevo to produce the newsletter and marketing, where the name and email address of the subscriber to the newsletter are stored, as well as the following information for orders: name, address and email address as provided by the customer. Regarding payments, the Art Trip Service does not collect personal data, but payments are made through the Paytrail Oyj online payment service.  

The Finnish National Gallery, Vimeo, Shopify and Brevo process personal data in the EU.

When the basis for the processing of personal data has ended, the personal data will be deleted. Personal data is retained where applicable  

  • for 2 years from the last registered transaction of the customer in the Art Trip Service,  
  • for 2 years, if the visitor to the Art Trip Service website has subscribed to the newsletter, and/or  
  • with regard to data collected by cookies, in accordance with the terms of the cookies accepted when visiting the Art Trip Service website.  

Possibility to review and rectify personal data  

A person has a right by law to review what data have been collected about them. The person also has the right to demand the correction or deletion of incorrect, incomplete, unnecessary or outdated personal data.  

The request for review must be made by filling out the Register data review request form and sending it by post to the Finnish National Gallery, Registry office, Kaivokatu 2, 00100 Helsinki, or by email to the address kirjaamo(at)kansallisgalleria.fi.   

A person can prohibit the Art Trip Service from using data about them for direct marketing purposes and customer satisfaction and other research purposes.  

The data subject has the right to lodge a complaint with the supervisory authority, which is the Office of the Data Protection Ombudsman | Request to review register data (pdf) 

Fill out this form and submit it to us if you would like to find out what data about you are stored in the register we control: Request to rectify register data (pdf) 

For more information about the privacy policies of the entire Finnish National Gallery, please visit the Finnish National Gallery – Data protection  

Changes to this privacy policy  

The Finnish National Gallery is constantly developing its operations. Periodic changes to the privacy policy are possible. Changes may be made without prior notice. Changes may also be related to changes in legislation.