Privacy Policy

Approved by the Board on 21.11.2023

Information for data subjects in accordance with Articles 13-14 of the EU General Data Protection Regulation (GDPR) (2016/679).

 

1. Controller

The Stina Krook Foundation sr
Business ID: 1480853-7
Email: info@stinakrook.fi

 

2. Purposes of processing personal data

The Stina Krook Foundation supports and promotes visual and performing arts by awarding grants and prizes annually, with particular consideration for the Swedish-speaking population in Finland. The foundation does not accept applications; instead, the board makes its decisions based on proposals from experts.

 

The foundation processes personal data of grant recipients to facilitate the distribution of grants and prizes and personal data of invited guests and participants at the foundation’s grant award ceremonies and other events to manage the practical arrangements for these events.

 

3. Legal basis for processing ersonal data

The processing of personal data is based on the foundation’s legitimate interest arising from the relationship between the grant recipient or invited guest/participant and the foundation.

 

For certain categories of personal data, such as those required for accounting and regulatory reporting, the legal basis for processing is compliance with a legal obligation.

 

4. Categories of personal data and retention periods

For grant recipients, the following personal data is processed:

• Name
• Contact details
• Experts’ justification for awarding the grant
• Awarded amount
• Payment details for grant or prize disbursement
• Report on the use of the awarded grant or prize

 

Personal data is retained for five years from the end of the year in which the grant or prize was awarded, unless a longer retention period is required by law. However, the grant recipient’s name, justification for awarding the grant, awarded amount, and the recipient’s report on grant usage are permanently archived for historical and archival purposes.

 

For invited guests and event participants, the following personal data is processed:

• Name
• Title
• Organization represented
• Contact details
• Participation details
• Photographs from events

 

Personal data is retained for five years from the end of the year in which the event took place. However, event photographs may be permanently archived for historical and archival purposes.

 

5. Sources of personal data

For grant recipients, expert justifications are obtained from the foundation’s experts. Contact details are obtained from publicly available sources, while payment details and reports on grant usage are provided by the grant recipients themselves.

 

For invited guests and event participants, title, organization, and contact details are obtained from publicly available sources. Participation details are collected from the invitee or participant.

 

6. Recipients of personal data

The name of the grant recipient, justification for awarding the grant, and event photographs may be published in the foundation’s external communication channels.

 

Personal data may be disclosed to public authorities as required by law, regulation, or official decision. Personal data may also be disclosed for research purposes.

 

7. Transfers of personal data outside the EU/EEA

Personal data is not transferred outside the European Union (EU) or the European Economic Area (EEA).

 

8. Security measures for protecting personal data

• Electronic Data: Stored in IT systems and computers protected against unauthorized access through firewalls, passwords, and access controls. Access rights are restricted to only those who require them to perform their duties within the foundation.
• Paper-Based Data: Stored in locked premises with restricted access.

 

9. Automated decision-making and profiling

No automated decision-making or profiling is conducted based on personal data.

 

10. Data subject rights

Data subjects whose personal data is processed by the foundation have the right to:

• Obtain confirmation of whether their personal data is being processed and receive information about how it is processed, including a copy of their personal data.
• Request rectification of inaccurate or incomplete personal data.
• Request erasure (“right to be forgotten”) if the personal data is no longer necessary for the purposes for which it was collected.
• Request restriction of processing while the accuracy of contested data is being verified.
• Object to the processing of their personal data based on grounds relating to their specific situation.

 

Data subjects also have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

 

For exercising these rights or for any other inquiries regarding the processing of personal data, please contact info@stinakrook.fi.