Data protection

Updated to 10.5.2019

The parish processes personal data for the purpose of maintaining its operations, taking care of membership and customer relationships, as well as producing and developing its activities and services. The data is processed on the basis of parish membership, service relationship or other relevant customer relationship. The processing is based on consent, agreement or law. For example, parish membership or the notification of the activities organised by the parish requires the handling of personal data. The personal data is handled in accordance with the related legislation and good governance.

Personal data is often obtained directly from the registered member or their legal representative. The data can also be collected by the demographic information system with the purpose of updating the contact information in the member information system, for example. The retention period for personal data is based on its intended use and the fulfilment of legal obligations. The protection of personal data and respect for privacy are important. The information is confidential and will not be shared with third parties unless there are legally defined bases. For this reason, the personal data is protected from unauthorised access through technical and administrative measures.

For more information about personal data registries and the processing of personal data, please contact the Seinäjoki Parish. Privacy notices regarding the personal data registries are available at the parish’s offices.

Privacy policy of the Evangelical Lutheran Church of Finland website publishing system Lukkari

Lukkari is the website publishing system built for the parishes and other individual churches that also works as the platform of the Seinäjoki parish webpage. The Lukkari publishing system provides the same features and structure for everyone, but the visual aspect can be built to reflect each parish’s own public image.

The processing of personal information on the page concerns the electronic functions that facilitate the services, such as ordering an extract from the population register, joining the church, requesting intercessory prayers and sending feedback.

The legal basis for the processing of data is the article 6.1.f of EU general data protection regulation, according to which the legitimate interest is based on the registered person’s own declaration and intention to request an official certificate, join the church, request intercessory prayers and give feedback.

Read the Lukkari privacy policy in its entirety.

Here you can read more about the use of cookies.

Rights to data protection of the registered

The EU’s data protection reform allows better data protection rights to the registered.

Registered’s rights:

• to request from the register holder the personal data concerning them, as well as the right to request the correction or deletion of the data in question.
• to request from the register holder the restriction of the processing of personal data concerning them, to object to the processing, and to exercise the right to data portability.
• to the extent that the processing of personal data is based on the registered’s consent, the right to revoke consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.
• to file a complaint about the processing of personal data to the national supervisory authority, if the registered notices that the processing of personal data concerning them breaks the EU’s General Data Protection Regulation. The exercise of this right does not limit legal remedies under the Church Law (1054/1994)

The registered may submit a request to exercise their rights by visiting the service offices of the Seinäjoki parish (local parish, Nurmo, Peräseinäjoki, Ylistaro). The request must be made in person, to confirm the identity of the requester. The data is also always delivered to the registered person in written form.

Data protection officer

The data protection officer surveils the conformity to the data protection regulation and gives information and advice about the obligation to adhere to the legislation and the exercise of the registered’s rights. The Seinäjoki parish data protection officer is the church government attorney Mikko Tähkänen, tel. 050 538 6597, tietosuojavastaava.kkr@evl.fi.

EU General Data Protection Regulation (2016/679) 5.6.2018

Data controller

Seinäjoki parish (Y-tunnus 0182398-1)
Ala-Kuljun katu 1 A 60100 Seinäjoki
(06) 418 4111, seinajoki.seurakunta (at) evl.fi

Contact person

Pete Ketola, Youth work director, Seinäjoki regional parish
Kalevankatu 12 B B2, 60100 Seinäjoki
tel. 044 477 7777, pete.ketola@evl.fi

Data protection officer’s contact

Tähkänen Mikko, attorney
tel.050 5386 597, tietosuojavastaava.kkr@evl.fi

Name of the registry

Confirmation school person register

Legal basis and purpose of personal data processing

Carrying out the confirmation school requires the processing of personal data. The registered person and/or their guardian gives their consent to the processing of their personal data upon registration. The personal data is used in the Seinäjoki parish confirmation school’s general planning, implementation and monitoring. The confirmation school exercises its functions in accordance with the Church Law. According to the Church Order, the parish must support parents and guardians in their upbringing and education work.

Legal basis for the processing of information
EU 2016/679, article 6.1 (f)
Church Law 1993/1054
Church Order 1993/1055

Groups of individuals and data content in the registry

The group of individuals whose data is processed includes the young people participating in confirmation school activities (confirmation day school, confirmation camp), their guardians and their substitute caregivers, as well as the adults, the pastor and the camp counsellors.

Data of the youth taking part in confirmation school

• First and last name, date of birth, street address, ZIP code and city, phone number, email address
• Confirmation school group expectations, friend code
• Name and phone number of the confirmation school and the confirmation school instructors, as well as pastors
• Attendance/Absences
• Possible allergies and other necessary information affecting participation in the camp and activities
• Information regarding church membership and baptism
• Photo consent

Guardians informations

• First and last name, street address, ZIP code and city, phone number, email address
• Custody
• Payment information and information on payment exemptions

Substitute caregivers informations

• First and last name, street address, ZIP code and city, phone number

Adults, pastor and camp counsellors informations

• First and last name, phone number and roles at the camps

Data sources

The basic data is acquired from the registrant and/or their guardian through the electronic registration system or a paper form. The information is updated and filled in on the basis of the information given by the registrant, their guardian and/or parish staff.

Data disclosure

The data is held secret. The information can be disclosed only with the explicit consent of the registrant or their legal representative or on the basis of legislation giving the right to disclosure.

Retention period for personal data or criteria for determining the retention period

The personal data is processed for the duration of the customer relationship. Confirmation school journals are retained permanently; the documents related to camps and field trips are retained for 5 years after the end of the activity. Accounting records are retained for 10 years.

Data transfer outside the EU or the European Economic Area

The data is not transferred outside the EU or the EEA.

Principles of registry protection

Personal data is processed in a way that is safe and respects the requirements of the legislation

• Equipment, files and document protection
• Access control
• User id
• Authorizations
• Registration of usage events
• Processing guidance and supervision

The controller also demands an adequate protection of the processed personal data from the electronic system’s administrator.

Registered’s rights

The registered has the right:

to request from the register holder the personal data concerning them, as well as the right to request the correction or deletion of the data in question.

to request from the register holder the restriction of the processing of personal data concerning them, to object to the processing, and to exercise the right to data portability.

to the extent that the processing of personal data is based on the registered’s consent, the right to revoke consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

To file a complaint about the processing of personal data to the national supervisory authority, if the registered notices that the processing of personal data concerning them is breaks the EU’s General Data Protection Regulation. The exercise of this right does not limit legal remedies under the Church Law (1054/1994)

Exercise of the right to inspection

An inspection request is made in combination with a personal visit or by signing a certified record either by hand or in any other trusted way.

National supervision authority

Data protection deputy office
PL 800, Ratapihantie 9, 00521 Helsinki
p. 029 56 66700, tietosuoja@om.fi
www.tietosuoja.fi

EU General Data Protection Regulation (2016/679) 2.11.2020

Data controller

Seinäjoki parish (Y-tunnus 0182398-1)
Ala-Kuljun katu 1 A 60100 Seinäjoki
(06) 418 4111, seinajoki.seurakunta (at) evl.fi

Contact person

Person
Ala-Kuljun katu 1 C 60100 Seinäjoki
050 , etunimi.sukunimi@evl.fi

Data protection officer’s contact

Tähkänen Mikko, lakimies
tel. 050 5386 597, tietosuojavastaava.kkr (at) evl.fi

Name of the registry

Volunteer work registry

Legal basis and purpose of personal data processing

The purpose of the data processing is

• the implementation, statistical analysis, and development of volunteer work
• the organisation of events, education events, and/or services related to volunteer work
• communication related to volunteer work

The processing of the personal data is based, depending on the case, on the registered’s consent, a signed agreement or on the registered’s legitimate interest.

Groups of individuals and data content in the registry

The registry processes volunteers’ personal and contact information (such as name, address, phone number, and email address) as well as, on a case-by-case basis, other necessary information related to volunteering, such as

• year and date of birth
• information of a minor’s volunteer guardian (name, address, phone number)
• the year volunteer work began
• interest in or participation in an activity or task
• information on completed training or courses
• information on special skills
• information on signing a confidentiality agreement
• note regarding the review of a criminal record (for those working with children and youth)

Data sources

The data is collected from the registration itself, by his registration as a volunteer or participation in the activities organised by the parish. The information can be updated from the parish’s membership registry if needed.

Disclosure of information and data transfer outside the EU or the European Economic Area

Data may be disclosed based on the explicit consent of the registered volunteer or their legal representative, or pursuant to legislation authorising the disclosure of such data. Data will not be transferred outside the EU or the EEA.

Retention period for personal data or criteria for determining the retention period

The personal data of the registered volunteer worker is retained for the duration of their volunteer relationship. After that, the data is deleted. The retention period for accounting records is 10 years, and for confidentiality agreements, 75 years.

Principles of registry protection

Personal data is processed in a way that is safe and respects the requirements of the legislation

• Equipment, files and document protection
• Access control
• User id
• Authorizations
• Registration of usage events
• Processing guidance and supervision

The controller also demands adequate protection of the processed personal data from the electronic system’s administrator.

Registered’s rights

The registered has the right:

to request from the register holder the personal data concerning them, as well as the right to request the correction or deletion of the data in question.

to request from the register holder the restriction of the processing of personal data concerning them, to object to the processing, and to exercise the right to data portability.

to the extent that the processing of personal data is based on the registered’s consent, the right to revoke consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

to file a complaint about the processing of personal data to the national supervisory authority, if the registered notices that the processing of personal data concerning them breaks the EU’s General Data Protection Regulation. The exercise of this right does not limit legal remedies under the Church Law (1054/1994)

Exercise of the right to inspection

An inspection request is made in combination with a personal visit or by signing a certified record either by hand or in any other trusted way.

National supervision authority

Data protection deputy office
PL 800, Ratapihantie 9, 00521 Helsinki
tel. 029 56 66700, tietosuoja@om.fi
www.tietosuoja.fi

EU General Data Protection Regulation (2016/679) 8.3.2021

Data controller

Seinäjoki parish (Y-tunnus 0182398-1)
Ala-Kuljun katu 1 A, 60100 Seinäjoki
06 418 4111, seinajoki.seurakunta(a)evl.fi

Contact person

Pete Ketola, director of education
Kalevankatu 12 B, 60100 Seinäjoki
044 477 7777, pete.ketola@evl.fi

Data protection officer’s contact

Tähkänen Mikko, attorney
p. 050 5386 597, tietosuojavastaava.kkr@evl.fi

Name of the register

Privacy policy for the early childhood education personal data register

Legal basis and purpose of personal data processing

The Seinäjoki Parish comprises the Seinäjoki Regional Parish and the chapel parishes of Nurmo, Ylistaro, and Peräseinäjoki, which carry out joint early childhood education programs throughout the region. The educational work carries out the parish’s duties as defined by the Church Law.

The day club, the family club and the Sunday school services, as well as the children’s life-stage celebrations require the processing of personal data. Personal data is used for the planning, implementation and monitoring of early childhood education work. Registration for clubs is done through an online application system. The parish sends a birthday card to the children turning 1, 2, 3, and 5 years old. Every year, birthday parties are held for children turning 4 and their families. Invitations to the parties are sent by mail to the child’s home.

Processing legal basis

The basis is mainly a relevant and appropriate relationship between the registered and the controller, as well as obligations established by the law and the agreements. In some cases, the legal basis is the consent given by the person or their guardian to the processing of their data for one or more specific purposes.

Groups of individuals and data content in the register

The children participating in day club and family club, as well as their guardian and alternative retriever

• child’s name and date of birth
• child’s club spot
• guardian’s name and contact
• alternative retriever’s name and phone number
• information regarding permission to appear in photos
• parent’s expectations and parent’s given information about the child that the counsellors need in club and camp situations

For family clubs, we collect the parents’ names and phone numbers, as well as the number of meetings. For Sunday school students, we collect their name, age, guardian’s phone number, and, if necessary, information about special dietary needs.

Sunday school instructors

• first and last name, home address, email address, phone number and information about where they hold Sunday school
• bank account number for commission payments and tax card (from all Sunday school instructors under the age of 18)

Early childhood education organised events

• essential information gathered together with the registration (name, diet and contact information)

Data sources

Day club, family club and Sunday school, as well as events: the data is collected from the registered or their guardian tai hänen huoltajaltaan, as well as from the parish register

Birthday wishes for children turning 1, 2, 3, and 5 years old, as well as invitations to parties for those turning 4: parish member register

Disclosure of information

The information in the register is not disclosed to third parties. The data can only be disclosed with the explicit consent of the concerned individual or their legal representative, or on the basis of legislation authorising the disclosure.

Retention period for personal data or criteria for determining the retention period

Personal data is processed for the duration of the customer relationship. The retention period is determined in accordance with the current records management plan.

Data transfer outside the EU or the European Economic Area

The data is not transferred outside the EU or the EEA.

Principles of register protection

Personal data is processed in a way that is safe and respects the requirements of the legislation

• Equipment, files and document protection
• Access control
• User id
• Authorizations
• Registration of usage events
• Processing guidance and supervision

The controller also demands adequate protection of the processed personal data from the electronic system’s administrator.

Registered’s rights

The registered has the right:

• to request from the register holder the personal data concerning them, as well as the right to request the correction or deletion of the data in question.
• to request from the register holder the restriction of the processing of personal data concerning them, to object to the processing, and to exercise the right to data portability.
• to the extent that the processing of personal data is based on the registered’s consent, the right to revoke consent at any time, without affecting the lawfulness of processing carried out based on consent before its withdrawal.
• to file a complaint about the processing of personal data to the national supervisory authority, if the registered notices that the processing of personal data concerning them breaks the EU’s General Data Protection Regulation. The exercise of this right does not limit legal remedies under the Church Law (1054/1994)

Exercise of the right to inspection

An inspection request is made in combination with a personal visit or by signing a certified record either by hand or in any other trusted way.

National supervision authority

Data protection deputy office
PL 800, Ratapihantie 9, 00521 Helsinki
tel. 029 56 66700, tietosuoja@om.fi
www.tietosuoja.fi

EU General Data Protection Regulation (2016/679) 29.4.2020

Data controller

Seinäjoki parish (Y-tunnus 0182398-1)
Ala-Kuljun katu 1 A 60100 Seinäjoki
(06) 418 4111, seinajoki.seurakunta (at) evl.fi

Contact person

Kirsi Poltto, director of communications
Ala-Kuljun katu 1 A 60100 Seinäjoki
p. 040 688 1433, kirsi.poltto (at) evl.fi

Data protection officer’s contact

Tähkänen Mikko, attorney
p. 050 5386 597, tietosuojavastaava.kkr (at) evl.fi

Name of the register

Communications’ customer and subscriber register

Personal data processing purpose and legal basis

The processing of personal information is based on the customer’s consent or an agreement stipulated between the parties. The customer’s name and address information are processed for the purpose of compiling a mailing list for the Lakeuden Risti magazine. The email address of newsletter subscribers is processed for the purpose of delivering the newsletter.

Legal basis for the processing of information
EU 2016/679, article 6.1 (a,b)

Groups of individuals and data content in the register

Subscribers to the newsletter

• Email address

Data sources

The information to be stored in the registry is collected from the registered person or his or her legal representative.

Disclosure of information and data transfer outside the EU or the European Economic Area

To process the data, we use third parties and subcontractors and ensure, through a contractual arrangement, that the personal data is processed in accordance with the applicable data protection laws.

Our newsletters use the MailChimp service, for which the data (= subscriber’s email address) may be stored outside the EU, at least in the U.S., within the limits of the Privacy Shield Framework regulations (privacyshield.gov/list). Mailchimp is listed among the companies certified in the Privacy Shield framework between the USA and EU; that means it is committed to protecting personal information in accordance with the data protection regulations. For more about the data protection service: mailchimp.com/legal.

Retention period for personal data or criteria for determining the retention period

We store the personal information in accordance with the current legislation only for as long as necessary to fulfil the purposes specified earlier. The registered information will be deleted at the conclusion of the customer relationship or other processing basis of personal data.

Principles of register protection

Personal data is processed in a way that is safe and respects of the requirements of the legislation

• Equipment, files and document protection
• Access control
• User id
• Authorizations
• Registration of usage events
• Processing guidance and supervision

The controller also demands adequate protection of the processed personal data from the electronic system’s administrator.

The newsletter subscriber list is stored on the MailChimp service. Access to the database is restricted by usernames and passwords. Access is granted only to individuals who are bound by confidentiality obligations and have been trained in the use of the database, and whose access is related to their position and duties.

Registered’s rights

The registered has the right:

to request from the register holder the personal data concerning them, as well as the right to request the correction or deletion of the data in question.

to request from the register holder the restriction of the processing of personal data concerning them, to object to the processing, and to exercise the right to data portability.

to the extent that the processing of personal data is based on the registered’s consent, the right to revoke consent at any time, without affecting the lawfulness of processing carried out based on consent before its withdrawal.

to file a complaint about the processing of personal data to the national supervisory authority, if the registered notices that the processing of personal data concerning them breaks the EU’s General Data Protection Regulation. The exercise of this right does not limit legal remedies under the Church Law (1054/1994)

Exercise of the right to inspection

An inspection request is made in combination with a personal visit or by signing a certified record either by hand or in any other trusted way.

National supervision authority

Data protection deputy office
PL 800, Ratapihantie 9, 00521 Helsinki
tel. 029 56 66700, tietosuoja@om.fi
www.tietosuoja.fi