PRIVACY POLICY
This is a register and data protection policy for the Foundation for the Finnish New York Cultural Institute New York in accordance with the Personal Data Act (Sections 10 and 24) and the EU General Data Protection Regulation (GDPR). Prepared on 2/22/2019, updated on 11/11/2021.
1. DATA CONTROLLER
Name: Foundation for the Finnish Cultural Institute in New York
Business ID: 0912598-5
2. PERSON RESPONSIBLE FOR THE REGISTER AND/OR CONTACT PERSON
Name: Annu Webb, Administrative Director
Contact: webb@fciny.org
3. NAME OF THE REGISTER
The Foundation for the Finnish Cultural Institute in New York’s residency register, consisting of
1. a register of applicants
2. a register of artist-in-residence
4. LEGAL BASIS AND PURPOSE OF THE PROCESSING OF PERSONAL DATA
The legal basis for the processing of personal data under the EU General Data Protection Regulation is the legitimate interest of the controller based on the customer relationship or other objective connection and, in the case of the residency register, also the enforcement of the contract. Applicants also give their consent to the processing of their data in the application form.
The purpose of the processing of personal data in the applicant register is for preparations of residency applications for the purposes of the assessment of
- evaluation of applications for residency
- making residency selections
- informing the applicants about the residency selection
- collecting statistical data on residency applications
The purpose of the processing of personal data in the artist-in-residence register is
- the conclusion of a contract with the artist-in-residence
- managing the residency
- monitoring, developing, and reporting on residency activities
5. CONTENT OF THE REGISTER
The data to be recorded in the register of applicants are
- surname
- first name
- degree and educational institution
- telephone number
- e-mail address
- pronouns
- previous residencies with the Institute (yes/no)
- motivation letter
- resume
- work samples
- website address
In addition to the above, the following are also recorded in the artist-in-residence register
- social security number
- postal address
- the date of the residency
- address of the residence
- feedback on the residency
The personal data in the register will only be kept for as long as necessary for the purpose for which the personal data is used. The data in the applicant register will be kept through the year following the applicant’s application, after which all their data will be deleted from the database. Data in the artist-in-residence register will be kept for 10 years from the date of the residency decision.
6. REGULAR DATA SOURCES
The data recorded in the register is obtained from the applicants themselves by means of the application form and from the artist-in-residence by means of the residency agreement and the feedback form filled in by the artist-in-residence.
7. REGULAR DISCLOSURES AND TRANSFERS OF DATA OUTSIDE THE EU OR THE EUROPEAN ECONOMIC AREA
The data will be processed by the staff of the Foundation for the Finnish Cultural Institute in New York and the Finnish Cultural Institute in New York, as well as the external jury members.
The data will be transferred by the controller to the United States for use by the staff and jury of the Finnish Cultural Institute in New York. Transfers of personal data outside the European Economic Area will be safeguarded in accordance with the European Commission's standard contractual clauses or other appropriate safeguards, such as the Privacy Shield.
The full names of the artist-in-residence will be published on the Institute's website and newsletter and in the Foundation's annual report. The Foundation may use the information collected for the register to monitor its activities. In such use, the data will be anonymised and will not be used to track or profile individual data subjects.
The Foundation may disclose information from the register to public authorities, for example as part of the Ministry of Education and Culture's monitoring of grantees and reporting obligations on grantees.
8. PRINCIPLES FOR THE PROTECTION OF THE REGISTER
A. Manual records (location and protection)
A list of applicants is printed and attached to the minutes of the Foundation's Board of Directors' meeting. Applications for artist-in-residence will be printed and a copy of the residency contract will be attached to the residency application.
The manual file will be kept in a locked room in the Foundation's office.
B. Data to be processed digitally
Access to the register is restricted to designated persons. Access to the data in the register is subject to the provision of a username and password.
9. RIGHT OF ACCESS AND RECTIFICATION OF INFORMATION
As a general rule, everyone has the right to inspect the information concerning them and to request that any inaccurate information be corrected or incomplete information be completed. If a person wishes to check or request the rectification of their data, the request must be sent in writing to the controller. The controller may, if necessary, ask the applicant to prove their identity. The controller will reply to the requester within the time limit laid down in the EU General Data Protection Regulation (as a general rule, within one month).
The right of access is free of charge and is exercised no more than once a year (12 months).
10. OTHER RIGHTS RELATING TO THE PROCESSING OF PERSONAL DATA
A data subject in the register has the right to request the erasure of personal data concerning them from the register ("right to be forgotten"). The data subject also has other rights under the EU General Data Protection Regulation, such as the restriction of the processing of personal data in certain circumstances. Requests should be sent in writing to the controller. The controller may, if necessary, ask the applicant to prove their identity. The controller will respond to the customer within the time limits set by the EU GDPR (as a general rule, within one month).