The Finnish Data Protection Act (December 5, 2018/1050) defines the conditions for the processing of personal data for academic expression and research purposes and may limit some of the data subject’s rights under the General Data Protection Regulation (EU 2016/679).

4 From where do we receive data?

We receive information primarily from following sources: yourself, auction houses, population register, authorities, contact information service providers and other similar reliable sources.

For the purposes described in this privacy notice, personal data may also be collected and updated from publicly available sources and based on information received from auction houses, current or former owners of artworks, authorities or other third parties within the limits of the applicable laws and regulations. Such updating of data is performed manually or by automated means.

We process the following personal data in connection with the related parties register: 

Basic information of related parties, such as name, social security number and position in the entity

Family members such as spouse or children

Control and related information such as company name, business ID, address, basis of control and basis of influence

Subject and parties of the related party transactions

Other possible information necessary for the purposes of use of the register.

5 From where do we receive the data?

Personal data is collected in principle from the data subject him/herself. We maintain the register based on related party notifications. A request to fill in the related party notification is sent to the related party once a year.

6 To whom do we disclose data, and do we transfer data outside of EU or EEA?

We may disclose personal data to the extent permitted and required by the applicable legislation. Data in the related parties register is disclosed to auditors and is published in the foundation’s annual report as required by the law.

We use subcontractors for the purposes of IT management, that process personal data on our behalf. We have ensured that personal data is protected by having data protection agreements in place with the subcontractors for the processing of personal data. For example the data system we use for the creation and maintance of catalogue raisonné is provided by an external service provider, on whose administrated and secured server the personal data is stored.

When you visit our website your IP and browser data may be disclosed to third party service providers through cookies and also be transferred outside the EU/EEA in connection with those services. In these cases we ensure that appropriate safeguards in accordance with the GDPR are used in data transfers. Read more about our cookie policy on the assigned page. Otherwise personal data is not transferred outside the EU/EEA.

The IT systems and cloud services we use can enable the service provider to access data from outside the EU/EEA in cases of e.g., technical support. If personal data is processed outside the EU or EEA, we make sure that the subcontractor is committed to the protective measures required by the General Data Protection Regulation, such as the EU Commission's standard contractual clauses.

7 How do we protect the data and how long do we store them?

Only those of our employees, who on behalf of their work are entitled to process personal data, are entitled to use the system containing personal data. Each user has a personal username and password to the system. The data is collected into databases that are protected by firewalls, passwords and other technical measures. The databases and their backup copies are in locked premises and can be accessed only by certain pre-designated persons.

As part of maintaining the catalogue raisonné online publications we store the ownership data of artworks. If you have given us your unambiguous consent, we may publish your ownership data in which case you may at any time request us to delete this data from the public records. Otherwise, all ownership data will be kept strictly confidential.

We estimate regularly the need for data storage taking into account the applicable legislation. In addition, we take care of such reasonable actions that ensure no incompatible, outdated or inaccurate personal data is stored in the register taking into account the purpose of the processing. We correct or erase such data without delay.

The storage and disposal of personal data is determined by applicable legislation. Personal data in the related parties register is retained for 6 years from the date of entry.

8 What are your rights as a data subject?

You have the right to inspect the personal data stored in the register concerning yourself and the right to demand rectification or erasure of the data. If you have access to your data, you may edit the data yourself. Insofar as the processing is based on consent, you also have the right to withdraw or change your consent. Withdrawing your consent does not affect the lawfulness of processing before the withdrawal of the consent.

You have the right to object or to demand restriction of the processing of your data and to lodge a complaint with the supervisory authority.

On grounds relating to your particular situation you also have the right to object other processing activities when the legal basis of processing is legitimate interest. In connection with your request, you shall identify the specific situation, based on which you object to the processing. We can refuse the request of objection only on legal grounds.

Please, note that when we process your personal data on the basis of academic expression your rights as a data subject may be limited under the Finnish Data Protection Act (December 5, 2018/1050).

9 Who can you be in contact with?

All contacts and requests concerning this privacy policy shall be submitted in writing or in person to the person mentioned in section two (2).

Please, see also cookie policy section.