Privacy Notices for VISA Applications

Description of the Service

The purpose of the purchase subsidy process is to enable citizens to apply for subsidies for purchasing fossil-free transport.

The purpose of the scrapping premium purchase subsidy process is to enable citizens to apply for subsidies for vehicle renewal.

The purpose of the overall implementation is to enable the subsidy application process in its entirety for both citizens and Traficom users regarding the application and logging of subsidies, verification of vehicle registration, entry of disbursements, and monitoring of the subsidy budget.

Legal Basis and Purpose of Data Processing

In the purchase subsidy register of the purchase subsidy system for fossil-free vehicles, application data for electric vehicle subsidies, along with associated personal data, is processed.
In the purchase subsidy register of the scrapping premium purchase subsidy system, application data for the scrapping premium and associated personal data are processed.

Data Content

Data Assets to be Processed

The application collects the personal data of individuals who have applied for a purchase subsidy into its own register, alongside other data related to the application. This data is automatically synchronized with the ServiceNow system and, through it, to records management. For approved subsidy applications, payment details, including personal data, are transferred to the Payment Application Information Service.

Technical Data Related to Usage

The system contains technical data, such as information regarding errors and connections, which is collected to improve the operation and usability of the application and to resolve technical issues.

Data Sources of the Processed Data Assets (Where the data is obtained from)

The data source is the user of the service or a Traficom user who logs the purchase subsidy application through the VISA form service.

Retention Period of Personal Data

Purchase subsidy system: 2 years
Scrapping premium: 3 years

Data Processing

Recipients and Categories of Recipients of Personal Data (To whom data is disclosed)

Data related to purchase subsidy applications is transmitted through an interface to ServiceNow, from which it is further forwarded to records management. Data related to purchase subsidy disbursements is transmitted to the Payment Application Information Service, which forwards it outside the Agency.

Processing of Personal Data on Behalf of the Data Controller

Access to the data within the purchase subsidy system is restricted exclusively to strictly defined and limited internal user groups within Traficom. Traficom acts as the data controller regarding the data within the purchase subsidy system.

Transfer of Personal Data to Third Countries Outside the EU/EEA

Data is not transferred outside the EU or the EEA.

Automated Decision-Making and Profiling

Automated decision-making and profiling are not performed.

Rights Related to the Processing of Personal Data

Exercising Your Rights

You can exercise your rights by submitting a request to Traficom via email or post. Contact details can be found under section "Contact Information of the Data Controller" in this privacy statement.

Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.
Office of the Data Protection Ombudsman
P.O. Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
Tel. +358 29 566 6700

Right of Access to One's Own Data

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data.
The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Rectification of Data

The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate or incorrect personal data concerning them.
Information regarding the data subject's rights is available on Traficom's website.
The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Object

Information regarding the data subject's rights is available on Traficom's website.
The data subject has the right to object to the processing of their personal data if the processing is based on public interest, legitimate interest, or the exercise of official authority. In such cases, the data controller may only continue processing the data if it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims. However, the right to object does not generally apply to processing that is based on a statutory legal obligation.
The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Restriction of Processing

The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.
  Information regarding the data subject's rights is available on Traficom's website. 
  The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Data Portability

The right does not apply to the processing operations in question, because the personal data is processed on the basis of a statutory legal obligation and public interest / exercise of official authority.

Right to Erasure

The right does not apply to the processing operations in question, because the personal data is not processed on the basis of consent or a contract.

Description of the Service

With the help of the Incident Management System (HHJ), Traficom manages communications network incident data that falls under Regulation M57. Authentication to the HHJ system is performed using AD / OTP authentication.

Legal Basis and Purpose of Data Processing

With the help of the Incident Management System, Traficom ensures the management of communication network incidents and the implementation of the issued regulation. The collection of personal data of operators' contact persons is necessary to enable communication related to the process.

Data Content

Data Assets to be Processed

Contact details of the contact persons of the operators who have submitted incident notifications are stored in the Incident Management System. The data to be stored consists of conventional contact details, such as name, email address, and telephone number.

Technical Data Related to Usage

The system contains technical data, such as information regarding errors and connections, which is collected to improve the operation and usability of the application and to resolve technical issues.

Data Sources of the Processed Data Assets (Where the data is obtained from)

The contact details of individuals collected in the Incident Management System are entered in accordance with the operators' own notifications. The entry and maintenance of data are carried out in the system by Traficom's administrator or by the operator themselves.

Retention Period of Personal Data

5 years.

Data Processing

Recipients and Categories of Recipients of Personal Data (To whom data is disclosed)

Viewing and editing rights to the personal data collected in the Incident Management System are provided through the system to the following user groups:
§ Organization administrators: data of users within their own organization
§ Traficom administrators: data of users across all organizations
Data is not disclosed outside the Agency.

Processing of Personal Data on Behalf of the Data Controller

Access to the data within the Incident Management System is restricted exclusively to strictly defined and limited internal user groups within Traficom. External operators can only process incident data concerning their own organization after authenticating to the system. Traficom acts as the data controller regarding the data within the Incident Management System.

Transfer of Personal Data to Third Countries Outside the EU/EEA

Data is not transferred outside the EU or the EEA.

Automated Decision-Making and Profiling

Automated decision-making and profiling are not performed.

Rights Related to the Processing of Personal Data

Exercising Your Rights

You can exercise your rights by submitting a request to Traficom via email or post. Contact details can be found under section "Contact Information of the Data Controller" in this privacy statement.

Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.
Office of the Data Protection Ombudsman
P.O. Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
Tel. +358 29 566 6700

Right of Access to One's Own Data

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data.
The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Rectification of Data

The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate or incorrect personal data concerning them.
Information regarding the data subject's rights is available on Traficom's website (traficom.fi).

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Object

Information regarding the data subject's rights is available on Traficom's website (traficom.fi).

The data subject has the right to object to the processing of their personal data if the processing is based on public interest, legitimate interest, or the exercise of official authority. In such cases, the data controller may only continue processing the data if it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims. However, the right to object does not generally apply to processing that is based on a statutory legal obligation.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Restriction of Processing

The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Information regarding the data subject's rights is available on Traficom's website (traficom.fi).

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Data Portability

The right does not apply to the processing operations in question, because the personal data is processed on the basis of a statutory legal obligation and public interest / exercise of official authority.

Right to Erasure

The right does not apply to the processing operations in question, because the personal data is not processed on the basis of consent or a contract.

Description of the Service

With the help of the training register for vehicle inspectors, Traficom monitors the valid training, qualifications, and their validity periods of vehicle inspectors (individuals).

Legal Basis and Purpose of Data Processing

A reference to private individuals in the HENKI system, as well as information on the vehicle inspection qualification and training data related to the person in question, is stored in the register so that this data can be recorded for the purposes of the register.

Data Content

Data Assets to be Processed

Data regarding the training completed by the vehicle inspectors recorded in the system and the validity of such training is stored in the register.

No direct personal data concerning the vehicle inspectors is stored in the system; instead, the vehicle inspectors are stored in the register as a reference to an identifier in Traficom's HENKI system, and the personal data itself is retrieved from the HENKI system.

Technical Data Related to Usage

The system contains technical data, such as information regarding errors and connections, which is collected to improve the operation and usability of the application and to resolve technical issues.

Data Sources of the Processed Data Assets (Where the data is obtained from)

The data source is a Traficom user who logs training details into the register.

Retention Period of Personal Data

10 years (from the expiry date of the vehicle inspector's most recent supplementary training)

Data Processing

Recipients and Categories of Recipients of Personal Data (To whom data is disclosed)

Viewing and editing rights to the personal data collected in the training register for vehicle inspectors are provided internally to strictly defined and limited user groups within Traficom.

Data is not disclosed outside the Agency.

Processing of Personal Data on Behalf of the Data Controller

Access to the data within the training register for vehicle inspectors is restricted exclusively to strictly defined and limited internal user groups within Traficom. Traficom acts as the data controller regarding the data within the training register for vehicle inspectors.

Transfer of Personal Data to Third Countries Outside the EU/EEA

Data is not transferred outside the EU or the EEA.

Automated Decision-Making and Profiling

Automated decision-making and profiling are not performed.

Rights Related to the Processing of Personal Data

Exercising Your Rights

You can exercise your rights by submitting a request to Traficom via email or post. Contact details can be found under section "Contact Information of the Data Controller" in this privacy statement.

Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman
P.O. Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
Tel. +358 29 566 6700

Right of Access to One's Own Data

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Rectification of Data

The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate or incorrect personal data concerning them.

Information regarding the data subject's rights is available on Traficom's website. 

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Object

Information regarding the data subject's rights is available on Traficom's website.

The data subject has the right to object to the processing of their personal data if the processing is based on public interest, legitimate interest, or the exercise of official authority. 

In such cases, the data controller may only continue processing the data if it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims. However, the right to object does not generally apply to processing that is based on a statutory legal obligation.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Restriction of Processing

The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Information regarding the data subject's rights is available on Traficom's website. 

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Data Portability

The right does not apply to the processing operations in question, because the personal data is processed on the basis of a statutory legal obligation and public interest / exercise of official authority.

Right to Erasure

The right does not apply to the processing operations in question, because the personal data is not processed on the basis of consent or a contract. 

Description of the Service

The purpose of the merchant shipping subsidy system is to enable client companies to submit recurring merchant shipping subsidy applications, monitor their statuses, and update information, as well as to enable Traficom users to receive, process, and make decisions on the applications.

Legal Basis and Purpose of Data Processing

Personal data related to the processing, decisions, and disbursement of subsidies is processed in the merchant shipping subsidy system.

Data Content

Data Assets to be Processed

Data concerning the contact details related to the applications is stored in the register, including company representatives, application contact persons, and the sender of the application. The data to be stored consists of the name, telephone number, and email address.

Technical Data Related to Usage

The system contains technical data, such as information regarding errors and connections, which is collected to improve the operation and usability of the application and to resolve technical issues.

Data Sources of the Processed Data Assets (Where the data is obtained from)

The data source is a user within the organization submitting the applications, who saves the organization's details and the attachments sent with the application.

An external user using the system is always strongly authenticated on behalf of the organization (Suomi.fi e-Identification + e-Authorizations), and the data is linked to Traficom's HENKI system, on the basis of which the system's audit logging is performed.

Retention Period of Personal Data

10 years

Data Processing

Recipients and Categories of Recipients of Personal Data (To whom data is disclosed)

Viewing and editing rights to the personal data collected in the system are provided internally to strictly defined and limited user groups within Traficom. In addition, the representative of the applicant organization can view the data of their own applications through the user interface.

Data is not disclosed outside the Agency.

Processing of Personal Data on Behalf of the Data Controller

Access to the data within the merchant shipping subsidy system is restricted exclusively to strictly defined and limited internal user groups within Traficom. Shipping companies submit data only regarding their own organization in an authenticated state and act as processors of their own data. Traficom acts as the data controller regarding the data within the merchant shipping subsidy system.

Transfer of Personal Data to Third Countries Outside the EU/EEA

Data is not transferred outside the EU or the EEA.

Automated Decision-Making and Profiling

Automated decision-making and profiling are not performed.

Rights Related to the Processing of Personal Data

Exercising Your Rights

You can exercise your rights by submitting a request to Traficom via email or post. Contact details can be found under section "Contact Information of the Data Controller" in this privacy statement.

Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

P.O. Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
Tel. +358 29 566 6700

Right of Access to One's Own Data

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Rectification of Data

The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate or incorrect personal data concerning them.

Information regarding the data subject's rights is available on Traficom's website. 

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Object

Information regarding the data subject's rights is available on Traficom's website.

The data subject has the right to object to the processing of their personal data if the processing is based on public interest, legitimate interest, or the exercise of official authority. In such cases, the data controller may only continue processing the data if it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims. However, the right to object does not generally apply to processing that is based on a statutory legal obligation.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Restriction of Processing

The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Information regarding the data subject's rights is available on Traficom's website. 

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Data Portability

The right does not apply to the processing operations in question, because the personal data is processed on the basis of a statutory legal obligation and public interest / exercise of official authority.

Right to Erasure

The right does not apply to the processing operations in question, because the personal data is not processed on the basis of consent or a contract.

 Description of the Service

The purpose of the radio licences card printing integration is to enable the sending of licence card printing requests for licences produced by RAHAS2 from RAHAS2. RAHAS2 sends a printing request for the desired certificates to the VISA platform.

VISA collects the printing requests into a queue in its own database, which it endeavors to send to the printing service at regular intervals. A return channel is also implemented in connection with the interface to VISA, through which the printing service can send information regarding the completion or failure of the licence printing back to the integration service.

RAHAS2 can also query the integration service across the interface for the status of a printing request, allowing it to receive information about the completion or failure of printing requests.

Legal Basis and Purpose of Data Processing

The card printing service enables other Traficom applications (currently utilized by RAHAS) to order licence prints and monitor the status of printing requests. The application collects printing requests into its database, in connection with which the personal data to be printed on the respective licence prints is present.

The data of the licence prints is transferred from the service to Traficom's print material server.

Data Content

Data Assets to be Processed

The application collects printing requests into its database, in connection with which the personal data to be printed on the respective licence prints is present.

Technical Data Related to Usage

The system contains technical data, such as information regarding errors and connections, which is collected to improve the operation and usability of the application and to resolve technical issues.

Data Sources of the Processed Data Assets (Where the data is obtained from)

The data source is the system making the printing request (currently only RAHAS2).

Retention Period of Personal Data

Short-term (only for the duration of transmitting the licence printing requests).

Data Processing

Recipients and Categories of Recipients of Personal Data (To whom data is disclosed)

Licence data is transferred to an external vendor's print servers, which are managed by an external service provider.

Processing of Personal Data on Behalf of the Data Controller

Access to the card printing service is strictly restricted through the interface access rights. Traficom acts as the data controller and the external vendor acts as the data processor regarding the data of the card printing service.

Transfer of Personal Data to Third Countries Outside the EU/EEA

Data is not transferred outside the EU or the EEA.

Automated Decision-Making and Profiling

Automated decision-making and profiling are not performed.

Rights Related to the Processing of Personal Data

Exercising Your Rights

You can exercise your rights by submitting a request to Traficom via email or post. Contact details can be found under section "Contact Information of the Data Controller" in this privacy statement.

Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

P.O. Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
Tel. +358 29 566 6700

Right of Access to One's Own Data

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Rectification of Data

The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate or incorrect personal data concerning them.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Object

Information regarding the data subject's rights is available on Traficom's website. 

The data subject has the right to object to the processing of their personal data if the processing is based on public interest, legitimate interest, or the exercise of official authority. In such cases, the data controller may only continue processing the data if it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

However, the right to object does not generally apply to processing that is based on a statutory legal obligation.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Restriction of Processing

The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purposes of the
• processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Data Portability

The right does not apply to the processing operations in question, because the personal data is processed on the basis of a statutory legal obligation and public interest / exercise of official authority.

Right to Erasure

The right does not apply to the processing operations in question, because the personal data is not processed on the basis of consent or a contract.

Description of the Service

The flight obstacle register keeps records of flight obstacles located in Finland. With the help of the associated forms, users can submit new flight obstacle applications.

The management application allows for the viewing and processing of flight obstacles within the flight obstacle register, as well as flight obstacle applications sent through the notification forms.

Information on the applicants must be collected for the processing and storage of applications.

Legal Basis and Purpose of Data Processing

Personal data related to the application, processing, and decisions regarding flight obstacles is processed in the flight obstacle register.

Data Content

Data Assets to be Processed

In the flight obstacle applications made by users and recorded in the register, the name of the strongly authenticated applicant is documented.

Technical Data Related to Usage

The system contains technical data, such as information regarding errors and connections, which is collected to improve the operation and usability of the application and to resolve technical issues.

Data Sources of the Processed Data Assets (Where the data is obtained from)

The data source is the Suomi.fi e-Identification service, through which information from the user's strong authentication is recorded in connection with the application.

Retention Period of Personal Data

10 years

Data Processing

Recipients and Categories of Recipients of Personal Data (To whom data is disclosed)

Viewing and editing rights to the personal data collected in the register are provided internally to strictly defined and limited user groups within Traficom.
Data is not disclosed outside the Agency.

Processing of Personal Data on Behalf of the Data Controller

Access to the data within the flight obstacle register is restricted exclusively to strictly defined and limited internal user groups within Traficom.

External operators submit data only regarding their own organization in an authenticated state and act as processors of their own data.

Traficom acts as the data controller regarding the data within the flight obstacle register.

Transfer of Personal Data to Third Countries Outside the EU/EEA

Data is not transferred outside the EU or the EEA.

Automated Decision-Making and Profiling

Automated decision-making and profiling are not performed.

Rights Related to the Processing of Personal Data

Exercising Your Rights

You can exercise your rights by submitting a request to Traficom via email or post. Contact details can be found under section "Contact Information of the Data Controller" in this privacy statement.

Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

P.O. Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
Tel. +358 29 566 6700

Right of Access to One's Own Data

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data.

Right to Rectification of Data

The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate or incorrect personal data concerning them.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Object

Information regarding the data subject's rights is available on Traficom's website. 

The data subject has the right to object to the processing of their personal data if the processing is based on public interest, legitimate interest, or the exercise of official authority. In such cases, the data controller may only continue processing the data if it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

However, the right to object does not generally apply to processing that is based on a statutory legal obligation.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Restriction of Processing

The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purposes of the
• processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Data Portability

The right does not apply to the processing operations in question, because the personal data is processed on the basis of a statutory legal obligation and public interest / exercise of official authority.

Right to Erasure

The right does not apply to the processing operations in question, because the personal data is not processed on the basis of consent or a contract.

 

Description of the Service

The purpose of the LIITU system is to enable functions for Traficom users related to the registration, monitoring, and printing of certificates regarding qualifications linked to transport permits.

Legal Basis and Purpose of Data Processing

A reference to private individuals in the HENKI system, as well as information on the transport permit qualifications related to the person in question, is stored in the register so that this data can be recorded for the purposes of the register.

Data Content

Data Assets to be Processed

Data regarding the completed transport permits / qualifications of the persons recorded in the system and the validity of such permits is stored in the register. No direct personal data is stored in the system; instead, the persons recorded in the system are stored in the register as a reference to an identifier in Traficom's HENKI system, and the personal data itself is retrieved from the HENKI system.

Technical Data Related to Usage

The system contains technical data, such as information regarding errors and connections, which is collected to improve the operation and usability of the application and to resolve technical issues.

Data Sources of the Processed Data Assets (Where the data is obtained from)

The data source is a Traficom user who logs qualification details into the register.

Retention Period of Personal Data

10 years (qualifications for which this period has elapsed since their revocation)

Data Processing

Recipients and Categories of Recipients of Personal Data (To whom data is disclosed)

Viewing and editing rights to the personal data collected in the register are provided internally to strictly defined and limited user groups within Traficom.

Data is not disclosed outside the Agency.

Processing of Personal Data on Behalf of the Data Controller

Access to the data within the LIITU system is restricted exclusively to strictly defined and limited internal user groups within Traficom. Traficom acts as the data controller regarding the data within the LIITU system.

Transfer of Personal Data to Third Countries Outside the EU/EEA

Data is not transferred outside the EU or the EEA.

Automated Decision-Making and Profiling

Automated decision-making and profiling are not performed.

Rights Related to the Processing of Personal Data

Exercising Your Rights

You can exercise your rights by submitting a request to Traficom via email or post. Contact details can be found under section "Contact Information of the Data Controller" in this privacy statement.

Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

P.O. Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
Tel. +358 29 566 6700

Right of Access to One's Own Data

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Rectification of Data

The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate or incorrect personal data concerning them.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Object

Information regarding the data subject's rights is available on Traficom's website. 

The data subject has the right to object to the processing of their personal data if the processing is based on public interest, legitimate interest, or the exercise of official authority. In such cases, the data controller may only continue processing the data if it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

However, the right to object does not generally apply to processing that is based on a statutory legal obligation.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Restriction of Processing

The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purposes of the
• processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Data Portability

The right does not apply to the processing operations in question, because the personal data is processed on the basis of a statutory legal obligation and public interest / exercise of official authority.

Right to Erasure

The right does not apply to the processing operations in question, because the personal data is not processed on the basis of consent or a contract.

Description of the Service

The application provides users with contact forms configured by Traficom, as well as query trees for customer contacts to support customer service.

The management application allows Traficom to maintain the forms and query trees implemented in the VISA form service.

Basis and Purpose of Data Processing

The VISA form service does not store personal data in itself; instead, the data is transferred to back-end systems where the personal data is retained.

Data Content

Data Assets to be Processed

Personal data collected through the VISA form service is saved in tickets within the ServiceNow system, in case management, and in the customer registry (or other back-end system).

Technical Data Related to Usage

The system contains technical data, such as data concerning errors and connections, which is collected to improve the operation and usability of the application and to resolve technical problems.

Data Sources of the Processed Data Assets (Where the data is obtained from)

The source of the personal data collected through the VISA form service is the person filling out the form. Most forms do not require authentication. For forms requiring authentication, the source of authentication is Suomi.fi e-Identification and authorizations or OTP authentication.

Retention Period of Personal Data

The system does not retain personal data.

Data Processing

Recipients and Categories of Recipients of Personal Data (To whom data is disclosed)

Viewing and editing rights to personal data collected through the VISA form service are provided internally within Traficom (via ServiceNow):

• via AD groups to customer service (an external service provider)

Not otherwise disclosed outside the Agency.

Processing of Personal Data on Behalf of the Data Controller

Access to data collected through the VISA form service is strictly restricted to specified, tightly defined internal user groups within Traficom. External customers submit information through the forms and thereby act as data processors for their own data. Traficom acts as the data controller regarding the data submitted through the VISA form service.

Transfer of Personal Data to Third Countries Outside the EU/EEA

Data is not transferred outside the EU or the EEA.

Automated Decision-Making and Profiling

Automated decision-making and profiling are not performed.

Rights Related to the Processing of Personal Data

Exercising Your Rights

You can exercise your rights by submitting a request to Traficom via email or post. Contact details can be found under section "Contact Information of the Data Controller" in this privacy statement.

Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

P.O. Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
Tel. +358 29 566 6700

Right of Access to One's Own Data

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Rectification of Data

The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate or incorrect personal data concerning them.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Object

Information regarding the data subject's rights is available on Traficom's website. 

The data subject has the right to object to the processing of their personal data if the processing is based on public interest, legitimate interest, or the exercise of official authority. In such cases, the data controller may only continue processing the data if it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

However, the right to object does not generally apply to processing that is based on a statutory legal obligation.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Restriction of Processing

The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purposes of the
• processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Data Portability

The right does not apply to the processing operations in question, because the personal data is processed on the basis of a statutory legal obligation and public interest / exercise of official authority.

Right to Erasure

The right does not apply to the processing operations in question, because the personal data is not processed on the basis of consent or a contract.

Description of the Service

A market information survey system with which Traficom can create new surveys, process surveys, and view survey responses for the purpose of collecting market information. 

The delivery of surveys to end customers takes place via an API to other applications (Data Collection), where the respondents of the surveys complete the responses to the surveys, and the responses are transmitted back to the MAKE system.

Legal Basis and Purpose of Data Processing

MAKE enables the creation of market information surveys and allows telecom operators to respond to them. The application has its own user register, which stores data on the users of the application, including the user's name, personal identity code, and the company they represent. MAKE utilizes the authentication methods provided by the VISA platform (Suomi.fi e-Identification and e-Authorizations).

Data Content

Data Assets to be Processed

The application has its own user register, which stores data on the users of the application, including the user's name, personal identity code, and the company they represent.

Technical Data Related to Usage

The system contains technical data, such as information regarding errors and connections, which is collected to improve the operation and usability of the application and to resolve technical issues.

Data Sources of the Processed Data Assets (Where the data is obtained from)

In MAKE, the data source is the Suomi.fi e-Identification and e-Authorizations service. Information regarding the target organizations of the surveys, which also includes personal data, is maintained internally within MAKE.

Retention Period of Personal Data

10 years

Data Processing

Recipients and Categories of Recipients of Personal Data (To whom data is disclosed)

The data is used exclusively by the applications for verifying login information for strictly defined user groups. Data is not disclosed outside the Agency.

Processing of Personal Data on Behalf of the Data Controller

Access to the data within the market information survey system is restricted exclusively to strictly defined and limited internal user groups within Traficom. 

External operators act as processors of market information regarding their own organization, but cannot process the data of other organizations. Traficom acts as the data controller regarding the market information survey system.

Transfer of Personal Data to Third Countries Outside the EU/EEA

Data is not transferred outside the EU or the EEA.

Automated Decision-Making and Profiling

Automated decision-making and profiling are not performed.

Rights Related to the Processing of Personal Data

Exercising Your Rights

You can exercise your rights by submitting a request to Traficom via email or post. Contact details can be found under section "Contact Information of the Data Controller" in this privacy statement.

Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

P.O. Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
Tel. +358 29 566 6700

Right of Access to One's Own Data

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Rectification of Data

The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate or incorrect personal data concerning them.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Object

Information regarding the data subject's rights is available on Traficom's website. 

The data subject has the right to object to the processing of their personal data if the processing is based on public interest, legitimate interest, or the exercise of official authority. In such cases, the data controller may only continue processing the data if it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

However, the right to object does not generally apply to processing that is based on a statutory legal obligation.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Restriction of Processing

The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purposes of the
• processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Data Portability

The right does not apply to the processing operations in question, because the personal data is processed on the basis of a statutory legal obligation and public interest / exercise of official authority.

Right to Erasure

The right does not apply to the processing operations in question, because the personal data is not processed on the basis of consent or a contract.

Description of the Service

The purpose of digitizing entries for unrequited expenditures is to harmonize the processing of unrequited expenditures at Traficom for Traficom's internal users. The payment claim data service enables the recording of payments and their export to accounting both via forms and through various VISA applications.

Legal Basis and Purpose of Data Processing

In the payment claim service, data is transmitted to HANDI systems from other VISA applications. Data related to payments, including personal data, is retained in the system. The data is used for payment information as well as for the agency's internal payment history view.

Data Content

Data Assets to be Processed

The application collects personal data into its own registry for the payment transaction and for the history view displaying payments.

Technical Data Related to Usage

The system contains technical data, such as data concerning errors and connections, which is collected to improve the operation and usability of the application and to resolve technical problems.

Data Sources of the Processed Data Assets (Where the data is obtained from)

The VISA application utilizing the service serves as the data source, which sends a payment request to the service.

Retention Period of Personal Data

2 years

Data Processing

Recipients and Categories of Recipients of Personal Data (To whom data is disclosed)

The data is transmitted to HANDI for payment processing. Payment information for all payment requests sent to the service, including associated personal data, is exported to HANDI back-end servers managed by an external service provider.

Processing of Personal Data on Behalf of the Data Controller

Access to the payment claim service data is strictly restricted to specified, tightly defined internal user groups within Traficom. Traficom acts as the data controller regarding the data of the payment claim service.

Transfer of Personal Data to Third Countries Outside the EU/EEA

Data is not transferred outside the EU or the EEA.

Automated Decision-Making and Profiling

Automated decision-making and profiling are not performed.

Rights Related to the Processing of Personal Data

Exercising Your Rights

You can exercise your rights by submitting a request to Traficom via email or post. Contact details can be found under section "Contact Information of the Data Controller" in this privacy statement.

Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

P.O. Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
Tel. +358 29 566 6700

Right of Access to One's Own Data

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Rectification of Data

The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate or incorrect personal data concerning them.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Object

Information regarding the data subject's rights is available on Traficom's website. 

The data subject has the right to object to the processing of their personal data if the processing is based on public interest, legitimate interest, or the exercise of official authority. In such cases, the data controller may only continue processing the data if it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

However, the right to object does not generally apply to processing that is based on a statutory legal obligation.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Restriction of Processing

The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purposes of the
• processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Data Portability

The right does not apply to the processing operations in question, because the personal data is processed on the basis of a statutory legal obligation and public interest / exercise of official authority.

Right to Erasure

The right does not apply to the processing operations in question, because the personal data is not processed on the basis of consent or a contract.

Description of the Service

The purpose of the hydrographic chart feedback system is to collect feedback on hydrographic/nautical charts from users transacting on the public internet and to provide Traficom's analysts with the opportunity to examine, analyze, and process the collected feedback.

Legal Basis and Purpose of Data Processing

The geospatial feedback application enables users of the application to provide feedback on various matters related to geospatial data, such as chart/map details. In addition, the analysis service built for Traficom users of the application allows for the review and further processing of the feedback in question. 

The application collects the personal data of the users from the feedback they submit into its own register, and the analysis service enables the review of this data. In the future, the analysis service may also enable the export of feedback to other Traficom applications.

Data Content

Data Assets to be Processed

The application collects the personal data of the users from the feedback submitted by the users into its own register.

Technical Data Related to Usage

The system contains technical data, such as information regarding errors and connections, which is collected to improve the operation and usability of the application and to resolve technical issues..

Data Sources of the Processed Data Assets (Where the data is obtained from)

The data source is the user of the service who submits the feedback.

Retention Period of Personal Data

3 years

Data Processing

Recipients and Categories of Recipients of Personal Data (To whom data is disclosed)

The data is used exclusively by the applications for verifying login information for strictly defined user groups. Data is not disclosed outside the Agency.

Processing of Personal Data on Behalf of the Data Controller

Access to the data within the hydrographic chart feedback system is restricted exclusively to strictly defined and limited internal user groups within Traficom. 

External customers enter hydrographic chart feedback information without authentication in the public application and thus act as processors of this information. Traficom acts as the data controller regarding the hydrographic chart feedback system.

Transfer of Personal Data to Third Countries Outside the EU/EEA

Data is not transferred outside the EU or the EEA.

Automated Decision-Making and Profiling

Automated decision-making and profiling are not performed.

Rights Related to the Processing of Personal Data

Exercising Your Rights

You can exercise your rights by submitting a request to Traficom via email or post. Contact details can be found under section "Contact Information of the Data Controller" in this privacy statement.

Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

P.O. Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
Tel. +358 29 566 6700

Right of Access to One's Own Data

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Rectification of Data

The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate or incorrect personal data concerning them.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Object

Information regarding the data subject's rights is available on Traficom's website. 

The data subject has the right to object to the processing of their personal data if the processing is based on public interest, legitimate interest, or the exercise of official authority. In such cases, the data controller may only continue processing the data if it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

However, the right to object does not generally apply to processing that is based on a statutory legal obligation.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Restriction of Processing

The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purposes of the
• processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Data Portability

The right does not apply to the processing operations in question, because the personal data is processed on the basis of a statutory legal obligation and public interest / exercise of official authority.

Right to Erasure

The right does not apply to the processing operations in question, because the personal data is not processed on the basis of consent or a contract.

Description of the Service

Receipt of notifications in accordance with the NIS2 Directive via a form and processing by supervisory authorities. The application enables the collection of notifications, sending of alerts to supervisory authorities, reviewing of notifications by external users, and supervision of notification reading by Traficom users.

The NIS2 application collects data regarding the supervisory authority that has read the notification. The user register of the application is stored in the VISA OTP authentication system, which enables two-factor authentication.

A NIS2 notification may contain personal data if the user adds it to the notification. In addition, the application includes registration to Traficom's own entity register and the management thereof, the personal data of which is stored in the application's database. Logging into the entity register is performed through the Suomi.fi e-Identification and e-Authorizations services.

Legal Basis and Purpose of Data Processing

Processing of notifications in accordance with the NIS2 Directive and processing of personal data submitted to Traficom in accordance with the NIS Directive. A statutory obligation of Traficom.

Data Content

Data Assets to be Processed

The content of the notifications, which may include personal data, is stored in the database of the NIS2 notification application. The data of Traficom's own entity register is stored in the application's database, which contains the personal data of the entities.

Technical Data Related to Usage

The NIS2 notification application contains technical data, such as information regarding errors and connections, which is collected to improve the operation and usability of the application and to resolve technical issues.

Data Sources of the Processed Data Assets (Where the data is obtained from)

The data source is the NIS2 notification form completed by the submitter of the notification. Submitting a notification does not require a separate login. The data for Traficom's entity register is collected via its own form, which requires Suomi.fi e-Identification and e-Authorizations before completing the form.

Retention Period of Personal Data

The retention period for the data in the NIS2 notification application and Traficom's entity register will be specified later.

Data Processing

Recipients and Categories of Recipients of Personal Data (To whom data is disclosed)

Notifications made via the NIS2 form are accessible to supervisory authorities through the application. The data in Traficom's entity register can only be processed by individuals in accordance with their internal role within Traficom, and it is not disclosed to external parties.

Otherwise, personal data is not regularly disclosed to external parties without separate consent or a legal basis.

Processing of Personal Data on Behalf of the Data Controller

Access to the data of the NIS2 notifications and the entity register is restricted exclusively to strictly defined and limited internal user groups within Traficom. 

Supervisory authorities act as processors of NIS2 notification data regarding their own sector but cannot process data from other sectors. Traficom acts as the data controller regarding the NIS2 notification application and Traficom's entity register.

Transfer of Personal Data to Third Countries Outside the EU/EEA

The data is used within the EU/EEA area in Traficom's own server room.

Automated Decision-Making and Profiling

Automated decision-making and profiling are not performed.

Rights Related to the Processing of Personal Data

Exercising Your Rights

You can exercise your rights by submitting a request to Traficom via email or post. Contact details can be found under section "Contact Information of the Data Controller" in this privacy statement.

Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

P.O. Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
Tel. +358 29 566 6700

Right of Access to One's Own Data

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Rectification of Data

The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate or incorrect personal data concerning them.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Object

Information regarding the data subject's rights is available on Traficom's website. 

The data subject has the right to object to the processing of their personal data if the processing is based on public interest, legitimate interest, or the exercise of official authority. In such cases, the data controller may only continue processing the data if it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

However, the right to object does not generally apply to processing that is based on a statutory legal obligation.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Restriction of Processing

The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purposes of the
• processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Data Portability

The right does not apply to the processing operations in question, because the personal data is processed on the basis of a statutory legal obligation and public interest / exercise of official authority.

Right to Erasure

The right does not apply to the processing operations in question, because the personal data is not processed on the basis of consent or a contract.

Description of the Service

The OTP authentication application allows users to authenticate into public web applications using VISA OTP authentication. Traficom users can manage the users authorized for authentication themselves and assign organization-specific administrative rights to the end-users of the authentication.

Legal Basis and Purpose of Data Processing

To enable the authentication function for various applications, the person's name, email address, and mobile phone number are collected into the VISA OTP application. The actual purpose of the processing is application-specific.

Data Content

Data Assets to be Processed

The person's name, email address, and mobile phone number are collected into the VISA OTP application.

Technical Data Related to Usage

The system contains technical data, such as data concerning errors and connections, which is collected to improve the operation and usability of the application and to resolve technical problems.

Data Sources of the Processed Data Assets (Where the data is obtained from)

The personal data of the organization's main users stored in the OTP authentication system is created in the system by a VISA main user, and the main user of a specific organization can manage the contact information of the organization's other users through the OTP service.

Retention Period of Personal Data

1 year after the user's latest login.

Data Processing

Recipients and Categories of Recipients of Personal Data (To whom data is disclosed)

Viewing and editing rights to the personal data collected for VISA OTP authentication are provided through the system to the following user groups:

• Organization main users: data of users within their own organization
• Traficom OTP2 main users: data of users across all organizations

Not disclosed outside the Agency.

Processing of Personal Data on Behalf of the Data Controller

Access to the VISA OTP authentication data is strictly restricted to specified, tightly defined internal user groups within Traficom. Internal or external customers authenticate through this system and act thereby as data processors for their own data. Traficom acts as the data controller regarding the data of the VISA OTP authentication.

Transfer of Personal Data to Third Countries Outside the EU/EEA

Not transferred outside the EU or EEA.

Automated Decision-Making and Profiling

Automated decision-making and profiling are not performed.

Rights Related to the Processing of Personal Data

Exercising Your Rights

You can exercise your rights by submitting a request to Traficom via email or post. Contact details can be found under section "Contact Information of the Data Controller" in this privacy statement.

Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

P.O. Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
Tel. +358 29 566 6700

Right of Access to One's Own Data

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Rectification of Data

The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate or incorrect personal data concerning them.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Object

Information regarding the data subject's rights is available on Traficom's website. 

The data subject has the right to object to the processing of their personal data if the processing is based on public interest, legitimate interest, or the exercise of official authority. In such cases, the data controller may only continue processing the data if it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

However, the right to object does not generally apply to processing that is based on a statutory legal obligation.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Restriction of Processing

The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purposes of the
• processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Data Portability

The right does not apply to the processing operations in question, because the personal data is processed on the basis of a statutory legal obligation and public interest / exercise of official authority.

Right to Erasure

The right does not apply to the processing operations in question, because the personal data is not processed on the basis of consent or a contract.

Description of the Service

An application where the user can apply for a new, automatically issued radio licence for specific radio equipment groups on shared frequencies. Applying for a licence requires Suomi.fi e-Identification and payment of the first annual frequency fee via Suomi.fi Payment in connection with the application. The user can also view and terminate their own radio licences after Suomi.fi e-Identification.

Legal Basis and Purpose of Data Processing

With the help of the radio licence service, Traficom's customers can apply for automatically issued radio licences. Personal data is used to handle the administrative tasks of the Finnish Transport and Communications Agency as mandated by the Act on Electronic Communications Services (917/2014).

The data of radio licences is stored in the RAHAS2 system, from which the data is retrieved to the forms only in the SAHA application for the duration of filling out the form or for the duration of viewing the licence details.

The privacy notice for the RAHAS2 system is available on the Traficom website on the page Privacy Notices for Traficom's Registers.

Data Content

Data Assets to be Processed

The holder of the licence or the contact person may be a private individual, whose contact details and address details are stored in the RAHAS2 system. The data to be stored consists of the name, telephone number, and email address. For the radio licence holder, the personal identity code and address are also stored.

Technical Data Related to Usage

The system contains technical data, such as information regarding errors and connections, which is collected to improve the operation and usability of the application and to resolve technical issues.

Data Sources of the Processed Data Assets (Where the data is obtained from)

As the source for the personal data collected through the radio licence application forms, the name and address details provided by the DVV's (Digital and Population Data Services Agency) VTJ interface (Population Information System) function based on the customer's personal identity code. 

The individual themselves supplements this data with telephone numbers and email addresses. The person is always strongly authenticated as a private individual (Suomi.fi e-Identification). Information on acting on behalf of someone else is obtained through Suomi.fi e-Authorizations (acting either on behalf of another person or a company).

Retention Period of Personal Data

Data is not permanently stored in the radio licence service; the RAHAS2 system functions as the storage location for the data.

Data Processing

Recipients and Categories of Recipients of Personal Data (To whom data is disclosed)

Viewing and editing rights to the personal data collected through the VISA radio licence forms are provided internally within Traficom (via RAHAS2):

• Via AD groups to radio licence processors and to customer service (internal users, not to the service provider)

In addition, viewing rights to the collected data are provided to the authenticated customer themselves through the radio licence system.
Data may be disclosed outside the Agency in the cases described in the privacy statement of the RAHAS2 system.

Processing of Personal Data on Behalf of the Data Controller

Access to the data collected through the radio licence forms is restricted exclusively to strictly defined and limited internal user groups within Traficom. External customers submit data through the forms and thus act as processors of their own data. Traficom acts as the data controller regarding the data submitted through the radio licence forms.

Transfer of Personal Data to Third Countries Outside the EU/EEA

Data is not transferred outside the EU or the EEA.

Automated Decision-Making and Profiling

The Radio Licence Service uses automated decision-making when granting licences. The decision on the implementation of the automated decision-making procedure is available on the Traficom website in Finnish or Swedish.

Rights Related to the Processing of Personal Data

Exercising Your Rights

You can exercise your rights by submitting a request to Traficom via email or post. Contact details can be found under section "Contact Information of the Data Controller" in this privacy statement.

Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

P.O. Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
Tel. +358 29 566 6700

Right of Access to One's Own Data

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Rectification of Data

The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate or incorrect personal data concerning them.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Object

Information regarding the data subject's rights is available on Traficom's website. 

The data subject has the right to object to the processing of their personal data if the processing is based on public interest, legitimate interest, or the exercise of official authority. In such cases, the data controller may only continue processing the data if it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

However, the right to object does not generally apply to processing that is based on a statutory legal obligation.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Restriction of Processing

The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purposes of the
• processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Data Portability

The right does not apply to the processing operations in question, because the personal data is processed on the basis of a statutory legal obligation and public interest / exercise of official authority.

Right to Erasure

The right does not apply to the processing operations in question, because the personal data is not processed on the basis of consent or a contract.

Description of the Service

The M2M interface application for the Finnish Border Guard's maritime transmitters enables the Finnish Border Guard to query maritime transmitter data from Traficom for monitoring purposes.

Legal Basis and Purpose of Data Processing

Through the FBG (Finnish Border Guard) interfaces, Traficom provides its partners (the Finnish Border Guard) with data related to vessel and emergency beacon licences. The data is synchronized from the RAHAS2 system (master data) into the FBG interfaces' own database for use by the application.

Data Content

Data Assets to be Processed

The data contained within the FBG interfaces is managed in RAHAS2, from which the data is retrieved via interfaces into the temporary database used by the FBG interfaces. The name and address details of the holders of ship radio licences and emergency beacons are stored in the tables.

Technical Data Related to Usage

The system contains technical data, such as information regarding errors and connections, which is collected to improve the operation and usability of the application and to resolve technical issues.

Data Sources of the Processed Data Assets (Where the data is obtained from)

The data source for the FBG interfaces is the RAHAS system, where the data on ship radio licences and emergency beacons is collected from the back-end database.

Retention Period of Personal Data

The personal data is synchronized from the source system, meaning that the retention period corresponds to the respective system.

Data Processing

Recipients and Categories of Recipients of Personal Data (To whom data is disclosed)

Viewing rights to the personal data collected through the FBG interfaces are provided to designated user organizations (the Finnish Border Guard) through the interface application. 

Processing of Personal Data on Behalf of the Data Controller

Access to the data within the FBG interfaces is strictly restricted through the interface access rights. Traficom acts as the data controller and the Finnish Border Guard acts as the data processor regarding the data of the FBG interfaces.

Transfer of Personal Data to Third Countries Outside the EU/EEA

Data is not transferred outside the EU or the EEA.

Automated Decision-Making and Profiling

Automated decision-making and profiling are not performed.

Rights Related to the Processing of Personal Data

Exercising Your Rights

You can exercise your rights by submitting a request to Traficom via email or post. Contact details can be found under section "Contact Information of the Data Controller" in this privacy statement.

Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

P.O. Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
Tel. +358 29 566 6700

Right of Access to One's Own Data

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Rectification of Data

The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate or incorrect personal data concerning them.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Object

Information regarding the data subject's rights is available on Traficom's website. 

The data subject has the right to object to the processing of their personal data if the processing is based on public interest, legitimate interest, or the exercise of official authority. In such cases, the data controller may only continue processing the data if it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

However, the right to object does not generally apply to processing that is based on a statutory legal obligation.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Restriction of Processing

The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purposes of the
• processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Data Portability

The right does not apply to the processing operations in question, because the personal data is processed on the basis of a statutory legal obligation and public interest / exercise of official authority.

Right to Erasure

The right does not apply to the processing operations in question, because the personal data is not processed on the basis of consent or a contract.

Description of the Service

The purpose of the ServiceNow case management integration is to synchronize specified tickets within ServiceNow to Traficom's case management system. Data is only synchronized from tickets that have been marked in ServiceNow as eligible for case management synchronization. A new feature will be implemented separately in ServiceNow for this purpose.

The integration service enables both the creation of new cases in the case management system based on the synchronized ServiceNow tickets, and the linking of tickets to already existing cases in the case management system based on the record number (diary number). Thus, multiple ServiceNow tickets can also be linked to the same case via the integration.

Legal Basis and Purpose of Data Processing

The ServiceNow case management integration enables the export of ServiceNow ticket data into Traficom's case management system. Ticket data (including associated personal data) is stored in the integration service database only temporarily to enable the integration process, and the permanent storage of the data takes place within the case management system.

Data Content

Data Assets to be Processed

The contents of the ticket, which may include personal data, are temporarily stored in the service database.

Technical Data Related to Usage

The integration synchronizes data from the ServiceNow system tickets selected by users into Traficom's case management system.

Data Sources of the Processed Data Assets (Where the data is obtained from)

The ServiceNow system serves as the source for the ticket data.

Retention Period of Personal Data

Short-term (for the duration of the ticket synchronization)

Data Processing

Recipients and Categories of Recipients of Personal Data (To whom data is disclosed)

The ServiceNow case management integration does not include viewing rights; instead, viewing and editing rights are restricted internally within Traficom (via the case management system), and additionally, customer service (an external service provider) has viewing and editing rights via AD groups.

Not otherwise disclosed outside the Agency.

Processing of Personal Data on Behalf of the Data Controller

Access to the ServiceNow case management integration data is strictly restricted through interface access rights. Traficom acts as the data controller, and for certain services of the Agency, the external customer service acts as a data processor regarding the data of the ServiceNow case management integration.

Transfer of Personal Data to Third Countries Outside the EU/EEA

Data is not transferred outside the EU or the EEA.

Automated Decision-Making and Profiling

Automated decision-making and profiling are not performed.

Rights Related to the Processing of Personal Data

Exercising Your Rights

You can exercise your rights by submitting a request to Traficom via email or post. Contact details can be found under section "Contact Information of the Data Controller" in this privacy statement.

Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

P.O. Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
Tel. +358 29 566 6700

Right of Access to One's Own Data

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Rectification of Data

The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate or incorrect personal data concerning them.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Object

Information regarding the data subject's rights is available on Traficom's website. 

The data subject has the right to object to the processing of their personal data if the processing is based on public interest, legitimate interest, or the exercise of official authority. In such cases, the data controller may only continue processing the data if it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

However, the right to object does not generally apply to processing that is based on a statutory legal obligation.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Restriction of Processing

The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purposes of the
• processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Data Portability

The right does not apply to the processing operations in question, because the personal data is processed on the basis of a statutory legal obligation and public interest / exercise of official authority.

Right to Erasure

The right does not apply to the processing operations in question, because the personal data is not processed on the basis of consent or a contract.

Description of the Service

Taxi licence surveys are used to collect data from taxi operators regarding their operations in accordance with the annual surveys.

Legal Basis and Purpose of Data Processing

In connection with the surveys, personal data of the respondent is collected for the purpose of identifying the person operating as a taxi entrepreneur under the Taxi Market Act.

Data Content

Data Assets to be Processed

In connection with the responses to the taxi licence surveys, personal data of the respondent (name, personal identity code) is collected for the purpose of identifying the person operating as a taxi entrepreneur under the Taxi Market Act.

Technical Data Related to Usage

The system contains technical data, such as information regarding errors and connections, which is collected to improve the operation and usability of the application and to resolve technical issues.

Data Sources of the Processed Data Assets (Where the data is obtained from)

The data source is the Suomi.fi e-Identification service, through which information from the user's strong authentication is recorded in connection with the survey responses.

Retention Period of Personal Data

Managed by the Traficom user.

Data Processing

Recipients and Categories of Recipients of Personal Data (To whom data is disclosed)

Wiewing rights to the personal data collected in the register are provided internally to strictly defined and limited user groups within Traficom. Data is not disclosed outside the Agency.

Processing of Personal Data on Behalf of the Data Controller

Access to the data of the taxi licence surveys is restricted exclusively to strictly defined and limited internal user groups within Traficom. External operators submit data only regarding their own organization in an authenticated state and act as processors of their own data. Traficom acts as the data controller regarding the data within the taxi licence surveys.

Transfer of Personal Data to Third Countries Outside the EU/EEA

Data is not transferred outside the EU or the EEA.

Automated Decision-Making and Profiling

Automated decision-making and profiling are not performed.

Rights Related to the Processing of Personal Data

Exercising Your Rights

You can exercise your rights by submitting a request to Traficom via email or post. Contact details can be found under section "Contact Information of the Data Controller" in this privacy statement.

Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

P.O. Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
Tel. +358 29 566 6700

Right of Access to One's Own Data

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Rectification of Data

The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate or incorrect personal data concerning them.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Object

Information regarding the data subject's rights is available on Traficom's website. 

The data subject has the right to object to the processing of their personal data if the processing is based on public interest, legitimate interest, or the exercise of official authority. In such cases, the data controller may only continue processing the data if it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

However, the right to object does not generally apply to processing that is based on a statutory legal obligation.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Restriction of Processing

The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purposes of the
• processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Data Portability

The right does not apply to the processing operations in question, because the personal data is processed on the basis of a statutory legal obligation and public interest / exercise of official authority.

Right to Erasure

The right does not apply to the processing operations in question, because the personal data is not processed on the basis of consent or a contract.

Description of the Service

The purpose of the VISA API Gateway solution and its associated identity service is to enable the provision of service interfaces produced for Traficom's My Services (Oma asiointi) to the public network through a load-balanced, centralized solution, simultaneously providing user identity management and connectivity to authentication services.

Legal Basis and Purpose of Data Processing

Authentication, authorization, and API services are provided for the My Services platform. The user's personal data (name, personal identity code) is collected into a database and transmitted to the back-end system. Audit logs are collected from events related to the user's personal data and exported to a centralized log management system.

Data Content

Data Assets to be Processed

The API GW solution stores the personal data of the logged-in user (name, personal identity code). In addition, information regarding the proxy/representative (authorized party) and the principal (mandator) or the represented company/organization is also stored via the authorization details.

The logging mechanism of the API GW solution collects user usage data from various applications, and the log data may contain references to information that uniquely identifies an individual. Audit logs are collected from events related to the user's personal data and exported to a centralized log management system.

Technical Data Related to Usage

The API GW solution contains technical data, such as information regarding errors and connections, which is collected to improve the operation and usability of the application and to resolve technical issues.

Data Sources of the Processed Data Assets (Where the data is obtained from)

The data sources for logins within the API GW solution consist of login events from various authentication applications (Suomi.fi e-Identification, Suomi.fi e-Authorizations) on the agency's integration platform, which are generated when a customer/user logs in using the respective authentication application.

Retention Period of Personal Data

5 years. User personal data collected in the database is deleted upon the termination of the user's e-service session.

Data Processing

Recipients and Categories of Recipients of Personal Data (To whom data is disclosed)

Authentication data is transferred to the back-end servers of Traficom's My Services, which are managed by an external service provider.

Processing of Personal Data on Behalf of the Data Controller

Access to My Services data is restricted exclusively to strictly defined and limited internal user groups within Traficom. Traficom acts as the data controller regarding the data within My Services.

Transfer of Personal Data to Third Countries Outside the EU/EEA

Data is not transferred outside the EU or the EEA.

Automated Decision-Making and Profiling

Automated decision-making and profiling are not performed.

Rights Related to the Processing of Personal Data

Exercising Your Rights

You can exercise your rights by submitting a request to Traficom via email or post. Contact details can be found under section "Contact Information of the Data Controller" in this privacy statement.

Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

P.O. Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
Tel. +358 29 566 6700

Right of Access to One's Own Data

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Rectification of Data

The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate or incorrect personal data concerning them.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Object

Information regarding the data subject's rights is available on Traficom's website. 

The data subject has the right to object to the processing of their personal data if the processing is based on public interest, legitimate interest, or the exercise of official authority. In such cases, the data controller may only continue processing the data if it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

However, the right to object does not generally apply to processing that is based on a statutory legal obligation.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Restriction of Processing

The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purposes of the
• processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Data Portability

The right does not apply to the processing operations in question, because the personal data is processed on the basis of a statutory legal obligation and public interest / exercise of official authority.

Right to Erasure

The right does not apply to the processing operations in question, because the personal data is not processed on the basis of consent or a contract.

Description of the Service

The Drone client application enables various functions for drone pilots and operators for drone operations, such as, among other things, registering as a drone operator, registering for online theory exams, changing one's own data, and extending the registration period. The data from the forms is stored in the Dronerekisteri (Drone Register) system, which is separate from this service, from which the data is retrieved to the forms for the duration of filling out the form in the Drone client application or for the duration of viewing the data.

Legal Basis and Purpose of Data Processing

The holder of drone permits or the contact person may be a private individual, making the collection of the customer's contact information necessary for the performance of the task. The data from the forms is stored in the Dronerekisteri system, from which the data is retrieved for the duration of the Drone client application user's transaction in the service.

Data Content

Data Assets to be Processed

The data of the customers of the Drone client application is stored in Traficom's Dronerekisteri system, which is separate from this service, from which the data is retrieved to the forms for the duration of filling out the form in the Drone client application or for the duration of viewing the data.Audit logs are collected from events related to the user's personal data and exported to a centralized log management system.

Technical Data Related to Usage

The system contains technical data, such as information regarding errors and connections, which is collected to improve the operation and usability of the application and to resolve technical issues.

Data Sources of the Processed Data Assets (Where the data is obtained from)

The person using the system is always strongly authenticated as a private individual (Suomi.fi e-Identification). Information on acting on behalf of someone else is obtained through Suomi.fi e-Authorizations (acting either on behalf of another person or a company). Personal data is retrieved from the separate Drone Register based on the personal identity code obtained through authentication.

Retention Period of Personal Data

Personal data is not retained in the Drone client application.

Data Processing

Recipients and Categories of Recipients of Personal Data (To whom data is disclosed)

Viewing and editing rights to the personal data collected into the Drone Register via the Drone client application are provided internally within Traficom (via the Drone Register).

In addition, viewing rights to the collected data are provided to the authenticated customer themselves.

Data is not disclosed outside the Agency.

Authentication data is transferred to the back-end servers of Traficom's My Services, which are managed by an external service provider.

Processing of Personal Data on Behalf of the Data Controller

Access to the data within the Drone client application is restricted exclusively to strictly defined and limited internal user groups within Traficom. Traficom acts as the data controller regarding the data within the Drone client application.

Access to My Services data is restricted exclusively to strictly defined and limited internal user groups within Traficom. Traficom acts as the data controller regarding the data within My Services.

Transfer of Personal Data to Third Countries Outside the EU/EEA

Data is not transferred outside the EU or the EEA.

Automated Decision-Making and Profiling

Automated decision-making and profiling are not performed.

Rights Related to the Processing of Personal Data

Exercising Your Rights

You can exercise your rights by submitting a request to Traficom via email or post. Contact details can be found under section "Contact Information of the Data Controller" in this privacy statement.

Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

P.O. Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
Tel. +358 29 566 6700

Right of Access to One's Own Data

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Rectification of Data

The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate or incorrect personal data concerning them.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Object

Information regarding the data subject's rights is available on Traficom's website. 

The data subject has the right to object to the processing of their personal data if the processing is based on public interest, legitimate interest, or the exercise of official authority. In such cases, the data controller may only continue processing the data if it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

However, the right to object does not generally apply to processing that is based on a statutory legal obligation.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Restriction of Processing

The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purposes of the
• processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Data Portability

The right does not apply to the processing operations in question, because the personal data is processed on the basis of a statutory legal obligation and public interest / exercise of official authority.

Right to Erasure

The right does not apply to the processing operations in question, because the personal data is not processed on the basis of consent or a contract.

Description of the Service

The purpose of the register of operations notifications is to receive notifications submitted to Traficom by Traficom's stakeholders regarding activities subject to notification requirements, and to enable Traficom users to process these notifications and compile the register on their basis.

Legal Basis and Purpose of Data Processing

The data content of the notifications and the register compiled on their basis includes, among other things, the contact persons of the operators and their contact details.

Data Content

Data Assets to be Processed

The purpose of the register of operations notifications is to receive notifications submitted to Traficom by Traficom's stakeholders regarding activities subject to notification requirements, and to enable Traficom users to process these notifications and compile the register on their basis. The data content of the notifications and the register compiled on their basis includes, among other things, the contact persons of the operators and their contact details.

Technical Data Related to Usage

The system contains technical data, such as information regarding errors and connections, which is collected to improve the operation and usability of the application and to resolve technical issues.

Data Sources of the Processed Data Assets (Where the data is obtained from)

The data source for the information in the register of operations notifications is the notification made by the notifying organization itself, which it provides via an electronic e-service form. The form is filled out unauthenticated.

Retention Period of Personal Data

Managed by the Traficom user.

Data Processing

Recipients and Categories of Recipients of Personal Data (To whom data is disclosed)

Viewing and editing rights to the personal data collected in the register are provided internally to strictly defined and limited user groups within Traficom.

Data is not disclosed outside the Agency.

Processing of Personal Data on Behalf of the Data Controller

Access to the data within the register of operations notifications is restricted exclusively to strictly defined and limited internal user groups within Traficom. External operators submit data only regarding their own organization in an authenticated state and act as processors of their own data. Traficom acts as the data controller regarding the data within the register of operations notifications.

Transfer of Personal Data to Third Countries Outside the EU/EEA

Data is not transferred outside the EU or the EEA.

Automated Decision-Making and Profiling

Automated decision-making and profiling are not performed.

Rights Related to the Processing of Personal Data

Exercising Your Rights

You can exercise your rights by submitting a request to Traficom via email or post. Contact details can be found under section "Contact Information of the Data Controller" in this privacy statement.

Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

P.O. Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
Tel. +358 29 566 6700

Right of Access to One's Own Data

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Rectification of Data

The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate or incorrect personal data concerning them.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Object

Information regarding the data subject's rights is available on Traficom's website. 

The data subject has the right to object to the processing of their personal data if the processing is based on public interest, legitimate interest, or the exercise of official authority. In such cases, the data controller may only continue processing the data if it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

However, the right to object does not generally apply to processing that is based on a statutory legal obligation.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Restriction of Processing

The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purposes of the
• processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Data Portability

The right does not apply to the processing operations in question, because the personal data is processed on the basis of a statutory legal obligation and public interest / exercise of official authority.

Right to Erasure

The right does not apply to the processing operations in question, because the personal data is not processed on the basis of consent or a contract.

Description of the Service

The online payment service enables the execution of online payments for transactions generated within various VISA services.

Legal Basis and Purpose of Data Processing

The Agency has a statutory basis to collect fees and process them.

Data Content

Data Assets to be Processed

The system collects the user's email address into its database in connection with the payment details (mandatory information for the external payment service to process the payment).

Technical Data Related to Usage

The system contains technical data, such as data concerning errors and connections, which is collected to improve the operation and usability of the application and to resolve technical problems.

Data Sources of the Processed Data Assets (Where the data is obtained from)

The connected VISA system serves as the data source through which the payer's information is transmitted (the user usually enters their own data into the system in question themselves prior to making the payment).

Retention Period of Personal Data

5 years.

Data Processing

Recipients and Categories of Recipients of Personal Data (To whom data is disclosed)

The customer's email address is sent to the Suomi.fi payment service for the execution of the payment.
Disclosed outside the Agency to the Suomi.fi payment service.

Processing of Personal Data on Behalf of the Data Controller

Access to the Online Payment Service data is strictly restricted to specified, tightly defined internal user groups within Traficom. External, strictly restricted actors operate as data processors for online payments in accordance with the contracts concluded with them. Traficom acts as the data controller regarding the data of the Online Payment Service.

Transfer of Personal Data to Third Countries Outside the EU/EEA

Data is not transferred outside the EU or the EEA.

Automated Decision-Making and Profiling

Automated decision-making and profiling are not performed.

Rights Related to the Processing of Personal Data

Exercising Your Rights

You can exercise your rights by submitting a request to Traficom via email or post. Contact details can be found under section "Contact Information of the Data Controller" in this privacy statement.

Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

P.O. Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
Tel. +358 29 566 6700

Right of Access to One's Own Data

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Rectification of Data

The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate or incorrect personal data concerning them.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Object

Information regarding the data subject's rights is available on Traficom's website. 

The data subject has the right to object to the processing of their personal data if the processing is based on public interest, legitimate interest, or the exercise of official authority. In such cases, the data controller may only continue processing the data if it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

However, the right to object does not generally apply to processing that is based on a statutory legal obligation.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Restriction of Processing

The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purposes of the
• processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Data Portability

The right does not apply to the processing operations in question, because the personal data is processed on the basis of a statutory legal obligation and public interest / exercise of official authority.

Right to Erasure

The right does not apply to the processing operations in question, because the personal data is not processed on the basis of consent or a contract.

Description of the Service

The VISA platform is Traficom's application and integration platform, upon which several different electronic services have been built. The platform features multiple login models; when these are utilized, the logged-in user's information is stored on the platform.

Legal Basis and Purpose of Data Processing

Enabling logins to the applications on the VISA platform and transmitting the logged-in user's personal data (name, personal identity code / eIDAS identifier) to the applications on the VISA platform. Information concerning the representative (authorized agent) and the principal (authorizer) via authorization is also stored on the VISA platform. This information is transmitted to the VISA platform through Suomi.fi e-Identification and authorizations.

The processing is based on the statutory duties of the agency.

Data Content

Data Assets to be Processed

The logged-in user's personal data (name, personal identity code) is stored on the VISA platform. In addition to this, information concerning the representative (authorized agent) and the principal (authorizer) or the represented company/organization via authorization is also stored.

Technical Data Related to Usage

The system contains technical data, such as data concerning errors and connections, which is collected to improve the operation and usability of the application and to resolve technical problems.

Data Sources of the Processed Data Assets (Where the data is obtained from)

The data sources for the logins on the VISA platform are the login events of the VISA platform's various authentication applications (AD login, Suomi.fi e-Identification, Suomi.fi authorization, VISA OTP authentication), which are generated when a customer/user logs in using the authentication application in question.

Retention Period of Personal Data

1 month.

Data Processing

Recipients and Categories of Recipients of Personal Data (To whom data is disclosed)

The information is used solely by the applications for verifying login details for tightly defined user groups. Not disclosed outside the Agency.

Processing of Personal Data on Behalf of the Data Controller

Access to the VISA platform data is strictly restricted to specified, tightly defined internal user groups within Traficom. External actors only submit information regarding their own organization, or external customers regarding their own data in an authenticated state, and all of these act as data processors for their own data. Traficom acts as the data controller regarding the data of the VISA platform.

Transfer of Personal Data to Third Countries Outside the EU/EEA

Data is not transferred outside the EU or the EEA.

Automated Decision-Making and Profiling

Automated decision-making and profiling are not performed.

Rights Related to the Processing of Personal Data

Exercising Your Rights

You can exercise your rights by submitting a request to Traficom via email or post. Contact details can be found under section "Contact Information of the Data Controller" in this privacy statement.

Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

P.O. Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
Tel. +358 29 566 6700

Right of Access to One's Own Data

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Rectification of Data

The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate or incorrect personal data concerning them.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Object

Information regarding the data subject's rights is available on Traficom's website. 

The data subject has the right to object to the processing of their personal data if the processing is based on public interest, legitimate interest, or the exercise of official authority. In such cases, the data controller may only continue processing the data if it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

However, the right to object does not generally apply to processing that is based on a statutory legal obligation.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Restriction of Processing

The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purposes of the
• processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Data Portability

The right does not apply to the processing operations in question, because the personal data is processed on the basis of a statutory legal obligation and public interest / exercise of official authority.

Right to Erasure

The right does not apply to the processing operations in question, because the personal data is not processed on the basis of consent or a contract.

Description of the Service

The VISA system includes a centralized log service where various types of log data (e.g. statistical log, error log) regarding the functions and use of applications on the VISA platform are stored.

Legal Basis and Purpose of Data Processing

Control, monitoring, and traceability of application use for applications utilizing the VISA platform. Registry data may reside within the registries of the VISA platform or the registries of back-end systems.

The processing is based on the statutory duties of the agency.

Data Content

Data Assets to be Processed

User activity data from various applications is collected into the VISA logging, and the log data may contain references to information identifying the individual. 

Audit logs and audit trail logs are collected for events related to the user's personal data, and these are exported separately to the agency's centralized log management system.

Technical Data Related to Usage

The system contains technical data, such as data concerning errors and connections, which is collected to improve the operation and usability of the application and to resolve technical problems.

Data Sources of the Processed Data Assets (Where the data is obtained from)

The data sources for VISA logging are application events generated when a customer/user uses a transactional application. The person's personal data becomes known to the application through the authentication and authorization event they perform, or in accordance with the data entered by the person themselves, for example, on a contact form.

Retention Period of Personal Data

5 years.

Data Processing

Recipients and Categories of Recipients of Personal Data (To whom data is disclosed)

Data collected into the VISA logging that contains personal-level information is provided internally to specified, tightly defined user groups within Traficom. Not disclosed outside the Agency.

Processing of Personal Data on Behalf of the Data Controller

Access to VISA logging data is strictly restricted to specified, tightly defined internal user groups within Traficom. Traficom acts as the data controller regarding the data of the VISA logging.

Transfer of Personal Data to Third Countries Outside the EU/EEA

Data is not transferred outside the EU or the EEA.

Automated Decision-Making and Profiling

Automated decision-making and profiling are not performed.

Rights Related to the Processing of Personal Data

Exercising Your Rights

You can exercise your rights by submitting a request to Traficom via email or post. Contact details can be found under section "Contact Information of the Data Controller" in this privacy statement.

Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

P.O. Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
Tel. +358 29 566 6700

Right of Access to One's Own Data

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Rectification of Data

The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate or incorrect personal data concerning them.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Object

Information regarding the data subject's rights is available on Traficom's website. 

The data subject has the right to object to the processing of their personal data if the processing is based on public interest, legitimate interest, or the exercise of official authority. In such cases, the data controller may only continue processing the data if it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

However, the right to object does not generally apply to processing that is based on a statutory legal obligation.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Restriction of Processing

The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purposes of the
• processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Information regarding the data subject's rights is available on Traficom's website.

The data subject may submit their request by email or post to the registry (kirjaamo).

Right to Data Portability

The right does not apply to the processing operations in question, because the personal data is processed on the basis of a statutory legal obligation and public interest / exercise of official authority.

Right to Erasure

The right does not apply to the processing operations in question, because the personal data is not processed on the basis of consent or a contract.