Privacy statements for Traficom’s registration forms, surveys and reports

Grounds for and purpose of the data processing

The processing of personal data is based on Article 6(1)(e) of the General Data Protection Regulation and section 4, subsection 1, paragraph 2 of the Data Protection Act, which specifies the aforementioned, according to which the processing of personal data is lawful when it is proportionate and necessary for the performance of a task carried out in the public interest. Traficom is investigating the opinions of the users of its permit, monitoring, interest group and statistical information services on its products, services and operations for the digitalisation of aviation, maritime transport, rail transport and road traffic. The objective of the survey is to monitor the development of customer satisfaction and the use of Traficom services and identify development areas in traffic services provided by the authorities.

Responding to the survey is voluntary, and the respondents are not asked to provide their identity or contact details. Any personal data entered in open responses will be removed and Traficom will process the responses anonymously. The information is only intended for use in the internal development of Traficom’s Transport System Services. The reporting and processing is carried out without identifiers.

Data content

The data undergoing processing

The survey provides information on the user satisfaction as well as development ideas concerning Traficom’s permit, monitoring, interest group and statistical information services related to the digitalisation of aviation, maritime transport, rail transport and road traffic. The respondents are not asked to provide personal data or contact details. Any personal data entered in open responses will be removed and Traficom will process the responses anonymously. The information received is only intended for the internal use of Traficom’s Transport System Services.

Webropol Oy (FI17739602) uses necessary cookies for the functioning of its service platform and collects the data specified below using them. These cookies are connected to the functionality and quality control of the service. Webropol collects e.g. the following information using cookies:

• operating system
• browser version
• IP address
• browser add-ons
• number of times the survey has been opened in the space of one week
• page download time
• incomplete responses

Sources of the processed data (where the data is received from)

The data source is a questionnaire on the Webropol platform. The link to the questionnaire is shared with customers via presentations, report forms and email. The respondents include both representatives of organisational customers as well as private individuals using the services (e.g. licence holders). The email addresses have been retrieved from the customer registers used in the course of Traficom’s statutory duties.

Storage period of personal data 

No personal data are requested. The responses received via Webropol surveys are stored on the Webropol server, and the surveys are open continuously.

If a survey is closed, the responses to the feedback survey are stored on the Webropol service platform for 90 days from the end of the response period, after which they are transferred to Traficom’s own server. Survey data deleted from the Webropol service are stored by Webropol on servers for one year after deletion, after which they are destroyed. After deletion, they will remain in Webropol’s backup files for 12 months, after which the data are deleted permanently.

In addition, Webropol stores data collected through cookies for 14 days.

Data processing

Recipients and categories of recipients of personal data (to whom personal data is disclosed)

Personal data are stored on the Webropol Oy (business ID: FI17739602) service platform. Webropol Oy and Traficom have an agreement on processing personal data. The only piece of personal data transmitted through the survey is the respondent’s IP address. As a rule, Traficom is not able to connect the responses given to individual respondents.

Processing of personal data on behalf of the controller

The only piece of personal data transmitted through the survey is the respondent’s IP address. As a rule, Traficom is not able to connect the responses given to individual respondents. Webropol may not transfer personal data to third parties, except to specific subcontractors agreed upon by Webropol and Traficom. The following subcontractors may act as processors in accordance with the definition in the data protection regulations when serving as Webropol subcontractors to ensure and improve the development, usability and reliability of the system: Telia Inmics-Nebula Oy (business ID 2546028-1) and Qumio Oy (business ID 2466203-3).

Transfer of personal data to third countries outside the EU/EEA

Personal data are not transferred outside the EU/EEA.

Automated decisionmaking and profiling

Data processing does not involve automated decision-making or profiling.

Rights related to the processing of personal data 

About exercising rights 

You can exercise your rights by submitting a request to Traficom by email or post. The controller’s contact details are listed in this privacy statement under the section ‘Controller’s contact details’. 

The right to lodge a complaint with the supervisory authority 

If you believe that your personal data is being processed in violation of legislation, you may lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman
PO Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
tel. +358 29 566 6700

Rights

Right of access

Data subjects have the right to obtain from the controller confirmation as to whether or not personal data concerning them is being processed. If processing takes place, data subjects have the right to access the personal data. The only piece of personal data transmitted through the survey is the respondent’s IP address. As a rule, Traficom is not able to connect the responses given to individual respondents.

Right to rectification 

The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate or incorrect personal data. The only piece of personal data transmitted through the survey is the respondent’s IP address. As a rule, Traficom is not able to connect the responses given to individual respondents.

Right to object 

In situations where the processing of personal data is based on public interest, the exercise of official authority vested in the controller or the legitimate interest of the controller or a third party, the data subject has the right to object to the processing of personal data concerning him or her.

If a data subject uses his or her right to object, the controller must stop the processing of the personal data, unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

If personal data is processed for direct marketing purposes, the data subject has the right to object to the processing without any specific grounds. 

In situations where personal data is processed for statistical or research purposes, the data subject may object to the processing on grounds relating to his or her particular situation, in response to which the controller must stop processing the data subject’s data, unless the processing is necessary for performing a task carried out for reasons of public interest. 

Right to restriction of processing 

The data subject has the right to obtain from the controller restriction of processing if:

• the accuracy of the personal data is contested by the data subject;

• the processing is unlawful but the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

• the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defence of legal claims;

• the data subject has objected to the processing of the personal data pending the verification of whether the legitimate grounds of the controller override those of the data subject.

The only piece of personal data transmitted through the survey is the respondent’s IP address. As a rule, Traficom is not able to connect the responses given to individual respondents.

Right to data portability

The data subject has the right to receive the personal data concerning him or her, which he or she has provided to the controller, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent or on a contract and the processing is carried out by automated means.

The only piece of personal data transmitted through the survey is the respondent’s IP address. As a rule, Traficom is not able to connect the responses given to individual respondents.

Right to erasure 

In situations where the legal basis for the processing of personal data is something other than compliance with a legal obligation, public interest or the exercise of official authority vested in the controller, the data subject has the right to obtain from the controller the erasure of personal data concerning him or her. The requested data will be erased unless the controller has a legal basis for refusing to erase the data, such as a legal obligation to retain the data.

The only piece of personal data transmitted through the survey is the respondent’s IP address. As a rule, Traficom is not able to connect the responses given to individual respondents.

Right to withdraw consent

Insofar as personal data is processed on the basis of the consent of the data subject, the data subject may withdraw his or her consent at any time by notifying the controller of the withdrawal. Withdrawing consent will not affect the lawfulness of processing carried out on the basis of the consent of the data subject before its withdrawal.

5.4.2023 TRAFICOM/120136/00.04.00.03/2023

Grounds for and purpose of the data processing

The processing of personal data is based on Article 6(1)(e) of the General Data Protection Regulation and section 4, subsection 1, paragraph 2 of the Data Protection Act, which specifies the aforementioned, according to which the processing of personal data is lawful when it is proportionate and necessary for the performance of a task carried out in the public interest.

Traficom is conducting a customer satisfaction survey to obtain information about the data subjects’ customer satisfaction and opinions on the outsourced customer service that they have received through the service provider Ajovarma Oy. The customer satisfaction survey focuses on customer service received through electronic service channels. The objective is to improve customer service quality, monitor the development of quality and identify development areas. Answering the survey is entirely voluntary and no personal data needs to be submitted in the survey.

Data content

The data undergoing processing

The survey is addressed to data subjects who have contacted Traficom in writing regarding the following subject areas: driving licences, road transport licences and permits, driving examinations or tests related to road transport permits, commercial traffic, parking card for people with disabilities, and electronic customer service concerning these subject areas.

The data subject is asked for information regarding customer satisfaction on a numerical scale (1–5), a yes/no-statement and an open response field where the data subject can write feedback.

The survey is anonymous. No information regarding the respondents’ identity is asked in the survey and we ask that the respondent not submit any identifying personal data. When answering the survey, the respondent’s IP address is transmitted, but as a rule, Traficom is not able to connect an IP address to individual responses.

Webropol uses necessary cookies for the functioning of its service platform and collects the data specified below using them. These cookies are connected to the functionality and quality control of the service.

Webropol collects e.g. the following information using cookies:

• operating system
• browser version
• IP address
• browser add-ons
• number of times the survey has been opened in the space of one week
• page download time
• incomplete responses.

Sources of the processed data (where the data is received from)

The data is received from the data subject in question. The data source is a questionnaire on the Webropol platform. The link to the questionnaire is sent to the data subjects who have been in contact in written form.

Storage period of personal data 

Webropol stores data collected through cookies for 14 days.

Data processing

Recipients and categories of recipients of personal data (to whom personal data is disclosed)

Personal data is stored on the Webropol Oy (business ID: FI17739602) service platform. Webropol Oy and Traficom have an agreement on processing personal data.

Processing of personal data on behalf of the controller

When answering the survey, the respondent’s IP address is transmitted, but as a rule, Traficom is not able to connect an IP address to individual responses. Webropol may not transfer personal data to third parties, except to specific subcontractors agreed upon by Webropol and Traficom. The following subcontractors may act as processors in accordance with the definition in the data protection regulation when serving as Webropol subcontractors to ensure and improve the development, usability and reliability of the system: Telia Cygate Oy (business ID 0752421-0), Qumio Oy (business ID 2466203-3) and DB Pro Services Oy (business ID: 2974225-1). 

Transfer of personal data to third countries outside the EU/EEA

Personal data is not transferred outside the EU/EEA.

Automated decisionmaking and profiling

The data processing does not involve automated decision-making or profiling.

Rights related to the processing of personal data 

About exercising rights 

You can exercise your rights by submitting a request to Traficom by email or post. The controller’s contact details are listed in this privacy statement under the section ‘Controller’s contact details’. 

The right to lodge a complaint with the supervisory authority 

If you believe that your personal data is being processed in violation of legislation, you may lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman
PO Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
tel. +358 29 566 6700

Rights

Right of access

The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning them is being processed. If processing takes place, the data subject has the right to access the personal data. No personal data that can be used to identify the respondent is asked in connection with the customer satisfaction survey, and the survey is answered anonymously. The data subject’s right to access their own personal data can be exercised only if the data subject can be unambiguously identified based on the given responses.

Right to rectification 

No personal data that can be used to identify the respondent is asked in connection with the customer satisfaction survey, and the survey is answered anonymously. The data subject's right to rectification can be exercised only if the data subject can be unambiguously identified based on the given responses.

Right to object 

In situations where the processing of personal data is based on public interest, the exercise of official authority vested in the controller or the legitimate interest of the controller or a third party, the data subject has the right to object to the processing of personal data concerning them. 

The right to object can be exercised if the data subject can be unambiguously identified based on the given responses. 

Right to restriction of processing 

The demand to restrict the processing of data can be processed if the data subject can be unambiguously identified based on the given responses.

Right to erasure 

In situations where the legal basis for the processing of personal data is something other than compliance with a legal obligation, the data subject has the right to obtain from the controller the erasure of personal data concerning them. The requested data will be erased unless the controller has a legal basis for refusing to erase the data, such as a legal obligation to retain the data. The demand to erase personal data can be processed if the data subject can be unambiguously identified based on the given responses.

17.7.2025 TRAFICOM/273189/00.04.00.03/2023

Grounds for and purpose of the data processing

The basis for the personal data processing is Article 6(1)(e) of the General Data Protection Regulation (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller).

Traficom is conducting a customer satisfaction survey to obtain information about the data subjects’ customer satisfaction and opinions on the outsourced customer service that they have received through the service provider Barona Customer Care Oy. The objective is to improve customer service quality, monitor the development of quality and identify development areas. Answering the survey is entirely voluntary and no personal data needs to be submitted in the survey.

Data content

The data undergoing processing

The survey is addressed to data subjects who have contacted Traficom in writing regarding the following subject areas: Vehicle registration, Vehicle taxation, Transport licences, Traficom’s e-services and Watercraft registration. The data subject is asked for information regarding customer satisfaction on a numerical scale, a yes/no-statement and an open response field where the customer can write feedback.

The survey is anonymous. No information regarding the respondents’ identity is asked in the survey and we ask that the respondent does not submit any identifying personal data. When answering the survey, the respondent's IP-address is transmitted, but as a rule, Traficom is not able to connect an IP-address to individual responses.

Webropol uses necessary cookies for the functioning of its service platform and collects the data specified below using them. These cookies are connected to the functionality and quality control of the service.

Webropol uses cookies to collect e.g. the following information:

• operating system
• browser version
• IP address
• browser add-ons
• number of times the survey has been opened in the space of one week
• page download time
• incomplete responses.

Sources of the processed data (where the data is received from)

The data is received from the data subject in question. The data source is a questionnaire on the Webropol platform. The link to the questionnaire is sent to the data subjects who have been in contact in written form.

Storage period of personal data 

Webropol will store data collected through cookies for 14 days.

Data processing

Recipients and categories of recipients of personal data (to whom personal data is disclosed)

Personal data is stored on the Webropol Oy (business ID: FI17739602) service platform. 

Webropol Oy and Traficom have an agreement on processing personal data.

Processing of personal data on behalf of the controller

When answering the survey, the respondent's IP-address is transmitted, but as a rule, Traficom is not able to connect an IP-address to individual responses. Webropol may not transfer personal data to third parties, except to specific subcontractors agreed upon by Webropol and Traficom. The following subcontractors may act as processors in accordance with the definition in the data protection regulation when serving as Webropol subcontractors to ensure and improve the development, usability and reliability of the system: Telia Cygate Oy (business ID 0752421-0), Qumio Oy (business ID 2466203-3) and DB Pro Services Oy (business ID: 2974225-1).

Transfer of personal data to third countries outside the EU/EEA

Personal data is not transferred outside the EU/EEA.

Automated decisionmaking and profiling

Data processing does not involve automated decision-making or profiling.

Rights related to the processing of personal data 

About exercising rights 

You can exercise your rights by submitting a request to Traficom by email or post. The controller’s contact details are listed in this privacy statement under the section ‘Controller’s contact details’. 

The right to lodge a complaint with the supervisory authority 

If you believe that your personal data is being processed in violation of legislation, you may lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman
PO Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
tel. +358 29 566 6700

Rights

Right of access

The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her is being processed. If processing takes place, the data subject has the right to access the personal data. No personal data that can be used to identify the respondent is asked in connection with the customer satisfaction survey, and the survey is answered anonymously. The data subject’s right to access their own personal data can be exercised only if the data subject can be unambiguously identified based on the given responses.

Right to rectification 

No personal data that can be used to identify the respondent is asked in connection with the customer satisfaction survey, and the survey is answered anonymously. The data subject's right to rectification can be exercised only if the data subject can be unambiguously identified based on the given responses.

Right to object 

In situations where the processing of personal data is based on public interest, the exercise of official authority vested in the controller or the legitimate interest of the controller or a third party, the data subject has the right to object to the processing of personal data concerning him or her.

The right to object can be exercised if the data subject can be unambiguously identified based on the given responses.

Right to restriction of processing 

The demand to restrict the processing of data can be processed if the data subject can be unambiguously identified based on the given responses.

Right to erasure 

In situations where the legal basis for the processing of personal data is something other than compliance with a legal obligation, public interest or the exercise of official authority vested in the controller, the data subject has the right to obtain from the controller the erasure of personal data concerning him or her. The requested data will be erased unless the controller has a legal basis for refusing to erase the data, such as a legal obligation to retain the data.

The demand to erase personal data can be processed if the data subject can be unambiguously identified based on the given responses.

17.7.2025 TRAFICOM/198633/00.04.00.03/2023

Grounds for and purpose of the data processing

The basis for the personal data processing is Article 6(1)(e) of the General Data Protection Regulation (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller).

Customers of Traficom’s statistical data service can provide feedback by responding to the customer satisfaction survey, the purpose of which is to improve service quality, monitor its development and identify areas for improvement. Answering the survey is entirely voluntary and no personal data needs to be submitted in the survey.

Data content

The data undergoing processing

Customers are asked to indicate their level of satisfaction using numerical scales, multiple-choice questions and open response fields, where they can justify or clarify their answers as well as provide development ideas or other feedback.

The survey is anonymous. The survey does not request any information that would identify respondents, and customers are asked not to provide any personal data that could reveal their identity. 

Webropol uses cookies that are necessary for the functioning of its service platform and uses them to collect the data listed below. These cookies are related to monitoring the functionality and quality of the service.

Webropol uses cookies to collect e.g. the following information:

• operating system
• browser version
• IP address
• browser add-ons
• number of times the survey has been opened within one week
• page download time
• incomplete responses.

Sources of the processed data (where the data is received from)

The source of data is a feedback form on the Webropol platform, with the information obtained directly from the customer.

Storage period of personal data 

Webropol stores data collected through cookies for 14 days.

Data processing

Recipients and categories of recipients of personal data (to whom personal data is disclosed)

Personal data is stored on the Webropol Oy (business ID: FI17739602) service platform. Webropol Oy and Traficom have an agreement on the processing of personal data.

Processing of personal data on behalf of the controller

Webropol Oy (business ID: FI17739602) acts as a processor and its subcontractors Telia Cygate Oy (business ID: 0752421-0) and Qumio Ltd (business ID: 2466203-3) as sub-processors.

Webropol may not transfer personal data to third parties, except to specific subcontractors agreed upon by Webropol and Traficom. The following subcontractors may act as processors, as defined in data protection regulation, when serving as Webropol subcontractors to ensure and improve the development, usability and reliability of the system: Telia Cygate Oy (business ID: 0752421-0) and Qumio Ltd (business ID: 2466203-3).

Transfer of personal data to third countries outside the EU/EEA

Personal data is not transferred outside the EU/EEA.

Automated decisionmaking and profiling

The processing of personal data does not involve automated decision-making or profiling.

Rights related to the processing of personal data 

About exercising rights 

You can exercise your rights by submitting a request to Traficom by email or post. The controller’s contact details are listed in this privacy statement under the section ‘Controller’s contact details’. 

The right to lodge a complaint with the supervisory authority 

If you believe that your personal data is being processed in violation of legislation, you may lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman
PO Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
tel. +358 29 566 6700

Rights

Right of access

The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her is being processed. If processing takes place, the data subject has the right to access the personal data. The data subject’s right to access their own personal data can be exercised only if the data subject can be unambiguously identified based on the given responses.

Right to rectification 

The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. The data subject's right to rectification can be exercised only if the data subject can be unambiguously identified based on the given responses.

Right to object 

In situations where the processing of personal data is based on public interest, the exercise of official authority vested in the controller or the legitimate interest of the controller or a third party, the data subject has the right to object to the processing of personal data concerning him or her. The right to object can be exercised if the data subject can be unambiguously identified based on the given responses.

If a data subject uses his or her right to object, the controller must stop the processing of the personal data, unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

If personal data is processed for direct marketing purposes, the data subject has the right to object to the processing without any specific grounds. 

In situations where personal data is processed for statistical or research purposes, the data subject may object to the processing on grounds relating to his or her particular situation, in response to which the controller must stop processing the data subject’s data, unless the processing is necessary for performing a task carried out for reasons of public interest. 

Right to restriction of processing 

The data subject has the right to obtain from the controller restriction of processing if:

• the accuracy of the personal data is contested by the data subject

• the processing is unlawful but the data subject opposes the erasure of the personal data and requests the restriction of their use instead

• the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defence of legal claims

• the data subject has objected to the processing of the personal data pending the verification of whether the legitimate grounds of the controller override those of the data subject.

The demand to restrict the processing of data can be processed if the data subject can be unambiguously identified based on the given responses.

Right to data portability

The data subject has the right to receive the personal data concerning him or her, which he or she has provided to the controller, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent or on a contract and the processing is carried out by automated means. 

The demand on data portability can be processed if the data subject can be unambiguously identified based on the given responses.

Right to erasure 

In situations where the legal basis for the processing of personal data is something other than compliance with a legal obligation, public interest or the exercise of official authority vested in the controller, the data subject has the right to obtain from the controller the erasure of personal data concerning him or her. The requested data will be erased unless the controller has a legal basis for refusing to erase the data, such as a legal obligation to retain the data. 

The demand to erase personal data can be processed if the data subject can be unambiguously identified based on the given responses.

Right to withdraw consent

Insofar as personal data is processed on the basis of the consent of the data subject, the data subject may withdraw his or her consent at any time by notifying the controller of the withdrawal. Withdrawing consent will not affect the lawfulness of processing carried out on the basis of the consent of the data subject before its withdrawal.

11.9.2025 TRAFICOM/655026/00.04.00.03/2025

Grounds for and purpose of the data processing

The basis for the personal data processing is Article 6(1)(e) of the General Data Protection Regulation (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller).

Traficom is conducting a customer satisfaction survey to obtain information about the data subjects’ customer satisfaction and opinions on the customer service. The objective is to improve customer service quality, monitor the development of quality and identify development areas. Answering the survey is entirely voluntary and no personal data needs to be submitted in the survey.

Data content

The data undergoing processing

The survey is targeted at customers who have contacted Traficom in writing. The survey is targeted at customers who have contacted Traficom about the following topics; postal services, TV and radio, information security, radio licences and frequencies, telephone and broadband or .fi domain names. The customers are asked to rate their satisfaction in the service on a numerical scale, with a yes/no statement and an open response field, in which the customer can write their own feedback.

The survey is anonymous. Respondents are not asked to provide any information about their identity, in addition to which respondents are explicitly asked not to disclose any identifying personal data.

Webropol uses necessary cookies for the functioning of its service platform and collects the data specified below using them. These cookies are connected to the functionality and quality control of the service.

Webropol collects e.g. the following information using cookies:

• operating system
• browser version
• IP address
• browser add-ons
• number of times the survey has been opened in the space of one week
• page download time
• incomplete responses.

Sources of the processed data (where the data is received from)

The data is received from the data subjects themselves.

Storage period of personal data 

Webropol stores data collected through cookies for 14 days.

Data processing

Recipients and categories of recipients of personal data (to whom personal data is disclosed)

Personal data is stored on the Webropol Oy (business ID: FI17739602) service platform. Webropol Oy and Traficom have an agreement on processing personal data.

Processing of personal data on behalf of the controller

Webropol Oy (business ID: FI17739602) serves as the processor of the personal data and its subcontractors Telia Cygate Oy (business ID: 0752421-0) and Qumio Oy (business ID: 2466203-3) serve as sub-processors.

Webropol may not transfer personal data to third parties, except to specific subcontractors agreed upon by Webropol and Traficom.

The following subcontractors may act as processors in accordance with the definition in the data protection regulations when serving as Webropol subcontractors to ensure and improve the development, usability and reliability of the system: Telia Cygate Oy (business ID 0752421-0) and Qumio Oy (business ID 2466203-3). 

Updated 28.11.2023.

Transfer of personal data to third countries outside the EU/EEA

Personal data is not transferred outside the EU/EEA.

Automated decisionmaking and profiling

The data processing does not involve automated decision-making or profiling.

Rights related to the processing of personal data 

About exercising rights 

You can exercise your rights by submitting a request to Traficom by email or post. The controller’s contact details are listed in this privacy statement under the section ‘Controller’s contact details’. 

The right to lodge a complaint with the supervisory authority 

If you believe that your personal data is being processed in violation of legislation, you may lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman
PO Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
tel. +358 29 566 6700

Rights

Right of access

The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her is being processed. If processing takes place, the data subject has the right to access the personal data. The data subject’s right of access can be realised only if the data subject can be unambiguously identified from the provided responses.

Right to rectification 

The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. The data subject’s right to rectification can be realised only if the data subject can be unambiguously identified from the provided responses.

Right to object 

In situations where the processing of personal data is based on public interest, the exercise of official authority vested in the controller or the legitimate interest of the controller or a third party, the data subject has the right to object to the processing of personal data concerning him or her.

If a data subject uses his or her right to object, the controller must stop the processing of the personal data, unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

If personal data is processed for direct marketing purposes, the data subject has the right to object to the processing without any specific grounds. 

In situations where personal data is processed for statistical or research purposes, the data subject may object to the processing on grounds relating to his or her particular situation, in response to which the controller must stop processing the data subject’s data, unless the processing is necessary for performing a task carried out for reasons of public interest. 

Right to restriction of processing 

The data subject has the right to obtain from the controller restriction of processing if:

• the accuracy of the personal data is contested by the data subject;

• the processing is unlawful but the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

• the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defence of legal claims;

• the data subject has objected to the processing of the personal data pending the verification of whether the legitimate grounds of the controller override those of the data subject.

A demand based on the data subject’s right to restriction of processing can be realised only if the data subject can be unambiguously identified from the provided responses.

Right to data portability

The data subject has the right to receive the personal data concerning him or her, which he or she has provided to the controller, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent or on a contract and the processing is carried out by automated means.

Right to erasure 

In situations where the legal basis for the processing of personal data is something other than compliance with a legal obligation, public interest or the exercise of official authority vested in the controller, the data subject has the right to obtain from the controller the erasure of personal data concerning him or her. The requested data will be erased unless the controller has a legal basis for refusing to erase the data, such as a legal obligation to retain the data.

A demand based on the data subject’s right to erasure of processing can be realised only if the data subject can be unambiguously identified from the provided responses.

13.5.2025 TRAFICOM/309795/00.04.00.03/2023

Grounds for and purpose of the data processing

The Finnish Transport and Communications Agency (Traficom) is conducting, as part of a study on the future of nautical charting in Finland, a survey of the national hydrographers of the Baltic Sea and North Sea countries concerning the state of nautical charting in those countries. 

Participation in the survey is entirely voluntary. The survey does not request any confidential information.”

Data content

The data undergoing processing

The survey asks about the official production of paper and electronic nautical charts in the target countries, as well as the outlook for future production. It also asks for respondents’ views on the development of international and national regulation governing nautical charting. 

The survey is completed via a Webropol survey link, which will be sent by email to the persons responsible for hydrographic surveying in the target countries.

Webropol uses cookies that are necessary for the functioning of its service platform and uses them to collect the data listed below.

These cookies are related to monitoring the functionality and quality of the service. Webropol uses cookies to collect e.g. the following information:

• Operating system
• Browser version
• IP address
• Browser add-ons
• The number of times surveys have been opened during one week
• Page download time
• Incomplete responses

Traficom sends messages related to the survey via the service uutiskirjeet.traficom.fi.

The cookies used in the uutiskirjeet.traficom.fi service are technical cookies that enable the functionality of the service.

Sources of the processed data (where the data is received from)

Traficom receives information from data subjects themselves through a survey on the Webropol platform.

Storage period of personal data 

The responses collected via the Webropol survey are stored on Webropol’s server for the duration of the survey. After that, the responses are transferred to Traficom’s own server and deleted from the Webropol service. Webropol retains data collected via cookies for 14 days

Data processing

Recipients and categories of recipients of personal data (to whom personal data is disclosed)

Personal data is stored on the Webropol Oy (business ID FI17739602) service platform. Webropol Oy and Traficom have an agreement on processing personal data.

Processing of personal data on behalf of the controller

Webropol Oy (business ID FI17739602) acts as a processor and its subcontractors Telia Cygate Oy (business ID 0752421-0) and Qumio Ltd (business ID 2466203-3) as sub-processors. Webropol may not transfer personal data to third parties, except to specific subcontractors agreed upon by Webropol and Traficom. The following subcontractors may act as processors in accordance with the definition in the data protection regulation when serving as Webropol subcontractors to ensure and improve the development, usability and reliability of the system: Telia Cygate Oy (business ID 0752421-0) and Qumio Ltd (business ID 2466203-3).

In the service uutiskirjeet.traficom.fi, personal data is processed on behalf of Traficom by Liana Technologies (Koodiviidakko Oy, business ID 19399621). Personal data is processed on behalf of the controller only during the stages when the uutiskirjeet.traficom.fi service is used to send messages

Transfer of personal data to third countries outside the EU/EEA

The data will not be transferred outside the EU/EEA countries.

Automated decisionmaking and profiling

The processing of personal data does not involve automated decision-making or profiling.

Rights related to the processing of personal data 

About exercising rights 

You can exercise your rights by submitting a request to Traficom by email or post. The controller’s contact details are listed in this privacy statement under the section ‘Controller’s contact details’. 

The right to lodge a complaint with the supervisory authority 

If you believe that your personal data is being processed in violation of legislation, you may lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman
PO Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
tel. +358 29 566 6700

Rights

Right of access

The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her is being processed. If processing takes place, the data subject has the right to access the personal data. 

Right to rectification 

The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her.

Right to object 

In situations where the processing of personal data is based on public interest, the exercise of official authority vested in the controller or the legitimate interest of the controller or a third party, the data subject has the right to object to the processing of personal data concerning him or her.

If a data subject uses his or her right to object, the controller must stop the processing of the personal data, unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

If personal data is processed for direct marketing purposes, the data subject has the right to object to the processing without any specific grounds. 

In situations where personal data is processed for statistical or research purposes, the data subject may object to the processing on grounds relating to his or her particular situation, in response to which the controller must stop processing the data subject’s data, unless the processing is necessary for performing a task carried out for reasons of public interest. 

Right to restriction of processing 

The data subject has the right to obtain from the controller restriction of processing if:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful but the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defence of legal claims;
• the data subject has objected to the processing of the personal data pending the verification of whether the legitimate grounds of the controller override those of the data subject.

Right to data portability

The data subject has the right to receive the personal data concerning him or her, which he or she has provided to the controller, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent or on a contract and the processing is carried out by automated means.

Right to erasure 

In situations where the legal basis for the processing of personal data is something other than compliance with a legal obligation, public interest or the exercise of official authority vested in the controller, the data subject has the right to obtain from the controller the erasure of personal data concerning him or her. The requested data will be erased unless the controller has a legal basis for refusing to erase the data, such as a legal obligation to retain the data.

Right to withdraw consent

Insofar as personal data is processed on the basis of the consent of the data subject, the data subject may withdraw his or her consent at any time by notifying the controller of the withdrawal. Withdrawing consent will not affect the lawfulness of processing carried out on the basis of the consent of the data subject before its withdrawal.

22.10.2025 TRAFICOM/731920/00.04.00.03/2025

Grounds for and purpose of the data processing

The data is processed as part of a master’s thesis carried out by a student at Aalto University, commissioned by Traficom. The assignment examines what factors influence the choice of parking location. The results of the study will be used as input for the development of the Finnish National Transport Model, with the aim of enabling assessment of the impacts of parking-related plans and decisions in the future.

Personal data will be processed for the purpose of fulfilling the Finnish Transport and Communications Agency’s (Traficom) statutory task of com-prehensive monitoring of the transport system, as laid down in the Act on the Finnish Transport and Communications Agency (935/2018, Section 2, subsection 2). Under the Act, Traficom coordinates and supervises the preparation and implementation of national transport system planning, and produces and maintains strategic programmes, measures, and a national-level situation overview for the various stakeholders of the transport system. 

Furthermore, the Act on Transport Services (320/2017, Section 179) obliges Traficom to assesses the effectiveness of the transport system and the impacts of the Act and regularly report on the status of the transport system. 

The assignment implements planning and monitoring tasks provided by law, and processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority (General Data Protection Regulation, Article 6(1)(e) and Data Protection Act, Section 4(1)(2)).

Data content

The data undergoing processing

The group of data subjects consists of the respondents to the survey. The study collects information on the parking choices of employed persons through a Webropol survey.

The categories of personal data processed are the survey’s cookie data. The questionnaire also collects information about respondents, but this information cannot be linked to individual respondents.

Through cookies, Webropol collects, among other things, the following data:

• Operating system
• Browser version
• IP address
• Browser add-ons
• Number of times surveys have been opened during a week
• Page loading time
• Incomplete responses

Cookies are used only for monitoring the functionality and quality of the questionnaire. They are stored for 14 days.

The questionnaire collects the following information about respondents:

• Workplace located in Helsinki, Espoo, or Vantaa (Yes/No)
• Age group (18–34, 35–54, over 55)
• Gender (Male, Female, Other or Prefer not to answer)
• Personal income (0–29,999 euros per year; 30,000–59,999 euros per year; over 60,000 euros per year; Prefer not to say)
• Education (Basic, Secondary, Higher education)
• Driving licence (Yes/No)
• Number of cars in the household (0, 1, 2 or more)

Answers given in the questionnaire cannot be linked to individual respondents, but the principles of personal data processing are applied also in relation to these answers.

The questionnaire does not include open-ended questions where directly identifying information could accidentally be provided. The study does not collect data from persons under 18 years of age.

Sources of the processed data (where the data is received from)

The source of personal data is the Webropol questionnaire completed by the respondent. The questionnaire is distributed to respondents either through employers who voluntarily participate in the study or via an open research invitation shared online. The invitations and the questionnaire do not contain any information identifying the employers, and therefore the employer cannot be linked to the responses provided.

Storage period of personal data

Personal data will be retained until the end of 2026, after which the data will be deleted by overwriting.

Data processing

Recipients and categories of recipients of personal data (to whom personal data is disclosed)

Personal data will not be shared with third parties. The survey dataset will be processed exclusively by the data processor for the purpose of completing the assignment.

Processing of personal data on behalf of the controller

The personal data processors are Webropol Oy (Business ID: FI17739602), Aalto University (Business ID: 2228357-4), and the master’s thesis author Ville Isoranta (Aalto University).

Personal data are collected using Webropol Oy’s survey form, in which the survey responses are stored. Webropol’s subcontractors, for the purposes of system development, usability, reliability, and improvement, are Telia Cygate (Business ID: 0752421-0) and Qumio Oy (Business ID: 2466203-3). Webropol Oy and Traficom have an agreement concerning the processing of personal data.

The research data are stored and processed on Aalto University’s secure storage (Secwork), located in a disk service owned by Aalto University, either in its own or a university-leased data center. Access to the storage is only possible within the university network. All file operations on the storage are logged.

Analysis of the research data and reporting is carried out by the master’s thesis author Ville Isoranta (ville.isoranta@aalto.fi). The thesis supervisor at Aalto University is Shaya Vosough (shaghayegh.vosough@aalto.fi).

Transfer of personal data to third countries outside the EU/EEA

Data will not be transferred outside the EU/EEA countries.

Automated decision-making and profiling

Personal data processing does not include any automated decision-making or profiling.

Rights related to the processing of personal data

About exercising rights

You can exercise your rights by submitting a request to Traficom by email or post. The controller’s contact details are listed in this privacy statement under the section ‘Controller’s contact details’. 

The right to lodge a complaint with the supervisory authority 

If you believe that your personal data is being processed in violation of legislation, you may lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman
PO Box 800, FI-00531 Helsinki
tietosuoja@om.fi
tel. +358 29 566 6700

Rights

Right of access

The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her is being processed. If processing takes place, the data subject has the right to access the personal data. 

Right to rectification 

The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her.

Right to object 

In situations where the processing of personal data is based on public interest, the exercise of official authority vested in the controller or the legitimate interest of the controller or a third party, the data subject has the right to object to the processing of personal data concerning him or her.

If a data subject uses his or her right to object, the controller must stop the processing of the personal data, unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

If personal data is processed for direct marketing purposes, the data subject has the right to object to the processing without any specific grounds. 

In situations where personal data is processed for statistical or research purposes, the data subject may object to the processing on grounds relating to his or her particular situation, in response to which the controller must stop processing the data subject’s data, unless the processing is necessary for performing a task carried out for reasons of public interest. 

Right to restriction of processing 

The data subject has the right to obtain from the controller restriction of processing if:

• the accuracy of the personal data is contested by the data subject;

• the processing is unlawful but the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

• the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defence of legal claims;

• the data subject has objected to the processing of the personal data pending the verification of whether the legitimate grounds of the controller override those of the data subject.

Right to data portability

The data subject has the right to receive the personal data concerning him or her, which he or she has provided to the controller, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent or on a contract and the processing is carried out by automated means.

Right to erasure

In situations where the legal basis for the processing of personal data is something other than compliance with a legal obligation, public interest or the exercise of official authority vested in the controller, the data subject has the right to obtain from the controller the erasure of personal data concerning him or her. The requested data will be erased unless the controller has a legal basis for refusing to erase the data, such as a legal obligation to retain the data.

Right to withdraw consent

Insofar as personal data is processed on the basis of the consent of the data subject, the data subject may withdraw his or her consent at any time by notifying the controller of the withdrawal. Withdrawing consent will not affect the lawfulness of processing carried out on the basis of the consent of the data subject before its withdrawal.

27.8.2025 281314/04.04.08.05/2025

Grounds for and purpose of the data processing

The processing of personal data is based on the performance of a task related to the general interest of the data controller (General Data Protection Regulation (2016/679) Article 6, Paragraph 1 Subsection e and Data Protection Act (1050/2018) § 4).

With the help of an Air Transport market mapping survey, Traficom is looking for possible way, using the views and opinions of the respondents, to make the operation of the Helsinki-Savonlinna route most efficient and customer-friendly.

Data content

The data undergoing processing

The survey is conducted anonymously. The survey does not ask for information about the identity of the respondents, and the data subject is asked not to provide any identifying personal information. When answering a survey, the respondent's IP address is forwarded, but Traficom is basically unable to connect IP addresses to individual answers.

Webropol uses cookies to collect, among other things, the following information:

• Operating system
• Browser version
• IP address
• browser add-ons
• how many times the form has been opened during the week
• page load time
• incomplete answers

Sources of the processed data (where the data is received from)

Questionnaires on the Webropol platform are used as the data source, the link of which will be sent by email to Air Operators.

Storage period of personal data 

Data will be stored until the end of 2026 at most.

Data processing

Recipients and categories of recipients of personal data (to whom personal data is disclosed)

Personal data is stored on the service platform of Webropol Oy (ID: FI17739602). Webropol Oy and the agency have an agreement on the processing of personal data.

Processing of personal data on behalf of the controller

When answering a survey, the respondent's IP address is forwarded, but Traficom is fundamentally unable to connect IP addresses to individual answers. Webropol may not transfer personal data to third parties, except to subcontractors that the agency and Webropol have agreed upon. The following subcontractors can be processors according to the definition of data protection regulation when acting as Webropol's subcontractors in order to guarantee and improve the development work, usability and reliability of the system: Telia Cygate Oy (business ID: 0752421-0) and Qumio Oy (business ID 2466203-3).

Transfer of personal data to third countries outside the EU/EEA

Data is not transferred outside the EU/EEA countries.

Automated decisionmaking and profiling

Data processing does not include automatic decision-making or profiling.

Rights related to the processing of personal data 

About exercising rights 

You can exercise your rights by submitting a request to Traficom by email or post. The controller’s contact details are listed in this privacy statement under the section ‘Controller’s contact details’. 

The right to lodge a complaint with the supervisory authority 

If you believe that your personal data is being processed in violation of legislation, you may lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman
PO Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
tel. +358 29 566 6700

Rights

Right of access

The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her is being processed. If processing takes place, the data subject has the right to access the personal data.

When answering the Air Transport market mapping study, personal information that identifies the respondent is not requested and the survey is answered anonymously. The data subject's right to access their own data can only be exercised when the data subject can be unequivocally identified from the answers given.

Right to rectification 

When answering the Air Transport market mapping study, no personal information identifying the respondent is requested and the survey is answered anonymously. The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her.

Right to object 

In situations where the processing of personal data is based on public interest, the exercise of official authority vested in the controller or the legitimate interest of the controller or a third party, the data subject has the right to object to the processing of personal data concerning him or her.

If a data subject uses his or her right to object, the controller must stop the processing of the personal data, unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

If personal data is processed for direct marketing purposes, the data subject has the right to object to the processing without any specific grounds. 

In situations where personal data is processed for statistical or research purposes, the data subject may object to the processing on grounds relating to his or her particular situation, in response to which the controller must stop processing the data subject’s data, unless the processing is necessary for performing a task carried out for reasons of public interest. 

Right to restriction of processing 

The data subject has the right to obtain from the controller restriction of processing if:

• the accuracy of the personal data is contested by the data subject;

• the processing is unlawful but the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

• the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defence of legal claims;

• the data subject has objected to the processing of the personal data pending the verification of whether the legitimate grounds of the controller override those of the data subject.

Right to data portability

The data subject has the right to receive the personal data concerning him or her, which he or she has provided to the controller, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent or on a contract and the processing is carried out by automated means.

Right to erasure 

In situations where the legal basis for the processing of personal data is something other than compliance with a legal obligation, public interest or the exercise of official authority vested in the controller, the data subject has the right to obtain from the controller the erasure of personal data concerning him or her. The requested data will be erased unless the controller has a legal basis for refusing to erase the data, such as a legal obligation to retain the data.

Right to withdraw consent

Insofar as personal data is processed on the basis of the consent of the data subject, the data subject may withdraw his or her consent at any time by notifying the controller of the withdrawal. Withdrawing consent will not affect the lawfulness of processing carried out on the basis of the consent of the data subject before its withdrawal.

17.12.2024 TRAFICOM/702279/00.04.00.03/2024

Grounds for and purpose of the data processing

The duties of the Finnish Transport and Communications Agency Traficom include monitoring the maritime market. As part of its maritime market monitoring, Traficom conducts the Maritime Barometer survey, which is targeted at the management of companies operating in Finland’s maritime market. The target group includes, for example, shipping companies, ports, and shipbrokers. Responses given in the survey are treated confidentially, and results are reported only in aggregate form so that individual respondents cannot be identified.

Participation in the survey is entirely voluntary. The survey does not request any confidential information.

Data content

The data undergoing processing

The survey gathers the target group companies’ views on developments in the maritime sector: both short-term economic and market outlooks as well as longer-term trends of change, such as the propulsion transition and the green transition.

The survey is completed via a Webropol survey link, which will be sent by email to companies in the target group.

Webropol uses cookies that are necessary for the functioning of its service platform and uses them to collect the data listed below.

These cookies are related to monitoring the functionality and quality of the service. Webropol uses cookies to collect e.g. the following information:

• Operating system
• Browser version
• IP address
• Browser add-ons
• The number of times surveys have been opened during one week
• Page download time
• Incomplete responses

Traficom sends messages related to the survey via the service uutiskirjeet.traficom.fi.

The cookies used in the uutiskirjeet.traficom.fi service are technical cookies that enable the functionality of the service.

Sources of the processed data (where the data is received from)

Traficom receives information from data subjects themselves through a survey on the Webropol platform.

Storage period of personal data 

The responses collected via the Webropol survey are stored on Webropol’s server for the duration of the survey. After that, the responses are transferred to Traficom’s own server and deleted from the Webropol service. 

Webropol retains data collected via cookies for 14 days.

Data processing

Recipients and categories of recipients of personal data (to whom personal data is disclosed)

Personal data is stored on the Webropol Oy (business ID FI17739602) ser-vice platform. Webropol Oy and Traficom have an agreement on processing personal data.

Processing of personal data on behalf of the controller

Webropol Oy (business ID FI17739602) acts as a processor and its subcontractors Telia Cygate Oy (business ID 0752421-0) and Qumio Ltd (business ID 2466203-3) as sub-processors. Webropol may not transfer personal data to third parties, except to specific subcontractors agreed upon by Webropol and Traficom. The following subcontractors may act as processors in accordance with the definition in the data protection regulation when serving as Webropol subcontractors to ensure and improve the development, usability and reliability of the system: Telia Cygate Oy (business ID 0752421-0) and Qumio Ltd (business ID 2466203-3).

In the service uutiskirjeet.traficom.fi, personal data is processed on behalf of Traficom by Liana Technologies (Koodiviidakko Oy, business ID 19399621). Personal data is processed on behalf of the controller only during the stages when the uutiskirjeet.traficom.fi service is used to send messages.

Transfer of personal data to third countries outside the EU/EEA

The data will not be transferred outside the EU/EEA countries.

Automated decision-making and profiling

The processing of personal data does not involve automated decision-making or profiling.

Rights related to the processing of personal data 

About exercising rights 

You can exercise your rights by submitting a request to Traficom by email or post. The controller’s contact details are listed in this privacy statement under the section ‘Controller’s contact details’.

The right to lodge a complaint with the supervisory authority 

If you believe that your personal data is being processed in violation of legislation, you may lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman
PO Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
tel. +358 29 566 6700

Rights

Right of access

The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her is being processed. If processing takes place, the data subject has the right to access the personal data. 

Right to rectification 

The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her.

Right to object 

In situations where the processing of personal data is based on public interest, the exercise of official authority vested in the controller or the legitimate interest of the controller or a third party, the data subject has the right to object to the processing of personal data concerning him or her.

If a data subject uses his or her right to object, the controller must stop the processing of the personal data, unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

If personal data is processed for direct marketing purposes, the data subject has the right to object to the processing without any specific grounds. 

In situations where personal data is processed for statistical or research purposes, the data subject may object to the processing on grounds relating to his or her particular situation, in response to which the controller must stop processing the data subject’s data, unless the processing is necessary for performing a task carried out for reasons of public interest. 

Right to restriction of processing 

The data subject has the right to obtain from the controller restriction of processing if:

• the accuracy of the personal data is contested by the data subject;
• the processing is unlawful but the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defence of legal claims;
• the data subject has objected to the processing of the personal data pending the verification of whether the legitimate grounds of the controller override those of the data subject.

Right to data portability

The data subject has the right to receive the personal data concerning him or her, which he or she has provided to the controller, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent or on a contract and the processing is carried out by automated means.

Right to erasure 

In situations where the legal basis for the processing of personal data is something other than compliance with a legal obligation, public interest or the exercise of official authority vested in the controller, the data subject has the right to obtain from the controller the erasure of personal data concerning him or her. The requested data will be erased unless the controller has a legal basis for refusing to erase the data, such as a legal obligation to retain the data.

Right to withdraw consent

Insofar as personal data is processed on the basis of the consent of the data subject, the data subject may withdraw his or her consent at any time by notifying the controller of the withdrawal. Withdrawing consent will not affect the lawfulness of processing carried out on the basis of the consent of the data subject before its withdrawal.

5.1.2026 TRAFICOM/4504/00.04.00.03/2026

Grounds for and purpose of the data processing

This privacy notice concerns the processing of the research register for the Long-Distance Public Transport Travel Surveys conducted at airports, railway stations, and bus terminals. The research register consists of responses provided by participants in the survey. A personal data register is created in the study, as it contains coordinate data that enables the indirect identification of individuals.

Personal data are processed to carry out the Finnish Transport and Communications Agency’s statutory task of comprehensive monitoring of the transport system, as provided in the Act on the Finnish Transport and Communications Agency (935/2018, Section 2, Subsection 2). Under this provision, the Finnish Transport and Communications Agency coordinates and supervises the preparation and implementation of national transport system planning, and produces and maintains national-level strategic programmes, sets of measures, and situational information for various transport system actors. The Act on Transport Services (320/2017, Section 179) also requires the Finnish Transport and Communications Agency to assess the functioning of the transport system and the effects of this Act, and to report regularly on the state of the transport system. 

The study fulfils statutory planning duties, and the processing of personal data is necessary and proportionate for performing a task carried out in the public interest within the activities of a public authority (Regulation (EU) 2016/679, Article 6(1)(e), Data Protection Act 1050/2018, Section 4(1)(2)).

The study provides essential background information for transport planning, the development of transport services, and transport policy. The data produced by the study are used to describe the current state of transport services and to develop a national transport model. The transport model enables the preparation of long-term forecasts for passenger and freight transport and supports the assessment of the impacts of programmes and measures. The preparation of the model is based on an assignment given to the Finnish Transport and Communications Agency Traficom by the Ministry of Transport and Communications.

Data content

The data undergoing processing

The data subjects of the study are public transport passengers who participate in the survey and submit the electronic questionnaire. 

The categories of data collected consist of the following survey responses:

• Respondent information: Age, Gender, Place of residence (municipality / coordinate), Type of dwelling, Driving license, Car ownership, Income level (categorised), Education (categorised), Main activity (categorised).
• Travel information: Location of origin and destination (municipality / coordinate), Purpose of the trip, Type of destination, Overnight stays at the destination, Mode of transport, Size of the travel party, Travel cost, Connecting modes of transport, Additional services included in the ticket, and Time of ticket purchase.

The research register does not contain any personal data that would enable direct identification, nor open-ended responses through which such data could be provided. The register does not contain sensitive personal data. Participation in the survey is voluntary.

Sources of the processed data (where the data is received from)

The research register is formed based on the responses provided by participants through the electronic questionnaire or direct interviews.

The research register may be supplemented with data that are not personal data and do not require the combination of personal data registers. Location-based data from the transport model or regional registers are linked to the research register. Such data include, for example, municipal groupings, regional divisions of the urban structure, and travel times by public transport or by car.

Storage period of personal data 

The personal data in the research register will be retained until further notice. The study will not be repeated, and therefore the research register is needed for long-term updates of transport models and the development of transport services.

Data processing

Recipients and categories of recipients of personal data (to whom personal data is disclosed)

During the research process, the research register is managed by the data processor (Taloustutkimus Oy), and personal data are not disclosed to external parties.

After the completion of the research process, the research register is retained by the data controller. Individual-level data may be disclosed for a justified and credible reason to the following entities: universities and higher education institutions, research institutes conducting academic research, state and municipal authorities, and service providers acting on behalf of the data controller. Any disclosure of data requires a research plan and a data permit.

Anonymised data (categorised) may be shared with actors working in the transport sector, such as planners, experts, or researchers. The anonymised dataset does not contain personal data that would allow direct or indirect identification of individuals.

Statistical reports and tabulations are published based on the research register, from which individual respondents cannot be identified. The published reports are publicly available.

Processing of personal data on behalf of the controller

During the research process, the data processor acting on behalf of the data controller is Taloustutkimus Oy (Business ID 0114711-9), until 1 September 2026.

After the completion of the research process, the research register may be processed under Traficom’s commissioned service assignments for the performance of Traficom’s statutory duties. In such commissioned service assignments, it must be ensured on a case-by-case basis that individual-level data are processed only for a justified reason, solely for the purposes specified in this notice, and only to the extent necessary.

Transfer of personal data to third countries outside the EU/EEA

The data controller and the data processor do not transfer personal data outside the EU or the EEA.

Automated decisionmaking and profiling

The study does not involve automated decision-making or profiling.

Rights related to the processing of personal data 

About exercising rights 

You can exercise your rights by submitting a request to Traficom by email or post. The controller’s contact details are listed in this privacy statement under the section ‘Controller’s contact details’.

The right to lodge a complaint with the supervisory authority 

If you believe that your personal data is being processed in violation of legislation, you may lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

PO Box 800, FI-00531 Helsinki

tietosuoja(at)om.fi

tel. +358 29 566 6700

Rights

Right of access

The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her is being processed. If processing takes place, the data subject has the right to access the personal data. 

The study does not collect personal data that would enable the direct identification of respondents or allow their identity to be unequivocally determined. Therefore, the data subject’s right to access their own data cannot be fulfilled after the questionnaire has been submitted.

Right to rectification 

The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her.

The study does not collect personal data that would enable the direct identification of respondents or allow their identity to be unequivocally determined. Therefore, the data subject’s right to access their own data cannot be fulfilled after the questionnaire has been submitted.

Right to object 

In situations where the processing of personal data is based on public interest, the exercise of official authority vested in the controller or the legitimate interest of the controller or a third party, the data subject has the right to object to the processing of personal data concerning him or her.

If a data subject uses his or her right to object, the controller must stop the processing of the personal data, unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

If personal data is processed for direct marketing purposes, the data subject has the right to object to the processing without any specific grounds. 

In situations where personal data is processed for statistical or research purposes, the data subject may object to the processing on grounds relating to his or her particular situation, in response to which the controller must stop processing the data subject’s data, unless the processing is necessary for performing a task carried out for reasons of public interest. 

The study does not collect personal data that would enable the direct identification of respondents or allow their identity to be unequivocally determined. Therefore, the data subject’s right to access their own data cannot be fulfilled after the questionnaire has been submitted.

Right to restriction of processing 

The data subject has the right to obtain from the controller restriction of processing if:

• the accuracy of the personal data is contested by the data subject;

• the processing is unlawful but the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

• the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defence of legal claims;

• the data subject has objected to the processing of the personal data pending the verification of whether the legitimate grounds of the controller override those of the data subject.

The study does not collect personal data that would enable the direct identification of respondents or allow their identity to be unequivocally determined. Therefore, the data subject’s right to access their own data cannot be fulfilled after the questionnaire has been submitted.

Right to data portability

The data subject has the right to receive the personal data concerning him or her, which he or she has provided to the controller, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent or on a contract and the processing is carried out by automated means.

This right does not apply to the processing activities in question, as personal data are not processed on the basis of consent or a contract.

Right to erasure 

In situations where the legal basis for the processing of personal data is something other than compliance with a legal obligation, public interest or the exercise of official authority vested in the controller, the data subject has the right to obtain from the controller the erasure of personal data concerning him or her. The requested data will be erased unless the controller has a legal basis for refusing to erase the data, such as a legal obligation to retain the data.

This right does not apply to the processing activities in question, as personal data are not processed on the basis of consent or a contract.

Right to withdraw consent

Insofar as personal data is processed on the basis of the consent of the data subject, the data subject may withdraw his or her consent at any time by notifying the controller of the withdrawal. Withdrawing consent will not affect the lawfulness of processing carried out on the basis of the consent of the data subject before its withdrawal.

This right does not apply to the processing activities in question, as personal data are not processed on the basis of consent or a contract.

24.11.2025 TRAFICOM/181444/02.03.01/2025 & TRAFICOM/181422/02.03.01/2025

Grounds for and purpose of the data processing

The Finnish Transport and Communications Agency Traficom will carry out, as in previous years, a voluntary evaluation of fi-domain name registrars in 2025. The evaluation will be conducted as a self-assessment completed by the registrar using a Webropol form.

Participation in the evaluation is entirely voluntary and free of charge for the participating registrar. Registrars have had the opportunity to register in advance as part of the survey’s target group.

The evaluation criteria will be scored, and the total score will be converted into a star rating from 0 to 5 stars. The star classification will be published in Traficom’s registrar search. 

Private individuals acting as registrars cannot participate in the evaluation, as data protection regulations prevent us from publishing their results in the public registrar search.

Data content

The data undergoing processing

In the survey, domain name registrars are asked to evaluate the content of their own websites. The survey is completed via a Webropol link, which is sent to those registrars who have preegistered for the self-assessment survey.

Webropol uses cookies that are necessary for the functioning of its service platform and uses them to collect the data listed below.

These cookies are related to monitoring the functionality and quality of the service. Webropol uses cookies to collect e.g. the following information:

• Operating system
• Browser version
• IP address
• Browser add-ons
• The number of times surveys have been opened during one week
• Page download time
• Incomplete responses

Traficom sends messages related to the survey via the service uutiskirjeet.traficom.fi.

The cookies used in the uutiskirjeet.traficom.fi service are technical cookies that enable the functionality of the service.

Sources of the processed data (where the data is received from)

Traficom receives information from data subjects themselves through a survey on the Webropol platform.

Storage period of personal data 

The responses collected via the Webropol survey are stored on Webropol’s server for the duration of the survey. After that, the responses are transferred to Traficom’s own server and deleted from the Webropol service. Webropol retains data collected via cookies for 14 days

Data processing

Recipients and categories of recipients of personal data (to whom personal data is disclosed)

Personal data is stored on the Webropol Oy (business ID FI17739602) service platform. Webropol Oy and Traficom have an agreement on processing personal data.

Processing of personal data on behalf of the controller

Webropol Oy (business ID FI17739602) acts as a processor and its subcontractors Telia Cygate Oy (business ID 0752421-0) and Qumio Ltd (business ID 2466203-3) as sub-processors. Webropol may not transfer personal data to third parties, except to specific subcontractors agreed upon by Webropol and Traficom. The following subcontractors may act as processors in accordance with the definition in the data protection regulation when serving as Webropol subcontractors to ensure and improve the development, usability and reliability of the system: Telia Cygate Oy (business ID 0752421-0) and Qumio Ltd (business ID 2466203-3).

In the service uutiskirjeet.traficom.fi, personal data is processed on behalf of Traficom by Liana Technologies (Koodiviidakko Oy, business ID 19399621). Personal data is processed on behalf of the controller only during the stages when the uutiskirjeet.traficom.fi service is used to send messages

Transfer of personal data to third countries outside the EU/EEA

The data will not be transferred outside the EU/EEA countries.

Automated decisionmaking and profiling

The processing of personal data does not involve automated decision- making or profiling.

Rights related to the processing of personal data 

About exercising rights 

You can exercise your rights by submitting a request to Traficom by email or post. The controller’s contact details are listed in this privacy statement under the section ‘Controller’s contact details’. 

The right to lodge a complaint with the supervisory authority 

If you believe that your personal data is being processed in violation of legislation, you may lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman
PO Box 800, FI-00531 Helsinki
tietosuoja(at)om.fi
tel. +358 29 566 6700

Rights

Right of access

The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her is being processed. If processing takes place, the data subject has the right to access the personal data. 

Right to rectification 

The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her.

Right to object 

In situations where the processing of personal data is based on public interest, the exercise of official authority vested in the controller or the legitimate interest of the controller or a third party, the data subject has the right to object to the processing of personal data concerning him or her.

If a data subject uses his or her right to object, the controller must stop the processing of the personal data, unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

If personal data is processed for direct marketing purposes, the data subject has the right to object to the processing without any specific grounds. 

In situations where personal data is processed for statistical or research purposes, the data subject may object to the processing on grounds relating to his or her particular situation, in response to which the controller must stop processing the data subject’s data, unless the processing is necessary for performing a task carried out for reasons of public interest. 

Right to restriction of processing 

The data subject has the right to obtain from the controller restriction of processing if:

• the accuracy of the personal data is contested by the data subject;

• the processing is unlawful but the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

• the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defence of legal claims;

• the data subject has objected to the processing of the personal data pending the verification of whether the legitimate grounds of the controller override those of the data subject.

Right to data portability

The data subject has the right to receive the personal data concerning him or her, which he or she has provided to the controller, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent or on a contract and the processing is carried out by automated means.

Right to erasure 

In situations where the legal basis for the processing of personal data is something other than compliance with a legal obligation, public interest or the exercise of official authority vested in the controller, the data subject has the right to obtain from the controller the erasure of personal data concerning him or her. The requested data will be erased unless the controller has a legal basis for refusing to erase the data, such as a legal obligation to retain the data.

Right to withdraw consent

Insofar as personal data is processed on the basis of the consent of the data subject, the data subject may withdraw his or her consent at any time by notifying the controller of the withdrawal. Withdrawing consent will not affect the lawfulness of processing carried out on the basis of the consent of the data subject before its withdrawal.

29.4.2025 TRAFICOM/240586/00.04.00.03/2025