Finnish Composers’ Copyright Society Teosto (“Teosto”) is a copyright society for composers, lyricists, arrangers and music publishers. We wish to support our members and the whole music sector during this difficult time by granting financial coronavirus support.

Teosto is committed to protecting the privacy of the applicants of the coronavirus support and processes their personal data in accordance with applicable data protection legislation. In this privacy policy we provide further information on:

• How to contact us regarding the processing of your personal data;
• What data we collect and how we collect it;
• The purpose for which the data is used and the legal grounds for the processing;
• For how long the data is stored;
• To whom the data is disclosed and transferred;
• Our data security;
• The rights of the data subject.

1. Contact Information

Teosto is the data controller for the processing of personal data in accordance with this privacy policy.

Data controller:

Finnish Composers’ Copyright Society Teosto (Business ID: 0117040-7) Keilasatama 2 A, 02150 Espoo, Finland

You can contact us by e-mail at dataprivacy@teosto.fi for information about processing your personal data.

2. Data We Are Processing and How We Collect It

We process the following data concerning applicants of the coronavirus support:

• Name of applicant or applicant’s representative
• Social security number, if the applicant is a person
• FO-number, if the applicant is an organisation
• Language
• Address, phone number and e-mail
• Bank details
• Teosto’s member number
• Royalties that the applicant has received from Teosto
• Result of the application (approved/denied)
• Amount granted
• Fund through which the support is granted
• Possible messages from the applicant and any data included in such messages
• Information related to the use of the application page of the coronavirus support, such as IP-address, browser information and loaded pages

All data is collected from the applicant him- or herself, except for information about the applicant’s Teosto royalties. We retrieve such information from Teosto’s internal databases.

3. Legal Grounds and Purpose of the Processing

We process personal data for the following purposes:

• The application process of the coronavirus support, including receiving and reviewing applications and payment of granted support;
• Customer service related to the coronavirus support;
• Fulfilling our legal obligations and rights;
• Teosto’s internal book-keeping of granted financial support; and
• Maintenance of the coronavirus support application page.

The processing of personal data is based on Teosto’s legitimate interest, the consent of the applicant or Teosto’s legal obligation.

When personal data is processed based on legitimate interest, a balance must be struck between the interest of the applicant and Teosto’s interests. According to Teosto’s statutes, Teosto shall promote creative Finnish music and its general conditions. Teosto does so by, for example, granting composers, lyricists, arrangers and music publishers financial coronavirus support upon application. The balance between the rights of Teosto and those of the applicant has been ensured, for example, in the following way:

• Teosto only collect necessary personal data;
• Personal data and especially sensitive data, such as social security numbers, is processed as restrictively as possible and only stored for as long as necessary; and
• Teosto does not process special categories of data.

4. Data Storage Time

We process and store data only for as long as it is necessary for the purposes defined above. Factors that affect the actual storage time are, amongst others, the result of the application (approved/denied), possible disagreements and Teosto’s accounting and other legal obligations.

5. Transfers and Disclosure of Personal Data

Teosto discloses and transfers your personal data mainly as described below:

• Publication of granted applications: We may publish granted applications, for example, on our own or on our member organisations’/partner organisations’ websites in accordance with applicable data protection legislation, if Teosto is obliged to do so or otherwise at Teosto’s discretion.
• Subcontractors: We use subcontractors for the processing of personal data for and on behalf of Teosto. We have ensured by contractual arrangements that the subcontractor will process personal data in accordance with applicable law.
• Member and partner organisations: We may transfer personal data to Teosto’s member organisations and other partner organisations in accordance with applicable data protection legislation, if such transfer is necessary for the application or payment process of the coronavirus support.
• Authorities: We may disclose your personal data to the competent authorities (such as the Tax Administration) in a manner required by applicable law.
• Mergers and acquisitions: If we sell, merge or otherwise arrange our business, your personal data may be disclosed to the parties of the arrangement.
• Enforcement and legal claims: We may disclose your personal data to third parties if it is necessary for the enforcement of an agreement, collection of receivables, an investigation of possible infringement, or for the enforcement of rights.

Disclosures and transfers outside the EU and the EEA. As a rule, we do not transfer personal data outside the EU or the EEA. If Teosto or our subcontractor, for example, uses a subcontractor outside the EU or the EEA, we will comply with safeguards and transfer criteria laid down in applicable data protection legislation.

6. Data Security

Teosto processes your personal data in a secure manner and uses appropriate organisational and technical data security tools to protect your personal data. Teosto applies Teosto’s own security policy in regard to data security. Please see the following link for more information (in Finnish): https://www.teosto.fi/tietoturvapolitiikka/.

7. Rights of the Data Subject

As a data subject, you have certain legal rights in relation to the processing of your personal data. You can currently influence the processing of your personal data as follows:

• Checking, correcting and deleting data: You have the right to examine your personal data stored by us. Upon your request, we correct, complete, or delete any faulty, incomplete or outdated personal data. You have the right to request the removal of your personal data (“right to be forgotten”) in accordance with applicable data protection legislation.
• Transfer of data: You may ask to have any personal data that we automatically process based on your consent or an agreement transferred by contacting Teosto.
• Withdrawal of consent: You may withdraw your consent at any time by contacting Teosto or through other specially provided means. Withdrawal of consent does not affect the legality of measures taken before the withdrawal.
• The right to object direct marketing and profiling: You can at any time prohibit the processing of your personal data for direct marketing and related profiling by clicking on the link at the end of the message or by contacting Teosto.
• Objection and restriction right: You may object to processing of personal data that is based on legitimate interest on grounds relating to your particular situation. In such a case, the processing of personal data is restricted during the evaluation of such grounds. Processing can also be restricted if, for example, the data subject disputes the accuracy of their personal data, whereby the processing is restricted while we verify the accuracy of such data.
• Right to complaint: You can file a complaint with the authority if you consider that your data has been processed contrary to this privacy policy or applicable law. The contact details of the supervisory authority can be found at www.tietosuoja.fi/en.