The Regional Council of Southwest Finland processes personal data in order to fulfill our duties and serve the municipalities, partners, and clients of the region. On this page, you will find information about what data is collected about you and what your rights are.
If you wish to receive information about the processing of your personal data, please contact the Regional Council of Southwest Finland’s registry office, and we will direct your inquiry to the appropriate person.
As a data subject, you have the right to know whether data concerning you is being processed at the Regional Council of Southwest Finland. We are obligated to provide you with access to your personal data, for example, as copies of your documents.
Please note that your right is personal and that you will need to authenticate yourself either through an electronic form or in person when making your request. You will receive detailed instructions for making the request from the Regional Council of Southwest Finland’s registry office.
You have the right to rectify inaccurate and incorrect data concerning you. If you believe that your data needs to be corrected, you may submit a request in free form to the Regional Council of Southwest Finland. In your request, you must specify and justify what information you require to be corrected. Additionally, state what you believe is the correct information and how you request the correction to be made. If we do not accept the request for rectification, we will provide you with a written response explaining why we could not accept your request.
In certain cases, you have the right to require the Regional Council of Southwest Finland to erase your data from its register. However, this right does not apply when the processing of personal data is based on law or the exercise of public authority.
You do not have the right to require us to transfer your data from one system to another when the processing of personal data is based on law.
You have the right to be informed of a data breach when a personal data breach is likely to result in a high risk to your rights and freedoms.
You have the right to bring the matter before the Data Protection Ombudsman if you believe that the processing of personal data concerning you violates applicable legislation. Follow the Data Protection Ombudsman’s instructions when lodging a complaint.
In certain cases, you may require that your data not be processed when you contest the accuracy of the data.
In specific situations, you have the right to object to automated individual decision-making, including profiling. The Regional Council of Southwest Finland does not conduct profiling or automated decision-making.
The use of data is based on laws and sometimes also on your consent. We collect only what we need: typically name and contact information, as well as essential information related to services.
We retain your personal data for the period required by various laws. The Regional Council of Southwest Finland defines retention periods in its information management plan and operating instructions. The determination of retention periods is based on, among other things, the National Archives’ decisions on permanently preserved documents and the recommendations of the Information Management Board on document retention periods.
In certain cases, data may be disclosed to third parties, such as various authorities to whom we have a statutory obligation to disclose information.
We disclose personal data to parties that process data on our behalf and for the Regional Council. These include, for example, system providers and other external service providers that process data within the scope of a contract. In these cases, the Regional Council of Southwest Finland retains the responsibility of the data controller.
We select as contractual partners only such personal data processors that meet the requirements of the General Data Protection Regulation. Requirements related to data protection are ensured through written agreements.
We do not use or disclose your data for direct marketing, distance selling, or other direct marketing purposes, nor for market and opinion research.
The operations of the Regional Council of Southwest Finland aim to implement the principles of data protection by design and by default. Information security includes technical and administrative measures to protect the data we hold so that data and information systems are kept accessible only to those authorized to use them. The processing of personal data is always related to the performance of work duties and to the extent required by each task. Employees have received data protection training.
This section provides more detailed information about personal data related to certain duties of the Regional Council. You may request additional information from the Data Protection Officer about personal data not mentioned here.
We need information about pending and resolved matters in our operations. The Information Management Act specifies what information we must have about our documents. The case management system allows us to monitor the processing of matters under preparation. Through case management, we produce information about the progress of matters, processing stages, and decisions. We comply with, among other things, the Information Management Act, the Archives Act, and the Act on the Openness of Government Activities.
According to the Local Government Act, we must post decisions subject to appeal on our website. The retention periods for documents and their registry information are governed by the information management plan. The retention periods defined therein are based on several laws, the regulations of the National Archives, and the recommendations of the Information Management Board.
Unethical or unlawful conduct may be reported to the Regional Council’s whistleblowing channel. Reports may be submitted to the channel anonymously or by providing one’s name if desired. All reports are handled confidentially, and the reporter cannot be traced. The reporter receives a case number, which must be saved in order to view the response and the progress of the processing.
No identifying information is collected about the reporter. All messages and attachments are encrypted, so it is not possible for any external party to read or view reports submitted to the system. The system automatically removes identifying information from any attachments to the report. The system provider also cannot view messages, determine users’ IP addresses, or store cookies in the reporter’s browser.
Personal data in the system is retained for five years from the archiving of the report. Unnecessary personal data provided by the reporter may be anonymized 30 days after receipt of the report. Personal data is not transferred outside the EU. Read more: Information for whistleblowers
Personal data related to procurement includes, for example, personal data provided in tender documents. Data is processed in the public procurement notification channel Hilma and in the Regional Council’s case management system. Data is kept accessible only to those authorized, and the retention of data stored in case management is governed by the definition of retention periods.
Processing is based on the fulfillment of a statutory obligation in procurements under the Public Procurement Act. In small-scale procurements, the basis for processing is public interest (Article 6(1)(e) of the General Data Protection Regulation).
Professionally operating cultural and arts associations, companies, cooperatives, small working groups, and individual practitioners in the field may register as creators in the Kulttuuripankki online service. After approval of registration, the creator’s profile becomes publicly visible in the online service.
Anyone requiring cultural or arts services may register as a client in the online service. Client profiles do not become publicly visible in Kulttuuripankki. The client’s name and organization become visible only when the client submits a request for proposals in the online service and/or makes a recommendation about a creator or service in the online service. Read more about data processing in Kulttuuripankki’s privacy statement.
The purpose of the surveys we conduct is to develop our operations and fulfill our statutory duties. Surveys are also conducted in project work. The aim of the surveys is to engage stakeholders, partners, and residents.
We process data to perform a task in the public interest and to exercise public authority vested in the data controller. Responses are always examined at the group level, and respondents are not identified individually.
If we collect respondents’ contact information, for example, for prize draws or awards, we process the contact information separately from other survey material.
When you are elected to a position of trust or join the Regional Council as an employee, we request your personal and bank account information for the payment of salary, fee, or other compensation. Data is collected to fulfill the payer’s statutory obligations.
Personal data may be disclosed in situations required by law, for example, to the Tax Administration, to the party office for party membership fees, and, if necessary, to pension insurance and accident insurance companies. Data is also processed for reporting and statistical purposes.
All information about elected officials is submitted through the Aimoa service. The data is used, among other things, to establish the elected official in the payroll information system.
During recruitment, we collect information provided by applicants, such as work experience, education, and expertise in various fields. Provide only information relevant to the job application in your application. Do not mention sensitive information in your application, such as information about your health. Your personal data is processed by recruiting managers and the specialists assisting them.
Your application documents are, in principle, public documents. Information that you have applied for a position or office becomes public as soon as the application is received. We may disclose personal data upon separate request, for example, to other parties involved in the recruitment. In such cases, we redact information to which they are not entitled. We retain applications for two years and the applicant summary for 10 years. If you are selected for the position, we retain your application permanently and publish the selection decision on our website for 21 days in accordance with the provisions of the Local Government Act.
We use event participant lists to manage registrations for events and meetings. Collected dietary information is provided to third parties with your name removed from the data. Information about registered participants may be used in communications for similar events. You may prevent receiving invitations in the future in the manner indicated in the invitation.
We use mailing lists to inform you about current matters related to the operations, events, and meetings of the Regional Council of Southwest Finland or the programs and projects it administers. If you wish to unsubscribe from the mailing list, please indicate this in the manner specified in the newsletter. You may also unsubscribe by contacting the sender of the message or the Regional Council of Southwest Finland’s registry office. Joining the Regional Council of Southwest Finland’s email lists is voluntary.
We use photographs taken at events and occasions in our communications. We inform participants at the beginning of the event if photographs will be taken. Photographs may feature identifiable individuals. If you do not wish to be photographed, please indicate this when responding to the invitation or upon arrival at the event. You may also request the removal of a photograph. Written consent from a minor’s guardian is always obtained for the publication of a photograph.
© 2026 Regional Council of Southwest Finland.
Some language versions produced with AI. Feedback: viestinta@varsinais-suomi.fi
