Register of personal data collected in the Vantaa and Kerava QPro client feedback survey system

Notice on the processing of personal data and the rights of the data subject, Articles 12–22 of the EU General Data Protection Regulation (679/2016).

1 Name of the register 

Register of personal data collected in the Vantaa and Kerava QPro client feedback survey system 

2 Controller 

Name: 

Wellbeing Services County of Vantaa and Kerava 

Address: 

PO Box 1000, 01088 Wellbeing Services County of Vantaa and Kerava 

Other contact details: kirjaamo@vakehyva.fi

3 Person responsible for the register and Data Protection Officer 

Person responsible for the register:  Data Protection Officer and contact details: 

Wellbeing Services County of Vantaa and Kerava’s Data Protection Officer tietosuojavastaava@vakehyva.fi 

4 Purpose and legal basis for the processing of personal data 

The purpose of processing personal data is to respond to client feedback collected through the system. Client feedback is collected in order to monitor and improve the quality of services provided by the wellbeing services county and to safeguard the interests of the client. 
 

The grounds for the processing of personal data under the EU General Data Protection Regulation (2016/679) are: 

  • Article 6(1)(c), according to which the processing of personal data is necessary for compliance with the legal obligations of the controller; and 
  • Article 6(1)(e), according to which the processing of personal data is necessary for the performance of a task carried out in the public interest. 
     

In addition to legislation, the Wellbeing Services County of Vantaa and Kerava complies with its own internal guidelines and policies. 

5 Data content of the register 

Name, phone number, e-mail, age, mother tongue and the status of the customer in relation to the wellbeing services county (client/patient/relative/other). 

6 Regular data sources 

Form information. 

7 Regular disclosures and transfers of data outside the EU or EEA 

The data contained in the register is processed only by those persons employed by the Wellbeing Services County of Vantaa and Kerava whose duties require it. Data are not regularly disclosed to third parties, except where required by legal obligations. 
 

In the wellbeing services county, processing will only take place in the system in question, which is located in the EU/EEA area. Data will not be transferred outside the EU or EEA.

8 Data retention periods 

Retention shall be in accordance with the data management plan of the wellbeing services county. Data shall be retained in the system for a period of three (3) years, after which it shall be deleted from the system and archived as required by the Archives Act (831/1994). Manually submitted data shall be transferred to the system by the wellbeing services county as soon as possible after submission and the manual document shall be destroyed immediately thereafter.

9 Principles of register protection 

A Manual data 

Any manual data will be stored in a locked cabinet or other space, access to which is determined by official or work duties, until it is transferred to the system. 

B Electronically stored data 

The hardware and software maintained by the Wellbeing Services County of Vantaa and Kerava are protected and secured in accordance with data security regulations. Employees using the information systems have access rights defined according to their work duties and personal user IDs and passwords for each system. Passwords for the systems must be changed regularly. Upon termination of employment, access rights are deactivated. Employees have signed a data protection agreement concerning the use of the information systems.

10 Rights of data subjects 

The data subject has the right to: 

  • review the data concerning them 
  • request rectification of their data 
  • demand the removal of their data (not applicable to statutory tasks) 
  • demand the restriction of the processing of their personal data (not applicable to statutory tasks) 
  • object to the processing of their personal data (not applicable to statutory tasks) 
  • request the transfer of personal data provided by them from one controller to another 
  • the right to withdraw their consent where the processing of personal data is based on consent 
  • opt out of automated decision-making. 
     

The data subject has the right to obtain information on the data relating to them which are recorded in this register or the absence of data relating to them, provided that they have provided the information necessary for the search. 
 

The data subject has the right to demand that the controller rectify, without undue delay, inaccurate or incorrect personal data concerning them. 

 

The controller must, on their own initiative or at the request of the data subject, rectify, remove or complete personal data contained in the personal data system if they are inaccurate, unnecessary, incomplete or out of date for the purposes of processing and collecting the data. 
 

The data subject has the right not to be subject to automated decision-making without legitimate grounds. 

A data subject who wishes to review, rectify or remove data concerning them as described in the previous paragraph must submit a request to this effect to the registry of the wellbeing services county, using a form signed in their own hand. The forms are available on the website of the Wellbeing Services County of Vantaa and Kerava at https://vakehyva.fi/fi/tietopyynnot. 

 

If the controller does not accept the data subject’s request, the controller must issue a written statement to that effect. The statement must also indicate the reasons why the request has not been accepted and the possibility of lodging a complaint with the supervisory authority and of exercising other legal remedies. 
 

Requests relating to the rights of the data subject shall be addressed to: 
 

Wellbeing Services County of Vantaa and Kerava 

Registry Office 

PO Box 1000, 01088 Wellbeing Services County of Vantaa and Kerava 

11 Automated decision-making, including profiling 

The processing of personal data does not involve automated decision-making and profiling.

12 Other matters related to the processing of personal data 

If the data subject’s requests are manifestly unfounded or unreasonable, in particular if they are made repeatedly, the controller may either: 
 

  • charge a reasonable fee taking into account the administrative costs of the provision of information or communications or the performance of the requested task; or 
  • refuse to carry out the requested action. 
     

In such cases, the controller must demonstrate that the request is manifestly unfounded or unreasonable.

13 Data subject’s right to lodge a complaint (Article 77 of the EU General Data Protection Regulation) 

The data subject has the right to lodge a complaint with the supervisory authority (Office of the Data Protection Officer) if the data subject considers that the processing of personal data concerning them infringes the General Data Protection Regulation, without prejudice to other administrative or judicial remedies.
 

Contact information of the Data Protection Officer: 

Visiting address: Lintulahdenkuja 4, 00530 Helsinki 

Postal address: PO Box 800, 00531 Helsinki 

Phone: 029 56 66700 

E-mail: tietosuoja@om.fi