Privacy Policy - Media Bank

Updated 17th May 2024 – machine coded translation

Media bank is a cloud service where photographs and videos of the university's functions can be browsed and uploaded for teaching and research use, as well as for illustration and marketing purposes. The public media bank for the media and the general public has a selection of stock photographs of the university as well as archived photographs from the 1920s to 1970s.

More broadly, the photographs in the archives and the University's personnel photos can be browsed and downloaded or ordered by logging into the media bank with the university's user-id.

1. Purpose of processing

The audiovisual materials of the University of Turku are processed for communication purposes and general archiving purposes.

The use of the material is allowed according to the terms of use for: marketing of education and research carried out at the University of Turku, communication purposes, teaching and research purposes.

Photographs from the archives can be accessed using a subscription form, which acts as a photograph usage agreement between the archives and the subscriber.

2. Personal data processed and retention period

The material may include photographs and video footage of natural persons.

The metadata of the materials may include, but are not limited to, the following personal data:

  • The subject of the photograph / video footage (may be a natural person)
  • Photographer (natural person)
  • Names of the people in the photo / video footage
  • Name of the donor or assignor of the material

The order form / photograph usage agreement includes the following personal data:

  • Username
  • Purpose of use of the material
  • Name
  • E-mail
  • Phone number
  • Address (not mandatory)

The photo permit contains the following personal data:

  • Username (in Utuforms)
  • Name and signature of the subject (paper forms)

Audiovisual material that is central to the university's functions is archived. (Based on decision KA296/43/04 of the National Archives). The items to be archived will be moved to the archive section of the media bank.

Other records are kept for a limited period of time. The valuation is done at the time of transfer to the archives.

Photographic permissions are archived (retained permanently).

3. Basis for processing

  • General Data Protection Regulation (Art. 6 para. 1) and the Data Protection Act (1050/2018 § 4)
    • Public interest and the exercise of public authority
    • Legal obligation of the controller
    • Contract
    • Consent
  • University Act 558/2009
  • Information Management Act 906/2019
  • Act on the Openness of Government Activities 621/1999
  • Archives Act 831/1994

4. Contact information

University of Turku

Kirjaamo

Yliopistonmäki

20014 Turun yliopisto

mediabank@utu.fi

tel. +358 29 450 5126 (Registry) / +358 29 450 2578 (Communications)

5. Origin of data

Audiovisual material has been created by filming the university's functions and events. Some of the photographs have been donated to the University archives.

The metadata for audiovisual material is collected as a result of the controller's own activities and research, from documents, archives, data subjects and donors of material.

Information provided by the subscriber on the order form / Photo Usage Agreement.

The information for the photographic permission comes from the person being photographed / filmed and from the university's IDM system (UTUforms form).

6. Regular disclosures of data

Data is not regularly disclosed from the Media bank.

7. Information on the transfer of personal data to a third country or international organization

Media bank's supplier Qbank and its subcontractors provide services mainly in the EU. There is limited access to data from outside the EEA. The legality of such transfers of personal data is based on the European Commission's decision on the adequacy of data protection in the US when data is transferred to a certified company in the US, such as Google. They are committed to complying with the transfer mechanisms and safeguards of the GDPR for all potential data transfers to third countries.

8. Publicity,confidentiality and request for information 

Audiovisual material resulting from the university's functions may constitute a public document, which is public in accordance with the Act on the Openness of Government Activities. They may be disclosed or provided under the conditions of §13 and §16 of the aforementioned Act and the Data Protection Act (1050/2018). 

The uploader / subscriber is responsible for using the materials in accordance with the Terms of Use and Finnish law.

9. Rights of the datasubject

9.1 Access to your own data

You have the right to know what personal data is being processed and what information is stored about you.

You can submit a request for information to the university. The procedure is as follows:

  • The university will provide the information requested as soon as possible without undue delay.
  • The requesting party will be asked to provide proof of identity separately, if necessary.
  • The deadline for providing the information or additional information relating to the request is one month from the date of receipt of the request. If the request for information is complex and extensive, the time limit may be extended by two months.
  • In principle, the information will be provided free of charge. If you request more than one copy, you will be charged a fee based on administrative costs. If a request for information is manifestly unfounded or unreasonable, or if you make repeated requests for information, the University may charge you the administrative costs of providing the information or refuse to provide it at all. In such cases, the university will give reasons for its decision.
  • If the university does not provide the information, you will be given written notification of this. At the same time, you will be informed of your rights to legal remedies, including the possibility of lodging a complaint with a supervisory authority.
9.2 Right to rectification

You have the right to request that any inaccurate or incomplete personal data concerning you be corrected or completed without undue delay. In addition, you have the right to request that any personal data concerning you that is not necessary be deleted.

If the University does not accept the request for rectification, a written statement will be issued stating the reasons why the request has not been accepted. At the same time, the university will inform you of your rights to legal remedies, such as the possibility to lodge a complaint with a supervisory authority.

9.3 Right to erasure

Depending on the legal basis for processing your data, you may have the right to have your personal data erased from the register. This right does not apply, for example, in cases where the processing of personal data is necessary for compliance with a legal obligation or for the exercise of official authority vested in the University of Turku. The storage and deletion of data is in accordance with the University's Data Retention Schedule and the data retention periods required by law.

9.4 Right to request restriction of processing

In certain circumstances, you may have the right to request the restriction of the processing of your personal data until the legal basis for the data or its processing has been duly reviewed and rectified or completed.

9.5 Right to transfer personal data from one system to another for another controller

The transfer of personal data from one system to another means that the data subject receives the personal data he or she has provided in a structured, commonly used and machine-readable format and can transfer the data to another controller without being prevented from doing so by the University. This right can only apply in situations where the processing is automated and based on consent or contract.

This right does not apply, for example, to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of a legal obligation incumbent upon the controller. Therefore, as a general rule, the right does not apply to personal data files held by the University.

9.6 Right to object to processing

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data where the legal basis for the processing is the performance of a task carried out in the public interest, the exercise of official authority or the legitimate interests of the University. In this case, the data may only be further processed if there is a substantial and legitimate ground for the processing which can be demonstrated.

You have the right to object at any time, without specific justification, to the processing of your personal data for direct marketing purposes.

9.7 Right to lodge a complaint with a supervisory authority

You can lodge a complaint with a supervisory authority if you believe that your personal data are being processed in breach of the EU General Data Protection Regulation (EU) 2016/679. In addition, you have the right to other administrative and judicial remedies. For more information, visit www.tietosuoja.fi. Contact the University of Turku Data Protection Officer by email: dpo@utu.fi.

You also have the right to bring an action against the controller or processor organisation if you consider that your rights have been infringed because your personal data have not been processed in accordance with the GDPR.

9.8 Other information to be provided

Log records are generated from the use of the service, which are used to ensure the information security of the service, the technical development of the service and the detection, prevention and resolution of faults (917/2014 138§, 141§, 144§, 272§). The logs are kept for the time necessary for these purposes and are not used for any other purpose.

The principles of personal data protection are described on a separate page: https://www.utu.fi/en/privacy/data-security-description