Privacy notice
Finnish Heritage Agency’s Permit and Collections Service – Privacy Notice
This privacy notice contains the information required under the EU General Data Protection Regulation (EU) 679/2016 for data subjects.
Prepared on 30 January 2026.
Name of the register
Finnish Heritage Agency’s Permit and Collections Service
Data controller and controller’s contact details
Name: Finnish Heritage Agency
Visiting address: Hakaniemenranta 6, Helsinki
Postal address: P.O. Box 913, FI-00101 Helsinki, Finland
Registry office (switchboard): +358 295 33 6080
Email: kirjaamo@museovirasto.fiData Protection Officer contact details
Contact: tietosuoja@museovirasto.fi
Purpose and legal basis for processing personal data
The purposes of processing personal data are:
- Processing permit applications, material orders, possible statements on the purpose of use, and other possible forms, as well as managing the related invoicing
- Other measures related to customer service management
The legal bases for the processing of personal data are:
Compliance with a legal obligation (EU GDPR, Article 6(1)(c)) and performance of a task carried out in the public interest and exercise of official authority (Article 6(1)(e)). In some cases, processing may exceptionally be based on the data subject’s consent (EU GDPR, Article 6(1)(a)) in addition to another lawful basis.
Processing bases are related, inter alia, to the following acts:
- Act on the Finnish Heritage Agency 510/2025
- Antiquities Act 295/1963
- Archives Act (831/1994)
- Act on the Openness of Government Activities (621/1999)
Categories of data and personal data contained in the register
Personal data stored in the Permit and Collections Service contact details:
Individual customer:
- Name and contact details: given names, surname, postal address, email address, phone number
- Suomi.fi e-Identification
Organisational customer:
- Contact person’s name and contact details
For example, documents delivered on the basis of digitization requests may contain the names and contact information of officials and private individuals.
Personal data included in service requests:
- In applications for permits to research or interfere with ancient monuments: contact details of property owners and holders:
- Name, postal address, email address, phone number
- In research permits for ancient monuments and research reporting: details of other persons participating in the research (e.g., principal investigator, fieldwork leader, client and funder):
- Name, postal address, email address, phone number
- Information included in documents concerning individuals related to official processes. Documents and their metadata routinely contain, among other things, names of officials as well as private individuals’ names and contact details.
Details of officials using the Permit and Collections Service:
- Name, department/unit, email address.
Recipients or categories of recipients of personal data
Employees of the Finnish Heritage Agency whose duties include tasks related to the customer service of the Permit and Collections Service.
In addition, recipients of personal data include providers of identification services and payment services.
Processors of personal data as defined in the General Data Protection Regulation: the system administrator.
Data may be disclosed only within the limits required and permitted by applicable legislation.
Transfers of data outside the EU or EEA
The Finnish Heritage Agency does not transfer personal data included in case management or in the authority’s archives to third countries or international organisations.
Retention period of personal data
Personal data included in documents and related to the processing of matters are retained in accordance with the Archives Act and the required records management plan (AMS or TOS).
Service requests are retained in the Permit and Collections Service for 3 years. If the material request concerns material with usage restrictions and the data subject has provided a statement of the intended purpose of use, the data will be retained for 10 years.
Official matters transferred to the case management system are retained in accordance with the records management plan.
Protection of personal data processing
Personal data related to the Finnish Heritage Agency’s Permit and Collections Service are processed confidentially. The Finnish Heritage Agency has implemented necessary technical and organisational measures and requires the same from processors of personal data. Data are processed only by persons whose duties include such processing.
Rights of the data subject
The legal basis for processing affects which rights the data subject has. The data subject’s rights in different situations are listed in more detail, for example, on the website of the Office of the Data Protection Ombudsman.
The data subject has the right to obtain confirmation from the controller as to whether personal data concerning them are being processed.
The data subject has the right to request:
- Access to personal data concerning them
- Rectification or erasure of incorrect or outdated data
- Restriction of processing and to object to processing under certain conditions
If the data subject considers that the processing of their personal data is unlawful, they have the right to lodge a complaint with the Data Protection Ombudsman.
Source of personal data and, where applicable, whether data originate from publicly available sources
Personal data have been obtained
- From the data subject themselves when ordering materials or services via the Finnish Heritage Agency’s Permit and Collections Service
- When a person authenticates strongly via the Suomi.fi e-Identification service, name information is obtained from the Population Information System
- A customer of the Permit and Collections Service may also provide, via the service, personal data of other individuals related to permit matters (e.g., other persons participating in archaeological research and property owners)
Use of data for automated decision-making and/or profiling
Data contained in the register are not used for profiling and are not subject to automated decision-making.