Information sheet about processing the personal data
Controller
Haaga-Helia University of Applied Sciences Ltd.
Business ID 2029188-8
Ratapihantie 13, 00520 Helsinki

Contact person:
Antti Jylhä, research area director
antti.jylha@haaga-helia.fi

Data protection officer:
dpo@haaga-helia.fi
tel. +358 29 447 1222

Purpose of processing and description of the processing activities of personal data
In the research project “Boating Finland – Boosting the Finnish Boat Industry and Waterway Tourism through Research Cooperation,” carried out by Haaga-Helia University of Applied Sciences, research and communication activities are conducted, during which it is necessary to collect personal data from respondents. The project is funded by Business Finland and 30 Finnish companies in the boating and tourism sectors. The duration of the project is 1 May 2025 – 31 August 2028.

Personal data is collected in the project for the following purposes:

1. Registration for project-organised events. When registering, the participant’s name, email address, and phone number are collected. This information is used only for communication related to the specific event and for estimating the number of participants, and is not made available to third parties.

2. Project communication. The project distributes a newsletter 3–5 times per year, which can be subscribed to voluntarily. Subscribers’ names and email addresses are collected and used only for delivering the newsletter and calculating the number of unique subscribers.

3. Prize draws. In connection with some project activities, personal data may be collected for prize draws. This personal data may include name, email address, and phone number. This information is used only for conducting the draw and informing the winners. The data is deleted after the draw, and the winners’ names will not be published without their explicit consent.

4. Research activities. Several sub-studies will be carried out during the project, and in this context it may be necessary to collect personal data. This information may include, for example:
   a. name
   b. email address
   c. phone number
   d. identifiable personal information related to boating and tourism, defined separately for each sub-study
   e. audio recordings if the study is conducted in an interview format.

Personal data and audio recordings collected for research purposes are stored on a network drive maintained by Haaga-Helia for this specific purpose, with access limited to project personnel involved in handling the research data. If an audio recording is made, it will be deleted from the recording device immediately after being transferred to the network drive. Personal data will not be disclosed to third parties.

Research data is processed using the following actions: organising, structuring, storing, modifying, searching, querying, combining, and restricting information.

Collected anonymised research data may be processed with AI assistance. If research data is processed with AI tools, personal data will not be entered into AI tools maintained by third parties.

Anonymised research data may be published as such or in processed form, for example as part of an online publication or research article.

Legal basis
The legal basis for the processing activities is the data subject’s consent.

Disclosures of personal data to third parties
Personal data will not be disclosed to third parties.

Transfers of personal data to third countries
Personal data will not be transferred to third countries.

Retention period
Personal data will be retained for the duration of the project and destroyed when the project ends. If, during the project, purposes arise that require the personal data to be stored for a longer period, separate consent will be requested for that purpose.

Principles of personal data protection
The research data collected in the project that contains personal data will be stored on the controller’s protected network drive, accessible only to persons working in the project whose tasks include processing the research data.

Rights of the data subject
As data subject you have the following rights in accordance with the EU General Data Protection Regulation:

• The right to obtain access to the personal data concerning him or her
• The right to withdraw his or her consent at any time without giving any reason. However, the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. The consent can be withdrawn by sending a request by email to the contact person specified above.
• The right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her, as well as the right to have incomplete personal data completed
• The right to obtain from the controller the erasure of personal data concerning him or her without undue delay, where one of the following grounds applies:
  • the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • the data subject withdraws consent on which the processing is based, and there is no other legal ground for the processing;
  • the personal data have been unlawfully processed;
  • the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
• The right to obtain from the controller restriction of processing, where one of the following applies:
  • the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
  • the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
  • the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; or
  • the data subject has objected to processing on grounds relating to his or her particular situation, pending the verification whether the legitimate grounds of the controller override those of the data subject.
• The right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on public interest or legitimate interest.
• The right to receive the personal data concerning him or her, which he or she has provided to the controller, in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, as long as the processing is based on consent pursuant to the GDPR, and the processing is carried out by automated means.
• The right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data relating to him or her infringes the GDPR (instructions on the website of the Office of the Data Protection Ombudsman https://tietosuoja.fi/en/home).