Privacy policy

Privacy policy

Parallax effect

PRIVACY POLICY - CAMERA SURVEILLANCE


Kampin Keskus Oy acts as the data registry owner for the processing of personal data in the form of camera surveillance carried out in the interiors, entrances and courtyards of the shopping centre properties in Kamppi Centre, as well as the entrances and yards of apartments and offices, and their immediate vicinities ("Site"). Kamppi Centre respects the privacy of its customers, residents and other visitors ("you" or "data subject") to the Site. This privacy policy describes how we collect and process your personal data and how we ensure the privacy and security of the personal data we collect and process. In addition, the policy describes your data protection rights.


1.          WHO IS THE REGISTRY OWNER?
2.          WHAT INFORMATION WE COLLECT AND HOW?
3.          PURPOSES AND LEGAL BASIS FOR PROCESSING PERSONAL DATA
4.          SHARING OF COLLECTED INFORMATION
5.          DATA TRANSFERS TO THIRD COUNTRIES
6.          DATA STORAGE PERIOD
7.          HOW TO EXERCISE YOUR PRIVACY RIGHTS?
8.          CHANGES TO THE PRIVACY POLICY

 
1. WHO IS THE REGISTRY OWNER?
 
The controller and owner of the of personal data registry described in this policy is:
  • Kampin Keskus Oy
If you have any questions about this Privacy Policy or the processing of your personal data in relation to camera surveillance, you can contact us by email at asiakaspalvelu@kamppi.fi.
 
2. WHAT INFORMATION WE COLLECT AND HOW?

This section details what personal data we may process about you and how the processing takes place. In section 3, you will find a diagram in which we have specified the purposes of the processing of your personal data and the legal basis for the processing of personal data.

We may collect, use, store and transfer different types of personal data about you, which we have grouped together in the following way:
 
  • (A) Footage means image material (without sound) of persons moving in or around the Site transmitted by the camera surveillance system. In addition to image material, date and time of recording is stored in the system.
We collect personal data as image material transmitted by cameras that are part of the camera surveillance system. We announce camera surveillance with signs and/or stickers in the stairwells and entrances of the shopping centre, offices and apartments.

 
3.  PURPOSES AND LEGAL BASIS FOR PROCESSING PERSONAL DATA
 
We will only process your personal data to the extent permitted by law. We will process your personal data in cases where the processing is necessary for the purposes of our legitimate interests or those pursued by a third party in accordance with Article 6(1)(f) of the GDPR.
 
The table below describes the purposes for which we process your personal data and the legal basis on which we process your data. We have also described our legitimate interest, if data processing is based on it.

 
Purpose of processing Data type Grounds for processing, including justifications for the exercise of legitimate interest
Camera surveillance

The camera surveillance system is used to monitor the Site.		 (A) Footage We have a legitimate interest in processing camera surveillance data to protect our property, prevent misuse and crime, investigate crimes that have already occurred, and increase the safety of our customers, residents and guests.

(Article 6(1)(f) of the GDPR)
Complaints, Disputes and Abuses

If damage or crime occurs at the Site, or there are claims related to the Site between the Controller and other parties, the Controller may process the data to investigate these.		 (A) Footage We have a legitimate interest in safeguarding our rights to investigate complaints, disputes and abuses to the extent that we are a party to the matter or the matter relates to a property owned or managed by us or its movable property.

(Article 6(1)(f) of the GDPR)
Analysing and improving business processes and practices

We use camera recordings to measure footfall in different areas of the Site.		 (A) Footage We have a legitimate interest in developing our business.

(Article 6(1)(f) of the GDPR)



4.  SHARING OF COLLECTED INFORMATION
 

We may share your data between the Controller's partner companies when it is necessary to carry out the purposes specified above. This processing is based on our legitimate interest to transfer data for internal purposes. Such internal purposes include, but are not limited to, the use of a centralized IT system.

We may disclose your information to third parties in the following situations:
 
  • When it is necessary for the purposes listed in section 3.
  • To governing authorities when required by law. Data may be disclosed to the police or other authorized government entities for the purpose of investigating crimes. Disclosure is always based on a separate request made by the authority.
  • To insurance companies for processing and resolving insurance incidents.
  • To third parties to safeguard their interests listed in Section 3.
  • To a person or entity that acquires all or most of the registry owner or its shares or assets, or with whom the registry owner is in the process of merging.
  • When we sincerely believe that disclosure is necessary to exercise our rights or defend against legal claims, to protect your safety or the safety of others, to investigate fraud, or to respond to a government request.
We share information, including personal data, with our trusted third-party service providers, who process personal data on our behalf according to our instructions. Such services include, for example, the maintenance and upkeep of IT systems, analytics and other services. Third-party service providers may have access to, or the possibility to process personal data to provide the above-mentioned services to us. Third parties are not allowed to use your personal data for any purpose other than those related to the services they provide. We have entered into data processing agreements with these third parties.

 
5. DATA TRANSFERS TO THIRD COUNTRIES

We will not transfer your data to countries outside the European Union or the European Economic Area unless we have verified that the transfer meets the requirements of Chapter V of the GDPR.

By default, personal data is not disclosed outside the EU or the EEA. If, in some circumstances, we transfer personal data outside the European Economic Area, sufficient safeguards are in place to ensure secure transfer in such situations. Such safeguards include, for example, decisions by the European Commission on an adequate level of data protection or standard contractual clauses separately approved by the Commission. These measures are considered to provide the data with the same protection as they receive in the European Economic Area.

If you would like more information about the processors of your personal data located outside the European Economic Area and the security measures we have put in place to ensure the continuation of data transfers, you can contact us by email using the contact details provided in Section 1 of this Privacy Notice.

6. DATA STORAGE PERIOD

We will retain the personal data we collect for as long as we still have an ongoing legitimate interest or obligation to retain the data. When such legitimate interest or obligation to retain data comes to an end, we will delete or anonymise your personal data.

Camera recordings are stored for one (1) month from the time of recording. After this time, the recordings are automatically destroyed. We have decided on a storage period of one (1) month because many crimes and accidents only become known to us with a delay. We want to ensure that we can use the camera surveillance system for the purposes we have declared.

The data may also be stored for a longer period if we have a legal obligation to retain the data, or if the retention is necessary for the establishment, exercise or defence of a legal claim in legal proceedings.

7.  HOW TO EXERCISE YOUR PRIVACY RIGHTS?


You have several different rights in relation to your personal data. Below you will find a summary of these rights, how to exercise them, and what limitations are attached to them.
If certain conditions are met, you have the right to:
      • The right to request access to your personal data. This right allows you to obtain a copy of any personal data we hold about you and to ensure that we process that data lawfully.
      • The right to request correction of your personal information. This right allows you to ask us to correct information about you that is inaccurate.
      • The right to request erasure of your data. This right allows you to ask us to delete or transfer personal data when there is no longer a suitable basis for processing the data.
      • The right to object to the processing of your data when the processing is based on our (or a third party's) legitimate interest, and you have a reason relating to a personal situation to object to the processing of the data. You also always have the right to object to the processing of your data for direct marketing purposes. 
      • Right to request restriction of processing of your data. With this right, you can ask us to stop processing your data, for example, while you verify the accuracy of the data or the basis for processing.
      • The right to request the transfer of your data from one system to another.
If you wish to exercise any of the above rights, you can contact us by email using the contact details provided in section 1 of this privacy policy. Your request will be processed in accordance with data protection legislation.

You have the right to make a complaint to the national data protection authority if you are dissatisfied with the way we process your personal data. In Finland, you can submit a report to the Office of the Data Protection Ombudsman at https://tietosuoja.fi/en/notification-to-the-data-protection-ombudsman.


8. CHANGES TO THE PRIVACY POLICY
 

This Privacy Notice may be updated as necessary to reflect changing legal and operational requirements. We recommend that you regularly visit our website to be informed of our updated privacy practices.

If significant changes are made to this privacy policy, the data subjects will be informed even before the changes take effect.