Privacy Policy
25 September 2026
Data Controller
Technology Academy Finland (TAF), (Business ID: FI1811330-2), Eteläranta 10, 00130 Helsinki.
Contact person for matters regarding the register
Minna Zaknoun, tel. +358 40 747 3035, minna.zaknoun@millenniumprize.org
Legal basis and purpose of processing personal data
TAF processes personal data in order to maintain its contacts and communications and to provide information about the Millennium Technology Prize, Technology Academy Finland and related activities.
For newsletter subscribers, personal data is processed for the purpose of sending newsletters and other communications that the subscriber has requested.
Depending on the purpose of processing, personal data is processed on the basis of:
- the data subject’s given consent
- an agreement or relationship with the data subject, or
- TAF’s legitimate interest in maintaining its professional relationships and communicating about the Millennium Technology Prize and its activities serves as the legal basis for the processing of data.
Categories of personal data
Depending on the relationship with TAF, the following personal data may be processed: Name, title, represented organisation, contact details (such as name, email, and phone number).
Recipients and categories of recipients
The personnel of data controller and the outsourcing partners (financial management), where applicable.
Consent
If the processing is based on consent, consent may be withdrawn by informing the data controller.
Data content of the register
The register may contain the following information on part of a single person: The name of the data subject, the position or title of the data subject, any possible organisation represented by the data subject, contact details (email address, phone number), country of residence, information on whether the data subject has refused the sending of material to them.
Regular data sources
Data is collected from the registration of the contact person as well as from notifications made by the customer during the customer relationship. Data stored in the register is primarily obtained from the person through messages sent via online forms. Individual supplementation and update data can be obtained from the data subject or an organisation they represent via email, telephone, social media services, agreements, meetings, or other events, where the person has disclosed their personal information.
Retention period of personal data
The data controller keeps the information obtained from the registrations until the data subject unsubscribes from communications. Notwithstanding the foregoing, the data controller may retain personal data for a longer period where required by applicable law or where necessary to establish, exercise or defend legal claims. Potential partners and external service providers will keep information only for as long as it is necessary for providing their services and will delete the information without delay after the end of the project.
Regular disclosure of data
The information in the register is only to be used by the organisation, except when using an external service provider in order to provide additional services or to support credit decisions. Information is not disclosed outside of the organisation or to partners of the organisation, except for matters related to loan applications, the recovery of receivables and invoicing, as well as when stipulated by law.
The personal information of the data subject is deleted at the user’s request, unless the deletion is prevented by legislation, outstanding invoices or recovery actions.
Transfer of data outside the EU or the EEA
Personal data may be transferred outside the European Union or the European Economic Area when it is necessary for the purpose of ensuring the technical implementation of the data controller or their partner, or when data is disclosed to partner organisations. When personal data is transferred outside the European Union or the European Economic Area, our foundation will ensure that the data security level of the personal data is sufficient, e.g. by agreeing that matters related to the processing of personal data comply with the General Data Protection Regulation through the use of contractual clause models approved by the European Commission or other appropriate safeguards.
The data controller is not responsible for the processing of personal data carried out by third-party recipients in their capacity as independent data controllers after the data has been lawfully disclosed to them.
Registry protection principles A: Manual materials
Contact data and other documents containing manually processed customer data gathered by Technology Academy Finland are stored in secure storage facilities after their initial processing. Only specified employees who have signed a confidentiality commitment have the right to process manually stored customer information. The security and processing of the data stored in the register must comply with the provisions and principles of the Data Protection Act, provisions given by the authorities, as well as good data processing practices.
Registry protection principles B: Digital materials
Only the specified organisation and employees working on behalf of the organisation have the right to use the cooperation and contact register of TAF and to maintain its information. Each specified user has a personal user account and a password. Each user has signed the confidentiality commitment. The system is protected by a two-step authentication method that secures the system against external communications. The security and processing of the data stored in the register must comply with the provisions and principles of the Data Protection Act, provisions given by the authorities, as well as good data processing practices.
Cookies
Our site uses cookies. Cookies are small files that are transferred to the user’s computer and stored there. Cookies do not harm the user’s computer or files. The primary purpose of using cookies is to improve and personalise the visitor’s user experience on the site and to analyse and improve the functionality and content of the site. With cookies, gathered data can also be utilised to implement targeted communications and marketing and to optimise marketing procedures. Visitors cannot be identified by cookies alone. With cookies, however, the gathered data may be linked to data obtained from the user in other situations, such as when the user fills out a form on our site.
For information on cookies used on the data controller’s website, please refer to the website’s cookie policy
Automatic processing and profiling
The data controller does not use automated decision-making or profiling in connection with the processing of personal data in the register.
Right of inspection, i.e. the right to access personal data.
The data subject has the right to access and inspect personal data stored in the register that concern them. The request must be submitted in writing by contacting the customer service of the data controller or the contact person for register-related matters. The request must be in Finnish or English. The request for inspection must be signed or come from a provably identifiable email address.
Right to transfer data from one system to another
The data subject has the right to have the data transferred from one system to another. The request for a transfer can be directed to the contact person of the register.
Right to demand data correction
Data stored in the register that is incorrect, unnecessary, insufficient, or expired for the purpose of data processing must be corrected, deleted, or supplemented. The request for data correction must be submitted in writing with the data subject’s signature to the customer service of the organisation or to the person responsible for maintaining the register. Alternatively the request must be sent from a provably identifiable email address. The request must specify the information to be corrected as well as the basis for correction. The correction must be implemented without delay. The correction of the error must be reported to the party from which the incorrect information has been received or to which the information has been disclosed.
Right to restrict processing
The data subject has the right to request the restriction of data processing, if the personal information in the register is incorrect, for example. Any requests must be sent to the person responsible for the register.
The right to object
The data subject has the right to request information related to them. The data subject also has the right to request the correction of deletion of personal data. The request can be directed to the contact person of the register.
Right to lodge a complaint with a supervisory authority
If the data subject considers that the processing of personal data concerning them has infringed this data protection regulation, the data subject has the right to lodge a complaint with a supervisory authority. The complaint may also be lodged in the member state where the data subject has a permanent residence or job. The contact details of the national supervisory authority are the following: The Office of the Data Protection Ombudsman, Address: Lintulahdenkuja 4, 00530 Helsinki, Postal address: PL 800, 00531 Helsinki
Switchboard: 029 566 6700 Registry: 029 566 6768 tietosuoja@om.fi, www.tietosuoja.fi
Other rights related to the processing of personal data
The data subject has the right to refuse the disclosure of their personal data and its processing for the purpose of direct advertising and other marketing. The data subject also has the right to demand the anonymisation of their personal data, where applicable, as well as the right to be forgotten, i.e., for their personal information to be entirely erased.
