Privacy Notice – Suomen Messut Oyj’s Visitor and Registration Register for Events

Last updated: 3 June 2026

This Privacy Notice describes the principles according to which Suomen Messut Oyj, as the data controller, collects and processes personal data relating to visitors and registered participants in its events. The register is used for event-related transactions, participation, communications, marketing and operational development. The register may contain data concerning company representatives and people acting in a professional capacity, as well as consumers, students and other private individuals.

1. Data Controller

Suomen Messut Oyj / Messukeskus
Messuaukio 1, 00520 Helsinki, Finland
Business ID: 0116322-3
asiakaspalvelu@messukeskus.com
Tel. +358 40 450 3250

2. Contact Person for Register Matters

Messukeskus / Customer Service

asiakaspalvelu@messukeskus.com

3. Name of the Register

Suomen Messut Oyj’s Visitor and Registration Register for Events

4. Purposes and Legal Bases of Processing, Personal Data Processed and Retention Periods

We collect, store and process personal data for predefined purposes and only on lawful grounds. The legal basis depends on the processing situation, the role of the data subject and whether the processing concerns event participation, a customer relationship, marketing or the use of online services. Retention periods are based on the duration of the customer relationship, event cycles and the need to analyse participation and develop services over several event seasons.

Event registration and participation

Registration, participation management, arranging admission and enabling event-related transactions.

Personal data processed:

• Name and contact details
• Organisation and job title or role
• Participation information

Legal basis: Contract. Processing is necessary to facilitate participation in the event.

Retention: A maximum of 24 months after the event, unless another legal basis or applicable legislation requires longer retention.

Visitor statistics and event development

Analysis of visitor flows, reporting, development of services, and event planning and evaluation.

Personal data processed:

• Visit and entrance-gate data
• Timestamps
• Event-specific participation information

Legal basis: Messukeskus’s legitimate interest in analysing visitor traffic and developing its events.

Retention: 12–24 months, depending on the purpose of use.

Customer relationship management and communications

Customer service, event-specific communications, management of transaction history and processing of feedback.

Personal data processed:

• Contact details
• Transaction history
• Information relating to communications

Legal basis: Messukeskus’s legitimate interest in managing customer relationships and communicating about event-related matters.

Retention: A maximum of 24 months based on the customer relationship or most recent transaction, unless another legal basis applies.

B2B direct marketing and cross-marketing

Marketing events, services and related content to company representatives and other persons acting in a professional capacity.

Personal data processed:

• Name
• Email address and/or telephone number
• Job title or role
• Organisation
• Transaction and participation history

Legal basis: Messukeskus’s legitimate interest in marketing similar or professionally relevant events and services to company representatives. The data subject has the right to object to such processing at any time.

Retention: Until the data subject objects to marketing or for a maximum of 24 months from the most recent transaction.

Electronic direct marketing to consumers or other non-B2B contacts

Sending newsletters, campaign messages and other electronic direct marketing where processing is not based on B2B legitimate interest.

Personal data processed:

• Name
• Email address
• Telephone number
• Consent and opt-out information

Legal basis: Consent, unless otherwise permitted by applicable legislation.

Retention: Until consent is withdrawn or the data subject objects to marketing.

Online service analytics and measurement

Analysing the use of the website and digital services, improving the user experience and measuring marketing.

Personal data processed:

• IP address
• Browsing and usage data
• Cookie data

Legal basis: Consent. The use of non-essential cookies and similar technologies is based on consent.

Retention: In accordance with cookie settings and the applicable cookie policy.

Legal obligations

Processing information relating to accounting, security or other legal obligations applicable to the data controller.

Personal data processed:

• Invoicing and payment information
• Log data
• Other information necessary to comply with legal obligations

Legal basis: Legal obligation. Processing is necessary to comply with a legal obligation applicable to the data controller.

Retention: For as long as required by applicable legislation.

5. Marketing and Targeting

We may target marketing on the basis of the industry of the organisation represented by the data subject, their job role, previous transactions, participation and other information describing the customer relationship. We may offer and market similar events and services, as well as events and services that are related in terms of their content.

For company representatives and persons acting in a professional capacity, processing is generally based on the data controller’s legitimate interest. For private individuals, electronic direct marketing is generally based on consent, unless otherwise permitted by applicable legislation. The data subject always has the right to object to direct marketing.

6. Sources of Personal Data

We primarily collect personal data directly from the data subject, for example in connection with registration, transactions and communications. We may also collect data from event systems and entrances, from the use of online services and customer service, and, on the basis of agreements, from partners such as event co-organisers or other parties involved in organising an event.

7. Disclosure and Transfers of Personal Data, Including Outside the EU/EEA

Personal data is processed by Messukeskus employees and contractually bound service providers, such as technical service providers, analytics and marketing service providers, and partners involved in organising events. Event partners may process personal data either on behalf of the data controller or as independent data controllers, depending on the event and cooperation model. Personal data is not sold to third parties. Personal data may be disclosed to public authorities where required by law and in connection with corporate transactions.

Some marketing, analytics or technical service providers may process personal data outside the EU/EEA, particularly in the United States. We use digital marketing and analytics service providers such as Google and Meta. Transfers are carried out in accordance with applicable data protection legislation and are primarily safeguarded under the EU–US Data Privacy Framework or by using Standard Contractual Clauses (SCCs) approved by the European Commission, together with any necessary supplementary safeguards.

8. Cookies and Online Tracking

We use cookies and similar technologies for analytics, improving the user experience and marketing. The use of non-essential cookies is based on the user’s consent. Essential cookies are used to ensure the technical operation of the service.

9. Profiling and Automated Decision-Making

We may use personal data to create target groups and target communications. Profiling may be based, for example, on event participation, transaction history and interests. We do not make automated decisions that produce legal effects concerning the data subject or similarly significantly affect the data subject.

10. Requirement to Provide Personal Data and Consequences of Not Providing It

Some information is necessary to enable participation in an event, manage a customer relationship or provide a service. If the required personal data is not provided, registration, participation or use of the service may not be possible.

11. Rights of the Data Subject and How to Exercise Them

Under applicable data protection legislation, the data subject has the right to access their personal data, rectify data, erase data, restrict processing, object to processing, receive their data in a portable format where applicable, withdraw consent where processing is based on consent, and object to direct marketing.

These rights can be exercised by contacting asiakaspalvelu@messukeskus.com.

12. Right to Lodge a Complaint with a Supervisory Authority

If you believe that we do not process your personal data in accordance with applicable data protection legislation, you may lodge a complaint with the Office of the Data Protection Ombudsman.

13. Changes to this Privacy Notice

We may update this Privacy Notice if our operations, data protection principles or applicable legislation change. The current version is available on our website.