Privacy Notice – Suomen Messut Oyj’s Access Permit Register

Last updated: 3 June 2026

This Privacy Notice describes the principles according to which Suomen Messut Oyj, as the data controller, collects and processes personal data for granting access permits, managing access and ensuring security on Messukeskus premises.

1. Data Controller

Suomen Messut Oyj / Messukeskus
Messuaukio 1, 00520 Helsinki, Finland
Business ID: 0116322-3
asiakaspalvelu@messukeskus.com
Tel. +358 40 450 3250

2. Contact for Register and Data Protection Matters

Messukeskus / Customer Service
Messuaukio 1, 00520 Helsinki, Finland
asiakaspalvelu@messukeskus.com
tietosuoja@messukeskus.com

3. Name of the Register

Suomen Messut Oyj’s Access Permit Register

4. Purposes and Legal Bases of Processing, Personal Data Processed and Retention Periods

We process personal data for predefined purposes and only on lawful grounds. The primary purpose of the Access Permit Register is to grant access rights, manage access and ensure security on Messukeskus premises during construction, dismantling and event periods.

We do not use the Access Permit Register for marketing without separate consent. Retention periods are based on the management of access rights, ensuring security and the need to investigate potential misuse or establish, exercise or defend legal claims.

Granting and managing access permits

Creating access permits, managing their validity, defining permitted areas and managing access permit identifiers.

Personal data processed:

• Name
• Company or organisation
• Role, such as constructor, performer or other event operator
• Contact details: email address, telephone number and address
• Permitted areas and validity period
• Access permit identifier or number

Legal basis: Legitimate interest. Processing is necessary to grant access rights, implement access management and ensure the security of Messukeskus premises and events. Where the data subject is personally a contracting party, for example a sole trader, processing may additionally be necessary for the performance of a contract.

Retention: For the duration of the event and construction period and for a maximum of 12 months after the end of the event, unless longer retention is necessary for the establishment, exercise or defence of legal claims.

Security and access control

Identifying individuals, monitoring movement and, where necessary, investigating misuse.

Personal data processed:

• Access permit data
• Entry and exit records
• Other log data relating to use of the access permit

Legal basis: Legitimate interest. Processing is necessary for security, access control and investigating misuse.

Retention: Log data is deleted within 12 months at the latest unless a case-specific investigation or the defence of a legal claim requires longer retention.

Operational communications relating to the access permit

Delivering the access permit and sending practical instructions concerning it, such as a link sent by email or a separately selected SMS link.

Personal data processed:

• Name
• Email address
• Telephone number, only where provided and SMS delivery has been selected
• Event information, pass type and validity

Legal basis: Legitimate interest. Processing is necessary to deliver the access permit, enable practical use of the access right and ensure that the event is organised safely. Where the data subject is personally a contracting party, processing may additionally be necessary for the performance of a contract.

Retention: For the duration of the event and construction period and for a maximum of 12 months after the end of the event, unless longer retention is necessary for the establishment, exercise or defence of legal claims.

Event-specific use of a photograph on an access permit

Using a photograph on an access permit or for identifying an individual only where required for the relevant event.

Personal data processed:

• Photograph

Legal basis: Legitimate interest. Processing is necessary to ensure identification and security.

Retention: The photograph is retained for no longer than the same retention period applicable to other access permit information and is deleted at the latest when that retention period expires.

5. General Information on Retention Periods

We do not retain personal data for longer than necessary for the purposes described in this Privacy Notice or for longer than required or permitted by law. Personal data may be retained for a longer period where necessary for the establishment, exercise or defence of legal claims.

6. Sources of Personal Data

We primarily collect personal data from data subjects themselves through access permit applications and forms, and from parties ordering access permits, such as exhibitors, event clients or other parties requiring access permits. Data may also be obtained from internal functions of Suomen Messut Oyj responsible for event production and practical arrangements.

7. Disclosure and Transfers of Personal Data, Including Outside the EU/EEA

Personal data is processed only by Messukeskus employees and contractually bound service providers, such as providers of access control and access permit systems. Personal data may be disclosed to the event client or another party involved in organising the event to the extent necessary to implement the access permit process and ensure security.

Personal data may be processed outside the EU/EEA only where the transfer has a lawful basis under applicable data protection legislation. Transfers are primarily safeguarded under the EU–US Data Privacy Framework or by using Standard Contractual Clauses (SCCs) approved by the European Commission, together with any necessary supplementary safeguards.

8. Data Protection Principles

We process personal data with due care and protect it using appropriate technical and organisational measures. Access to personal data is restricted on a role-based basis to employees and contractual partners whose duties require such processing. Use may be monitored and logged as part of information security and access control.

9. Requirement to Provide Personal Data and Consequences of Not Providing It

Certain personal data must be provided in order to issue an access permit and manage access rights. If the required information is not provided, an access permit may not be issued. Providing a telephone number is necessary only if the data subject also wishes to receive the access permit link by SMS and separately selects this delivery method.

10. Profiling and Automated Decision-Making

We do not use data contained in the Access Permit Register to make automated decisions that produce legal effects concerning the data subject or similarly significantly affect the data subject.

11. Rights of the Data Subject and How to Exercise Them

Under applicable data protection legislation, the data subject has the right to access their personal data, rectify data, erase data, restrict processing, object to processing based on legitimate interest, receive their data in a portable format where applicable, and withdraw any consent where processing is based on consent.

These rights can be exercised by contacting asiakaspalvelu@messukeskus.com or tietosuoja@messukeskus.com.

12. Right to Lodge a Complaint with a Supervisory Authority

If you believe that we do not process your personal data in accordance with applicable data protection legislation, you may lodge a complaint with a supervisory authority. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.

13. Changes

We may update this Privacy Notice if our operations, data protection principles or applicable legislation change. Unless otherwise stated, changes take effect when we publish the updated Privacy Notice.