Privacy Notice – Suomen Messut Oyj’s Access Permit Register
Last updated: 3 June 2026
This Privacy Notice describes the principles according to which Suomen Messut Oyj, as the data controller, collects and processes personal data for granting access permits, managing access and ensuring security on Messukeskus premises.
1. Data Controller
Suomen Messut Oyj / Messukeskus
Messuaukio 1, 00520 Helsinki, Finland
Business ID: 0116322-3
asiakaspalvelu@messukeskus.com
Tel. +358 40 450 3250
2. Contact for Register and Data Protection Matters
Messukeskus / Customer Service
Messuaukio 1, 00520 Helsinki, Finland
asiakaspalvelu@messukeskus.com
tietosuoja@messukeskus.com
3. Name of the Register
Suomen Messut Oyj’s Access Permit Register
4. Purposes and Legal Bases of Processing, Personal Data Processed and Retention Periods
We process personal data for predefined purposes and only on lawful grounds. The primary purpose of the Access Permit Register is to grant access rights, manage access and ensure security on Messukeskus premises during construction, dismantling and event periods.
We do not use the Access Permit Register for marketing without separate consent. Retention periods are based on the management of access rights, ensuring security and the need to investigate potential misuse or establish, exercise or defend legal claims.
Granting and managing access permits
Creating access permits, managing their validity, defining permitted areas and managing access permit identifiers.
Personal data processed:
- Name
- Company or organisation
- Role, such as constructor, performer or other event operator
- Contact details: email address, telephone number and address
- Permitted areas and validity period
- Access permit identifier or number
Legal basis: Legitimate interest. Processing is necessary to grant access rights, implement access management and ensure the security of Messukeskus premises and events. Where the data subject is personally a contracting party, for example a sole trader, processing may additionally be necessary for the performance of a contract.
Retention: For the duration of the event and construction period and for a maximum of 12 months after the end of the event, unless longer retention is necessary for the establishment, exercise or defence of legal claims.
Security and access control
Identifying individuals, monitoring movement and, where necessary, investigating misuse.
Personal data processed:
- Access permit data
- Entry and exit records
- Other log data relating to use of the access permit
Legal basis: Legitimate interest. Processing is necessary for security, access control and investigating misuse.
Retention: Log data is deleted within 12 months at the latest unless a case-specific investigation or the defence of a legal claim requires longer retention.
Operational communications relating to the access permit
Delivering the access permit and sending practical instructions concerning it, such as a link sent by email or a separately selected SMS link.
Personal data processed:
- Name
- Email address
- Telephone number, only where provided and SMS delivery has been selected
- Event information, pass type and validity
Legal basis: Legitimate interest. Processing is necessary to deliver the access permit, enable practical use of the access right and ensure that the event is organised safely. Where the data subject is personally a contracting party, processing may additionally be necessary for the performance of a contract.
Retention: For the duration of the event and construction period and for a maximum of 12 months after the end of the event, unless longer retention is necessary for the establishment, exercise or defence of legal claims.
Event-specific use of a photograph on an access permit
Using a photograph on an access permit or for identifying an individual only where required for the relevant event.
Personal data processed:
- Photograph
Legal basis: Legitimate interest. Processing is necessary to ensure identification and security.
Retention: The photograph is retained for no longer than the same retention period applicable to other access permit information and is deleted at the latest when that retention period expires.
5. General Information on Retention Periods
We do not retain personal data for longer than necessary for the purposes described in this Privacy Notice or for longer than required or permitted by law. Personal data may be retained for a longer period where necessary for the establishment, exercise or defence of legal claims.
6. Sources of Personal Data
We primarily collect personal data from data subjects themselves through access permit applications and forms, and from parties ordering access permits, such as exhibitors, event clients or other parties requiring access permits. Data may also be obtained from internal functions of Suomen Messut Oyj responsible for event production and practical arrangements.
7. Disclosure and Transfers of Personal Data, Including Outside the EU/EEA
Personal data is processed only by Messukeskus employees and contractually bound service providers, such as providers of access control and access permit systems. Personal data may be disclosed to the event client or another party involved in organising the event to the extent necessary to implement the access permit process and ensure security.
Personal data may be processed outside the EU/EEA only where the transfer has a lawful basis under applicable data protection legislation. Transfers are primarily safeguarded under the EU–US Data Privacy Framework or by using Standard Contractual Clauses (SCCs) approved by the European Commission, together with any necessary supplementary safeguards.
8. Data Protection Principles
We process personal data with due care and protect it using appropriate technical and organisational measures. Access to personal data is restricted on a role-based basis to employees and contractual partners whose duties require such processing. Use may be monitored and logged as part of information security and access control.
9. Requirement to Provide Personal Data and Consequences of Not Providing It
Certain personal data must be provided in order to issue an access permit and manage access rights. If the required information is not provided, an access permit may not be issued. Providing a telephone number is necessary only if the data subject also wishes to receive the access permit link by SMS and separately selects this delivery method.
10. Profiling and Automated Decision-Making
We do not use data contained in the Access Permit Register to make automated decisions that produce legal effects concerning the data subject or similarly significantly affect the data subject.
11. Rights of the Data Subject and How to Exercise Them
Under applicable data protection legislation, the data subject has the right to access their personal data, rectify data, erase data, restrict processing, object to processing based on legitimate interest, receive their data in a portable format where applicable, and withdraw any consent where processing is based on consent.
These rights can be exercised by contacting asiakaspalvelu@messukeskus.com or tietosuoja@messukeskus.com.
12. Right to Lodge a Complaint with a Supervisory Authority
If you believe that we do not process your personal data in accordance with applicable data protection legislation, you may lodge a complaint with a supervisory authority. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.
13. Changes
We may update this Privacy Notice if our operations, data protection principles or applicable legislation change. Unless otherwise stated, changes take effect when we publish the updated Privacy Notice.