Skip to content
Descriptions of registers Register of Customers

Privacy Notice – Suomen Messut Oyj’s Corporate Customer Register

Last updated: 3 June 2026

This Privacy Notice describes the principles according to which Suomen Messut Oyj, as the data controller, processes the personal data of corporate customers’ contact persons for the purposes of managing customer relationships, providing services and developing its business.

1. Data Controller

Suomen Messut Oyj / Messukeskus
Messuaukio 1, 00520 Helsinki, Finland
Business ID: 0116322-3
asiakaspalvelu@messukeskus.com

2. Contact for Register Matters / Data Protection Officer

Messukeskus / Customer Service
asiakaspalvelu@messukeskus.com

3. Name of the register

Suomen Messut Oyj’s Corporate Customer Register

4. Purposes and Legal Bases of Processing, Personal Data Processed and Retention Periods

We collect, store and process personal data for predefined purposes and only on lawful grounds. The legal basis depends on the processing situation and the nature of the customer relationship.

Retention periods are based on the duration of the customer relationship, legal requirements and the need to maintain and develop customer relationships and services.

Customer relationship management and contracts

Managing corporate customer relationships, preparing and performing contracts, and managing event participation.

Personal data processed:

Legal basis: Contract. Processing is necessary for the performance of a contract.

Retention: For the duration of the customer relationship and for a maximum of 6 years thereafter.

Legal obligations

Accounting, invoicing and reporting to public authorities.

Personal data processed:

Legal basis: Legal obligation. Processing is based on applicable legislation.

Retention: 6–10 years in accordance with applicable legislation.

Customer relationship maintenance and communications

Customer service, event-specific communications, feedback and development of the customer relationship.

Personal data processed:

Legal basis: Legitimate interest in maintaining and developing the customer relationship.

Retention: For the duration of the customer relationship and for a maximum of 3 years thereafter.

B2B direct marketing

Communicating about events, services and offerings to corporate customers’ contact persons in relation to their professional duties.

Personal data processed:

Legal basis: Legitimate interest. Communications are based on the data subject’s professional role and duties. The data subject has the right to object to marketing at any time.

Retention: Until the data subject objects to marketing or for a maximum of 24 months from the most recent transaction.

Targeting and customer segmentation (profiling)

Targeting customer communications on the basis of the company’s industry, transaction history, participation and interests.

Personal data processed:

Legal basis: Legitimate interest in targeting customer communications and developing services.

Retention: For the duration of the customer relationship and for a maximum of 24 months from the most recent transaction, unless the data subject objects to such processing earlier.

Marketing measurement and development

Monitoring the effectiveness of communications, such as opens and clicks, and optimising marketing.

Personal data processed:

Legal basis: Legitimate interest in monitoring the effectiveness of communications and developing marketing. To the extent that measurement is based on non-essential cookies or similar technologies, the processing is based on consent in accordance with the applicable cookie policy.

Retention: A maximum of 24 months.

5. Cross-Marketing and Targeting

We may target marketing to a data subject on the basis of the industry of the company they represent, their job role, previous transactions, event participation and other information describing the customer relationship. Marketing communications relate to the data subject’s professional role and duties as a company representative.

We may communicate with the data subject about events, services and related offerings that are similar in content or professionally relevant to the business of the company represented by the data subject.

6. Sources of Personal Data

We primarily collect personal data from data subjects themselves when the customer relationship is established and during the relationship. We may also collect data when a person acts as a company representative, in connection with the use of services, from publicly available company and contact information sources and, on the basis of agreements, from partners.

7. Disclosure and Transfers of Personal Data, Including Outside the EU/EEA

Personal data is processed by Messukeskus employees and contractually bound service providers. In connection with events, personal data may also be processed jointly with another event organiser.

Some service providers may process personal data outside the EU/EEA, particularly in the United States. We use analytics and digital marketing services such as Google and Meta. Transfers are safeguarded under the EU–US Data Privacy Framework or by using the European Commission’s Standard Contractual Clauses (SCCs), together with any necessary supplementary safeguards.

8. Data Protection Principles

Personal data is processed in accordance with the principle of data protection by default. Access to personal data is restricted on a role-based basis, use is monitored and logged, and technical safeguards such as encryption and multi-factor authentication are used. Personnel are subject to confidentiality obligations.

9. Cookies and Measurement

The Corporate Customer Register as such is not based on online tracking. The use of online services is governed by a separate cookie policy under which non-essential cookies require consent.

10. Requirement to Provide Personal Data

Some personal data is necessary for managing the customer relationship and providing services. If this information is not provided, we may not be able to process a contract or provide a service.

11. Profiling and Automated Decision-Making

We use limited profiling to target customer communications. Profiling may be based, for example, on event participation, transaction history and interests. Profiling does not result in automated decisions that would have significant effects on the data subject.

12. Rights of the Data Subject

The data subject has the right to access their personal data, have inaccurate personal data rectified, request the erasure of personal data, restrict processing, object to processing, receive personal data in a portable format where applicable, withdraw consent and object to direct marketing.

These rights can be exercised by contacting asiakaspalvelu@messukeskus.com.

13. Right to Lodge a Complaint with a Supervisory Authority

The data subject has the right to lodge a complaint with the Office of the Data Protection Ombudsman.

14. Changes

We may update this Privacy Notice if our operations or applicable legislation change.