Privacy Statement – Collections

Controller
Gösta Serlachius Fine Arts Foundation (hereinafter Serlachius Museums)
Joenniementie 47

FI-35800 Mänttä
Business ID 0151144-3
Contact person of the controller: CFO Juha Roponen (forename.lastname@serlachius.fi)

Name of the personal data file system: Serlachius Museums’ Collection Registers

Purpose of personal data processing:

Recording, storing and researching the collection and making it accessible is a statutory task of professional museums, the performance of which requires the recording of information related to the collection (Museums Act 314/2019). In connection with the accumulation, cataloguing, research and collection services of the collection, personal data are stored to verify the legality of acquisitions, to record historical and provenance information, to verify the reliability of the information, to protect copyright and to ensure the appropriate use of personal data contained in the datasets.

The collection registers of the Serlachius Museums consist of electronic and analogue records and collection catalogues, collection management systems and electronic query systems.

Legal basis for processing the personal data:

The basis for processing personal data related to museum collections is the performance of a task carried out in the public interest pursuant to Article 6(1)(e) of the EU General Data Protection Regulation 2016/679. This is regulated in more detail in the national Data Protection Act 1050/2018. According to section 4 paragraph 4 of the Data Protection Act, research material and cultural heritage material containing personal data as well as the personal data included in their metadata can be processed for archiving purposes when such processing is necessary and proportionate both to the aim of the public interest pursued and to the rights of the data subject.

The processing of the personal data of donors of collection materials and customers of collection services may also be based on consent or legitimate interest.

Data content of the registers:

In the collection registers, personal data are contained in the operator register of the collection management systems, in the descriptive information and metadata of materials, in photographs (facial images), in digital or digitally created objects (archive collections), and in the information of registered users.

The registers store the personal data necessary for collection work and the production of collection services, such as a person’s name, date of birth, telephone number, address, email address and material order transactions. Personal history information is also stored in the registers.

Regular sources of information:

The information stored in the personal data systems is obtained from the individuals themselves, archive and memoir material, as well as public data sources such as archives, publications and websites or public registers maintained by third parties.

Regular disclosure of data:

Personal data related to the museum collection may be disclosed to customers of collection services and the parties concerned.

Data are regularly disclosed to the national Finna service with regard to metadata defined as public. Data scraping into the Finna index takes place via the OAI-PMH interface once a day.

For the purpose of managing and maintaining the collection, data may be disclosed to established and essential partners who have a contractual relationship with the Serlachius Museums. In addition, Serlachius Museums may outsource the processing of personal data to trusted service providers or subcontractors, for example in connection with the implementation of collection services.

The data in the registers are not disclosed for marketing purposes.Data are not transferred outside the EU countries.

Protection of the registers:

The processing, viewing and use of materials containing personal data are restricted by access and display restrictions. Only employees and technical maintenance personnel whose work requires access to personal data have access to personal data. Collection service customers gain access to collection descriptions and personal data contained in objects by accepting the collection’s terms of use. Collection service customers only see personal data to the extent necessary. Information systems are protected technically by commonly used methods, e.g. personal passwords. Digital material is stored in a secure cloud service in Europe and in locked premises at the museum. Analogue material is stored at the museum in locked premises to which access is restricted.

Rights of the data subjects:

Individuals have the right to check what information about them has been stored in the registers, and to request the correction of incorrect, inaccurate or incomplete information about them. In addition, individuals have the right to request that information about them be erased (the right to be forgotten). Individuals also have the right at any time to withdraw their consent to the processing of their personal data. The withdrawal of consent has no effect on processing carried out before the withdrawal.

According to Article 17(3) of the EU General Data Protection Regulation, however, the right to erasure, i.e. the right to be forgotten, does not apply when personal data are processed for archiving purposes in the public interest. Section 32 of the national Data Protection Act, in turn, allows for derogation for archiving purposes from the data subject’s rights referred to in Articles 15, 16 and 18–21 of the Regulation.

Inspection requests must be made in writing to the address:
Serlachius Museums
Joenniementie 47
FI-35800 Mänttä

Right of complaint

Data subjects have the right to file a complaint with the data protection authority if they consider that the processing of personal data violates the EU’s General Data Protection Regulation or national laws or decrees governing data protection.

This Privacy Statement was last updated on 28 May 2026.