Please note, that this is a translation of the original privacy statement in Finnish. If there are discrepancies between the translation and the original privacy statement, the original privacy statement is considered to be valid. 

1 Data controller and contact details

Name: Academic Engineers and Architects in Finland TEK
Address: Ratavartijankatu 2, FI-00520 Helsinki, Finland
Telephone: +358 (0)9 229 121
Business ID: 0117014-0

Enquiries concerning data protection should primarily be sent by email to the data controller’s data protection team at tietosuoja@tek.fi.

Data subjects may also contact the data controller in writing or in person. 

2 Data subjects

The CCTV system covers the main entrances and visitor lobbies (TEK lounges) at TEK premises.

CCTV involves the processing of personal data of people who move within the areas covered by the cameras, such as employees, TEK members and visitors.

3 Purposes and legal basis for processing personal data

Personal data is processed for the purpose of operating a recording CCTV system.
The purposes of CCTV are to protect property, prevent crime and misuse, and assist in investigating suspected or known crimes, misuse, damage or accidents that have already occurred. CCTV is also used to ensure the safety of TEK members, visitors and staff.

The legal basis for processing is the data controller’s legitimate interest in protecting property, ensuring the safety of TEK members, employees and visitors, preventing disturbances and financial losses, and investigating incidents.

4 Personal data processed

The personal data processed consists of video footage transmitted by the cameras covered by the CCTV system (without audio). In addition to the image, the date and time of events are recorded.

5 Sources of personal data

The source of the personal data is the video footage transmitted by the cameras included in the CCTV system.

6 Regular disclosures and transfers of personal data

As a rule, personal data is not disclosed to third parties.

CCTV recordings may be disclosed to the extent required and permitted by applicable legislation.

CCTV recordings may be disclosed to the police or other competent authorities for the investigation of offences or the performance of another statutory duty. Disclosure is always based on a specific request submitted by an authority.

CCTV recordings may also be disclosed where disclosure is necessary for the establishment, exercise or defence of legal claims or for handling an insurance claim.

7 Transfers of personal data outside the EU or EEA

Personal data is not transferred outside the European Union or the European Economic Area.

8 Retention period for personal data

Depending on the capacity of the recording device, personal data is retained for approximately four weeks and for no longer than one year. The data is destroyed by overwriting it with new data. Data may be retained for longer where this is necessary for a reason arising from the purposes of CCTV, such as investigating misuse.

9 Rights of the data subject

Under applicable data protection legislation, the data subject has the right at any time to:

• be informed about the processing of their personal data
• access their personal data and review the personal data concerning them 
• request the rectification of inaccurate or incorrect personal data and the completion of incomplete data
• request the erasure of their personal data
• object to the processing of their personal data on grounds relating to their particular situation, insofar as the processing is based on the data controller’s legitimate interests
• receive their personal data in a machine-readable format and transmit that data to another data controller, provided that the data subject has supplied the personal data to the data controller, the processing is based on a contract or the data subject’s consent, and the processing is carried out by automated means; and request restriction of the processing of their personal data
• withdraw their consent and object to the processing of their personal data insofar as the processing is based on the data subject’s consent

Requests concerning the exercise of data subject rights and other enquiries should be addressed to the data controller, whose contact details are provided in section 1 of this Privacy Notice.

The data controller may ask the data subject to specify their request in writing and verify the data subject’s identity before processing the request. The data controller may refuse to comply with a request on grounds provided for by applicable law.

10 Right to lodge a complaint with a supervisory authority

Every data subject has the right to lodge a complaint with the competent supervisory authority if they consider that the data controller has not processed personal data in accordance with applicable data protection legislation.

11 Data security

Personal data processed digitally is protected and stored in the data controller’s information systems, access to which is restricted to persons who need the data to perform their duties. These persons use two-factor authentication.
Workstations and storage media used by the data controller are encrypted.

12 Changes to this Privacy Notice

This Privacy Notice may be updated from time to time, for example when legislation changes. This Privacy Notice was last updated on 8 October 2026.