Privacy Policy: GTK’s Online Services User Register
Updated: 4.11.2026
Data controller
Geologian tutkimuskeskus (Geological Survey of Finland)
P.O. Box 96, 02151 Espoo, Finland
Tel. +358 29 503 0000
gtk(at)gtk.fi
Contact person in matters related to the register
Jari Väätäinen
P.O. Box 96, 02151 Espoo, Finland
Tel. +358 29 503 0000
jari.vaatainen(at)gtk.fi
Contact details of the Data Protection Officer
tietosuojavastaava(at)gtk.fi
Tel. +358 29 503 0000
Purposes and legal grounds for processing of personal data
The purpose of processing is to manage and monitor orders placed by users of GTK’s online services, manage contacts and enquiries, develop the services, carry out reporting, and perform other activities related to the maintenance of the services.
Legal basis for processing personal data
The data subject is asked to provide consent to the processing of personal data when logging in to the service.
Data content
Data content of the register and categories of personal data
To log in to the service, users must provide and verify their email address and provide a password. No other personal data is requested.
Sources of personal data
The only source of personal data is the information provided by the data subject.
Retention period for personal data
The user’s personal data is normally deleted from the service immediately after the requested information has been delivered and, at the latest, if the personal data has remained unused for more than two years.
Whether the provision of personal data is a statutory or contractual requirement or a requirement necessary to enter into a contract
There is no statutory obligation to provide personal data. An email address is required to deliver the material ordered by the user.
Processing of personal data
Recipients or categories of recipients of personal data
Staff responsible for processing orders and maintaining the service.
Processing of personal data on behalf of the controller
Application developer Solita and the Government ICT Centre Valtori have access to personal data for maintenance purposes. The register is maintained in an information system provided by Microsoft Oy.
Transfers of personal data to third countries outside the EU/EEA
Personal data is not transferred to countries outside the European Union or the European Economic Area.
Automated decision-making and profiling
No automated decision-making or profiling is carried out.
Rights of the data subject
Exercising your rights
Data subjects may exercise their rights by submitting a request concerning their personal data to the controller, the Geological Survey of Finland (GTK), at the address provided above under “Controller”. To speed up the processing of the request, please specify the register to which the request relates.
Right to lodge a complaint with a supervisory authority
If a data subject considers that the processing of their personal data is contrary to the law, they may lodge a complaint with a supervisory authority in the Member State of their habitual residence or place of work, or in the Member State where the alleged infringement occurred.
In Finland, the matter may be referred to the Office of the Data Protection Ombudsman:
Postal address: PO Box 800, FI-00531 Helsinki, Finland
Email: tietosuoja(at)om.fi
Telephone: +358 29 566 6700
Right of access to personal data
The data subject has the right to obtain confirmation from the controller as to whether or not personal data concerning them is being processed and, where such personal data is being processed, the right to access the personal data.
Right to rectification
The data subject has the right to require the controller to rectify inaccurate or incorrect personal data concerning them without undue delay.
Right to restriction of processing
The data subject has the right to require the controller to restrict the processing of their personal data where:
- the data subject contests the accuracy of the personal data;
- the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead;
- the controller no longer needs the personal data for the purposes of processing, but the data subject requires it for the establishment, exercise or defence of legal claims; or
- the data subject has objected to the processing of their personal data pending verification of whether the legitimate grounds of the controller override those of the data subject.
Right to object
Where the processing of personal data is based on a task carried out in the public interest or on the legitimate interests of the controller or a third party, the data subject has the right to object to the processing of their personal data.
If the data subject exercises their right to object, the controller must cease processing the personal data unless the controller can demonstrate compelling legitimate grounds for the processing that override the rights and freedoms of the data subject, or the processing is necessary for the establishment, exercise or defence of legal claims.
The data subject has the right to object to processing without providing specific grounds where personal data is processed for direct marketing purposes.
Where personal data is processed for statistical or research purposes, the data subject may object to the processing on grounds relating to their particular situation. In such cases, the controller must cease processing the personal data unless the processing is necessary for the performance of a task carried out for reasons of public interest.
Right to erasure
Where the processing of personal data is based on a legal basis other than compliance with a legal obligation applicable to the controller or the performance of a task carried out in the public interest, the data subject has the right to request the erasure of their personal data.
The requested personal data will be erased unless the controller has a lawful basis for refusing the request, such as a statutory obligation to retain the data.
Right to withdraw consent
Where personal data is processed on the basis of the data subject’s consent, the data subject may withdraw their consent at any time by notifying the controller. See the contact details on the first page of this privacy notice.
Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
