Privacy notice for the Asporto/Gettogym project

EU General data protection regulation, articles 12–14.

Date of preparation: 02 Septemper 2025

Information for participants in the Asporto/Gettogym project survey study

You are about to take part in the evaluation study of the Asporto/Gettogym project, which is being carried out at the Finnish Institute for Health and Welfare (THL). This notice describes how your personal data will be processed in the study.

Participation in the survey study is voluntary. There will be no negative consequences for you if you choose not to participate or if you decide to discontinue your participation. At the end of this notice, you will find more detailed information about your rights.

1. Information on the processing of personal data in the evaluation study

The study uses personal data as research material. The purpose of this notice is to provide information on the personal data being processed, as well as their sources and how they are used in the study. At the end of this notice, you will find more detailed information about the rights of data subjects.

2. Data controllers of the study

Finnish Institute for Health and Welfare (THL)
P.O. Box 30
00271 Helsinki
Tel. +358 29 524 6000

Contact person for matters concerning the study

Name: Teemu Vauhkonen
Phone number: +358 29 524 8399
Email: [email protected]

3. Data protection officer contact details

Email address of THL's Data Protection Officer: tietosuoja(at)thl.fi.

4. Researchers conducting the study

The data collected in the study will be processed within the research activities of the Finnish Institute for Health and Welfare (THL). The study is part of the Safe Streets programme, which is carried out in the Safety and Security Unit.

5. What information the research data contains

The research data collected through the surveys include information provided by participants about their background (e.g., family background, age, gender) as well as self-reported information on offending behaviour and victimisation experiences. In addition, the survey data will be supplemented with information collected by the project staff: the date of starting the activities and the number of participation occasions.

6. Sources of personal data

The research data are collected through an electronic survey.

7. How personal data are stored

The Finnish Institute for Health and Welfare (THL) is responsible for storing the data. Survey data are saved on a password-protected USB drive, which is kept in locked premises within THL's high-security environment. Access to the data is restricted to the institute’s facilities and protected by personal usernames and passwords. Entry to the premises is limited to THL staff only, and the facilities are secured with access control and a burglary alarm system. Access to the data is granted only to those who need it for the research activities of the evaluation project.

8. Sensitive personal data

The study involves processing the following special categories of personal data (i.e., sensitive personal data) in accordance with Article 9 of the GDPR: Race or ethnic origin.

The study involves processing information on victimisation experiences and offences, as well as related attitudes. The study also asks for the respondent’s background information and information about their family background.

9. Duration of personal data processing

Survey data will be collected between August 2025 and December 2026. The survey data will be destroyed once it is no longer needed for conducting the study or for verifying the accuracy of the results. However, the data stored by the Finnish Institute for Health and Welfare will be destroyed no later than the end of 2027.

10. Legal basis for processing personal data

Personal data are processed on the following basis in accordance with Article 6(1) of the General Data Protection Regulation (GDPR): Consent of the research participant.

If the processing of personal data is based on the participant's consent, the participant has the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of the processing carried out before the withdrawal.

11. Recipients of data

The Webropol application is used to carry out the electronic survey. Webropol is responsible for the technical security of its service and acts as a data processor on behalf of THL. Data will not be transferred or disclosed outside the European Economic Area.

12. Transfer or disclosure of data outside the EU and the European Economic Area

Data will not be transferred or disclosed outside the European Economic Area.

13. Automated decision-making

No automated decisions will be made.

14. Protection of personal data

Personal data are processed and stored in such a way that only persons who need the data for the study have access to them.

Data processed in information systems are protected in the following ways:

• Username
• password
• Access control

How manual material is protected: No manual material is collected in the study

Processing of direct identifiers: The controller collects personal data without direct identifiers.

15. Processing of personal data after the completion of the study

The research data will be destroyed.

Where the data will be archived and for how long: The data will not be archived. The data will be destroyed by the end of 2027.

16. What rights do data subjects have and possible derogations from these rights

The contact person for matters related to the rights of research participants is the person mentioned in Section 1 of this notice.

17. Rights of the data subject

Data protection legislation guarantees participants certain rights to ensure the protection of privacy as a fundamental right. If you wish to exercise your rights, please follow the instructions available here:
Data protection

Alternatively, you may contact THL's Registry Office [kirjaamo(at)thl.fi] or the contact person mentioned in Section 1. If THL is unable to identify you from the data, certain rights such as the right of access, rectification, and erasure do not apply.

Withdrawal of consent (Article 7 of the GDPR)

You have the right to withdraw your consent if the processing of personal data is based on consent. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Right of access (Article 15 of the GDPR)

You have the right to know whether your personal data are being processed in the study and which personal data are being processed. You may also request a copy of the personal data being processed.

Right to rectification (Article 16 of the GDPR)

If your personal data being processed are inaccurate or incorrect, you have the right to request their rectification or completion.

Right to erasure (Article 17 of the GDPR)

You have the right to request the erasure of your personal data in the following cases:

• the personal data are no longer necessary for the purposes for which they were collected or otherwise processed
• you withdraw the consent on which the processing is based, and there is no other legal basis for the processing
• you object to the processing and there are no overriding legitimate grounds for the processing
• the personal data have been unlawfully processed; or
• the personal data must be erased to comply with a legal obligation under Union or Member State law applicable to the controller.

Derogations from rights

The rights described above may be restricted on the legal grounds set out in data protection legislation, insofar as the rights would prevent or seriously impair the achievement of scientific or historical research purposes or statistical purposes. The need for derogation is always assessed on a case-by-case basis. If you wish to exercise your rights, please follow the instructions available here:
Data protection

Contacts

If you have any questions regarding your rights, please contact THL's Registry Office [kirjaamo(at)thl.fi] or the contact person of the study.