WE UPDATED OUR DATA SECURITY POLICY ON 25 MAY 2018.
Yle’s services are governed by the principles of personal data protection
YOUR PRIVACY IS IMPORTANT TO US
Yleisradio Oy (hereinafter “Yle”) is committed to protecting the privacy of the users of its services and observes in its operations the legislation concerning privacy protection and best privacy practices. This privacy statement describes the practices concerning the collection and processing of personal data at Yle. “Personal data” by which a person can be identified either directly or indirectly.
This privacy statement applies when Yle is the controller of the personal data register and when we refer to the application of this privacy statement in connection with the use of Yle’s services. We may also provide additional information related to data protection in connection with a specific service, website or application.
The basis for processing personal data may be an agreement between the user and Yle (e.g. creating an Yle ID), the user’s other pertinent connection to Yle’s services (e.g. using Yle Areena), or the user’s consent (e.g. participating in a competition for viewers). Your personal data may also be processed when it is needed in order to protects Yle's legitimate interests. Applications published by Yle that you download may also process your personal data.
Yle’s services can be offered on various device platforms, and the services may include links or access to the websites or services of other parties. Yle’s services can be used, for instance, with a smart TV, mobile device or application provided by an external party with its own, independent privacy policies and terms and conditions of use. Applications downloaded from an application store, such as the Apple App Store, Google Play or Microsoft Store, are also subject to the terms and conditions of the service provider in question. We recommend that you carefully review the privacy policies and terms and conditions of such external parties. Yle is not responsible for the privacy policies or terms and conditions of external parties.
If you do not accept the policies described in this privacy statement, we do not recommend that you submit your personal data to Yle. Most of Yle’s services can be used without registration or by using a pseudonym, instead of your real name, in which case you do not need to submit your personal data.
What information do we collect?
Yle may collect information about its users necessary for the purposes defined in this privacy statement. The purpose determines what kind of information is collected about the users in different situations.
Your personal data may be collected when you register as a user of Yle’s services, when you use the services, in connection with competitions, campaigns or surveys, and otherwise when you do business with us. Among other information, Yle collects personal data belonging to the categories specified below.
1. The information you provide to Yle
In connection with various services, we may ask you for information that you may choose to provide to Yle:
- Your basic information and information related to authentication, such as name, pseudonym, password or other form of identification, e-mail address and other comments you provide in Yle's online service
- Information describing and relating to the user, such as date of birth and gender, interests, favourites preferred topics, language and other such selections, comments you provide in Yle’s online services, details of the devices you use, and other information related to content production and programmes.
- Feedback information, such as customer feedback
- Permission and consent
- Information related to competitions and raffles
- Research and survey information
- Other information provided or submitted with your consent, such as information collected from external sources.
We collect data through various means, for instance, when you enter information during registration, when using a service or when participating in Yle’s competitions, prize draws or surveys.
2. Information observed and derived during the use of services
We may collect the following information of you and your use of Yle’s services:
- Customer communication information, e.g. information on clicking links
- The webpage from which you came to Yle’s webpage
- Device IDs, such as terminal device model and the individual device and/or cookie ID, operating system of the terminal device
- Channel of data collection: web browser, mobile browser, application and browser version
- IP address
- Session ID, session time and duration
- Information that can be connected to the user based on the usage history of Yle’s services, derived from the observed usage and/or information the user has provided, e.g. demographics, interests and other user grouping.
- Other information collected with your consent.
- Location information if you have provided your express consent for it
Yle’s services and functions based on location information utilise satellite, IP address or other network-based positioning information. The use of assisted positioning methods, such as assisted GPS, may include the exchange of your location information and device- and operator-specific identifiers with a positioning server. When you use our services that are based on location information, such as local content or location-based emergency bulletins, your location information is sent with your consent to Yle for the purpose of providing the appropriate content.
3. Personal data relinquished to us
With your consent, we obtain information about your home municipality from the Population Register Centre in order to offer you the possibility to use Yle Areena in other EU countries.
Why do we process personal data?
We process your personal data in association with one or more of the purposes defined below.
1. Providing services
Your personal data can be used for the implementation of Yle’s services, for user identification and for making Yle’s services more personal, interactive and user-friendly, e.g. by enabling the use of Yle’s services on your different devices, by providing you with recommendations on potentially interesting content, by enabling various polls and competitions, and by showing you targeted content in our services. Your personal data may also be used for responding to your requests and questions, implementing the choices you make and performing other comparable tasks, ensuring data security, and preventing the misuse of services.
2. Developing services
Your personal data may be used for developing Yle’s services and for improving the user experience. Your personal data may be used for questionnaires and surveys related to Yle’s services and content, for processing feedback, as well as for implementing coverage and usage analyses related to audience surveys. We may connect information collected through different services and applications to the extent that the information has been collected for the same purpose, and we may create statistics as required for the purpose of developing services and applications.
3. Service and customer communication
Yle may send you important and essential information concerning the content and features of the service and considers the communication to be of direct benefit to you. In that case, the communication is based on the pertinent connection between the parties and is justified from the service provider's perspective, considering the justified expectations the user has of Yle.
As a user of Yle ID, you will receive regular e-mails with information on the benefits of using the ID and content provided by Yle. We may contact you in matters related to customer service or our services and send you personalised recommendations about new content. You can manage customer communication through your Yle ID profile.
How do we store and connect personal data?
According to what has been described above, Yle’s services may store information on the use of Yle’s services to facilitate various functions. Yle stores information observed and derived during the use of services separate from the actual personal data register used to identify a user. Information observed and derived during the use of services is stored using surrogate keys from which an individual user cannot be identified. A surrogate key is a personalised technical ID containing a random series of numbers and letters.
Do we disclose personal data?
As a rule, Yle does not sell or otherwise disclose your personal data outside Yle. However, Yle may disclose your personal data outside Yle in the following situations:
1. Your consent
Your personal data can be disclosed with your express consent, for instance, to a service provided by an external party.
As a rule, your personal data is not shown to other users of Yle’s services, but in some services, you can choose to share, for instance, your alias or other information with other users. We advise you to consider carefully before sharing your personal data or other information with other users.
3. Subcontractors and service providers
Yle may use subcontractors and service providers for the technical maintenance of its services, customer service, the administration and analysis of user information, surveys, customer communications or the implementation of various campaigns. Your personal data is only disclosed to Yle’s subcontractors or service providers to the extent that they participate in the implementation of Yle’s services and the purposes described in this privacy statement.
The service providers may not use your data for any purposes other than those described in this privacy statement and defined by Yle. Yle obligates them to maintain the privacy of your information and to ensure a sufficient level of data security to protect your personal data.
4. International transfer of data
Yle seeks to primarily implement services and process your personal data utilising operators and services located within the EU or EEA. However, in some cases, Yle’s services may be implemented using operators, services and servers located elsewhere, in which case your personal data may be transferred between different countries. Such transfers may include moving personal data outside the EU or EEA to countries with legislation concerning the processing of personal data that deviates from the requirements of the Finnish legislation, such as the United States. Even then, Yle ensures a sufficient level of protection for your personal data, among other things, by agreeing on matters related to the privacy and processing of personal data as required by legislation using e.g. the model agreement provisions approved by the European Commission and otherwise so that the processing of personal data takes place according to this privacy statement.
5. Research use
In some cases, we may disclose information for scientific or other research, provided that the information in question has first been converted to a form in which individual persons are no longer identifiable.
6. Disclosure due to mandatory legislation
Your personal data may be disclosed according to the demands of competent authorities and relevant legal prerequisites.
How do we keep the data up to date?
We strive to keep the personal data in our possession accurate through reasonable measures by removing unnecessary information and updating outdated information.
Some of Yle’s services allow users to administer the personal data, selections and consents we collect themselves. We advise you to regularly check the accuracy of your data using these functionalities. Please note that it is your responsibility to update the personal data you provide to us if it changes.
What do we do to protect your personal data?
We pay particular attention to privacy protection and data security in the design, implementation and maintenance of our services. We use appropriate physical, technical and administrative security measures to protect your personal data against misuse. Persons have been specifically appointed to take care of privacy protection and data security. We restrict access to systems and databases containing personal data to the appointed persons who have an essential work-related need and the right to process the personal data in question.
We implement privacy protection and data security, among other things, through the preventive risk management measures, by taking privacy protection and data security into account in the design of our services, by training our personnel and by regularly inspecting the compliance of our services. We respond to risks related to the misuse of data and other comparable risks, taking into account the probability of the risk and the nature of the data to be protected.
Yle may also use subcontractors and service providers for implementing its services and processing personal data. In this case, we ensure through agreements and other arrangements that your personal data is processed in accordance with legislation, best data security practices and this privacy statement.
How long do we store your data?
We store your data according to the relevant legislation and only for as long as is necessary for the purposes defined in this privacy statement. After the basis for processing your personal data has ended (e.g. when you delete your Yle ID), we will delete your personal data.
The user is considered to have terminated the account they have registered, such as Yle ID, if they have not logged in using their user ID for two years. In such a case, Yle will remove the data the person has provided from the user information database and delete the user ID, after which nobody (not even the user in question) can take it into use again. Information observed and derived during the use of services is turned into a format in which an individual cannot be recognised any more.
Please note that some of Yle’s services may include public, interactive and communicative functionalities, such as comments sections or discussion boards, and your alias and the content you have produced may remain visible in them even after you have terminated the user ID you have registered or your user relationship has ended.
What rights do you have?
You have the legal right to inspect the data we have collected concerning you. You also have the right to request the correction or deletion of incorrect, defective, unnecessary or outdated personal data.
You can exercise your rights by sending a request to us through Yle’s data protection site yle.fi/tietosuoja. You can also exercise your rights by utilising the settings available on your device, in our applications or in our services.
You can yourself manage your data and exercise your rights in your own profile while logged in with your Yle ID. Through the message setting of the ID, you can influence what customer communication you wish Yle to send you. However, we may still send you notification concerning our services, such as information on features, changes or service failures and interruptions. You can delete your Yle ID, if you wish.
Changes to this privacy statement
Who is the data controller and how can I contact them?
The controller of your personal data is Yle, the Finnish Broadcasting Company, at the address Uutiskatu 5, 00024 Yleisradio.
In matters concerning privacy protection, you can send e-mail to firstname.lastname@example.org.