Updated 29 March 2019

The security of the personal data of media bank users is extremely important to Finlayson Oy. This data protection notice explains how we process the data of media bank (“image bank”, users when they use the service.

1. Controller

Finlayson Oy, business ID 1832849-3 (”Finlayson”)
Porkkalankatu 13 FL
00180 Helsinki

Image bank data protection contact person:
PR and Brand manager Julia Vierros

2. Purpose of processing of personal data and legal basis for peronal data processing

The purpose of processing the personal data is to provide and maintain the image bank service. Personal data are processed so the service can be provided to different user groups and to offer contact services and customer service related to the service.

The legal basis for personal data processing is a contract and the controller’s legitimate interest.

3. What personal data does Finlayson process?

The following data are gathered from image bank users:

  • first name
  • surname
  • email address
  • country
  • company
  • user group, e.g., internal, stores, media, export, retail or other

The data are primarily supplied by the users themselves. In addition, data related to the service, such as images uploaded by users, are gathered. You may also supply data when you contact Finlayson employees.

4. Who processes your personal data?

Your personal data are first and foremost processed inside the Finlayson organization and only by people who are entitled to process your personal data by virtue of their work duties. Your personal data are processed in the EU and EEA.

Your personal data are only processed by third parties when we use service providers in our operations – for example, for the purpose of developing or maintaining our services. We ensure the adequate protection of your personal data by concluding requirement-compliant processing contracts on processing. Service providers may only process your personal data for the processing purposes defined by Finlayson. Should you wish to know more about third parties which process your personal data, you may email

5. Data storage period

The service users’ data are reviewed and inactive users removed annually. A user is considered inactive when he or she has not used the service for 12 months.

6. Rights of the data subject

As a data subject you have the right to affect the processing of your personal data and to receive information about the processing. You will find information below on your rights as a data subject. Should you wish to exercise any of the rights below, we kindly ask you to contact the image bank data protection contact person, Juli Vierros, by email at

  • Right to inspect data
    You have the right to obtain confirmation as to whether or not personal data concerning you are being processed, and to inspect what data we have gathered about you.
  • Rectification of inaccurate personal data
    You have the right to ask us to complete or rectify inaccurate or incomplete personal data.
  • Right to erasure
    You have the right to have your personal data erased. In such a case, we will erase all personal data related to the image bank user account.
  • Restriction of processing
    In certain cases you have the right to restriction of processing. You may exercise your right when your data are in some respect inaccurate, for example. In such a case you have the right to demand the processing of your data be temporarily restricted until the accuracy of your data has been verified.
  • Right to data portability
    You may demand your personal data be transmitted to if we process personal data that you have supplied on the basis of a contract. In such a case we supply your personal data in a macine-readable format to allow you to store them yourself or transmit them to another controller.
  • Right to object to data processing
    In certain cases you have the right to object, for a justified reason, to the processing of your personal data. You have the right to object to personal data processing when we, for example, process your personal data on the basis of our legitimate interest. We then assess, on a case-by-case basis, whether there are still compelling legitimate grounds for processing your personal data.
  • Right to lodge a complaint with a supervisory authority
    If you think that we have processed your personal data unlawfully, you have the right to lodge a complaint about your personal data processing with a local supervisory authority.