Data protection policy for case management system (VirastoVahva)
Name of the register
Data protection policy for the customer register of the VirastoVahva case management system
Controller
Finnish Arts and Culture Agency (Kuvi)
Kaikukatu 2 C, FI-00530 Helsinki
+358 295 249 000, [email protected], www.taike.fi
Contact information for data protection officer
[email protected], tel. +358 295 249 000 (switchboard)
Purpose and legal basis of processing personal data
Matters handled by the Finnish Arts and Culture Agency (Kuvi) are recorded in the VirastoVahva case management system. VirastoVahva is a case management solution provided by the Government ICT Centre Valtori that meets the legal requirements for case management and archiving.
VirastoVahva is used to record, for example, requests for statements and clarifications received by Kuvi, as well as procurement and contract documents and other matters to be recorded. Government grant matters are processed using the Applyforgrants.fi service, so information regarding the processing of personal data related to government grant matters can be found in the data protection policy for the online service for government grant information (Applyforgrants.fi). The exception is the final report forms on the use of government grants, which are submitted to the Finnish Arts and Culture Agency temporarily using the Webropol survey tool. Final report forms submitted via the Webropol survey tool are archived in VirastoVahva.
The purpose of using the information is to process pending matters as required by law.
Valtori and its subcontractors are responsible for the technical maintenance of the case management system. The system is not connected to other IT systems.
The Finnish Arts and Culture Agency processes personal data in order to perform its statutory tasks. The tasks of the Finnish Arts and Culture Agency are regulated by the Act on the Finnish Arts and Culture Agency (511/2025).
Personal data in the register
Matters handled by the Finnish Arts and Culture Agency are recorded in the case management system and given a case number.
The scope of the data to be processed depends on the nature of the matter and what relevant data has been submitted to the Finnish Arts and Culture Agency.
Typically, we process at least the following personal data:
- Name of party who filed the matter
- Contact information of the party who filed the matter, for example, telephone number, e-mail address and/or postal address
- Description of the matter
- Information regarding the stages of the matter.
In matters related to fees and compensation paid by the Finnish Arts and Culture Agency, we also process personal ID numbers and bank account information.
Disclosure of data
Data is not as a rule disclosed to third parties. Data may be disclosed only to the extent required and permitted by applicable law. The basis for disclosing data may be, for example, the Act on the Openness of Government Activities (621/1999).
Transfer of data outside the EU or EEA countries
We transfer personal data outside the EU/EEA. We have safeguards related to the transfer of personal data.
Retention periods for personal data
The retention periods for personal data related to pending matters are determined in accordance with the Archives Act (831/1994), public archive regulations and Taike's archiving plan and information management plan. The retention periods will be confirmed later in the information management model of the Finnish Arts and Culture Agency.
Regular sources of data
Data is primarily provided by the data subjects themselves. In addition, data may be obtained from other authorities.
Technical and organisational security measures
Data is protected by data access rights management, the technical protection of databases and servers, the physical protection of facilities, access control, data traffic protection and data backups.
Automated decision-making
Personal data is not used for automated decision-making.
Rights of the data subject
Right to inspect
You can send a request to inspect your data to the data protection officer (contact information above). Be prepared to prove your identity.
Right to rectification
You have the right to rectify inaccurate and incorrect personal data about yourself. You can send a request in writing to the data protection officer (contact information above). Indicate in the request for rectification the data to be corrected and the exact changes or additions. Be prepared to prove your identity.
Right to erasure
Under Article 17 of the General Data Protection Regulation (GDPR), the data subject has the right to request the erasure of personal data concerning him or her from the register.
This right does not apply to personal data that the Finnish Arts and Culture Agency requires in order to perform its statutory tasks. Most of the Finnish Arts and Culture Agency’s services are based on compliance with a legal obligation or the performance of a task carried out in the public interest or the exercise of official authority. In these cases, you cannot request the erasure or transfer of your personal data to another system, nor, in principle, can you object to the processing of your personal data.
You have the right to demand that the Finnish Arts and Culture Agency delete personal data about yourself that is processed on the basis of your consent. You can send a request to erase your data in writing to [email protected]. Be prepared to prove your identity.
Right to appeal to the supervisory authority
If you believe that your personal data is being processed unlawfully, you can submit a complaint to the Office of the Data Protection Ombudsman.
Office of the Data Protection Ombudsman
Visiting address: Lintulahdenkuja 4, 00530 Helsinki
Postal address: P.O. Box 800, 00531 Helsinki
E-mail: tietosuoja(at)om.fi
Switchboard: +358 (0)29 566 6700
Registry: +358 (0)29 566 6768
Further information about submitting a complaint is available on the website of the Office of the Data Protection Ombudsman: https://tietosuoja.fi/en/home
Last updated on 17 June 2026