Register and privacy policy

Helsinki Design Week

Updated 10 August 2026

This privacy notice explains how Luovi Productions Oy / Helsinki Design Week processes the personal data of customers, website visitors, event organisers, partners, and other contacts.

Data Controller

Luovi Productions Oy / Helsinki Design Week
Katajanokanlaituri 5
00160 Helsinki
Business ID 1085032-4
www.helsinkidesignweek.com

Contact Person for Data Protection Matters

Iris Korkman
iris.korkman(at)helsinkidesignweek.com

Whose Personal Data We Process

We process personal data relating to, for example, the following groups of individuals:

  • customers
  • event organisers and their contact persons
  • partners and their contact persons
  • individuals contacting us through website forms
  • visitors to the Helsinki Design Week website
  • recipients of communications and marketing

Purposes and Legal Bases for Processing Personal Data

Personal data may be processed for the following purposes:

Managing Customer, Event and Partnership Relationships

Personal data is processed for communications, event coordination, cooperation, maintaining customer relationships, and providing agreed services.

Depending on the situation, processing is based on the performance of a contract, measures taken prior to entering into a contract, or the legitimate interests of the data controller.

The legitimate interest is based on the data controller’s need to maintain and develop customer and partner relationships and manage related communications.

Responding to Enquiries

Information submitted through website forms, email, or other channels is processed to respond to enquiries and other contacts.

Depending on the situation, processing is based on the legitimate interests of the data controller or measures taken prior to entering into a contract.

Communications and Marketing

Personal data may be used for communications and marketing related to Helsinki Design Week’s activities, events, and services.

Processing is based on consent when consent is required. In other situations permitted by applicable legislation, processing may be based on the legitimate interests of the data controller.

Consent may be withdrawn and direct marketing may be objected to at any time.

Website Usage Analytics

We use Google Analytics 4 to analyse website usage and visitor traffic.

User consent is requested through the website’s cookie banner for non-essential analytics cookies and the related processing of personal data.

Consent preferences are managed using the Complianz solution.

Personal Data We Process

Depending on the purpose, we may process information such as:

  • name
  • organisation and position within the organisation
  • postal address
  • email address
  • telephone number
  • website address
  • social media or other online service addresses
  • information provided by the user in connection with an event or partnership
  • content of enquiries and other communications
  • information relating to customer and partner relationships

In connection with website use, and depending on the user’s consent, we may also process information such as:

  • browser and device type
  • operating system
  • pages viewed on the website
  • actions performed on the website
  • date, time, and duration of the visit
  • traffic source
  • approximate geographical location
  • information related to cookies and other technical identifiers
  • the user’s cookie consent choices

Directly identifying information, such as names or email addresses, is not intentionally sent to Google Analytics.

Sources of Personal Data

Personal data is primarily obtained directly from the data subject, for example:

  • through website forms
  • by email
  • through communications related to events and partnerships
  • during customer and partnership relationships
  • through other contacts initiated by the data subject

Information about an organisation’s contact persons may also be obtained from the organisation they represent or from public sources, such as the organisation’s website.

Technical and usage-related website data may be collected automatically from the user’s browser or device in accordance with the user’s cookie consent choices.

Cookies and Google Analytics 4

The Helsinki Design Week website uses essential cookies to enable the technical operation of the website.

With the user’s consent, statistical cookies and Google Analytics 4 may also be used to analyse website usage.

Google Analytics may be used to generate statistics on matters such as visitor numbers, page views, traffic sources, and activity on the website.

Depending on the service settings and the user’s consent, Google Analytics uses cookies or other technical identifiers.

Cookie-related consent preferences are managed using the Complianz solution. Users can change or withdraw their consent at any time through the website’s cookie settings.

More detailed information about the cookies in use, their purposes, and their retention periods is available on the website’s Cookie Policy page.

Recipients of Personal Data and Service Providers

The data controller may use service providers to process personal data on its behalf and for agreed purposes.

Depending on the implementation of the website and other activities, service providers may include:

Handpicked Cherries Oy

Sofiankatu 4
00170 Helsinki
Business ID 2757084-7
www.handpickedcherries.com

Gruppo Oy

Laivurinkatu 37
00150 Helsinki
Business ID 2190176-4
www.gruppo.fi

Into Digital Oy

Lapinlahdenkatu 1 B
00180 Helsinki
Business ID 2241331-6
into-digital.fi

Google Analytics is also used as the website’s analytics service provider.

Personal data may be provided to service providers for processing only to the extent necessary to provide the relevant service.

Personal data may also be disclosed to public authorities when required by law or by a lawful order issued by a competent authority.

Personal data is not sold to third parties.

Transfers of Personal Data Outside the European Economic Area

We aim to use service providers and processing solutions in a way that ensures an appropriate level of protection for personal data.

Some of the service providers we use, such as Google, operate internationally. As a result, personal data may in certain situations be processed or transferred outside the European Economic Area.

When personal data is transferred outside the European Economic Area, safeguards required by applicable data protection legislation are used, such as an adequacy decision approved by the European Commission, the EU-U.S. Data Privacy Framework, or standard contractual clauses approved by the European Commission.

Retention of Personal Data

Personal data is retained only for as long as necessary to fulfil the purposes described in this privacy notice or to comply with legal obligations.

Customer, event, and partnership information is generally retained for the duration of the customer or partnership relationship and thereafter for as long as there is a justified business or legal need to retain the information.

Information relating to an organisation’s contact person may be deleted or updated when the individual no longer represents the organisation and there is no other basis for retaining the information.

Information relating to enquiries is retained for as long as necessary to process the matter or for any justified follow-up.

Consent-based marketing data is processed until consent is withdrawn or there is no longer a purpose-based need to process the data.

In Google Analytics 4, the retention period for event-level data is set to 2 months and the retention period for user-level data to 14 months. The retention period for user data restarts when the user engages in new activity. These retention settings apply to user-level and event-level data in Google Analytics associated with cookies, user identifiers, and similar identifiers.

Data is deleted or anonymised when there is no longer a valid basis for retaining it.

Protection of Personal Data

Personal data is processed in electronic systems protected by appropriate technical and organisational measures.

Access to personal data is restricted to individuals whose work duties require them to process the data.

Access rights, user accounts, and other technical safeguards are used to prevent unauthorised use, alteration, disclosure, or loss of personal data.

Obligations relating to personal data processing and information security are agreed with service providers involved in processing personal data as required by applicable legislation.

Rights of the Data Subject

Depending on the situation and in accordance with applicable data protection legislation, the data subject has the right to:

  • receive information about the processing of their personal data
  • access personal data concerning them
  • request correction of inaccurate or incomplete information
  • request deletion of personal data
  • request restriction of the processing of personal data
  • object to the processing of personal data
  • receive personal data they have provided in a format that allows it to be transferred from one system to another when the conditions for this right are met
  • withdraw consent at any time
  • object to the use of personal data for direct marketing

Not all rights apply to every personal data processing situation. The applicability of these rights depends, among other things, on the legal basis on which the personal data is processed.

Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

Exercising Your Rights

Requests concerning personal data may be submitted to the data controller:

Iris Korkman
iris.korkman(at)helsinkidesignweek.com

Where necessary, the data controller may ask the person making the request to verify their identity.

Requests are processed within the time limits required by the General Data Protection Regulation.

Right to Lodge a Complaint with a Supervisory Authority

If a data subject considers that their personal data has been processed in violation of data protection legislation, they have the right to lodge a complaint with the competent data protection authority.

In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.

Changes to This Privacy Notice

We may update this privacy notice if the processing of personal data, the services we use, or applicable legislation changes.

The current version of this privacy notice is published on the Helsinki Design Week website.