Updated October 1st, 2026. In case of any discrepancy, the Finnish version prevails.

This notice explains how we process personal data on jyvaskylankesa.fi and puistojuhlat.fi, in our online store, and at Jyväskylän Kesä festival and Puistojuhlat events.

1. Data controller

Jyväskylän festivaaliyhdistys ry (Jyväskylä Festival Association, business ID 1062184-7)
Seminaarinkatu 13, 40100 Jyväskylä, Finland
kesa@jyvaskylankesa.fi

Questions and requests about data protection: kesa@jyvaskylankesa.fi

2. What data we process

• Customers and ticket buyers: name, email address, phone number, address, ordered products and tickets, order history, and payment status and method. We never receive card details.
• Order source: the channel that brought you to the store, such as a search engine, an ad or a newsletter. The store saves this with the order.
• Newsletter subscribers: email address, name if given, and whether newsletters are opened and links clicked.
• Customer service: the messages you send us and related information.
• Website use: IP address, browser and device information, and data from cookies and similar identifiers.
• Events: photos and videos in which you may appear.

3. Purposes and legal bases

• Processing orders, delivering and checking tickets, customer service, returns and complaints. Basis: contract.
• Event notices to ticket buyers, such as a cancellation, postponement or schedule change. Basis: contract.
• Accounting and other legal obligations. Basis: legal obligation.
• Newsletter. Basis: consent.
• Website analytics with Google Analytics. Basis: consent.
• Targeting and measuring ads on Facebook and Instagram. Basis: consent.
• Order source data, developing the store and preventing misuse. Basis: legitimate interest.
• Photographing events and festival communications. Basis: legitimate interest.

4. Advertising on Facebook and Instagram

If you accept marketing cookies, we use the Meta Pixel and Meta Conversions API. They tell Meta about page views, items added to the cart and purchases. For purchases, your email address and phone number are also sent in hashed form so that Meta can match the purchase to an account.

We use this data to measure ad results and to build audiences, such as site visitors, buyers and people similar to them. We are joint controllers with Meta for collecting and transferring the data. After that, Meta processes the data as an independent controller under the Meta Privacy Policy.

5. Photography at events

Our events are photographed and filmed. We use the photos and videos on our websites, on social media, in marketing, for the media and in the festival’s historical archive. If you do not want to be photographed, please tell the photographer.

You can ask us to remove a photo of you from our own channels by emailing kesa@jyvaskylankesa.fi.

6. Visitor surveys

We run visitor surveys with partners. Taking part is voluntary. The survey provider explains its own data processing in the survey. We only receive aggregated results that cannot identify individual respondents.

7. Who receives your data

We do not sell personal data. We use the following service providers, which process data on our behalf or as independent controllers:

• Euronic Oy: website and online store servers in Finland
• Website technical maintenance provider
• Paytrail Plc: card, online banking and mobile payments
• Epassi Finland Oy and Edenred Finland Oy: culture benefit payments
• Google: email (Google Workspace) and analytics (Google Analytics)
• Creamailer Oy: newsletters
• Meta Platforms Ireland Ltd: advertising, only with your consent

For tickets bought through Lippupiste, Lippupiste Oy is the controller. We disclose data to authorities when required by law.

8. Transfers outside the EU and EEA

Google and Meta may transfer data to the United States. These transfers rely on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

9. Retention

• Order and accounting data: six years from the end of the year in which the financial period ended.
• Customer account: until you delete it or ask us to delete it.
• Newsletter: until you unsubscribe.
• Customer service messages: up to two years after the matter is closed.
• Google Analytics: up to 14 months.
• Cookies: per cookie. Your cookie choice is stored for six months.
• Photos and videos: kept in the festival’s historical archive.

10. Cookies

• Necessary cookies keep the cart, login and your cookie choice working. They do not require consent.
• Analytics cookies (Google Analytics) show how the site is used. They are only used with your consent.
• Marketing cookies (Meta Pixel) measure and target advertising. They are only used with your consent.

You can change your choices at any time: Cookie settings.

11. Your rights

You have the right to:

• access your data and get a copy of it
• have inaccurate data corrected
• have your data erased
• restrict processing
• object to processing based on legitimate interest and to direct marketing
• receive the data you provided in a portable format
• withdraw your consent at any time

Send your request to kesa@jyvaskylankesa.fi. We reply within one month.

You also have the right to lodge a complaint with the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi).

12. Security

Our websites and online store are hosted on servers in Finland. We protect data with encrypted connections, restricted access rights and regular updates. Payment card details are handled by Paytrail and never reach us.

13. Changes

We update this notice when needed. The current date is shown at the top of the page.