Privacy notice

Karm Productions Oy (SoundVault)
Business ID: 3306120-5
Address: Päivänkakkarantie 10, 02270 Espoo
Email for data protection matters: info@soundvaultfi.com

• Ticket buyers and visitors to our events
• Newsletter subscribers
• Visitors to our websites
• People who respond to surveys and polls
• People who contact us and senders of booking requests
• Applicants for jobs and internships
• Contact persons of partners, sponsors and artists

Ticket buyers and visitors

• Name, email address and phone number, if it is requested
• Order details: tickets, price, time of purchase and payment status. Payment card or bank account details are processed by the ticketing platform or the payment service provider, not by us.
• Voluntary answers to questions asked in connection with the ticket: favourite artists, reason for buying the ticket, how you heard about the event, interests, year of birth, and home town or country
• Information on which marketing channel the purchase came through: the ad click identifier and, if you allow analytics, the tracking link and campaign tag (UTM)
• Ticket check at the entrance: time and gate

Newsletter subscribers

• Email address, name if you give it, time of subscription, and message opens and clicks

Website visitors

• Data collected by cookies and similar technologies, such as your browser, device, the pages you visited and where you came to the website from. Marketing and analytics cookies are enabled only with your consent.
• Festival website visitor statistics in our Odin system: pages opened, time, device type, a random session identifier, time spent on the page, ticket choices and checkout steps, and the campaign tags (UTM) of the arrival link and the ad click identifier. These are collected only if you allow analytics, and no name, email address or payment details are linked to them. You can change your choice with the Privacy choices button at the bottom of the page. With the same choice, only link clicks are collected from SoundVault's link page.

Surveys and polls

• Your answers. Surveys are anonymous unless you give your contact details yourself.

Enquiries and booking requests

• Name, email address, phone number, organisation, information about the event or artist, the content of the message, and the correspondence that arises from handling the matter. The data are obtained from you or from the organisation you represent.

Job and internship applications

• Name and contact details, CV, application, information on skills and work history, and assessments and messages created during recruitment. Do not send health information or other sensitive data in your application unless it is essential for the role.

Partners

• Name, job title, company, work email and work phone, and contact history. The data are obtained from you, your company's website, LinkedIn or business information services.

When we obtain your contact details from someone other than you, we provide this notice at the latest at the time of our first contact with you or within one month of obtaining the data, whichever comes first.

Our legitimate interests are developing the event business and customer service, managing proper business and partner relationships, the safety of the service and the events, preventing misuse, and the establishment, exercise and defence of legal claims. Before processing, we assess its necessity and its impact on your rights. You can request more information about this assessment at info@soundvaultfi.com.

To place an order, the contact and order details marked as mandatory at checkout are required. Without them, we cannot enter into a ticket contract, deliver the ticket or handle entry. Keeping accounting data is a statutory requirement. Subscribing to the newsletter and answering preference and background questions are voluntary and do not affect buying a ticket or entry.

Electronic direct marketing to a natural person is, as a rule, based on prior consent. We may use an email address obtained in connection with a sale only to market our own events in the same product group or otherwise similar events, subject to the conditions of section 200 of the Act. In that case, we offer a clear, easy and free way to opt out both when the address is collected and in every message.

We may form groups based on purchase history, place of residence and voluntarily provided music preferences. The use of voluntary answers is based on consent; other direct marketing profiling is subject to the legitimate interest and the right to object described in this notice. As a result of profiling, you may receive marketing messages that match your group. It does not affect the ticket price, availability or entry, and no decisions based solely on automated processing that would have legal or similarly significant effects are made on its basis. You can always object to direct marketing and related profiling.

We do not sell or disclose your personal data to sponsors or partners. Sponsors receive only anonymous summaries, for example “34% of visitors are interested in audio”, and no summaries are made of groups so small that an individual could be identified.

We disclose personal data only to recipients who need the data to carry out the purposes described in this notice. Depending on the service and the contract, a recipient may act as a processor, a joint controller or an independent controller. We use the following categories of recipients:

• Ticket sales and payment: SoundVault Festival tickets are sold by Weeztix, which receives the buyer's details, the order, the click identifier of the arrival link and, if you allow analytics, the campaign tags. For other events, the ticketing platform chosen for them, such as Biletti.fi. In addition, the payment service providers named at checkout
• Email and newsletter: the email or newsletter service in use
• Website: technical hosting, content delivery and security services
• Other analytics and advertising: only services that have been enabled, and only when the required consent for the processing has been given
• Embedded media: the YouTube and Spotify players on the home page and the artist and talent pages load only when you choose that player
• Professional advisers and authorities, when the disclosure is necessary to perform a contract, because of a legal claim or under the law

Ticketing and payment services may also process data for their own statutory purposes. Their role and their own privacy information are shown at checkout before you place the order.

We transfer personal data outside the EU and EEA only if the transfer has a basis under Chapter V of the EU General Data Protection Regulation. A transfer to a recipient in the United States is based on the EU–US Data Privacy Framework only if the receiving legal entity holds a valid certification. Otherwise, we use, for example, standard contractual clauses approved by the European Commission and assess the supplementary measures needed. You can request more information and a copy of the applicable safeguards at info@soundvaultfi.com.

• Personal data contained in accounting vouchers and other statutory accounting records: at least 6 years from the end of the calendar year in which the financial year ended
• Voluntary ticket survey answers and the customer profile formed from them: until you withdraw your consent or for no more than 5 years from your last purchase, whichever comes first; we regularly assess whether keeping them is necessary
• Ticket check data: 12 months from the event
• Newsletter: until you unsubscribe
• Direct marketing opt-out: the minimum necessary data is kept so that the opt-out is respected
• Enquiries and booking requests: for as long as the matter is being handled and for no more than 12 months after it is closed, unless a contract, a legal obligation or a legal claim requires longer retention
• Job and internship applications: for the duration of the recruitment and after that only for as long as necessary to handle the rights and obligations related to the selection decision
• Strictly necessary browser storage and external media loaded with consent: for the period that the cookies page states
• Festival website visitor events in Odin: 30 days, after which only aggregated daily statistics are kept
• Partner data: 3 years from the last contact

Which rights apply depends on the legal basis of the processing and on the situation. You have the right to:

• know what data we process about you, and receive a copy of it
• request the rectification of inaccurate data
• request the erasure of your data when there is no statutory or legal claim related ground for keeping it
• request the restriction of processing
• transfer the data you have given us and that is processed by automated means to another service, when the processing is based on consent or a contract
• object to processing based on legitimate interest, and opt out of direct marketing at any time
• withdraw your consent at any time; withdrawal does not affect the lawfulness of earlier processing. You can withdraw your consent to analytics with the Privacy choices button at the bottom of the page.

You always have an unconditional right to object to the processing of your personal data for direct marketing, including related profiling. When you object to direct marketing, we no longer process your data for this purpose.

Send your request to info@soundvaultfi.com. We respond without undue delay and at the latest within one month. We may ask for the additional information needed to verify your identity. If a request is complex or there are several requests, we may extend the time limit by no more than two months, and we will tell you so, with the reasons, within the first month. You can unsubscribe from the newsletter with the link at the end of every message.

If you consider that the processing of your data breaks the law, you can lodge a complaint with the Office of the Data Protection Ombudsman.

We protect personal data with technical and organisational measures appropriate to the risks. We restrict access rights according to job duties, use personal user accounts and secure authentication methods, protect data in transit, and maintain procedures for backups and for managing security incidents. We review our security measures regularly.

We update this notice when our processing changes. The date of the update is shown at the top of the page.