Rights of the data subject

Right of access

The HSL Customer Register Privacy Statement and service-specific descriptions describe what data are processed in different services and for what purposes as well as outline the data storage principles.

HSL’s customers have the right to know what personal data concerning them is collected.

You can view and update your service-specific data in the following HSL’s mobile and online services:

  • HSL Mobile ticket (your information, purchase history)
  • HSL app (settings), new service being introduced
  • HSL account (your information, your routes)
  • City bike service (front page, HSL account users)
  • HSL card service (HSL card information, hsl.fi/kortti) and My Travel Card app for Android and Windows devices

HSL card customer information and HSL card information related to purchase and sales transactions are available as printouts from HSL service points by presenting a valid identification document. You do not need to have your HSL card with you.

You can read more about the data provided on request below in “Submitting a request to exercise data subject rights to HSL”.

Right to erasure (“right to be forgotten”)

You have the right to have your personal data erased from HSL’s systems if

  • the personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed,
  • you withdraw the consent on which the processing was based and there is no other legal basis for the processing,
  • you object to the processing of your data or there are no legitimate grounds for the processing of your personal data.

HSL cannot, on customer’s request, erase data whose processing is based on other legitimate grounds than the customer’s consent, and whose processing is still necessary or is necessary for compliance with HSL’s legal obligation. For such data, HSL has set storage periods after which the customer’s data are erased.

You can submit a request to erase your data in accordance with the instructions provided below in the section “Submitting a request to exercise data subject rights to HSL”.

Right to rectification

You have the right to demand HSL to correct inaccurate and incorrect personal data concerning you without undue delay. You have the right to have incomplete personal data completed by providing a supplementary statement to HSL.

Right to restriction of processing

You have the right to restrict the processing of your personal data if you contest the accuracy of your personal data. In such cases, the processing shall be restricted for a period enabling HSL to verify the accuracy of the personal data. The restriction of the processing of personal data means, for example, restricting the personnel’s right to process the customer’s personal data. HSL has the right to store the data whose processing has been restricted by the customer.

Right to object and right not to be subject to a decision based solely on automated processing (including profiling)

You have the right to object to the processing of your personal data and not to be subject to a decision based solely on automated processing, such as profiling, and which produces legal effects concerning you or similarly significantly affects you. The right to object to the processing of personal data shall not apply to data files of public bodies maintained on legal basis.

You have the right to object to the processing of your personal data for direct marketing and profiling. HSL will always obtain the customer’s consent to direct marketing and profiling. You can withdraw your consent at any time, in the same way in which you gave it.

You have the right to object to the processing of your location data in HSL’s online and mobile services. You can give and withdraw your consent to the collection and processing of your location data in HSL’s online and mobile services.

Right to data portability

You have the right to receive the personal data concerning you, which you have provided to HSL, in a structured, commonly used and machine-readable format and to transmit this data to another controller, where the processing is based on consent or an agreement and the data are stored electronically.

Right to be notified of a personal data breach

Where a personal data breach is likely to result in a high risk to the rights and freedoms of customers, HSL must notify customers of the data breach without undue delay.

The notification shall contain

  • A description of the data breach
  • The name and contact details of HSL’s Data Protection Officer from whom more information can be obtained
  • A description of the likely consequences to the customer
  • A description of the measures HSL proposes to take or has already taken to mitigate the possible adverse effects.

Right to file a complaint with a supervisory authority

You have the right to file a complaint with a supervisory authority if you consider there has been a breach in the processing of your personal data.

Supervisory authority: Office of the Data Protection Ombudsman, switchboard: +358 29 566 6700, email: tietosuoja@om.fi

Submitting a request to exercise data subject rights to HSL

You can submit a request regarding your data at an HSL service point. To submit a request, you need to present an identification document. The contact details of service points are available on HSL’s website at https://www.hsl.fi/en/customer-service.

HSL is developing an online service enabling you to submit a request regarding your data online. We will customers about the opening of the service on our website.

We will process your request as soon as possible and respond within 30 days of receiving the request. This may be extended by a maximum of two months where necessary, taking into account the complexity and number of the requests. HSL will inform the customer of any such extension and the reasons for it within one month of receiving the request.

The implementation of the access/erasure request must not have a detrimental effect on the rights and freedoms of other customers or data subjects. Consequently, HSL cannot, on customer’s or data subject’s request, provide or erase data where HSL cannot fully ensure that the person who has provided the data and the person making the request are the same.

You have the right to obtain a copy of the personal data being processed free of charge. If you request more than one copy, HSL can charge a reasonable fee corresponding to the administrative costs of fulfilling the request. HSL can provide data from the following services:

  • HSL card
  • HSL app (buyers of mobile season tickets)
  • HSL account
  • Customer panel

In addition, HSL can provide data subjects with data from the penalty fare register.

HSL is constantly developing its services and management of customer data. In the future, you will be able to obtain data from more services.

HSL shall inform the recipients to whom personal data has been disclosed about any rectification, erasure or restriction of the processing of personal data, unless this proves to be impossible or unless this proves impossible or involves a disproportionate effort.

Back to top