VR-Group Plc’s data protection notice on the use of images and videos

27.8.2025

1. Controller

VR-Group Plc (hereinafter referred to as “VR”)
Business ID: 1003521-5
P.O. Box 488, FI-00096 Helsinki, Finland
tel. +358 (0)29 4343

2. Data Protection Officer and contact information

The contact person for this register is:

VR-Group Plc, Communications Unit
PO Box 488, FI-00101 Helsinki, Finland
viestinta(a)vr.fi
Tel. +358 (0)29 434 7123

Data Protection Officer's contact information:

VR-Group Plc
Data Protection Officer
P.O. Box 488, FI-00096 Helsinki, Finland
tietosuojavastaava(a)vr.fi

3. Purpose of the processing of personal data

Photographic and video material and the personal data contained therein are processed for communications and marketing purposes, for example, on VR’s websites, social media channels, marketing materials and in various presentations and publications. Personal data is also processed in systems where the images and videos are stored and managed, such as VR’s image bank.

4. Processed personal data categories

VR processes photographs, videos, and marketing and communications materials and any personal data they contain, such as identifiable images, names and job titles. VR also processes username-related data in the systems where the images and videos are stored and managed.

5. Groups of data subjects

Data subjects are persons whose photos and videos are processed by VR for the purposes referred to in this data protection notice. Data subjects may be VR employees or external persons who have participated in VR’s filming and photography.

In addition, data subjects are users for whom usernames have been created for the systems in which the images and videos are stored and processed.

6. Legal basis of personal data processing

Personal data is processed on the basis of consent or an agreement. Consent is a voluntary, individual, informed and unambiguous declaration of consent by which the data subject accepts the processing of their personal data.

7. Sources of data

Images, videos and related personal data are primarily collected from the data subject in connection with the photography or filming. Personal data may also be collected from a partner, such as a photo agency.

8. Recipients of personal data

We use external parties to support the processing of personal data, including the maintenance and development of IT systems. These service providers process personal data commissioned by us and on our behalf. The data processing is in compliance with the current legislation and is always carried out in accordance with this data protection notice. This is ensured through, among other things, contracts between the companies.

Without statutory grounds, we will not disclose customer data to parties outside VR or parties other than those participating in the production of VR’s services.

9. Transfer or disclosure of data outside the EU or the EEA

Personal data will not be disclosed outside the EU or the European Economic Area or outside countries which the European Commission considers to have an adequate level of data protection, unless the adequate level of data protection has been ensured by means of contracts or in another manner required by law.

10. The data retention period or the definition criteria for the retention period

The retention period for images, videos and other potential personal data may vary depending on the material and the purpose of use. VR erases personal data in accordance with a schedule that is separately agreed in connection with the data collection.

11. Rights of data subjects

As a data subject, you have a right to your personal data processed by VR. You can exercise your rights by contacting the parties described in section 2.

We will respond to your request as soon as possible, nevertheless within one month. Below, we have listed the general rights of data subjects:

1. Right to access data

A data subject shall have the right to receive confirmation regarding whether their data have been processed by VR and to receive a copy of their personal data.

2. Right to rectification

A data subject shall have the right to request that VR rectify inaccurate or incorrect data regarding the data subject. The incorrect nature of data is to be decided on a case-by-case basis by resolving whether the data are incorrect from the viewpoint of the processing thereof (unnecessary, incomplete, outdated).

3. Right to erasure (“right to be forgotten”)

There is no right to erasure of your data when the storage of the data is necessary to comply with VR’s obligations based on applicable legislation.

4. Right to restriction of processing

In certain special situations stipulated by legislation, the data subject has the right to request the restriction of the processing of their personal data.

5. Right to data portability

You have the right to request your personal data in machine-readable file format. This right concerns data that is in electronic format and whose processing is based on consent or the performance of a contract.

6. Right to withdraw consent

In situations in which the processing of the data subject’s personal data is based on consent, you have the right to withdraw your consent. After the consent is withdrawn, the consent-based processing in question will be discontinued.

7. Right to lodge a complaint with an authority

We seek to resolve any disputes primarily directly with data subjects. If a data subject finds that we have not processed personal data as stipulated by law, the data subject may lodge a complaint with a data protection authority.

12. Principles of data protection

The data security of VR’s personal data processing as well as personal data confidentiality, integrity and accessibility are ensured with appropriate technical and organisational measures in accordance with VR’s data security principles. Personal data is protected against unauthorised access and illegal or accidental processing. Personal data is processed only by persons specifically appointed by VR to such tasks.