Registry and Privacy Statement

This is a registry and privacy statement in accordance with the EU General Data Protection Regulation (GDPR) included in the 3J Tickets service. Prepared on June 30, 2024. The latest amendment was made on March 17, 2025.

1. General Information

3J Tickets (hereinafter "Service") is a free online service produced by 3J Tickets Oy (Business ID 3452258-7, hereinafter "Data Controller") through which a customer (hereinafter "Customer") can search and book public transport journeys, journey chains, and purchase and reload single, series, and season tickets.

2. Data Controller and Contact Person

3J Tickets Oy
Kiilakuja 6, 11130 Riihimäki
jyri.niemimuukko@3jtickets.fi

3. Registry Name

3J Tickets Oy acts as data controller or personal data processor for personal data that the Customer provides for use of the Service to purchase travel tickets. Such personal data provided for use is maintained in the following registries for which 3J Tickets Oy is responsible: customer registry, marketing registry, stakeholder registry, and web service user registry.

4. Legal Basis and Purpose of Personal Data Processing

The legal basis for personal data processing in accordance with the EU General Data Protection Regulation is the contract arising from the purchase of scheduled transport between the Service and the Customer, in which the data subject is a party.

The purpose of personal data processing is to enable the implementation of the public transport payment system as well as communication with customers, maintaining customer relationships, and marketing.

Data is not used for automated decision-making or profiling.

5. Registry Data Content

Data stored in the registry includes: person's name, social security number (in connection with school travel subsidized ticket products), date of birth, company/organization, contact information (phone number, email address, street address), network connection IP address, information about ordered services and their changes, billing information, and other information related to customer relationships and ordered services.

Website visitors' IP addresses and cookies necessary for service functions are processed on the basis of legitimate interest, among other things, to ensure information security and to collect statistical information about website visitors in cases where they can be considered personal data. Consent is requested separately for third-party cookies when necessary.

6. Regular Data Sources

Data stored in the registry is obtained from customers, among other things, as information stored in the Service, through social media services, from contracts and other situations where the customer provides their information.
Contact information of companies and other organizations' representatives may also be collected from public sources such as websites, directory services, and other companies.

7. Regular Data Disclosures and Data Transfer Outside the EU or EEA

Data is not regularly disclosed to other parties except what is necessary for implementing the public transport service purchased by the Customer. Information about the Customer's purchased service as well as the Customer's contact information is disclosed to the public transport service provider or authority acting as the client within the Service. Data is not transferred to the United States without explicit consent from data subjects.

8. Registry Protection Principles

Registry processing follows due diligence and data processed through information systems is appropriately protected. When registry data is stored on Internet servers, their hardware's physical and digital security is properly maintained. The data controller ensures that stored data as well as server access rights and other information critical to personal data security are handled confidentially and only by employees whose job description includes this.

9. Right of Access and Right to Demand Correction of Information

Every person in the registry has the right to check the data stored about them in the registry and demand correction of any incorrect information or completion of incomplete information. If a person wants to check the data stored about them or demand correction, the request must be sent in writing to the data controller. The data controller may request the requester to prove their identity if necessary. The data controller responds to the customer within the time specified in the EU Data Protection Regulation (generally within one month).

10. Other Rights Related to Personal Data Processing

A person in the registry has the right to request deletion of personal data concerning them from the registry ("right to be forgotten"). Similarly, data subjects have other rights under the EU General Data Protection Regulation, such as restriction of personal data processing in certain situations. Requests must be sent in writing to the data controller. The data controller may request the requester to prove their identity if necessary. The data controller responds to the customer within the time specified in the EU Data Protection Regulation (generally within one month).

11. Cookies

We use cookies and similar technologies in 3J Tickets services to ensure proper service functionality and improve user experience. Through cookies, we maintain, for example, web service login information and personal settings related to application use. Cookies do not cause harm to your device and cannot spread viruses or malware.

When marketing or statistical cookies are in use, you can modify your cookie-related consents through the management page. If cookies are limited to only those necessary for system operation, the management page is not visible.