Registry and privacy policy

This is the EU General Data Protection Regulation (GDPR) compliant register and privacy policy for the 3J Tickets service. Created on 30.6.2024. Last modified on 17.3.2025.

1. General

3J Tickets (hereinafter “the Service”) is a free online service provided by 3J Tickets Oy (business ID 3452258-7, hereinafter “the Controller”), through which the customer (hereinafter “the Customer”) can search and book public transport journeys, travel packages and purchase and top up single, series and season tickets.

2. Data controller and contact person

3J Tickets Oy
Kiilakuja 6, 11130 Riihimäki
jyri.niemimuukko@3jtickets.fi

3. Name of the register

3J Tickets Oy acts as the controller or processor of the personal data that the Customer provides to the Service in order to purchase a ticket. Such personal data submitted for use is maintained in the following registers for which 3J Tickets Ltd is responsible: the customer register, the marketing register, the stakeholder register and the online service user register.

4. Legal basis and purpose of the processing of personal data

The legal basis for the processing of personal data under the EU General Data Protection Regulation is the contract between the Service and the Customer for the purchase of a charter trip to which the data subject is a party.

The purpose of the processing of personal data is to enable the implementation of the public transport payment system and to communicate with customers, to maintain customer relations and for marketing purposes.

The data will not be used for automated decision-making or profiling.

5. Data content of the register

The data stored in the register include: name, social security number (in the case of a school travel ticket product), date of birth, company/organisation, contact information (telephone number, e-mail address, street address), IP address of the network connection, information on ordered services and changes thereto, billing information and other information related to the customer relationship and ordered services.

The IP addresses of visitors to the website and the cookies necessary for the functioning of the service are processed for legitimate interests, such as ensuring security and collecting statistics on visitors to the website in cases where they can be considered as personal data. Third party cookies are subject to separate consent where necessary.

6. Regular data sources

The information stored in the register is obtained from the customer, for example, through information stored in the Service, social media services, contracts and other situations in which the customer discloses his/her information.
Information from contact persons of companies and other organisations may also be collected from public sources such as websites, directory services and other companies.

7. Regular disclosures and transfers of data outside the EU or EEA

Data will not be regularly disclosed to parties other than those necessary for the provision of the public transport service purchased by the Customer. The data relating to the service purchased by the Customer and the Customer's contact details are disclosed to the provider of the public transport service or to the subscriber acting as a public authority within the Service. Data will not be transferred to the United States without the express consent of the data subjects.

8. Principles of register protection

The register will be processed with due care and the data processed by the information systems will be adequately protected. Where the data is stored on Internet servers, the physical and digital security of the hardware is adequately ensured. The controller shall ensure that stored data, as well as access rights to servers and other information critical to the security of personal data, are treated confidentially and only by employees whose job description includes this.

9. Right of inspection and request for correction

Every person in the register has the right to inspect the data recorded in the register and to request the correction of any inaccurate data or the completion of incomplete data. If a person wishes to check or request the rectification of data stored about him or her, the request must be sent in writing to the controller. The controller may, if necessary, ask the applicant to prove his or her identity. The controller will reply to the customer within the time limits laid down in the EU General Data Protection Regulation (as a general rule, within one month).

10. Other rights relating to the processing of personal data

A data subject in the register has the right to request the erasure of personal data concerning him or her from the register ("right to be forgotten"). Data subjects also have other rights under the EU General Data Protection Regulation, such as the restriction of the processing of personal data in certain circumstances. Requests should be sent in writing to the controller. The controller may, if necessary, ask the applicant to prove his or her identity. The controller will respond to the customer within the time limits set by the EU GDPR (usually within one month).

11. Cookies

We use cookies and similar technologies in the 3J tickets services to ensure the correct functioning of the service and to improve the user experience. For example, we use cookies to maintain your login information for the online service and your personal preferences for using the application. Cookies do not harm your device and cannot spread viruses or malware.

Where marketing or statistical cookies are enabled, you can edit your consent to cookies via the administration page. If cookies are limited to those necessary for the system to work, the administration page will not be visible.