This privacy policy notice concerns the personal data of buyers of Amos Rex museum’s tickets and guided tours. In this policy, we describe how we process your personal data when you purchase tickets or a guided tour through our online shop.  

We reserve the right to update our privacy policy from time to time, and recommend you review this privacy policy periodically.  


1. Data controller    

Name: Amos Rex AB / Amos Rex 

Address: Mannerheimintie 22–24, 00100 Helsinki 

Business ID: 2137480–2 


2. Contact person for the register    

Melissa Aaltonen 

Amos Rex / Amos Rex Ab 


3. Name of register    

Amos Rex Ticket sales' customer register   


4. Purpose and legal basis of processing personal data / purpose of register    

We collect your personal data so that we can deliver your ticket or guided tour. The collected personal data is used for the purposes of Amos Rex’s online sales system. We use your data when you purchase products or a ticket so that we can:    

  • process your order    

  • support the site’s user experience   

  • receive payment and    

  • provide customer support   


The legal basis for processing personal data is the execution of contract. We process your personal data to complete the transaction of delivering your ticket or guided tour.    

When we process your personal data for marketing purposes, we always ask for your consent. Consent may be withdrawn at any time.    


5. Information content of register    

  • First and last name   

  • Address    

  • Postal code   

  • Country    

  • Phone number    

  • Email    

Additional information registered by companies:    

  • Name of company    

  • Business ID    

  • Address for electronic invoice    

  • Operator code  

  • Reference number

Business customers are presented with the opportunity to fill out additional relevant information in the section for additional information.    

Information storage period: 

Data is stored while the user and Amos Rex are bound by a valid, mutual contract and/or consent.   

Data may be stored for longer insofar as this is necessary to fulfil obligations set in valid legislation such as responsibilities concerning bookkeeping, and to demonstrate that they have been appropriately fulfilled.  


6. Data sources    

Amos Rex collects personal data to be processed directly from the buyer of the museum ticket or guided tour.    


7. Transfers of personal data and transfers of personal data out of the European Economic Area  

Information related to the sales system is not passed on separately and remains only with the controller. Personal data is transferred outside the EU/EEA zone when necessary for providing the service. This type of transferring always takes place in accordance with standard contractual clauses approved by the European commission.  


8. Transferring personal data when consenting to digital marketing purposes  

When we process your personal data for marketing purposes, we may transfer your personal data to third parties. We always ask for your consent for this. Consent may be withdrawn at any time. Consent to marketing purposes is not a prerequisite for buying a ticket or guided tour.   

If you consent, we transfer personal data only to our immediate contractual partners and only to the extent that is necessary. Consent may be withdrawn at any time.  


9. Protection and security of the register    

Amos Rex is committed to following sufficient security measures in all its activities to protect personal data.    

Digital contents are stored in a service provider’s environment. The service is protected with personal passwords, and the transfer of data is done through encrypted data transfer connections.    

User rights are limited to only viewing or updating the data to the extent required by one’s work tasks.    

Electronically stored data:  

Personal data is only available to authorized employees holding a position that requires them to process the data.   

The register is located on a server environment under the express control of Johku/Aptual Commerce Oy. Read more of Johku service’s data protection principles:  


10. Your rights and choices    

The registered has the right to see the saved data on them and demand the correction of possibly false data.   

This is automatized by the Johku platform:  

Every customer email you receive from Amos Rex online store has a link to the My Johku -service.  

In My Johku, a user may check data saved about him/herself and, if necessary, make corrections to it. The service also has a function by which the user can download the data in a structured format for transfer from one system to another. You can access the My Johku service at any time at the address  

My Johku also offers users the chance to terminate their My Johku agreement and to delete data from My Johku. If the user stops using My Johku and terminates his/her agreement with Johku, all automatic functions concerning the management of his/her data will cease and Johku’s possibilities to work for the benefit of the user in relation to the merchant will disappear. Once the agreement has ended, the user must manage his/her own data (checking, correction, the right to be forgotten, limitation, the right to transfer data from one system to another) in writing directly with the merchant keeping the register.  

Under no circumstances does Johku use profiling and automatic decision-making based on it.  

The use of the My Johku service is free of charge.  


11. Other rights of the registered    

We only store your data for the purposes defined in this policy and for legal purposes applying to us that require the data to be stored. We remove your data securely once we no longer need it for these purposes in accordance with the company’s policies.  The registered has the right to see the saved data on them, demand the correction of possibly false data and completion of incomplete data and to be removed if there is no legal basis for storing the data. The data controller may ask for the presenter of the request to prove their identity. The data controller shall respond to the customer within the time frame stipulated by data protection legislation (primarily within a month).  All data check and correction requests shall be made to the contact person in charge of register matters mentioned at the start of this document.    


12. Cookies  

We collect cookies for the purpose of providing a functioning website and developing it. We want to serve our website users as well as possible, now and in the future, and cookies are a way for us to improve how our website works.  

You can find more information on the cookies our website uses and their purposes here: . 

This privacy policy was updated on the 26th of October 2022.