PROCESSING OF STAKEHOLDER DATA AT LAUREA
Privacy notice 25th May 2019
Laurea University of Applied Sciences, Ratatie 22, FI-01300 Vantaa, Finland
Controller’s contact person: President, Managing Director Jouni Koski,
Contact details of the data protection officer: Marjo Valjakka,
Person in charge of the stakeholder data register: Director Teemu Ylikoski,
Purpose and legal basis for the processing of personal data:
The purpose of processing personal data is to develop Laurea’s co-operation with stakeholders as well as implement and market continuing education and events targeted at the job market.
The lawfulness of the processing of personal data is determined pursuant to Article 6 of the EU’s General Data Protection Regulation as follows:
With respect to education provided in co-operation with the operating environment and data related to research, development and innovation activities, the processing of personal data is based on the obligations laid down in the Universities of Applied Sciences Act (932/2014).
With respect to alumni and specifically requested permissions to send marketing materials, the processing of personal data is based on consent.
Personal data categories to be processed
The data concerning the partners, alumni, customers and other stakeholders of Laurea University of Applied Sciences are stored in Laurea’s partner system, which includes the following data:
First and last name
Mobile phone number
Title and area of responsibility
Information on permission granted by the person to send marketing materials
Name of organisation
Organisation contact details
Branch of organisation
In addition, for those participating in continuing education subject to a charge, the following information necessary for registration as a student is stored in the education management and planning system: personal identification number, basic education, place of residence, place of domicile, native language and nationality.
Relating to events and continuing education, information on participation fees, dates of participation, date of enrolment and other voluntary information provided by the participant are also saved in the register. The voluntary information may include special diet information and information provided through a feedback questionnaire.
The data will be erased when they are no longer needed for the event arrangements. If a person participating in an event or continuing education has granted permission to send marketing materials, the person’s contact details will be stored in the partner system.
The contact details will be erased from Laurea’s systems once the co-operation has ended. No automatic decision-making or profiling is carried out on the basis of personal data.
Regular sources of information
Project database and venture database of Laurea University of Applied Sciences. Personal data may also be collected and updated from controllers that provide address, update, credit information or other similar services.
From alumni and people attending education and events, data are collected by virtue of the participant’s voluntary notification via an online form.
Regular disclosure and transfer of data
The data in the personal register are intended for internal use at Laurea. Data may be disclosed internally when required for purposes of Laurea’s educational, research or regional development tasks or for purposes of business operations. Continuing education data are disclosed to the Ministry of Education and Culture for the compilation of statistics and, when necessary, to other providers of the education in question.
The first name, last name, job title and organisation of those who have granted specific permission may be published on the participant list for an event, education or seminar.
Contact details are not disclosed to parties outside Laurea without asking permission for this in advance from those concerned.
Personal data are not transferred outside the EU or ETA area.
Principles of register protection
Personal data are accessible only to those who require the data in order to perform their job. Data of partners may be processed under restricted rights by students admitted to Laurea with their study entitlement in force and by specified Laurea employees.
The use of the service is based on the performance of the person’s job or studies. The restrictions of use are arranged through personal access rights and by means related to data communications. A user ID and password are required to access the register system. The main user of the system is in charge of granting access rights.
When processing personal data, Laurea applies good practices of data processing pursuant to the Act on the Openness of Government Activities.
The rights of data subjects
The rights of data subjects are determined in accordance with Articles 15–22 of the EU’s General Data Protection Regulation.
Right of access
• Data subjects may request access to the data concerning themselves. The request is
made in writing to the person in charge of the register. The request must specify the data it concerns.
• Data subjects may request the person in charge of the register to rectify their data.
Withdrawal of consent and erasure of data that are based on the subject’s consent
• A data subject may withdraw his/her consent to the processing of personal data and
prohibit the use of his/her personal data by Laurea University of Applied Sciences for alumni, marketing and communication purposes. Data subjects may also request to erase personal data that are based on their consent.
Restriction of processing
• The data subject has the right to restrict processing if:
- the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data
- the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead
- the controller no longer needs the personal data for the purposes of the processing but the data subject needs them for the establishment, exercise or defence of legal claims.
Portability of data that are based on consent
• The data subject has the right to receive the personal data concerning him or her, which he
or she has provided to a controller, in a machine-readable format if the processing is based on consent and the processing is carried out by automated means.
The data protection officer is the contact person in matters related to the data subject’s rights. Data subjects have the right to file a complaint with the data protection authority.