Metropolia's guidelines concerning coronavirus

Read about the impact of coronavirus on Metropolia's operations.

This Privacy Notice is based on the EU’s General Data Protection Regulation (2016/679, “GDPR”), namely the obligation to inform the data subjects (GDPR Articles 12–14), the data controller’s obligation to maintain a record of processing activities under its responsibility (GDPR Article 30), as well as the obligations set out in the Finnish Data Protection Act (1050/2018) supplementing the GDPR.

Additionally, this Privacy Notice has been prepared with the aim of making it accessible in accordance with the requirements of the EU’s Web Accessibility Directive (Directive (EU) 2016/2102 of the European Parliament and of the Council on the accessibility of the websites and mobile applications of public sector bodies) and the Finnish Act on the Provision of Digital Services (306/2019) supplementing it.

Submitted on 22.2.2021 - 10:34

Name of the register

Personal data register of Metropolia’s public website (Metropolia.fi)

Data controller

Name

Metropolia University of Applied Sciences Ltd

Contact information

Metropolia University of Applied Sciences Ltd (Business ID: 2094551-1)
Postal address: P.O. Box 4000, FI-00079 Metropolia
Visiting address: Myllypurontie 1, 00920 Helsinki, Finland
Telephone (switchboard): +358 9 7424 5000 

Person responsible for the register at the data controller

Name: Riitta Konkola
Position: President, CEO of Metropolia University of Applied Sciences

Person responsible for the content of the register

Name: Liisa Salo
Position: Head of Communications, Communications and Marketing
Address: Metropolia University of Applied Sciences Ltd, PO Box 4000, 00079 Metropolia, Finland
Email: liisa.salo [at] metropolia.fi

Contact details of the contact person for the register

Name: Satu Orkola
Position: Communications Specialist, Communications and Marketing
Address: Metropolia University of Applied Sciences Ltd, PO Box 4000, 00079 Metropolia, Finland
Email: satu.orkola [at] metropolia.fi

Data Protection Officer

Tuulia Aarnio, Metropolia’s Data Protection Officer
Tel: +358 40 844 0690
Email: tietosuojavastaava [at] metropolia.fi

Purpose and legal basis of the processing of personal data

Purpose of the processing of personal data:

Metropolia University of Applied Sciences Ltd (“Metropolia”) collects personal data on the users of its public website (Metropolia.fi). Metropolia is committed to complying with the requirements of data protection legislation when processing personal data. The purpose of processing personal data is the technical maintenance and development of Metropolia’s website as well as the maintenance, analysis and development of the communications and marketing content on the website.

Metropolia may, from time to time, install cookies on the computers of visitors to its public website (Metropolia.fi).

Cookies are used to collect data on, for example, the web pages from which a visitor to the website has navigated to Metropolia’s Metropolia.fi domain, the web pages the visitor has browsed and the time of browsing, the browser they have used, the resolution of their screen and their operating system and the IP address of their computer, in other words, the Internet domain from which the data sent originates and where they are received.

Cookie data allows Metropolia and its partners to track the number of visitors to Metropolia’s public website (Metropolia.fi) as well as to analyse and develop the website so as to better serve visitors. Additionally, Metropolia’s partners may, for the purpose of targeting advertising, use cookies that collect data on visitors’ visits on this website and other websites. Data collected with cookies is used for producing targeted advertising based on the visitor’s subjects of interest. When advertising is targeted with the help of cookies, the visitor is not identified and their data are not connected to other personal data possibly obtained from them in other circumstances.

Visitors have the opportunity to block the use of cookies by changing their browser settings so that the browser does not allow cookies to be installed.  The visitor accepts that, in the case of certain services, blocking cookies may affect the functioning of the services.

Lawful basis for the processing of personal data:

The processing of personal data contained in the personal data register of Metropolia’s public website is based on:

  • legitimate interests
  • consent of the data subject (e.g. cookies)

When a visitor visits Metropolia’s public website (Metropolia.fi) a cookie consent banner/pop-up will appear on the page, requiring the visitor to give their consent for the use of cookies. If the visitor does not give their consent, the computer or online device they are using will not be tracked for functions related to marketing, among other things.

  • legal obligation (e.g. the EU’s Web Accessibility Directive and the Finnish Act on the Provision of Digital Services supplementing it require that the websites of public sector bodies, among others, must be accessible. A website must have an accessibility notice that describes to what extent the website is accessible and to what extent it is not. A website must also provide the opportunity to give feedback on its accessibility, in which the website visitor may leave their contact details to allow the website administrator to contact them in matters related to accessibility.

(Directive (EU) 2016/2102 of the European Parliament and of the Council on the accessibility of the websites and mobile applications of public sector bodies; the Finnish Act on the Provision of Digital Services (306/2019)).

Legitimate interests of the data controller or a third party

The lawful basis for the processing of personal data in the personal data register of Metropolia’s public website (Metropolia.fi) is, in certain respects, legitimate interest.

Metropolia processes personal data under the lawful basis of legitimate interest in the following situations, for example:

  • Offering information and/or services to visitors of its website
  • Developing online services and improving the individual online service experience on the Metropolia.fi website
  • Enabling technical maintenance and development of the Metropolia.fi website
  • Preventing harmful online behaviour on the Metropolia.fi website

Communicating about and marketing its services, functions and events as well as the training courses it organises as part of Metropolia’s fee-based education and continuous learning services etc.

Data recipients or recipient groups and regular disclosures

The following personal data are processed by personal data group in the personal data register of Metropolia’s public website (Metropolia.fi):

  • Data observed and derived from the use of Metropolia’s public website (Metropolia.fi)
  • Metropolia collects data on the users of the website using cookies, among other means. A cookie is a small text file sent to the user’s browser that usually contains an anonymous identifier number; a cookie does not damage the terminal device. 
  • Statistics compiled from the use of the website include the number of visitors, the country from which a visit takes place, the duration of each visit and the browser used, as well the content the visitor has browsed. In addition, a statistic is collected on whether the visitor is an internal Metropolia user or an external user. An individual user cannot be identified from these data.

Data collected with cookies on visitors (data subjects) and cookie types:

Cookies can be used when a visitor visits Metropolia’s public website (Metropolia.fi) using a computer or another online device if the visitor gives their consent to the use of cookies and the processing of their personal data.

  • Cookies enable the services on the Metropolia.fi website to remember the visitor’s computer or other device as well as their server for the purposes of the processing described in section 4 above.
  • A secondary cookie type are user-input cookies, which are necessary for enabling the functionalities in certain services on the Metropolia.fi website. These cookies cannot be blocked through the cookie consent banner/pop-up. A selection made by a visitor on Metropolia’s public website (Metropolia.fi) is saved in the cookie and will remain valid for 90 days. If the visitor wishes to cancel their selection, they can do so by deleting all cookies on their browser.

Although most browsers accept cookies automatically, the visitor can choose to either accept cookies or block them through their browser settings, which are usually found in the browser’s tools or settings menu. The visitor can also delete cookies from their device at any time.

If the visitor does not accept cookies, they may not be able to use all the features of the website services when visiting Metropolia’s public website (Metropolia.fi). You can find more information on managing cookies in your browser’s help section.

Below is a list of the cookie types used on Metropolia’s public website (Metropolia.fi):

User-input cookie/session cookie:

  • This is used for tracking the performance of Metropolia’s public website (Metropolia.fi)
  • Metropolia’s public website (Metropolia.fi) has been built using common internet platforms. These have integrated cookies that help solve compatibility issues (e.g. recognising the browser type) and improve performance (e.g. quicker loading of content).
  • User-input cookie/session cookies are used for an individual session only.
  • They are deleted once the browser is closed.

Security or Asp.NET cookies:

  • Asp.NET cookies are used for ensuring that, when a visitor registers in order to gain access to a restricted area, their device is logged in for the duration of the session. The visitor’s username and password are required for access to restricted areas.
  • The Asp.NET cookie creates an ID number for each visitor to allow them to navigate on the website flawlessly.
  • Asp.NET cookies are used for an individual session only.
  • They are deleted once the browser is closed.

Page settings cookies:

  • The purpose of page settings cookies is to remember the visitor’s preferences/settings (e.g. language) and to aim to improve the visitor’s experience (e.g. by personalising greetings or content). This applies to areas for which the visitor has expressly registered for access or to the creation of an account.
  • Page settings cookies are used for an individual session only.
  • They are deleted once the browser is closed.

Analytics cookies:

  • Metropolia uses external information systems and software (listed in section 8 of this Privacy Notice) (incl. Google Analytics) with the purpose of understanding how visitors to Metropolia’s public website (Metropolia.fi) use it.
  • This information can help improve the quality and content of Metropolia’s public website (Metropolia.fi) for visitors and it may also be used for creating targeted communications, marketing and content. The combined statistical data cover such areas as the total number of visits or page views and references to our website.
  • Analytics cookies are permanent, but they are deleted automatically after two years if the visitor no longer visits Metropolia’s website services.

Feedback cookies for website visitors:

  • Metropolia uses a third-party survey tool (Google Analytics) to invite a certain percentage of visitors to give feedback. Cookies are also used to prevent multiple invitations being sent to the feedback survey to the same visitor. The first cookie is installed if the visitor has not been invited to participate in the survey and it is used to ensure that the visitor is not invited after browsing the first page. The second cookie is installed if the visitor has been invited to participate in the survey and it is used to ensure that the visitor is not invited again within the next 90 days.
  • The first feedback cookie is used for an individual session only, and it will be deleted once the browser is closed.
  • The second cookie is permanent and it will be deleted automatically after 90 days or when the survey is shown.

Social media sharing cookies:

  • Metropolia’s public website (Metropolia.fi) uses third-party social media widgets or buttons in order to offer visitors additional functionalities for sharing content on social media websites and through email.
  • These widgets or buttons allow visitors to install a cookie on their device to facilitate the use of the service, to ensure that interaction is shown on the website (e.g. by updating the number of social media shares) and to maintain log data on each visitor’s activities in the Metropolia website services.
  • The social media sharing cookies are permanent, but they are deleted automatically after two years if the visitor no longer visits Metropolia’s website services.
  • Visitors should check the data protection terms and conditions of each service provider before using such a service. For more information on the use of social media widgets and applications, see the appropriate section below.

Other third-party tools and widgets are occasionally used on Metropolia’s public website (Metropolia.fi) for offering additional functionalities. When you use these tools or widgets, a cookie is usually installed on your device to facilitate the use of the service and to ensure that interaction is shown correctly on Metropolia’s public website. These cookies do not reveal the visitor’s email address and are not used otherwise to identify individuals. In its analytics reports, Metropolia receives other identifiers, including IP addresses, but these are intended for measuring the number of individual visitors to Metropolia’s website services and identifying their geographical point of origin, but not for identifying individual visitors.

Analytics tools:

  • Data saved on the Metropolia.fi website (data from the feedback form, data submitted when joining email lists, data collected with cookies and statistical data). These data are analysed using Google Analytics, among others. For more information on Google Analytics, please visit http://www.google.com/analytics/. You can opt out of data collection by Google Analytics by downloading an add-on to your browser at https://tools.google.com/dlpage/gaoptout.
  • Additionally, Metropolia’s website contains third-party components related to, for example, social media community services, such as Facebook and YouTube. Third-party plug-ins on Metropolia’s website are downloaded from the servers of the third-party services. Metropolia’s website will not send visitors’ data through social media plug-ins.
  • The third-party services or third-party applications on Metropolia’s website are subject to the terms of use and other terms and conditions of the respective third parties.

Metropolia uses analytics tools such as Google Analytics. More information on the use of Google Analytics at Metropolia can be found here: http://www.google.com/analytics/learn/privacy.html

To give website visitors more options on how Google Analytics collects their data, Google provides an add-on that can be installed on browsers to opt out of Google Analytics. The add-on communicates with the Google Analytics JavaScript (ga.js) to indicate that website browsing data may not be sent to Google Analytics. The Google Analytics opt-out add-on does not prevent data from being sent to the website itself or to other web analytics services.

When a visitor browses Metropolia’s public website (Metropolia.fi), marketing automation cookies are installed on their browser. These cookies help identify the visitor to the website through a combination of a specific browser and computer. The visitor will also be remembered if they return to Metropolia’s website services. If a visitor identifies themselves voluntarily by giving personal information, e.g. by filling in a contact form or clicking on links in an email message, the individual user ID in the cookie will be linked to the personal data provided voluntarily by the visitor. Metropolia’s public website (Metropolia.fi) may use the data provided by the visitor during their online visits to tailor content or to provide suggestions on similar sites that might interest the visitor.

Web beacons:

A web beacon embedded in Metropolia’s public website (Metropolia.fi) is a small image file that can be used for collecting certain data from the visitor’s computer, such as the IP address, the time taken to view content, the browser type and the existence of cookies on the same server. Metropolia uses web beacons in compliance with applicable legislation.

Metropolia or its service providers may use web beacons for tracking the effectiveness of third-party websites offering recruitment or marketing services or for collecting statistics on visitors and managing cookies.

Visitors have the opportunity to disable certain web trackers by blocking the cookies related to them. A web beacon may continue to log anonymous visits from the visitor’s IP address, but these data from the cookies are not saved.

Web beacons may also be used to collect data for assessing the visitor’s interest and improving the user experience in the future.

Location-based tools:

Metropolia may collect and use information on the geographical area in which the visitor’s computer or mobile device is located. These location data are collected so that Metropolia can offer visitors information on services that could interest them based on their geographical location and to improve location-based products and services.

Social media widgets and applications:

Metropolia’s website services may include functions that enable sharing content through third-party social media applications, such as the Facebook Like button and the Twitter widget. These social media applications may collect and use data on the use of Metropolia’s public website (Metropolia.fi) (see “Social media sharing cookies” above). Other members on the social media applications may collect and use all personal data you provide through the social media applications, and such interaction is subject to the privacy protection practices of the companies providing the applications. We do not control and are not responsible for the actions of these companies or how they use your data.

Additionally, Metropolia’s public website (Metropolia.fi) may host blogs, forums, crowdsourcing and other applications or services (generally referred to as “social media features”). The purpose of social media features is to facilitate the sharing of information and content. All personal data provided by the user through Metropolia’s social media features may be shared with others using the same social media features (unless mentioned otherwise at the time the data are collected), over whom Metropolia may have limited control or no control at all.

  • The data you provide on Metropolia’s public website (Metropolia.fi) (e.g. on the feedback form). The website asks for your name and email address when you give feedback. In addition, your email address is requested when you join an electronic mailing list.

Regular sources of personal data

The personal data in the personal data register of Metropolia’s public website (Metropolia.fi) are obtained from the website visitors themselves or from persons who provide their contact details to Metropolia through the feedback form on the Metropolia.fi site.

Information systems used in the processing of personal data

The data in the personal data register of Metropolia’s public website (Metropolia.fi) are processed using the following information systems and software:

Drupal content management tool

The content on Metropolia’s public website (Metropolia.fi) is created and made visible on the Metropolia.fi site using the Drupal content management tool.

Google Analytics

The data on website visits are analysed using Google Analytics, among others. For more information on Google Analytics, please visit http://www.google.com/analytics/. You can opt out of data collection by Google Analytics by downloading an add-on to your browser at https://tools.google.com/dlpage/gaoptout

Google Tag Manager (GTM)

The purpose of this cookie is to manage tracking tags, such as Facebook Pixel. You can find more information on how Google uses cookies under this link: Marketing Platform.

Facebook

The purpose of this cookie is targeting, creating and analysing marketing communications in order to display marketing communications that are likely to interest visitors.

You find more information on how Facebook uses cookies here:

Cookies & Other Storage Technologies

If a visitor to Metropolia’s public website (Metropolia.fi) has a Facebook account, Facebook may link the cookie ID related to the visit with the visitor’s Facebook account.

Metropolia’s public website (Metropolia.fi) contains third-party components related to, for example, social media community services, such as Facebook and YouTube.

Third-party plug-ins on Metropolia’s public website (Metropolia.fi) are downloaded from the servers of the third-party services. Metropolia’s website will not send visitors’ data through social media plug-ins.

The third-party services or third-party applications on Metropolia’s public website (Metropolia.fi) are subject to the terms of use and other terms and conditions of the respective third parties. 

YouTube

The purpose of this cookie is targeting, creating and analysing marketing communications in order to display marketing communications that are likely to interest visitors.

Metropolia’s public website (Metropolia.fi) contains third-party components related to, for example, social media community services, such as Facebook and YouTube.

Third-party plug-ins on Metropolia’s public website (Metropolia.fi) are downloaded from the servers of the third-party services. Metropolia’s website will not send visitors’ data through social media plug-ins. The third-party services or third-party applications on Metropolia’s public website (Metropolia.fi) are subject to the terms of use and other terms and conditions of the respective third parties.

Twitter

The purpose of this cookie is targeting, creating and analysing marketing communications in order to display marketing communications that are likely to interest visitors.

You can find more information on how Twitter uses cookies under this link:

Safety and security

Metropolia’s public website (Metropolia.fi) contains third-party components related to, for example, social media community services, such as Facebook and YouTube.

Third-party plug-ins on Metropolia’s public website (Metropolia.fi) are downloaded from the servers of the third-party services. Metropolia’s website will not send visitors’ data through social media plug-ins.

The third-party services or third-party applications on Metropolia’s public website (Metropolia.fi) are subject to the terms of use and other terms and conditions of the respective third parties.

React and Share functionality

For preparing or distributing reports/articles, Metropolia’s public website uses the React and Share functionality that enables users to give feedback on them. These reports/articles are distributed to Metropolia’s staff through Metropolia’s email system. A separate privacy notice is applied to the React and Share functionality. React and Share is an independent data controller.

Metropolia’s email system

Data received through the feedback channel are processed in the Microsoft O365 based Metropolia email system. This system’s server, on which personal data and other data are processed, belongs to Metropolia and is located in Finland.

Description of the groups of data subjects and personal data groups

Under a broad interpretation of Article 4.9 of the EU’s General Data Protection Regulation, below is a list of the processors/recipients of personal data to which the data controller “transfers” or “discloses” the personal data it controls for processing (e.g. through a technical interface when maintenance tasks are performed).

The data in the personal data register of Metropolia’s public website (Metropolia.fi) may be transferred within the Metropolia organisation and only to the extent necessary for the technical maintenance and development of the website as well as the maintenance, analysis and development of the communications and marketing content of the website.

Metropolia discloses personal data to third parties under the following conditions only:

Your consent

Your personal data may be disclosed under your express consent to, for example, a third-party service, such as the provider of electronic mailing list services Postiviidakko when you join our email list. You may withdraw your consent at any time. If you do so, your data will no longer be collected.

Service providers

We disclose personal data only to the extent that third parties require access to the personal data we process in order to offer services to Metropolia for the purposes specified in this Privacy Notice. By this we mean, for example, the Google Analytics tools offered by Google.

We have the appropriate precautions in place to ensure that your personal data will in this case be processed only for the purposes stated in this Privacy Notice and in compliance with valid legislation. In this case, the processing of personal data takes place on behalf of Metropolia and for Metropolia’s benefit. 

Research use

We may occasionally disclose data for scientific or other research, such as student projects, in compliance with data protection legislation.

Legal reasons

Metropolia may share your personal data with third parties if access to the personal data or their processing is necessary for (i) complying with applicable legislation and/or a court order; or (ii) detecting, preventing or dealing with misuse, security risks or technical problems. Metropolia will provide information on such use of personal data whenever possible.

Data may be disclosed to the authorities on the basis of an act, decree or official decision.

Since the personal data contained in the register are processed in the following systems, the providers of these systems (the companies behind them) can be deemed recipients of personal data and recipients of regular disclosures from the personal data register of Metropolia’s public website, because in the event of a technical fault, the system providers have access to the data contained in the personal data register of Metropolia’s public website (Metropolia.fi) through a technical interface and administrative user IDs.

Under Article 28 of the GDPR, Metropolia will prepare/has prepared a joint agreement with the following partners:

Orange Advertising Oy and Drupal content management tool

The content on Metropolia’s public website (Metropolia.fi) is created and made visible on the Metropolia.fi site using the Drupal content management tool.

Google LLC and the Google Analytics tools provided by Google

  • Data are analysed using Google Analytics, among others. For more information on Google Analytics, please visit http://www.google.com/analytics/ . You can opt out of data collection by Google Analytics by downloading an add-on to your browser at https://tools.google.com/dlpage/gaoptout.
  • Additionally, Metropolia’s website contains third-party components related to, for example, social media community services, such as Facebook and YouTube. Third-party plug-ins on Metropolia’s website are downloaded from the servers of the third-party services. Metropolia’s website will not send visitors’ data through social media plug-ins.
  • The third-party services or third-party application on Metropolia’s website are subject to the terms of use and other terms and conditions of the respective third parties.

React and Share Oy and the React and Share functionality

For preparing or distributing reports/articles, Metropolia’s public website uses the React and Share functionality that enables users to give feedback on them. These reports/articles are distributed to Metropolia’s staff through Metropolia’s email system. A separate privacy notice is applied to the React and Share functionality. React and Share is an independent data controller.

Transfer of information outside the EU or EEA or to international organisations

The personal data contained in the personal data register of Metropolia’s public website may be transferred outside the EU or EEA.

However, Metropolia always aims to provide its services and process personal data using parties and services located in the EU or EEA. Metropolia’s services may, however, in some cases be provided using parties, services and servers located elsewhere, and in such a case, your personal data may be transferred between different countries. Such transfers may include disclosures of personal data to countries outside the EU or EEA whose legislation governing the processing of personal data differs from Finnish law, such as the United States. In such cases, Metropolia will make sure your personal data are adequately protected.

Personal data retention times

The personal data contained in the personal data register of Metropolia’s public website are stored as follows:

Cookies are valid for the duration of a session until the visitor closes their browser or they are permanent cookies that remain valid from a few months to a number of years. The maximum period cookies are stored is two years, after which they are deleted, unless the visitor uses Metropolia’s public website (Metropolia.fi) within this period.

The typical retention periods for data collected with cookies are as follows:

Necessary cookies

The cookies necessary for logging in to services are session-specific, which means they are not stored after the user closes their browser.

Visitor tracking and analytic cookies

Data collected by Google Analytics are typically stored for 26 months, while data collected by Piwik Pro are typically stored for 36 months.

Targeting communications:

Data collected for targeting marketing communications are stored as follows:

  • Facebook 180 days
  • Twitter 30 days
  • YouTube around 18 months, or 540 days
  • Google around 18 months, or 540 days

Rights of the Data Subject

The data subjects have the right to receive confirmation from the data controller of whether their personal data are being processed. Furthermore, the data subjects have the right of access to their personal data and the right to inspect their personal data stored in the register and to receive copies of them. Under the GDPR, the data controller must respond to requests by the data subjects to exercise their rights within one month of receiving such a request.

A. Right of access to personal data

The data subjects have the right to check whether their personal data are stored in the personal data register. A data subject may submit a request for information by delivering the data subjects’ information request form, which can be found on Metropolia’s public website and/or Metropolia’s intranet, to one of the three offices of Metropolia’s Student and Admission Services. The form must be filled in carefully, printed and signed personally by the data subject. If the data subject is a member of staff, they can deliver the request form to Metropolia’s Human Resources Management unit. When submitting the request, the data subject must prove their identity in a reliable manner (for example by presenting an official personal identity document or driving licence to the Metropolia employee receiving the request).

The visiting addresses of the offices of Metropolia’s Student and Admission Services are:

Metropolia’s Myllypuro campus

Myllypurontie 1, 00920 Helsinki, Finland

Metropolia’s Arabia campus

Hämeentie 135 D, 00560 Helsinki, Finland

Metropolia’s Myyrmäki campus

Leiritie 1, 01600 Vantaa, Finland

The visiting address of Metropolia’s Human Resources Management unit is:

Metropolia’s Myllypuro campus (Buildings C and D, 5th floor)

Myllypurontie 1, 00920 Helsinki, Finland

All information requests will be forwarded from the offices of Metropolia’s Student and Admission Services and/or the Human Resources Management unit to Metropolia’s Data Protection Officer (email: tuulia.aarnio [at] metropolia.fi, tietosuojavastaava [at] metropolia.fi).

Metropolia’s Data Protection Officer will respond to information request submitted by the data subjects. If necessary, the Data Protection Officer can be requested to provide additional information on progress in the processing of the request or on the content of the response.

B. Right to rectify personal data and to restrict processing

The data subjects have the right to request the data controller to restrict the processing of their personal data in the following cases:

  • the data subject disputes the correctness of their personal data (right to rectify personal data), in which case processing will be restricted until the data controller can ascertain that the data is correct;
  • processing violates the law and the data subject objects to the erasure of their personal data, instead requesting that the processing of the data be restricted;
  • the data controller no longer needs the personal data for the purposes of the processing, but the data subject needs them in order to establish, exercise or defend a legal claim.

Such a request for rectifying personal data in a Metropolia personal data register or restricting processing can be submitted in person to one of the above-mentioned offices of Metropolia’s Student and Admission Services or Metropolia’s Human Resources Management unit (staff only), where the data subject must prove their identity in a reliable manner when submitting the request.

C. Right to erase personal data

The data subject has the right to obtain from the controller the erasure of their personal data from a Metropolia register without undue delay if any of the following conditions are met:

  • the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • the data subject withdraws consent on which processing is based and there is no other lawful basis for processing;
  • the personal data have been unlawfully processed; or
  • the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.

Such a request for the erasure of personal data in a Metropolia personal data register can be submitted in person to one of the three above-mentioned offices of Metropolia’s Student and Admission Services or Metropolia’s Human Resources Management unit (staff only), where the data subject must prove their identity in a reliable manner when submitting the request.

D. Right to data portability (transfer of data from one system to another)

Not applicable.

E. Right to not be subjected to a personal data breach

The data subject has the right to not be subjected to a personal data breach, as referred to in Article 33 of the EU’s General Data Protection Regulation, due to the data controller’s negligence in data protection and/or data security matters or due to negligence on the part of a data processor used by the controller in data protection and/or data security matters. The data subject has the right to be informed without undue delay if a personal data breach is likely to pose a high risk to the rights and freedoms of natural persons.

Right to Object

According to Article 21 of the EU’s General Data Protection Regulation, the data subjects have the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on point (e) of Article 6(1) (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller), such as profiling based on these provisions. The data controller may no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

The request to stop processing of collected personal data can be submitted to one of the three above-mentioned offices of Metropolia’s Student and Admission Services, where the data subject must prove their identity when submitting the request.

Right to withdraw consent

If the processing of personal data is based on the data subject’s consent, the data subject has the right to withdraw their consent for processing at any time without the withdrawal of consent affecting the lawfulness of processing based on consent before its withdrawal.

The withdrawal of consent for the processing of personal data collected by Metropolia (withdrawal request) can be submitted to one of the three above-mentioned offices of Metropolia’s Student and Admission Services (or in the case of a member of staff, to the Human Resources Management unit), where the data subject must prove their identity when submitting the request.

Right to lodge a complaint with a supervisory authority

Every data subject has the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of their personal data infringes the applicable data protection regulations.

The national supervisory authority in Finland is the Office of the Data Protection Ombudsman. Contact details:

Office of the Data Protection Ombudsman
Street address: Lintulahdenkuja 4, 00530 Helsinki, Finland
Postal address: PO Box 800
FI-00531 Helsinki

Telephone (switchboard): + 358 29 56 66700
Fax: + 358 9 56 66735
Email: tietosuoja [at] om.fi

Registry Security Principles

General description of the technical and organisational security measures aiming at protecting the personal data of the data subjects and the personal data registers at Metropolia:

  • The data controller (Metropolia) and the system providers have agreed on the protection of the register. If necessary, the responsibilities have been described in adequate detail in the appropriate agreements.
  • The employees and other personnel of the data controller (Metropolia) have undertaken to comply with the obligation of secrecy and to keep confidential the information they receive in connection with the personal data processing.
  • The system providers (personal data processors that act on behalf of the data controller, Metropolia) undertake to maintain the register and the personal data relating to it in accordance with good data processing practices and comply with the obligation to absolute secrecy and confidentiality.
  • The data security of the personal data register of the data controller (Metropolia) and the confidentiality of the data contained therein are ensured with appropriate technical and administrative means in accordance with good data processing practices.
  • The data controller (Metropolia) has restricted user rights and authorisations to data systems, tools and other storage platforms in such a way that they can only be accessed and processed by the persons who are necessary for such processing due to their job duties or position.
  • The system containing personal data may only be used by employees who are entitled to process personal data due to their job duties and/or position. Such employees will be given the appropriate training for their duties.
  • Every user of a tool/system must identify themselves with their personal codes, which are issued when the right to access the tool/system is granted. The right of access will expire once the employee resigns or is transferred from the duties for which they were granted the right at Metropolia.
  • The data are collected in databases that are protected logically and physically.
     
  • The databases and their back-up copies are located in locked premises, and the data can only be accessed by certain pre-appointed persons.

Information on whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to e

Information on whether the provision of personal data for processing in the personal data register of Metropolia’s public website is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data. An account has been given for each register regarding how the personal data were obtained.

  • Browsing the Metropolia.fi website and, for example, giving feedback to Metropolia through the site constitutes a personal register based on voluntary subscription and used for managing Metropolia’s public activities.
  • The personal data stored in the register have been collected from the data subjects themselves.

Automated individual decision-making, including profiling

The personal data contained in the personal data register of Metropolia’s public website are not used for automatic decision making or profiling.