This Privacy Notice is based on the EU's General Data Protection Regulation (2016/679, “GDPR”), namely the obligation to inform the data subjects (GDPR Articles 12–14), the data controller's obligation to maintain a record of processing activities under its responsibility (GDPR Article 30), as well as the obligations set out in the Finnish Data Protection Act (1050/2018) supplementing the GDPR.
Additionally, this Privacy Notice has been prepared with the aim of making it accessible in accordance with the requirements of the EU's Web Accessibility Directive (Directive (EU) 2016/2102 of the European Parliament and of the Council on the accessibility of the websites and mobile applications of public sector bodies) and the Finnish Act on the Provision of Digital Services (306/2019) supplementing it.
The purpose of processing personal data in Metropolia University of Applied Sciences’ students and studies register is to enable studies at Metropolia and to fulfill the institution's responsibilities. These tasks include planning, implementation, monitoring, and evaluation of teaching; recording, managing, and maintaining study and performance data; producing various certificates and reports for internal and research purposes; and transferring information to authorities.
In addition to statutory obligations, personal data is also processed for:
- Maintaining and implementing teaching cooperation networks with other educational institutions and companies
- Applying for and implementing teaching internships
- Guiding students on study-related matters
- TARU training
- Organizing student healthcare
- Implementing student well-being services and individualized teaching arrangements
- Collecting student feedback and alumni surveys
- SIMHE (Supporting Immigrants in Higher Education) activities
- Facilitating cultural performance brokerage
- Academic affairs webinars
- Student shadowing activities
- Managing international mobility
Processing based on public interest, exercise of public authority, or legal obligation
The processing of personal data in the students and studies register is primarily based on the data controller's legal obligations and the exercise of public authority concerning academic, personal, and contact information.
The legal obligation or exercise of public authority is based on the following laws and regulations:
Universities of Applied Sciences Act (932/2014)
Archives Act (831/1994)
EU General Data Protection Regulation (GDPR, 2016/679)
Administrative Procedure Act (434/2003)
Public Health Act (66/1972)
Act on Public Employment and Business Services (916/2012)
Act on Student Healthcare for Higher Education Students (695/2019)
Act on National Study and Degree Registers (884/2017)
Act on the Openness of Government Activities (621/1999)
Act on the Protection of Privacy in Working Life (759/2004)
Metropolia Degree Regulations
Student Financial Aid Act (65/1994)
SORA legislation
Data Protection Act (1050/2018)
Statistics Act (280/2004)
Unemployment Security Act (1290/2002)
Aliens Act (301/2004)
Decree 338/2011 §9 (based on the Health Care Act 1326/2010)
Non-Discrimination Act (1325/2014)
Processing based on consent
- Remote monitoring for EXAM exams
- International mobility (partially)
- Cultural performance brokerage
- Surveys
- Teaching internships
- Academic affairs webinars (partially)
- Student shadowing activities
- Student well-being services and individualized support arrangements
- SIMHE activities
- Processing of register extracts and other documents required by training placements in social and health degree programs
Processing based on contract
- International mobility (partially)
- TARU training
Processing based on the controller's legitimate interest
- Metropolia’s continuing education and corporate services
The data subjects in Metropolia’s students and studies register include students and staff at Metropolia, staff of partner organizations, and incoming exchange students.
The types of personal data that may be collected:
Teaching internships
Name
Contact details
Educational background
Supervisor’s name and contact details
Consent details
Study information
Name
Contact details
Social security number and date of birth
Gender
Student number
Previous education information
Application and program details
Degree details
Study performance data
National learner identifier (OID)
Username
Nationality
Language skills
Passport number for foreign students
Attendance, graduation, and withdrawal information
Financial information
Permissions for data disclosure
Information related to academic dishonesty
Enrollment and payment data
Publication consent for student selection results
Student photo
Surveys
Name
Contact details
Previous education information
Degree information
Previously acquired competencies
Language skills
Goals
TARU training
Name
Contact details
Social security number
Gender
Degree information
Employment information
Experience
Data collected from individuals confirming their training placement
Nationality
Language skills
Education and corporate services
Name
Contact details
Social security number
Dietary preferences
Educational background
Job title/Work role
Organizational and client relationship details
Billing information
Consent for direct marketing
Training information
Pre-survey responses
Log data
Student healthcare
Name
Social security number
Student number
Language skills
Gender
Study and degree information
Consent details
Reason for contact
Individualized teaching arrangements
Name
Student number
Study and degree information
Reason for contact
Student feedback
Name
Contact details
Student number
Gender
Year of birth
Language skills
Nationality
Previous education
Study and degree details
Employment information (if applicable)
Log data
IP address
SIMHE activities
Name
Contact details
Social security number
Gender
Date of birth
Organizational details
Dietary preferences
Nationality
Information on migration to Finland
Previous education
Work experience
Applicant data
Consent details
Collaboration-related information
International mobility
Name
Contact details
Social security number and date of birth
Gender
Nationality
Language skills
Mobility details
Emergency contact details
Study performance data
Study and degree details
Scholarship information
Organization details
Insurance information
EXAM Service
Name
Contact details
Student number
Username
Exam reservation details and performance data
Photo and audio recordings
Consent details
Music pedagogy practice students
Name
Contact details
Date of birth
Guardian information for underage students
Instrument
Musical background
Metrofonia performance brokerage
Name
Contact details
Event details
Instrument
Study and degree information
Webinars
Name
Contact details
Organizational details
Employment details
Feedback
Student Shadowing Activities
Name
Contact details
Student number
Study and degree information
Previous education
Voluntary additional information
Consent details
Personal data is primarily obtained directly from the data subject.
In addition, the following are regular sources of information for Metropolia's student and studies register:
- The OILI register maintained by CSC (IT Center for Science Ltd.) for student attendance or absence registration
- Management systems for paid education
- Metropolia IT management user directory
- MobilityOnline system for international mobility (e.g., student exchange)
- Other universities and educational institutions
- The national Studyinfo.fi service maintained by the Finnish National Agency for Education
- Data provided by applicants themselves via external application forms linked to Studyinfo.fi
- The Shibboleth system
- Employer organizations
- The Population Information System
- The VIHTA appointment booking tool for career guidance registration
The data controller may transfer or disclose personal data for processing to the following parties:
- The Ministry of Education and Culture via the AVOP survey as part of a feedback survey for students near graduation, coordinated by the ministry.
- CSC (IT Center for Science Ltd.) for inclusion in the national VIRTA data warehouse for higher education and the OILI service through VIRTA.
- The Finnish National Agency for Education, the European Union, and other potential funding organizations for monitoring international student mobility programs.
- KELA (Social Insurance Institution of Finland), upon request, for assessing eligibility for student social benefits (e.g., enrollment certificates, transcripts, progress of studies).
- Municipalities or other entities that organize student healthcare, as required under the Public Health Act, to carry out their tasks.
- The Ministry of Education and Culture for research, evaluation, development, monitoring, and guidance purposes.
- Statistics Finland, which may also forward data to the Finnish National Agency for Education and the Ministry of Education and Culture.
- Employment authorities, KELA, or unemployment funds for processing eligibility for labor market support and unemployment benefits.
- The Finnish Immigration Service (Migri) and the police, upon request, for verifying residence permits.
- For scientific research purposes.
- The National Supervisory Authority for Welfare and Health (Valvira) for verifying and monitoring professional qualifications.
- Metropolia University of Applied Sciences' student union (METKA) for maintaining its membership register.
- OMA/Peppi systems for operational and academic management.
If a student consents, their contact information may also be disclosed for the following purposes:
- Direct marketing
- Educational marketing
- Publishing graduation information
- Inclusion in Metropolia University of Applied Sciences' internal People Finder system
Personal data in the register is processed in various information systems and software. Access to the data may be granted as necessary, e.g., through technical interfaces during maintenance or error correction tasks. External system providers and service providers managing these tools are considered recipients of personal data and regular recipients of disclosures.
Personal data contained in this register is not, as a rule, transferred outside the EU or EEA or to international organizations.
However, personal data may be transferred outside the EU or EEA when necessary for implementing IT services essential for work or studies, based on a case-by-case assessment. The primary destination country for such transfers is the United States. It is also possible that countries like India, which is often used as the operational base for global ICT service providers' helpdesk or IT support functions, may serve as the destination for data transfers.
International transfers of personal data from Metropolia University of Applied Sciences’ register to the United States and/or other non-EU/EEA countries are primarily safeguarded under Chapter V of the EU General Data Protection Regulation (GDPR), as stipulated in Article 46, through the use of Standard Contractual Clauses (SCCs). SCCs are incorporated into the data processing agreements with ICT service providers. Only essential data is transferred, and the transfers are conducted in compliance with data protection laws and within their limits. The security and privacy of the transfer are always agreed upon separately.
Personal data may be transferred outside the EU/EEA in the context of international student admissions and exchanges, as well as facilitate these processes, or when a student participates in international RDI (Research, Development, and Innovation) activities.
If data is transferred outside the EU/EEA, the transfer is approved by the data controller and is preceded by a documented Transfer Impact Assessment (TIA). The data transfer agreement includes Standard Contractual Clauses (SCCs) approved by the European Commission. The data controller continuously monitors and evaluates the data protection level of the destination country. Transfers may also be carried out using other methods explicitly approved in writing by the data controller.
The retention period for personal data is based on law and varies depending on the nature and purpose of the data. Retention periods are determined by the Act on National Study and Degree Registers (884/2017), the Universities of Applied Sciences Act (932/2014), and the National Archives’ decision on retention periods for universities of applied sciences (AL/20757/07.01.01.03.02/2016). Some data is deleted when it is no longer needed and there is no legal obligation to retain it. Retention periods are calculated either from the date the personal data was collected or when the individual ceases using the service.
Examples of Retention Periods:
- Recordings from camera surveillance for EXAM examinations: 90 days
- Exam answers and evaluations: Six months
- Data related to teaching internships and student well-being services (unless the student requests an extension of the retention period): One year
- Data related to student shadowing activities, surveys, and TARU training: Two years
- Health-related information: Four years
- Music pedagogy practice student data: Five years
- Data related to the payment of international scholarships: 10 years
- Credit-bearing study records, study rights, enrollment, degree and performance data, student healthcare records, and other related information: Permanently