This Privacy Notice is based on the EU's General Data Protection Regulation (2016/679, “GDPR”), namely the obligation to inform the data subjects (GDPR Articles 12–14), the data controller's obligation to maintain a record of processing activities under its responsibility (GDPR Article 30), as well as the obligations set out in the Finnish Data Protection Act (1050/2018) supplementing the GDPR.
Additionally, this Privacy Notice has been prepared with the aim of making it accessible in accordance with the requirements of the EU's Web Accessibility Directive (Directive (EU) 2016/2102 of the European Parliament and of the Council on the accessibility of the websites and mobile applications of public sector bodies) and the Finnish Act on the Provision of Digital Services (306/2019) supplementing it.
Personal data register of Get Work Vantaa Project’s career coaching service
The Personal Data Register of Get Work Vantaa Project’s career coaching service contains the following personal data:
first name
surname
telephone number
email address
place of residence
native language
citizenship
age group
information on client’s employment and study situation
education
work experience
duration of residency in Finland
other data and documents given by the client for implementing the career coaching service
Sanna Saarnia, Metropolia’s Data Protection Officer
Email: tietosuojavastaava [at] metropolia.fi (tietosuojavastaava[at]metropolia[dot]fi)
Get Work Vantaa is a joint project implemented in collaboration between Metropolia UAS, Laurea UAS and the City of Vantaa. The aim of the project is to enhance employment, competence development and career possibilities of English-speaking immigrants in Vantaa. As a part of the project, Metropolia University of Applied Sciences and Laurea University of Applied Sciences provide and develop a career coaching service. The purpose of the processing and stocking of personal data is to implement the career coaching service and to contact and inform the clients about services, events, workshops, and other relevant actions.
The processing of the personal data contained in the data register of Get Work Vantaa project’s career coaching service is based on consent.
The Personal Data Register of Get Work Vantaa Project’s career coaching service contains the following personal data:
first name
surname
telephone number
email address
place of residence
native language
citizenship
age group
information on client’s employment and study situation
education
work experience
duration of residency in Finland
other data and documents given by the client for implementing the career coaching service
Personal data is collected from the data subjects themselves through a background information form, emails and career coaching sessions.
According to the EU's General Data Protection Regulation a data subject has
· Right to access information held about them by a data controller, the right or check the accuracy of the data, and a right to receive a copy of their personal data
· Right to rectification of inaccurate personal data and the right to restrict processing
· Right to obtain from the controller the erasure of their personal data from a Metropolia register without undue delay
· Right to data portability (transfer of data from one system to another the right to rectify personal data and to restrict processing
· Right to not be subjected to a personal data breach
· Right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on point (e) of Article 6(1)
· Right to withdraw their consent for processing at any time
A data subject may submit a request for an access to information, a request for rectifying personal data, a request for the erasure of personal data, a request to stop processing of collected personal data, or a request to withdraw consent by contacting the contact persons for the register or the career coaches of the Get Work Vantaa Project’s career coaching service. A data request can also be made by submitting a data subjects’ information request form to Metropolia’s Student and Admission Services. The form must be signed personally by the data subject. When submitting the request, the data subject must prove their identity in a reliable manner.
The visiting addresses of the offices of Metropolia’s Student and Admission Services are
· Metropolia Myllypuro campus, Myllypurontie 1, 00920 Helsinki
· Metropolia Arabia campus, Hämeentie 135 D, 00560 Helsinki
· Metropolia Myyrmäki campus, Leiritie 1, 01600 Vantaa
· Metropolian Karamalmi campus, Karaportti 2, 02610 Espoo
Under the GDPR, the data controller must respond to requests by the data subjects to exercise their rights within one month of receiving such a request.
As a general rule, the personal data contained in the Personal Data Register of Get Work Vantaa Project’s career coaching service are not transferred outside the EU or EEA or to international organisations.
The personal data contained in the register may be transferred outside the EU or EEA for the provision of IT services that are necessary for working or completing studies, based on a case-by-case consideration.
The international transfer of personal data to the United States and/or elsewhere outside the EU or EEA is secured primarily with measures, i.e. Standard Contractual Clauses, provided for in Chapter V, Article 46 of the EU’s General Data Protection Regulation (GDPR). The Standard Contractual Clauses are included in agreements with ICT service providers concerning the processing of personal data.
Only the necessary data are transferred and the transfer is carried out in accordance with data protection legislation and within the restrictions placed by it. A separate agreement is always concluded on data security during the transfer.
The personal data collected for and processed within the personal data register of Get work Vantaa Project’s career coaching service is stored solely the period necessary for implementing and developing the career coaching service and for providing the reports acquired by the funder of the project. The data will be destroyed by 31 December 2025 at latest.
According to the EU's General Data Protection Regulation a data subject has
· Right to access information held about them by a data controller, the right or check the accuracy of the data, and a right to receive a copy of their personal data
· Right to rectification of inaccurate personal data and the right to restrict processing
· Right to obtain from the controller the erasure of their personal data from a Metropolia register without undue delay
· Right to data portability (transfer of data from one system to another the right to rectify personal data and to restrict processing
· Right to not be subjected to a personal data breach
· Right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on point (e) of Article 6(1)
· Right to withdraw their consent for processing at any time
A data subject may submit a request for an access to information, a request for rectifying personal data, a request for the erasure of personal data, a request to stop processing of collected personal data, or a request to withdraw consent by contacting the contact persons for the register or the career coaches of the Get Work Vantaa Project’s career coaching service. A data request can also be made by submitting a data subjects’ information request form to Metropolia’s Student and Admission Services. The form must be signed personally by the data subject. When submitting the request, the data subject must prove their identity in a reliable manner.
The visiting addresses of the offices of Metropolia’s Student and Admission Services are
· Metropolia Myllypuro campus, Myllypurontie 1, 00920 Helsinki
· Metropolia Arabia campus, Hämeentie 135 D, 00560 Helsinki
· Metropolia Myyrmäki campus, Leiritie 1, 01600 Vantaa
· Metropolian Karamalmi campus, Karaportti 2, 02610 Espoo
Under the GDPR, the data controller must respond to requests by the data subjects to exercise their rights within one month of receiving such a request.
According to Article 21 of the EU’s General Data Protection Regulation, the data subjects have the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on point (e) of Article 6(1) (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller), such as profiling based on these provisions. The data controller may no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
The request to stop processing of collected personal data can be submitted to one of the three above-mentioned offices of Metropolia’s Student and Admission Services or Metropolia’s Human Resources Management unit (staff only), where the data subject must prove their identity when submitting the request.
According to Article 21 of the EU’s General Data Protection Regulation, the data subjects have the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on point (e) of Article 6(1) (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller), such as profiling based on these provisions. The data controller may no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
The request to stop processing of collected personal data can be submitted to one of the three above-mentioned offices of Metropolia’s Student and Admission Services, where the data subject must prove their identity when submitting the request.
If the processing of personal data is based on the data subject’s consent, the data subject has the right to withdraw their consent for processing at any time without the withdrawal of consent affecting the lawfulness of processing based on consent before its withdrawal.
The withdrawal of consent for the processing of personal data collected by Metropolia (withdrawal request) can be submitted to one of the three above-mentioned offices of Metropolia’s Student and Admission Services (or in the case of a member of staff, to the Human Resources Management unit), where the data subject must prove their identity when submitting the request.
Every data subject has the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of their personal data infringes the applicable data protection regulations.
The national supervisory authority in Finland is the Office of the Data Protection Ombudsman. Contact details:
Office of the Data Protection Ombudsman
Street address: Lintulahdenkuja 4, 00530 Helsinki, Finland
Postal address: PO Box 800
FI-00531 Helsinki
Telephone (switchboard): + 358 29 56 66700
Email: tietosuoja [at] om.fi (tietosuoja[at]om[dot]fi)
General description of the technical and organisational security measures aiming at protecting the personal data of the data subjects and the personal data registers:
- The protection of the register has been agreed upon with the system providers. If necessary, the responsibilities have been described in adequate detail in the appropriate agreements.
- The employees and other personnel have undertaken to comply with the obligation of secrecy and to keep confidential the information they receive in connection with the personal data processing.
- The system providers (personal data processors) undertake to maintain the register and the personal data relating to it in accordance with good data processing practices and comply with the obligation to absolute secrecy and confidentiality.
- The data security of the personal data register of the data controllers and the confidentiality of the data contained therein are ensured with appropriate technical and administrative means in accordance with good data processing practices.
- The data controllers have restricted user rights and authorisations to data systems, tools and other storage platforms in such a way that they can only be accessed and processed by the persons who are necessary for such processing due to their job duties or position.
- The system containing personal data may only be used by employees who are entitled to process personal data due to their job duties and/or position. Such employees will be given the appropriate training for their duties.
- Every user of a tool/system must identify themselves with their personal codes, which are issued when the right to access the tool/system is granted. The right of access will expire once the employee resigns or is transferred from the duties for which they were granted the right at Metropolia.
- The data are collected in databases that are protected logically and physically.
The databases and their back-up copies are located in locked premises, and the data can only be accessed by certain pre-appointed persons.
The provision of personal data is voluntary. Personal data is used for implementing the Get Work Vantaa Project’s career coaching service.
Data included in the personal data register shall not be used for automated decision-making or profiling.