This Privacy Notice is based on the EU's General Data Protection Regulation (2016/679, “GDPR”), namely the obligation to inform the data subjects (GDPR Articles 12–14), the data controller's obligation to maintain a record of processing activities under its responsibility (GDPR Article 30), as well as the obligations set out in the Finnish Data Protection Act (1050/2018) supplementing the GDPR.
Additionally, this Privacy Notice has been prepared with the aim of making it accessible in accordance with the requirements of the EU's Web Accessibility Directive (Directive (EU) 2016/2102 of the European Parliament and of the Council on the accessibility of the websites and mobile applications of public sector bodies) and the Finnish Act on the Provision of Digital Services (306/2019) supplementing it.
Personal Data Register of Vallu Entrance Examination Service for Higher Education Institutions' Student Selection
Controllers:
Entrance examinations of universities of applied sciences:
Ab Yrkeshögskolan vid Åbo Akademi, Yrkeshögskolan Novia
PB 6 (Wolffskavägen 31), 65201 Vasa, hakijapalvelut [at] novia.fi (hakijapalvelut[at]novia[dot]fi)
Centria-ammattikorkeakoulu Oy
Talonpojankatu 2, 67100 Kokkola, info [at] centria.fi (info[at]centria[dot]fi)
Diakonia-ammattikorkeakoulu Oy
PL 12 (Kyläsaarenkuja 2), 00511 Helsinki, kirjaamo [at] diak.fi (kirjaamo[at]diak[dot]fi)
Haaga-Helia Ammattikorkeakoulu Oy
Ratapihantie 13, 00520 Helsinki, kirjaamo [at] haaga-helia.fi (kirjaamo[at]haaga-helia[dot]fi)
Humanistinen Ammattikorkeakoulu Oy
Ilkantie 4, 00400 Helsinki, humak [at] humak.fi (humak[at]humak[dot]fi)
Hämeen Ammattikorkeakoulu Oy
PL 230 (Visamäentie 35), 13101 Hämeenlinna, hamk [at] hamk.fi (hamk[at]hamk[dot]fi)
Jyväskylän Ammattikorkeakoulu Oy
PL 207 (Rajakatu 35), 40101 Jyväskylä, kirjaamo [at] jamk.fi (kirjaamo[at]jamk[dot]fi)
Kaakkois-Suomen Ammattikorkeakoulu Oy
PL 68 (Patteristonkatu 3 D), 50101 Mikkeli, kirjaamo [at] xamk.fi (kirjaamo[at]xamk[dot]fi)
Kajaanin Ammattikorkeakoulu Oy
PL 52 (Ketunpolku 1), 87101 Kajaani, kajaanin.amk [at] kamk.fi (kajaanin[dot]amk[at]kamk[dot]fi)
Karelia-ammattikorkeakoulu Oy
PL 256 (Tikanrinne 9), 80101 Joensuu, info [at] karelia.fi (info[at]karelia[dot]fi)
LAB-ammattikorkeakoulu Oy
PL 214 (Mukkulankatu 19), 15101 Lahti, asiakirjat [at] lab.fi (asiakirjat[at]lab[dot]fi)
Lapin Ammattikorkeakoulu Oy
Jokiväylä 11 C, 96300 Rovaniemi, kirjaamo [at] lapinamk.fi (kirjaamo[at]lapinamk[dot]fi)
Laurea-ammattikorkeakoulu Oy
Ratatie 22, 01300 Vantaa, rehtorintoimisto [at] laurea.fi (rehtorintoimisto[at]laurea[dot]fi)
Metropolia Ammattikorkeakoulu Oy
PL 4000 (Myllypurontie 1), 00079 Metropolia, kirjaamo [at] metropolia.fi (kirjaamo[at]metropolia[dot]fi)
Oulun Ammattikorkeakoulu Oy
PL 222 (Yliopistonkatu 9), 90101 OULU, kirjaamo [at] oamk.fi (kirjaamo[at]oamk[dot]fi)
Satakunnan Ammattikorkeakoulu Oy
PL 1001 (Satakunnan katu 23), 28101 Pori, kirjaamo [at] samk.fi (kirjaamo[at]samk[dot]fi)
Savonia-ammattikorkeakoulu Oy
PL 6 (Microkatu 1), 70201 Kuopio, savonia [at] savonia.fi (savonia[at]savonia[dot]fi)
Seinäjoen Ammattikorkeakoulu Oy
PL 412 (Kampusranta 11), 60101 Seinäjoki, kirjaamo [at] seamk.fi (kirjaamo[at]seamk[dot]fi)
Tampereen Ammattikorkeakoulu Oy
Kuntokatu 3, 33520 Tampere, tamk [at] tuni.fi (tamk[at]tuni[dot]fi)
Turun Ammattikorkeakoulu Oy
Joukahaisenkatu 3, 20520 Turku, kirjaamo [at] turkuamk.fi (kirjaamo[at]turkuamk[dot]fi)
Vaasan Ammattikorkeakoulu Oy
PL 509 (Wolffintie 30), 65101 Vaasa, info [at] vamk.fi (info[at]vamk[dot]fi)
Yrkeshögskolan Arcada Ab
Jan-Magnus Janssons plats 1, 00560 Helsinki, registrator [at] arcada.fi (registrator[at]arcada[dot]fi)
Entrance examinations of universities:
Helsingin yliopisto
PL 3 (Fabianinkatu 33), 00014 Helsingin yliopisto, hakijapalvelut [at] helsinki.fi (hakijapalvelut[at]helsinki[dot]fi)
Itä-Suomen yliopisto
PL 111, 80100 Joensuu ja PL1627 Kuopio, hakijapalvelut [at] uef.fi (hakijapalvelut[at]uef[dot]fi)
Jyväskylän yliopisto
PL 35, 40014 Jyväskylän yliopisto, hakijapalvelut [at] jyu.fi (hakijapalvelut[at]jyu[dot]fi)
Lapin yliopisto
PL 122, 96101 Rovaniemi, hakijapalvelut [at] ulapland.fi (hakijapalvelut[at]ulapland[dot]fi)
Oulun yliopisto
PL 8000, 90014 Oulun yliopisto, hakijapalvelut [at] oulu.fi (hakijapalvelut[at]oulu[dot]fi)
Tampereen yliopisto
Kalevantie 4, 33014 Tampereen yliopisto, hakijapalvelut.tau [at] tuni.fi (hakijapalvelut[dot]tau[at]tuni[dot]fi)
Turun yliopisto
20014 Turun yliopisto, hakijapalvelut [at] utu.fi (hakijapalvelut[at]utu[dot]fi)
Åbo Akademi
Tuomiokirkontori 3, 20500 Turku, studinfo [at] abo.fi (studinfo[at]abo[dot]fi)
Person responsible for the content of the register:
Name: Tuomas Orama Position: Research and Development Manager, Metropolia University of Applied Sciences Ltd
Address: Metropolia University of Applied Sciences Ltd, PO Box 4000, 00079 Metropolia, Finland
Email: tuomas.orama [at] metropolia.fi (tuomas[dot]orama[at]metropolia[dot]fi)
Contact details of the contact person for the register:
Name: Tuomas Orama
Position: Research and Development Manager, Metropolia University of Applied Sciences Ltd
Address: Metropolia University of Applied Sciences Ltd, PO Box 4000, 00079 Metropolia, Finland
Email: tuomas.orama [at] metropolia.fi (tuomas[dot]orama[at]metropolia[dot]fi)
Rekisterinpitäjien tietosuojavastaavat:
Ammattikorkeakoulujen valintakokeet:
Ab Yrkeshögskolan vid Åbo Akademi, Yrkeshögskolan Novia
dataskyddsansvarig [at] novia.fi (dataskyddsansvarig[at]novia[dot]fi)
Centria-ammattikorkeakoulu Oy
rainer.bjork [at] centria.fi (rainer[dot]bjork[at]centria[dot]fi)
Diakonia-ammattikorkeakoulu Oy
tietosuojavastaava [at] diak.fi (tietosuojavastaava[at]diak[dot]fi)
Haaga-Helia Ammattikorkeakoulu Oy
ilkka.valve [at] haaga-helia.fi (ilkka[dot]valve[at]haaga-helia[dot]fi)
Humanistisen Ammattikorkeakoulu Oy
security [at] humak.fi (security[at]humak[dot]fi)
Hämeen Ammattikorkeakoulu Oy
tietosuojavastaava [at] hamk.fi (tietosuojavastaava[at]hamk[dot]fi)
Jyväskylän Ammattikorkeakoulu Oy
tietosuoja [at] jamk.fi (tietosuoja[at]jamk[dot]fi)
Kaakkois-Suomen Ammattikorkeakoulu Oy
tietosuojavastaava [at] xamk.fi (tietosuojavastaava[at]xamk[dot]fi)
Kajaanin Ammattikorkeakoulu Oy
tietosuojavastaava [at] kamk.fi (tietosuojavastaava[at]kamk[dot]fi)
Karelia Ammattikorkeakoulu Oy
tietosuoja [at] karelia.fi (tietosuoja[at]karelia[dot]fi)
LAB-ammattikorkeakoulu Oy
tietosuoja [at] lab.fi (tietosuoja[at]lab[dot]fi)
Lapin Ammattikorkeakoulu Oy
tietosuoja [at] lapinamk.fi (tietosuoja[at]lapinamk[dot]fi)
Laurea-ammattikorkeakoulu Oy
marjo.valjakka [at] laurea.fi (marjo[dot]valjakka[at]laurea[dot]fi)
Metropolia Ammattikorkeakoulu Oy
tietosuojavastaava [at] metropolia.fi (tietosuojavastaava[at]metropolia[dot]fi)
Oulun Ammattikorkeakoulu Oy
tietosuoja [at] oamk.fi (tietosuoja[at]oamk[dot]fi)
Satakunnan Ammattikorkeakoulu Oy
tietosuojavastaava [at] samk.fi (tietosuojavastaava[at]samk[dot]fi)
Savonia-ammattikorkeakoulu Oy
tietosuojavastaava [at] savonia.fi (tietosuojavastaava[at]savonia[dot]fi)
Seinäjoen Ammattikorkeakoulu Oy
tietosuojavastaava [at] seamk.fi (tietosuojavastaava[at]seamk[dot]fi)
Tampereen Ammattikorkeakoulu Oy
dpo [at] tuni.fi (dpo[at]tuni[dot]fi)
Turun Ammattikorkeakoulu Oy
tietosuoja [at] turkuamk.fi (tietosuoja[at]turkuamk[dot]fi)
Vaasan Ammattikorkeakoulu Oy
security [at] vamk.fi (security[at]vamk[dot]fi)
Yrkeshögskolan Arcada Ab
tietosuoja [at] arcada.fi (tietosuoja[at]arcada[dot]fi); dataskydd [at] arcada.fi (dataskydd[at]arcada[dot]fi)
Yliopistojen valintakokeet:
Helsingin yliopisto
tietosuoja [at] helsinki.fi (tietosuoja[at]helsinki[dot]fi)
Itä-Suomen yliopisto
tietosuoja [at] uef.fi (tietosuoja[at]uef[dot]fi)
Jyväskylän yliopisto
tietosuoja [at] jyu.fi (tietosuoja[at]jyu[dot]fi)
Lapin yliopisto
tietosuoja [at] ulapland.fi (tietosuoja[at]ulapland[dot]fi)
Oulun yliopisto
dpo [at] oulu.fi (dpo[at]oulu[dot]fi)
Tampereen yliopisto
dpo [at] tuni.fi (dpo[at]tuni[dot]fi)
Turun yliopisto
dpo [at] utu.fi (dpo[at]utu[dot]fi)
Åbo Akademi
dataskydd [at] abo.fi (dataskydd[at]abo[dot]fi)
Purpose of the processing of personal data:
The personal data register for the student selection entrance examination system and management system included in the Vallu entrance examination service is used to process personal data for carrying out student selections by higher education institutions. The Vallu entrance examination system also includes the entrance examination score service in which the applicants' entrance exam score are published.
Entrance examinations carried out in the Vallu entrance exam service are used for selecting students in Finland for higher education studies leading to Finnish-, Swedish- or English-language degrees. The service processes the personal data of (registered) applicants and higher education staff that use the service.
The above universities of applied sciences process personal data in such a way that a joint controllership exists between them, as referred to in Article 26 of the EU's General Data Protection Regulation (EU 2016/679).
The universities of applied sciences have entered into an agreement on joint controllership specifying their actual roles, responsibilities, and relationships with regard to the data subjects.
When universities provide joint entrance examinations, the register is shared by the universities. Each university also organises their own entrance examinations for which they solely act as controller.
Data from the personal data register of the Vallu entrance examination service may be disclosed for scientific and historical research purposes. Disclosure of data is based on consent from the data subject.
Lawful basis for the processing of personal data:
Personal data of the register may be disclosed for scientific and historical research purposes. Disclosure of data is based on consent of the data subject.
The processing of data included in the register of Vallu entrance examination service is based on legal obligation of the data controllers.
- Universities of Applied Sciences Act 932/2014 and decrees enacted on the basis of it
- Universities Act 558/2009 and decrees enacted on the basis of it
- Act on the National Registers of Education Records, Qualifications and Degrees, 884/2017
The lawful basis for the processing of personal data in the register is not “legitimate interest”. Therefore this section does not apply.
The following are the groups of data subjects in the personal data register:
- Applicants to higher education using the Vallu entrance examination service
- The staff of higher education institutions using the Vallu entrance examination service.
The following personal data by personal data category is stored in the personal data file of the Vallu entrance examination service:
Background information of applicant:
- Basic information on the applicant: forenames, call name, surname, national learner ID, personal identity code, email, telephone number
- Application ID
- Study programmes applied for
- Entrance examination identifiers for content area/part
- Information on the location and time of the entrance examination
Personal data handled in the Vallu entrance examination service:
- Background information of applicant
- Applicant's unique QR code
- Information about entrance examinations
- Adaptations required by the applicant's individual arrangements. The reasons for the individual arrangements are not stored in the register
The management system of the Vallu entrance examination service generates a unique identifier in the form of a QR code. The applicant's unique QR code includes the information on the applicant's right to take the entrance examination, and details about the exam. The unique QR code is used together with a personal identity document for performing strong identification of the applicant before the exam.
Higher education institutions create locations in the management system and place applicants in different locations. An applicant may also be granted additional time and individual arrangements for health-related reasons; the applicant's exam performance may be rejected or the applicant may be transferred to another exam event. The reasons for the individual arrangements are not stored in the register.
Applicant's exam answers:
- Answers given in the entrance examination are only saved on a server of Metropolia University of Applied Sciences.
- Log data related to the answers given in the entrance examination (incl. precise time each answer is saved is only stored on a server of Metropolia University of Applied Sciences).
Scores obtained by the applicant in the entrance examination:
Data processed after the entrance examination and transferred by from the Vallu entrance examination service into the Opintopolku.fi service through a technical interface includes:
- Information whether the applicant took the entrance examination (yes or no)
- Scores obtained by the applicant in the entrance examination
Metropolia University of Applied Sciences also submits to all higher education institutions that used the Vallu entrance examination service an electronic report containing the following data about the higher education applicants:
- Background information of applicant
- Applicants' exam answers
- Scores obtained by the applicant in the entrance examination
In certain exceptional situations, Metropolia University of Applied Sciences submits the data after the entrance examination only to the higher education institutions.
This data is stored in each higher education institutions in accordance with their practices.
After the entrance examination, the higher education institution may publish, using the entrance examination score service, details that may be viewed by each applicant about themselves. Higher education institutions decide separately for each examination which data is to be published. The data to be published may be:
- The applicant's total score of the entrance examination
- The applicant's score in specific parts
- Exam questions
- Images and PDF attachments of the exam
- Applicant's answers to the questions
- Written grounds by the marker
- Lowest score to pass a specific part
Details of the staff of higher education institutions using the Vallu entrance examination service
- Forename and surname
- Haka user ID
- Email address
- Home organisation
The following categories of personal data are stored in the Vallu entrance examination service register:
In some entrance exams, also the applicant’s nationality, the passport or identity card number, and the facial image on the passport or identity card are collected.
In some cases, the completion of the entrance exam conducted remotely online may be monitored, to ensure equal treatment of applicants. When participating in remote monitoring, applicants give their consent to monitoring conditions, such as keeping their webcam on. The applicant has the right to interrupt monitoring during the exam due to, for example, an unforeseen situation, which may however lead to dismissal of the exam results. The applicant accepts the terms of use for the SMOWL proctoring software and Vallu entrance examination service before starting the pre-identification for the exam. The terms of use for Candour are accepted by the applicant in the Candour ID application.
Personal data of the applicant
Metropolia University of Applied Sciences retrieves the applicant's background data processed in the Vallu entrance examination service from the Opintopolku.fi service via a technical interface.
In certain exceptional cases, student application is carried out outside the study path, in which case the higher education institution will receive the personal data directly from the applicant and submit it to Metropolia University of Applied Sciences.
The answers given in the entrance examination are obtained from the data subjects themselves in the exam situation.
Higher education institutions create locations in the management system for taking the exam, and place applicants in them. An applicant may also be granted additional time and individual arrangements on the basis of their application. Higher education institutions may also reject the applicant's exam or have the applicant transferred to another exam event.
The scores given for the essays are received from persons performing the assessment for higher education institutions after the exam event.
Personal data of the staff of the universities of applied sciences
The personal data of the staff of the higher education institutions are mostly obtained from the data subjects themselves when they applied for employment at the university of applied sciences, and partly the data (such as the Haka ID) is created for them by their employer.
In some entrance exams, the applicants have to verify their identity online and the applicants' exam is monitored by a proctoring software integrated into the Vallu entrance examination service.
Metropolia University of Applied Sciences obtains, via a technical interface, facial images of the applicants read by the Candour application from the chip of their passport or identity card to the Vallu entrance examination service.
After the entrance exam, a summary of the monitoring data of the participants of the exam will be disclosed to the Vallu entrance examination service.
Access to the personal data contained in the register will be given, where necessary, in the systems listed below. (For the purpose of repairing a technical fault, for example, access will be given to the system provider or to the maintenance personnel of a measurement device.) All system/software providers used (the companies behind them) can be deemed to be recipients of personal data.
With respect to the systems used by the register, personal data processing agreements in accordance with Article 28 of the GDPR have been concluded with the following cooperation partners:
Finnish National Agency for Education; Opintopolku.fi service
Eduix Oy
CSC-IT Center for Science Ltd
Candour Oy
SMOWLtech
Personal data is not transferred outside the EU or EEA or to international organisations
Entrance examinations of universities of applied sciences:
The data saved in the entrance examination service is retained for two (2) years as of the date on which the decision concerning student selections is issued.
With an exception of the facial image stored by Candour Oy and the applicant-specific monitoring data in the SMOWL proctoring software which will be stored for 12 months after the exam.
University entrance examinations:
The data saved in the entrance examination service is retained until the end of the year applicable to the entrance examinations.
The data subjects have the right to receive confirmation from the data controller of whether their personal data are being processed. Furthermore, the data subjects have the right of access to their personal data and the right to inspect their personal data stored in the register and to receive copies of them. Under the GDPR, the data controller must respond to requests by the data subjects to exercise their rights within one month of receiving such a request.
A. Right of access to personal data
The data subjects have the right to check whether their personal data are stored in the personal data register. A data subject may submit a request for information by delivering the data subjects’ information request form, which can be found on Metropolia’s public website and/or Metropolia’s intranet, to one of the three offices of Metropolia’s Student and Admission Services. The form must be filled in carefully, printed and signed personally by the data subject. If the data subject is a member of staff, they can deliver the request form to Metropolia’s Human Resources Management unit. When submitting the request, the data subject must prove their identity in a reliable manner (for example by presenting an official personal identity document or driving licence to the Metropolia employee receiving the request).
The visiting addresses of the offices of Metropolia’s Student and Admission Services are:
Metropolia’s Myllypuro campus
Myllypurontie 1, 00920 Helsinki, Finland
Metropolia’s Arabia campus
Hämeentie 135 D, 00560 Helsinki, Finland
Metropolia’s Myyrmäki campus
Leiritie 1, 01600 Vantaa, Finland
Metropolia’s Karamalmi campus
Karaportti 2, 02610 Espoo, Finland
The visiting address of Metropolia’s Human Resources Management unit is:
Metropolia’s Myllypuro campus (Buildings C and D, 5th floor)
Myllypurontie 1, 00920 Helsinki, Finland
All information requests will be forwarded from the offices of Metropolia’s Student and Admission Services and/or the Human Resources Management unit to Metropolia’s Data Protection Officer (email: tietosuojavastaava [at] metropolia.fi (tietosuojavastaava[at]metropolia[dot]fi)).
Metropolia’s Data Protection Officer will respond to information request submitted by the data subjects. If necessary, the Data Protection Officer can be requested to provide additional information on progress in the processing of the request or on the content of the response.
B. Right to rectify personal data and to restrict processing
The data subjects have the right to request the data controller to restrict the processing of their personal data in the following cases:
- the data subject disputes the correctness of their personal data (right to rectify personal data), in which case processing will be restricted until the data controller can ascertain that the data is correct;
- processing violates the law and the data subject objects to the erasure of their personal data, instead requesting that the processing of the data be restricted;
- the data controller no longer needs the personal data for the purposes of the processing, but the data subject needs them in order to establish, exercise or defend a legal claim.
Such a request for rectifying personal data in a Metropolia personal data register or restricting processing can be submitted in person to one of the above-mentioned offices of Metropolia’s Student and Admission Services or Metropolia’s Human Resources Management unit (staff only), where the data subject must prove their identity in a reliable manner when submitting the request.
C. Right to erase personal data
The data subject has the right to obtain from the controller the erasure of their personal data from a Metropolia register without undue delay if any of the following conditions are met:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- the data subject withdraws consent on which processing is based and there is no other lawful basis for processing;
- the personal data have been unlawfully processed; or
- the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
Such a request for the erasure of personal data in a Metropolia personal data register can be submitted in person to one of the three above-mentioned offices of Metropolia’s Student and Admission Services or Metropolia’s Human Resources Management unit (staff only), where the data subject must prove their identity in a reliable manner when submitting the request.
D. Right to data portability (transfer of data from one system to another)
Partly applicable. Article 20 of the General Data Protection Regulation (GDPR) introduces a new right of data portability of a data subject. This right allows for data subjects to receive the personal data that they have provided to a data controller, in a structured, commonly used and machine-readable format, and to transmit those data to another data controller without hindrance. The new right to data portability aims to empower data subjects regarding their own personal data, as it facilitates their ability to move, copy or transmit personal data easily from one IT environment to another (whether to their own systems, the systems of trusted third parties or those of new data controllers).
In accordance with Article 20(1)(a) of the GDPR, in order to fall under the scope of data portability, processing operations must be based:
- either on the data subject’s consent (pursuant to Article 6(1)(a), or pursuant to Article 9(2)(a) when it comes to special categories of personal data);
- or, on a contract to which the data subject is a party pursuant to Article 6(1)(b).
The GDPR does not establish a general right to data portability for cases where the processing of personal data is not based on consent or contract.
Such a request pursuant to Article 20 of the GDPR can be submitted in person to one of the three above-mentioned offices of Metropolia’s Student and Admission Services or Metropolia’s Human Resources Management unit (staff only), where the data subject must prove their identity in a reliable manner when submitting the request.
E. Right to not be subjected to a personal data breach
The data subject has the right to not be subjected to a personal data breach, as referred to in Article 33 of the EU’s General Data Protection Regulation, due to the data controller’s negligence in data protection and/or data security matters or due to negligence on the part of a data processor used by the controller in data protection and/or data security matters. The data subject has the right to be informed without undue delay if a personal data breach is likely to pose a high risk to the rights and freedoms of natural persons.
According to Article 21 of the EU’s General Data Protection Regulation, the data subjects have the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on point (e) of Article 6(1) (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller), such as profiling based on these provisions. The data controller may no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
The request to stop processing of collected personal data can be submitted to one of the three above-mentioned offices of Metropolia’s Student and Admission Services or Metropolia’s Human Resources Management unit (staff only), where the data subject must prove their identity when submitting the request.
Not applicable to this register.
Every data subject has the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of their personal data infringes the applicable data protection regulations.
The national supervisory authority in Finland is the Office of the Data Protection Ombudsman. Contact details:
Office of the Data Protection Ombudsman
Street address: Lintulahdenkuja 4, 00530 Helsinki, Finland
Postal address: PO Box 800
FI-00531 Helsinki
Telephone (switchboard): + 358 29 56 66700
Fax: + 358 9 56 66735
Email: tietosuoja [at] om.fi (tietosuoja[at]om[dot]fi)
General description of the technical and organisational security measures aiming at protecting the personal data of the data subjects and the personal data registers:
- The protection of the register has been agreed upon with the system providers. If necessary, the responsibilities have been described in adequate detail in the appropriate agreements.
- The employees and other personnel have undertaken to comply with the obligation of secrecy and to keep confidential the information they receive in connection with the personal data processing.
- The system providers (personal data processors) undertake to maintain the register and the personal data relating to it in accordance with good data processing practices and comply with the obligation to absolute secrecy and confidentiality.
- The data security of the personal data register of the data controllers and the confidentiality of the data contained therein are ensured with appropriate technical and administrative means in accordance with good data processing practices.
- The data controllers have restricted user rights and authorisations to data systems, tools and other storage platforms in such a way that they can only be accessed and processed by the persons who are necessary for such processing due to their job duties or position.
- The system containing personal data may only be used by employees who are entitled to process personal data due to their job duties and/or position. Such employees will be given the appropriate training for their duties.
- Every user of a tool/system must identify themselves with their personal codes, which are issued when the right to access the tool/system is granted. The right of access will expire once the employee resigns or is transferred from the duties for which they were granted the right at Metropolia.
- The data are collected in databases that are protected logically and physically.
The databases and their back-up copies are located in locked premises, and the data can only be accessed by certain pre-appointed persons.
Information on whether the processing of data in the personal data file is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data. An account has been given for each register regarding how the personal data was obtained.
The personal data are obtained from the data subjects themselves in connection with their application and participation in the entrance examination.
When the applicant begins to enter data through the Opintopolku.fi service, they are informed that the data will be processed by the Finnish National Agency for Education and several different higher education institutions (universities of applied sciences in Finland as joint data controllers; and universities, joint register between several universities having joint entrance examinations).
The personal data of the staff of the higher education institution is partly obtained from the data subjects themselves when they applied for employment at the institution, and partly the data (such as the Haka ID, work email address) is created for them by their employer based on their employment contract.
Data included in the personal data file is not used for automated decision-making or profiling.