Home Privacy policy Privacy notice: Processing personal data of persons applying for studies

Privacy notice: Processing personal data of persons applying for studies

Privacy notice: Processing personal data of persons applying for studies: joint informative document for data subjects (Articles 13 and 14 of the General Data Protection Regulation [2016/679]).

Purposes of processing personal data

Applicants’ personal data is processed in applicant register in order to ensure the selection procedure to be in accordance with selection criteria. By processing personal data, it is ensured the implementation of the legal protection of applicants and the implementation of authority data collection.

The higher education institution processes applicant data in order to perform duties set for universities of applied sciences. By processing personal data, it is ensured the equal treatment of applicants during selection procedure.

Legal basis for processing

The basis for personal data processing is public interest. Main legal instruments include the Finnish Universities of Applied Sciences Act (932/2014), Government Decree on Universities of Applied Sciences (1129/2014) and Act on National Study and Degree Registers (Laki valtakunnallisista opinto- ja tutkintorekistereistä 884/2017).

Personal data content and retention periods of the register

1. Persons applied via the Studyinfo service

Data category name	Retention period
Applicant data	retained permanently
– first name, last name	retained permanently
– personal identity code/date of birth	retained permanently
– learner’s national identifier (OID)	retained permanently
Contact details	retained permanently
Data disclosure permissions	retained permanently
Educational background	retained permanently
Work experience	retained permanently
Target programmes	retained permanently
Entrance examination points	retained permanently
Results of the selection	retained permanently
Entrance examination answers	1 year
Special arrangement documents	2 months (handling time for requests for adjustment)
Study place acceptance information	retained permanently
Registration information	retained permanently

2. Persons enrolled in Open UAS studies2, persons applied for exchange studies, persons applied for specialist educations (application not available via Studyinfo)

Data category name	Retention period
Applicant data	2 years, Open UAS 2 months
– first name, last name	2 years, Open UAS 2 months
– personal identity code/date of birth	2 years, Open UAS 2 months
Contact details	2 years, Open UAS 2 months
Data disclosure permissions	2 years, Open UAS 2 months
Educational background	2 years, Open UAS 2 months
Work experience (not Open UAS)	2 years
Payment and invoicing details	2 years, Open UAS 2 months
Application attachments (also videos)	2 years

3. Persons applied for exchange studies

Data category name	Retention period
Applicant data	retained permanently
– first name, last name	retained permanently
– date of birth	retained permanently
– passport number	retained permanently
Contact details	retained permanently
Exchange period details (type of exchange, duration)	retained permanently
Application annexes (Learning Agreement, transcript of records)	retained permanently

¹See the Studyinfo service register description (https://studyinfo.fi/wp2/en/)

²The retention period is based on the handling time for requests for rectification.

Data subjects

The register contains information on persons applying for studies at HAMK or enrolled as HAMK students.

Regular sources of data

The Matriculation Examination Board provides the Matriculation Examination data.

With regard to exchange students, the data subject themselves.

Regular disclosures of data

Data is disclosed from the applicant register (Studyinfo1)

Admitted applicants: the enrolment and registration service for students OILI (CSC – IT Center for Science Ltd)

Data may be disclosed from the register for research purposes through research permit procedure.

Data concerning persons applied for exchange studies may be disclosed from the mobility system to the UAS KOTA data collection of the Finnish Ministry of Education and Culture/Finnish National Agency for Education.

1 See the Studyinfo service register description (https://studyinfo.fi/wp2/en/)

Principles of data protection of the register

A Manual material

Printouts are disposed of in a secure manner at the end of the retention period. Material is kept in a locked space.

B Data processed through automated data processing

Data is stored in an information system or protected network drive. Users have personal user IDs for the system. Access is granted only to those persons who are entitled to access and use the data in the system or network drive in order to perform their duties.

The lawful processing of personal data is ensured by categorisation of data and with operating methods that are in compliance with the data handling rules concerning data set.

Automated decision-making

No automated decision-making is performed on the recorded data.

Transfer of data outside the EU or EEA

No data is transferred outside the EU or EEA.

Rights of the data subject

The EU General Data Protection Regulation (2016/679) provides the data subject with the following rights:

The data subject shall have the right to withdraw his or her consent at any time. (Article 7)

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed. The data subject shall have the right to access to the personal data concerning him or her. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the data controller may charge a fee or refuse to act on the request. (Article 12 and Article 15)

The data subject shall have the right to obtain from the data controller the rectification of inaccurate personal data concerning him or her contained in the register (Article 16). A request for rectification shall be submitted in writing. Persons in an employment relationship (with HAMK or HAMI) are able to do rectification suggestions concerning their recorded working hours, which are then approved by their supervisor or salary administration personnel.

The data subject shall have the right to request the erasure of personal data concerning him or her where one of the following grounds applies (Article 17):

the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
the data subject withdraws consent on which the processing is based and there is no other legal ground for the processing;
the data subject objects to the processing, and there are no overriding legitimate grounds for the processing (Article 21);
the personal data have been unlawfully processed;
the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.

The data subject shall have the right to obtain restriction of processing where one of the following applies (Article 18):

the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.

Where the processing is based on consent and carried out by automated means, the data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a data controller, in a machine-readable format. (Article 20)

Requests to exercise these rights are to be submitted:

Häme University of Applied Sciences Ltd
Data protection officer
P.O. Box 230 (Visamäentie 35A)
FI-13101 Hämeenlinna, Finland

email: tietosuojavastaava@hamk.fi. You can also send the message via secured e-mail https://www.securedmail.eu/ .

The data subject shall have the right to lodge a complaint with the Office of the Data Protection Ombudsman.