Home Privacy policy Privacy notice: R&D project management

Privacy notice: R&D project management

Privacy notice: R&D project management: joint informative document for data subjects (Articles 13 and 14 of the General Data Protection Regulation [2016/679]).

Purposes of processing personal data

Personal data is processed to carry out different management tasks of research and develop-ment projects. These tasks include:

project communication
project reporting
participant lists of people participating in project activities
managing and preparing project contracts and agreements
management of IPR contracts related to results and data generated in the projects.

Legal basis for processing

The basis for processing personal data:

the law
public interest
consent in some cases

The main legal instruments include:

Finnish Universities of Applied Sciences Act (932/2014)
EU General Data Protection Regulation (2016/679)
Act on the Openness of Government Activities (621/1999)

Regulations of different funding programmes and project funders also form the basis for data processing.

Personal data content and retention periods of the register

Data category name
Name
Contact details
Job title
Salary and other information related to employment
Employer
Information on working hours

Data contained in documents mentioned in the decision AL/20757/07.01.01.03.02/2016 (sec-tion 13) of the National Archives of Finland are retained permanently: https://arkisto.fi/uploads/normit/valtionhallinto/seulontapaatokset/AMK%20paatos%20AL%2020757%202016.pdf. (only in Finnish).

Data contained in documents that have to be kept for a set period of time based on project funder’s regulations, but not retained permanently, are retained for 15 years.

In other cases the data will be retained until the data is no longer needed for its original pur-poses.

Data subjects

People participating in R&D projects:

HAMK/HAMI/HAMK Academy students
HAMK/HAMI/HAMK Academy personnel
Personnel of the project partners and stakeholders of HAMKin/HAMIn/HAMK Academy
People participating in the project as a target group

Regular sources of data

Data is collected from existing records, the person him/herself or the partner and stakeholder organisations.

HAMK/HAMI/HAMK Academy personnel data is also collected from the HR, working time monitoring and project management systems.

Regular disclosures of data

project funding organisations
project partners
HAMK/HAMI/HAMK Academy auditor or outside auditors/authorities
other data processors (e.g. companies offering IT services or other expert services), who will process the data based on agreements

Principles of data protection of the register

A Manual material

Data is processed mainly in electronic form. Possible manual material is kept in locked space and destroyed when no longer needed.

B Data processed through automated data processing

Data is stored in HAMK/HAMI/HAMK Academy information systems and project funders’ systems. Users have personal user IDs. Access is granted only to those persons who are enti-tled to access and use the data in the system in order to perform their duties.

The lawful processing of personal data is ensured by categorisation of data and with operating methods that are in compliance with the data handling rules concerning data set.

Automated decision-making

No automated decision-making is performed on the recorded data.

Transfer of data outside the EU or EEA

No data is transferred outside the EU or EEA.

Rights of the data subject

The EU General Data Protection Regulation (2016/679) provides the data subject with the following rights:

The data subject shall have the right to withdraw his or her consent at any time. (Article 7)

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed. The data subject shall have the right to access to the personal data concerning him or her. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the data controller may charge a fee or refuse to act on the request. (Article 12 and Article 15)

The data subject shall have the right to obtain from the data controller the rectification of inaccurate personal data concerning him or her contained in the register (Article 16). A request for rectification shall be submitted in writing. Persons in an employment relationship (with HAMK or HAMI) are able to do rectification suggestions concerning their recorded working hours, which are then approved by their supervisor or salary administration personnel.

The data subject shall have the right to request the erasure of personal data concerning him or her where one of the following grounds applies (Article 17):

the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
the data subject withdraws consent on which the processing is based and there is no other legal ground for the processing;
the data subject objects to the processing, and there are no overriding legitimate grounds for the processing (Article 21);
the personal data have been unlawfully processed;
the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.

The data subject shall have the right to obtain restriction of processing where one of the following applies (Article 18):

the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.

Where the processing is based on consent and carried out by automated means, the data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a data controller, in a machine-readable format. (Article 20)

Requests to exercise these rights are to be submitted:

Häme University of Applied Sciences Ltd
Data protection officer
P.O. Box 230 (Visamäentie 35A)
FI-13101 Hämeenlinna, Finland

email: tietosuojavastaava@hamk.fi. You can also send the message via secured e-mail https://www.securedmail.eu/ .

The data subject shall have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Data controller

Häme University of Applied Sciences Ltd, Häme Vocational Institute Ltd and HAMK Academy Ltd
P.O. Box 230 (Visamäentie 35A), FI-13101 Hämeenlinna
13101 Hämeenlinna

Telephone: +358 3 6461, e-mail address: hamk@hamk.fi