Data Protection Act 2018/1050, EU General Data Protection Regulation 2016/679. The data protection statement contains information that must be communicated to data subjects when processing personal data. Because of the data protection statement, it forces the controller to provide proof. The obligation to provide information is central to the regulation in principle and means that the data controller must comply with national legislation related to data protection.
This document details the information about the processing of personal data on a research or project basis. The data protection notice of the Research date category can be found at xamk.fi/en/about/data-protection-announcement.
South-Eastern Finland University of Applied Sciences
PL 68 (Patteristonkatu 3)
50101 Mikkeli
Phone 040 655 0555
Business ID: 2472908-2
Coordinator of research data category:
Minna Pasila
Contracts and IPR Specialist
Phone 050 312 5109
Email: etunimi.sukunimi@xamk.fi
Markus Häkkinen
Project Manager, Data Protection officer
South-Eastern Finland University of Applied Sciences
RDI Services
PL 68 (Patteristonkatu 3 D), 50101 Mikkeli
Phone 040 198 1150
Email: etunimi.sukunimi@xamk.fi
Person responsible for the register and data related to the register:
Riku Happonen
Project Manager
Phone 044 70 28238
Email: etunimi.sukunimi@xamk.fi
This privacy statement applies to the Xentre App service of South-Eastern Finland University of Applied Sciences Ltd (Xamk) and the related processing of personal data. The service is provided and maintained by Mesensei Oy. The Xentre App is an electronic social network. The processing of data is partly automated and it is possible to form a unified register or separate registers of the data.
Purpose of processing personal data
· Implementation of teaching, working life collaboration, and research, development, and innovation activities (RDI activities)
· Managing customer and stakeholder relations, including sales of services and implementation of cooperation projects
· Marketing and communication
In cases related to research, development, and innovation activities, as well as collaboration in education, the processing of personal data is based on the statutory tasks of the University of Applied Sciences, as described in the University of Applied Sciences Act 932/2014, and project-specific funding conditions.
The processing of personal data in the register is based on a relevant connection or the performance of a contract in which the data subject is involved.
The legal basis for processing is the legitimate interest of the University of Applied Sciences when it comes to business and the processing of information of potential customers. Personal data is stored at this stage to establish contact with potential customers. Personal data of potential customers is completely removed from the register if no customer relationship or stakeholder collaboration is established.
The following personal data are collected from an unregistered pseudonymous user:
· Nickname that the user enters into the application.
· Synthetic identifier based on mobile device data to be associated with the user account.
· Gender (Not required)
· Technical information about the communication sent by the application to the server (e.g., software version, timestamps of events)
· User-entered keywords
· Other users with whom the user has been in contact.
· Number and duration of online calls made and answered.
· Number of messages sent and received.
· Message content
· User recommendations
· User favorites: other users, events, groups, etc.
· Events for which the user has booked a seat.
· Feedback that the user has left with customer service and the contact information attached to it.
In addition to the above, the following personal data is collected from the registered users who created the user account:
· The name by which the user account was created.
· Password (in cryptographically secure format)
· Topics and keywords by which the user can be found.
· Photo
· Profile info
· E-mail address
· Recommendations received by the user.
· Hours and minutes indicated by the user during which he is available online.
· Organizations and groups to which the user belongs.
· Events to which the user is associated.
The processors of personal data are natural persons in the context. Mesensei Oy, which produces and maintains the Xentre App mobile application, acts as a processor of the register on behalf of Xamk. The processor complies with Xamk's instructions on the processing of personal data and data protection.
The register owned by Xamk and described in this statement is not transferred outside the EU or EEA. However, the information published in the mobile application is displayed individually in the service, from where it can be searched globally for those who have a license to the service. Depending on the terminal device used to access the mobile application and its settings, it is possible that certain identifiers that can be linked to a natural person may be transferred outside the EU or EEA to countries whose data protection practices may differ from the EU's General Data Protection Regulation.
Personal data will be stored for as long as the need to use it still exists. In project activities, personal data is stored according to the archiving period required by the funder.
If the data subject requests the erasure of personal data concerning him or her, they will be deleted from the register. If a person withdraws his or her consent to the use of his or her data for a specific purpose, this will be recorded in the system in the data of that person.
The data subject may request the data concerning him or her. The request must be made in writing to the Data Protection Officer or via an electronic form (can be found at:
https://www.xamk.fi/en/xamk2/data-protection-announcement/
In the request, the data subject must specify which data the request concerns.
The data subject may submit a request for rectification of his or her data to the Data Protection Officer.
The controller also updates the personal data in its register on its own initiative whenever persons acting in the name of the controller receive information about them either from the data subject himself or from public sources.
The data subject may indicate in writing the prohibition of the use of his or her personal data. This prohibition shall be entered in the register.
The registered entity may also request the erasure of personal data concerning him or her from the register. The data will be deleted if South-Eastern Finland University of Applied Sciences Ltd does not have a legal reason to retain the data, such as fulfilling a contractual obligation or conducting RDI work.
The data subject has the right to restriction of processing if one of the following is fulfilled:
· The accuracy of the personal data is contested by the data subject, in which case the processing is restricted for a period during which the registrant can verify their accuracy.
· The processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of their use instead.
· The controller no longer needs the personal data for the purposes of the processing, but the data subject needs them for the establishment, exercise, or defense of legal claims.
· The data subject has objected to the processing of the personal data pursuant to Article 21, pending verification whether the legitimate grounds of the controller override those of the data subject.
The data subject has the right to object, on specific grounds, to the processing of his or her personal data based on the legitimate interest of the controller.
The data subject has the right to receive in a machine-readable format the personal data concerning him or her that he or she has provided to the controller, provided that the processing is based on consent and the processing takes place by automated means.
The data subject must be informed of the right to withdraw consent at any time (If the processing is based on consent or explicit consent)
Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement, if the data subject considers that the processing of personal data concerning him or her infringes this Regulation.
In the case of a customer relationship or cooperation for which a written agreement is drawn up, the conclusion of the agreement requires the receipt of sufficient personal information necessary for the preparation and implementation of the agreement.
Personal data is not used for profiling the data subject or for automated decision-making.
At the planning stage of project cooperation, personal data can be obtained from a public source. In this case, consent is requested from the data subject within 1 month.