Stakeholder privacy statement
The following section describes how we process the personal data of Laurea stakeholders.
Laurea's stakeholders referred to in this privacy statement are:
If this privacy statement does not specify what the stakeholder's personal data processing policy applies to, the processing policy applies to all stakeholders. In addition, only the processing principles applicable to a specific stakeholder are specified in the statement.
Data controller
Laurea University of Applied Sciences, Ratatie 22, FI-01300 Vantaa, Finland
- Controller’s contact person: President, CEO Jouni Koski, jouni.koski@laurea.fi
- Person in charge of the stakeholder register: Teemu Ylikoski, Director, teemu.ylikoski@laurea.fi
- Data Protection Officer: Marjo Valjakka, marjo.valjakka@laurea.fi
Partners and customers
What personal data do we process and for what purposes?
We process the following personal data of partners and customers in order to implement and execute co-operation agreements and customer agreements.
- First and last name
- Email address
- Mobile phone number
- Postal address
- Title and area of responsibility
- Language
- Name of organisation
- Organisation contact details
- Branch of organisation
- Information on permission granted by the person to send marketing materials
We also process contact information from potential partners and customers to identify needs for possible collaboration.
On what basis do we process personal data?
Laurea's co-operation projects and customer relationships are based on the obligation laid down in the Polytechnics Act (932/2014) to implement teaching and research, development and innovation activities in co-operation with business and industry, as well as other operating environments.
The processing of personal data of partners is based on the implementation of partnership agreements or the consent of the individual to join Laurea's stakeholder register. Consent may be requested, for example, in connection with events or surveys organised by Laurea.
The processing of personal data of potential customers is based on Laurea's legitimate interest.
Where do we collect the personal data we process?
We receive partners' personal data from our partners and through contractual co-operation.
We collect information from potential partners from public sources such as websites or business directories, or from individuals themselves.
Where do we disclose personal data?
Stakeholder contact details can be disclosed to Laurea's subcontractors for the purpose of developing operations in order to carry out stakeholder surveys, for example. A separate personal data processing agreement is always concluded with the subcontractors.
How long do we store personal data?
Partner information is reviewed annually. The contract information is stored for two years after the end of the contract. Partner data will be deleted no later than five years after the last co-operation or at the request of the partner.
The contact details of potential customers collected from public sources are kept for that purpose, after which they are deleted no later than within one year.
Participants in paid continuing education and events
What personal data do we process and for what purposes?
We process participant information for the implementation and development of continuing education and events for working life.
We process the following personal data for participants in Laurea's paid continuing education and events:
- First and last name
- Email address
- Mobile phone number
- Postal address
- Participation fee information
- Participation dates
- Registration date
- Information on permission granted by the person to send marketing materials
- Other voluntary data provided by the participant such as special diets and any data provided in the feedback questionnaire
In addition, the following information is stored in the student affairs administration's system for those participating in continuing education:
- Personal identification code
- Education
- Municipality of residence
- Place of domicile
- Mother tongue
- Nationality
On what basis do we process personal data?
The processing of personal data is based on consent and, with regard to data stored in the student affairs administration systems, our statutory obligation (Polytechnics Act 932/2014 and Act on the National Register of Education, Qualifications and Degrees 884/2017).
Where do we collect the personal data we process?
We collect the participant information using an electronic form with the participant's own notification.
Where do we disclose personal data?
In addition, continuing education data on participants in paid continuing education and events are disclosed for statistical purposes to the Ministry of Education and Culture and, if necessary, to other parties implementing the training in question.
How long do we store personal data?
The participant data will be anonymised no later than two years after the implementation of the education or event.
Personal data of participants in continuing education transferred to the student affairs administration system will be permanently stored.
Alumni
We process the personal data of Laurea alumni so that we can develop Laurea's alumni activities and services offered to alumni, as well as market and implement events, education and other services intended for alumni.
We process the following personal data:
- First and last name
- Email address
- Mobile phone number
- Postal address
- Education or trainings from which the alumnus has graduated
- Year of completion or years of completion
- Degree or degrees completed by the alumnus
- Campus where the alumnus has studied
From alumni attending education and events, data are collected by virtue of the participant’s voluntary notification via an online form. This information includes:
- Participation dates
- Registration date
- Other voluntary data provided by the participant such as special diets and any data provided in the feedback questionnaire
On what basis do we process personal data?
The processing of alumni personal data is based on the consent given by the student after graduating from Laurea.
Where do we collect the personal data we process?
The personal data of alumni can be obtained through the form to be filled in at the time of graduation and through the alumni's own notifications.
How long do we store personal data?
The personal data of the alumni will be stored as long as there is a need to use them to carry out alumni activities. If a person requests that their personal data be deleted, it is removed from the register.
The processing of personal data concerning all stakeholder groups
Marketing implemented by Laurea
For those stakeholders with whom Laurea actively co-operates, we regularly send targeted news on current issues concerning Laurea's education and service offering.
With regard to electronic direct marketing implemented by Laurea, the legal basis for processing is the explicit consent given by the data subject. A data subject may withdraw their consent to the processing of personal data at any time and prohibit the use of their personal data by Laurea University of Applied Sciences for marketing and communication purposes.
We can also send newsletters on Laurea's operations to potential partners or otherwise inform them of the opportunities for co-operation. In this case, the grounds for processing are Laurea's legitimate interest. One can refuse to receive newsletters at any time.
Processing of personal data outside the EU or EEA
Personal data are not transferred outside the EU or ETA area.
How do we protect personal data?
The data security and data protection guidelines of Laurea University of Applied Sciences are followed in the processing of personal data. Personal data are accessible only to those who require the data in order to perform their job. Data of partners may be processed under restricted rights by students admitted to Laurea with their study entitlement in force and by specified Laurea employees.
The use of the service is based on the performance of the person’s job or studies. The restrictions of use are arranged through personal access rights and by means related to data communications. A user ID and password are required to access the systems. The main user of the system is in charge of granting access rights.
System suppliers acting as processors of personal data are responsible for the technical protection and information security of personal data in accordance with the agreements.
No automatic decision-making or profiling is carried out on the basis of personal data.
The rights of data subjects
The rights of data subjects are determined in accordance with Articles 15–22 of the EU’s General Data Protection Regulation. The contact person for matters related to the rights of data subjects is Marjo Valjakka, Data Protection Officer at Laurea University of Applied Sciences, marjo.valjakka@laurea.fi
Right of access
Data subjects may request access to the data concerning themselves. The request is made in writing to the person responsible for the register. The request must specify the data it concerns. When submitting a request, the data subject must also prove their identity in a reliable manner.
Rectification
Data subjects may request the person in charge of the register to rectify their data.
Restriction of processing
The data subject has the right to restrict the processing,
• if the data subject disputes the accuracy of the personal data, in which case the processing is limited to a period during which the controller can verify their accuracy
• the processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of their use instead
• the controller no longer needs the personal data for the purposes of the processing, but the data subject needs them for the establishment, exercise or defence of legal claims.
Portability of data that are based on consent
The data subject has the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a machine-readable format if the processing is based on consent and the processing is carried out by automated means.
Right to lodge a complaint with a data protection authority
The data subject has the right to lodge a complaint with the supervisory authority if the data subject considers that the processing of personal data concerning them is in breach of applicable data protection legislation. In Finland, the national supervisory authority is the Office of the Data Protection Ombudsman.