Stakeholder privacy statement

Laurea's stakeholders referred to in this privacy statement are:

• Partners and customers
• Participants in paid continuing education and events
• Alumni

If this privacy statement does not specify what the stakeholder's personal data processing policy applies to, the processing policy applies to all stakeholders. In addition, only the processing principles applicable to a specific stakeholder are specified in the statement.

Data controller

Laurea University of Applied Sciences, Ratatie 22, FI-01300 Vantaa, Finland

• Controller’s contact person: President, CEO Jouni Koski, jouni.koski@laurea.fi
• Person in charge of the stakeholder register: Teemu Ylikoski, Director, teemu.ylikoski@laurea.fi
• Data Protection Officer: Marjo Valjakka, marjo.valjakka@laurea.fi

What personal data do we process and for what purposes?

We process the following personal data for all stakeholders ("Contact Information"):

• First and last name
• Email address
• Mobile phone number
• Postal address
• Information on permission granted by the person to send marketing materials

In addition, we process other stakeholder personal data as follows:

Laurea's partners and customers

We process the personal data of partners and customers in order to implement and execute co-operation agreements and customer agreements. 

We also process information from potential partners and customers to identify needs for possible collaboration.

Laurea's co-operation projects and customer relationships are based on the obligation laid down in the Polytechnics Act (932/2014) to implement teaching and research, development and innovation activities in co-operation with business and industry, as well as other operating environments.

As regards Laurea's partners and customers, in addition to the contact information listed above, we process the following personal data:

• Title and area of responsibility
• Language
• Name of organisation
• Organisation contact details
• Branch of organisation

Participants in paid continuing education and events

We process participant information for the implementation and development of continuing education and events for working life.

In addition to the contact information listed above, we process the following personal data for participants in Laurea's paid continuing education and events:

• Participation fee information
• Participation dates
• Registration date
• Other voluntary data provided by the participant such as special diets and any data provided in the feedback questionnaire

In addition, the following information is stored in the student affairs administration's system for those participating in continuing education:

• Personal identification code
• Education
• Municipality of residence
• Place of domicile
• Mother tongue
• Nationality

Alumni

We process the personal data of Laurea alumni so that we can develop Laurea's alumni activities and services offered to alumni, as well as market and implement events, education and other services intended for alumni.

As regards Laurea's alumni, in addition to the contact information listed above, we process the following personal data:

• Education or trainings from which the alumnus has graduated
• Year of completion or years of completion
• Degree or degrees completed by the alumnus
• Campus where the alumnus has studied

From alumni and people attending education and events, data are collected by virtue of the participant’s voluntary notification via an online form. This information includes:

• Participation dates
• Registration date
• Other voluntary data provided by the participant such as special diets and any data provided in the feedback questionnaire

On what basis do we process personal data?

Partners and customers:

The processing of personal data of partners is based on the implementation of partnership agreements.

The processing of personal data of potential customers is based on Laurea's legitimate interest.

Participants in paid continuing education and events

The processing of personal data is based on consent and, with regard to data stored in the student affairs administration systems, our statutory obligation (Polytechnics Act 932/2014 and Act on the National Register of Education, Qualifications and Degrees 884/2017).

Alumni

The processing of alumni personal data is based on the consent given by the student after graduating from Laurea.

Where do we collect the personal data we process?

Partners and customers

We receive partners' personal data from our partners and through contractual co-operation.

We collect information from potential partners from public sources such as websites or business directories, or from individuals themselves.

Participants in paid continuing education and events

We collect the participant information using an electronic form with the participant's own notification.

Alumni

The personal data of alumni can be obtained through the form to be filled in at the time of graduation and through the alumni's own notifications.

How long do we store personal data?

Partners and customers

Partner information is reviewed annually. The contract information is stored for two years after the end of the contract. Partner data will be deleted no later than five years after the last co-operation or at the request of the partner.

The contact details of potential customers collected from public sources are kept for that purpose, after which they are deleted no later than within one year.

Participants in paid continuing education and events

The participant data will be anonymised no later than two years after the implementation of the education or event.

Personal data of participants in continuing education transferred to the student affairs administration system will be permanently stored.

Alumni

The personal data of the alumni will be stored as long as there is a need to use them to carry out alumni activities. If a person requests that their personal data be deleted, it is removed from the register.

Marketing implemented by Laurea

For those stakeholders with whom Laurea actively co-operates, we regularly send targeted news on current issues concerning Laurea's education and service offering.

With regard to electronic direct marketing implemented by Laurea, the legal basis for processing is the explicit consent given by the data subject. A data subject may withdraw their consent to the processing of personal data at any time and prohibit the use of their personal data by Laurea University of Applied Sciences for marketing and communication purposes.

We can also send newsletters on Laurea's operations to potential partners or otherwise inform them of the opportunities for co-operation. In this case, the grounds for processing are Laurea's legitimate interest. One can refuse to receive newsletters at any time.

Where do we disclose personal data?

All stakeholder groups

Stakeholder contact details can be disclosed to Laurea's subcontractors for the purpose of developing operations in order to carry out stakeholder surveys, for example. A separate personal data processing agreement is always concluded with the subcontractors.

In addition, continuing education data on participants in paid continuing education and events are disclosed for statistical purposes to the Ministry of Education and Culture and, if necessary, to other parties implementing the training in question.

Personal data are not transferred outside the EU or ETA area.

No automatic decision-making or profiling is carried out on the basis of personal data.

How do we protect personal data?

The data security and data protection guidelines of Laurea University of Applied Sciences are followed in the processing of personal data. Personal data are accessible only to those who require the data in order to perform their job. Data of partners may be processed under restricted rights by students admitted to Laurea with their study entitlement in force and by specified Laurea employees.

The use of the service is based on the performance of the person’s job or studies. The restrictions of use are arranged through personal access rights and by means related to data communications. A user ID and password are required to access the systems. The main user of the system is in charge of granting access rights.

System suppliers acting as processors of personal data are responsible for the technical protection and information security of personal data in accordance with the agreements.

When processing personal data, Laurea applies good practices of data processing pursuant to the Act on the Openness of Government Activities.

The rights of data subjects

The rights of data subjects are determined in accordance with Articles 15–22 of the EU’s General Data Protection Regulation. The contact person for matters related to the rights of data subjects is Marjo Valjakka, Data Protection Officer at Laurea University of Applied Sciences, marjo.valjakka@laurea.fi

Right of access

 Data subjects may request access to the data concerning themselves. The request is made in writing to the person responsible for the register. The request must specify the data it concerns. When submitting a request, the data subject must also prove their identity in a reliable manner.

Rectification

 Data subjects may request the person in charge of the register to rectify their data.

Restriction of processing

The data subject has the right to restrict the processing,

• if the data subject disputes the accuracy of the personal data, in which case the processing is limited to a period during which the controller can verify their accuracy

• the processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of their use instead

• the controller no longer needs the personal data for the purposes of the processing, but the data subject needs them for the establishment, exercise or defence of legal claims.

Portability of data that are based on consent

The data subject has the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a machine-readable format if the processing is based on consent and the processing is carried out by automated means.

Right to lodge a complaint with a data protection authority

The data subject has the right to lodge a complaint with the supervisory authority if the data subject considers that the processing of personal data concerning them is in breach of applicable data protection legislation. In Finland, the national supervisory authority is the Office of the Data Protection Ombudsman.