Privacy notice for stakeholders

The Laurea stakeholder groups referred to in this privacy statement are

• Partners and customers
• Persons participating in paid continuing education courses and Laurea events
• Alumni

If this privacy statement does not specifically identify which processing principles apply to a stakeholder group, the processing principles apply to all stakeholder groups. In addition, the statement only specifies processing principles concerning certain stakeholder groups.

Data controller
Laurea University of Applied Sciences, Ratatie 22, 01300 Vantaa

• Contact person of the data controller: President, CEO Jouni Koski, jouni.koski@laurea.fi
• Person responsible for the stakeholder register: Director Teemu Ylikoski, teemu.ylikoski@laurea.fi
• Data Protection Officer: Marjo Valjakka, tietosuoja@laurea.fi

Laurea partners and customers

What personal data do we process and for what purposes?

We process the following personal data of partners and customers to implement and carry out cooperation and customer agreements

• First and last name
• Email address
• Mobile phone number
• Postal address
• Title and area of responsibility
• Language
• Organization name
• Organization contact details
• Organization’s business sector
• Information on marketing consents provided by the person

For potential partners and customers, we process contact information to identify needs for possible cooperation.

On what basis do we process personal data?

The background for Laurea’s cooperation projects and customer relationships is the obligation set out in the Universities of Applied Sciences Act (932/2014) to implement education as well as research, development and innovation activities in cooperation with business and working life and other operating environments.

Processing of partners’ personal data is based on the performance of partnership agreements or the individual’s consent to join Laurea’s stakeholder register. Consent can be requested, for example, in connection with events or surveys organized by Laurea.

The processing of potential customers’ personal data is based on Laurea’s legitimate interest.

Where do we collect the personal data we process from?

We receive partners’ personal data from the partners themselves and through contractual cooperation.
We collect information on potential partners from public sources such as websites or company information directories, or from the individuals themselves.

To whom do we disclose personal data?

Stakeholder contact details may be disclosed to Laurea’s subcontractors to develop operations, for example to carry out stakeholder surveys. A separate data processing agreement is always concluded with subcontractors.

How long do we retain personal data?

Partner data are reviewed annually. Contract information is retained for two years after the end of the contract. Partner data are deleted at the latest five years after the last cooperation or upon separate request.

Contact details of potential customers collected from public sources are kept for that purpose, after which they are deleted within one year at the latest.

Persons participating in paid continuing education and events

What personal data do we process and for what purposes?

We process participant data to carry out and develop continuing education aimed at working life and various events.

For persons participating in Laurea’s paid continuing education courses and events, we process the following personal data:

• First and last name
• Email address
• Mobile phone number
• Postal address
• Participation fee information
• Participation dates
• Registration time
• Information on marketing consents provided by the person
• Other voluntary information provided by the participant, such as special diets and any information given in feedback surveys

In addition, the following information required for registering as a student is recorded in the student records system for those participating in continuing education:

• Personal identity number
• Prior education
• Municipality of residence
• Home municipality
• Mother tongue
• Nationality

On what basis do we process personal data?

The processing of personal data is based on the consent given by the participant and, concerning the data stored in the student records system, on our statutory obligation (Universities of Applied Sciences Act 932/2014 and the Act on the national study and degree register 884/2017).

Where do we collect the personal data from?

We collect participant data via the participant’s own declaration through an electronic form.

Where do we disclose personal data?

Personal data of event participants are not disclosed outside Laurea. Data on continuing education participants in paid courses are disclosed to the Ministry of Education and Culture for statistical purposes and, if necessary, to other parties implementing the education.

How long do we retain personal data?

Participant data are anonymized no later than two years after the implementation of the training or event.

Personal data transferred to the student records system concerning continuing education participants are retained permanently.

Alumni

What personal data do we process and for what purposes?

We process Laurea alumni personal data in order to develop Laurea’s alumni activities and services offered to alumni, and to market and organise events, training and other services aimed at alumni.

We process the following personal data:

• First and last name
• Email address
• Mobile phone number
• Postal address
• Education or degree programme(s) from which the alumnus graduated
• Year of graduation or years of graduation
• Degree(s) the alumnus has completed
• Campus where the alumnus studied
• Information on marketing consents provided by the person

Information from alumni participating in trainings and events is collected via the participant’s own voluntary declaration through an electronic form. These data are:

• Participation dates
• Registration time
• Other voluntary information provided by the participant, such as special diets and any information given in feedback surveys

On what basis do we process personal data?

Processing of alumni personal data is based on the consent that the student has given upon graduating from Laurea.

Where do we collect the personal data from?

We obtain alumni personal data via the form completed at graduation and from alumni’s own notifications.

How long do we retain personal data?

Alumni personal data are retained as long as they are needed to carry out alumni activities. If a person requests deletion of their personal data, they will be removed from the register.

Processing of personal data concerning all stakeholder groups

Marketing carried out by Laurea

To stakeholder groups with whom Laurea has active cooperation, we regularly send targeted news informing about current matters related to Laurea’s education and service offerings.

For Laurea’s electronic direct marketing, the legal basis for processing is the explicit consent given by the data subject. The data subject may withdraw consent for processing of their personal data at any time and forbid the use of their personal data for Laurea University of Applied Sciences’ marketing and information purposes.

We may also send newsletters about Laurea’s activities to potential partners or otherwise inform about cooperation opportunities. In such cases the legal basis is Laurea’s legitimate interest. Recipients may unsubscribe from newsletters at any time.

Processing personal data outside the EU or EEA

Personal data are not transferred outside the EU or EEA.  If such data transfers are made, one of the following conditions must apply:

• The person has given consent for the transfer of his/her data.
• The EU Commission has determined that the data protection level in the country in question is adequate.
• Adequate security measures have been taken by applying model contract clauses approved by the EU Commission or by ensuring that the company processing the data has binding corporate rules in place.

How do we protect personal data?

The processing of personal data complies with Laurea University of Applied Sciences’ information security and data protection guidelines. Personal data are accessible only to those who need them to perform their duties. Partner data may be processed with limited rights by students admitted as Laurea students whose right to study is valid, and by Laurea employees expressly named.

The processing of personal data is based on performing one’s duties or studies. Access restrictions are implemented through individual user rights and network controls. System use requires a username and password. The system administrator is responsible for granting access rights.
System providers acting as processors are contractually responsible for the technical protection and security of personal data.

No automated decision-making or profiling is carried out using personal data.

Rights of the data subject

The rights of the data subject are defined in Articles 15-22 of the EU General Data Protection Regulation. The contact person for matters relating to data subject rights is Laurea University of Applied Sciences’ Data Protection Officer Marjo Valjakka, tietosuoja@laurea.fi

Right of access to data

A data subject may request the information concerning them. The request should be made in writing to the person responsible for the register. The request should specify which data it concerns. When submitting the request, the data subject must also prove their identity in a reliable manner.

Rectification of data

A data subject may request correction of their data from the person responsible for the register.

Restriction of processing

The data subject has the right to restriction of processing,

• if the data subject contests the accuracy of the personal data, in which case processing is restricted for the time the controller needs to verify their accuracy
• if the processing is unlawful and the data subject opposes erasure and requests restriction instead
• if the controller no longer needs the personal data for the purposes of processing, but the data subject needs them for the establishment, exercise or defence of legal claims

Erasure of data

A data subject has the right to request deletion of personal data concerning them from the stakeholder register by contacting the person responsible for the register. Data will be deleted if Laurea University of Applied Sciences has no lawful basis to retain them, for example to fulfil contractual obligations or to carry out teaching or RDI activities.

Right to lodge a complaint with a supervisory authority

A data subject has the right to lodge a complaint with the supervisory authority if they consider that the processing of personal data concerning them violates applicable data protection legislation. The national supervisory authority in Finland is the Office of the Data Protection Ombudsman.