Personal data register of Path to a diverse worklife -project

Personal data register of Path to a diverse worklife -project

Joint controllers’ name:

Metropolia University of Applied Sciences Ltd
Vamlas – Vammaisten lasten ja nuorten tukisäätiö sr

Joint controllers’ contact information:

Metropolia University of Applied Sciences Ltd (Business ID: 2094551-1)
Postal address: P.O. Box 4000, FI-00079 Metropolia
Visiting address: Myllypurontie 1, 00920 Helsinki, Finland
Telephone (switchboard): + 358 9 7424 5000

Vamlas – Vammaisten lasten ja nuorten tukisäätiö sr (Business ID: 0116657-1)
Address: Haapaniemenkatu 7–9 B, 2. krs, 00530 Helsinki

Contact details of the contact person for the register:

Name: Elina Förster
Position: Project manager, future proof health and wellbeing innovation hub
Address: Metropolia University of Applied Sciences, PO Box 4000, FI-00079 METROPOLIA
E-mail: Elina.forster [at] metropolia.fi (Elina[dot]forster[at]metropolia[dot]fi)

Name: Pia Vaajakallio
Position: Project coordinator, working life expert
Address: Vamlas – Vammaisten lasten ja nuorten tukisäätiö sr, Haapaniemenkatu 7-9 B, 2.krs, 00530 Helsinki
Email: Pia.Vaajakallio [at] vamlas.fi (Pia[dot]Vaajakallio[at]vamlas[dot]fi)

Purpose of the processing of personal data:

The processing purpose of the personal data register of the Path to a diverse worklife -project and the personal data it contains is to implement the project’s development activities, process participant information and receive registrations for the project’s workshops and trainings as well as organization of them, communicate about the project’s activities and events (including newsletters), and deliver feedback surveys. In addition, as part of the project, research data is collected from the participants through surveys and group interviews. The project’s personal data register, which is based on voluntary participation, is used to manage the project’s activities.

The project involves collaboration between Metropolia and Vamlas, and parties act as joint controllers. Metropolia is primarily responsible for collecting the project’s research data, as well as organizing workshops and events. The project’s leading researcher is from Vamlas, which is mainly responsible for the analysis and reporting of the research data. Both parties process the participant data of the project.

Additionally, personal data is processed for reporting to the project’s funder.

Project research methods and materials:

During the project period from September 1, 2023, to August 31, 2025, data will be collected through surveys, group interviews, and workshops. The collected interview, survey, and co-development workshops materials serve as research data and are utilized in the development work of this project, aiming to improve the accessibility of student selection, study processes, and the implementation of internship periods. A data management plan has been prepared for the project.

Both quantitative and qualitative methods and materials are used in the research. Necessary background information about participants (whether they are studying for a University of Applied Sciences degree or a Master’s degree in Applied Sciences, the starting year of the studies, degree program) will be collected to allow for more detailed analysis of the results from interviews and co-development workshops across different participant groups.

Based on the collected background information or other research questions and answers, individual participants are not identifiable. If a participant’s free-text field response contains identifiable information contrary to the instructions, such information will be removed from the research data. In group interviews, responses are recorded in an anonymous form. Participation is voluntary.

Legal basis for the processing of personal data:

The processing of personal data in the Path to a diverse worklife -project’s personal data register is based on consent obtained from the data subject.

To the extent that the purpose of processing is to report to the project’s funder for the funder’s monitoring and supervision activities, the processing is based on the legitimate interest of the controllers or a legal obligation (the Finnish Act on the Funding of Regional Development and the European Union’s Regional and Structural Policy Projects (757/2021) and Finnish Government Decree on the Eligibility for Support of Costs Part-financed by a Structural Fund (358/2014)).

The legitimate interest of the data controllers is based on the requirements set in the funder’s financing decision, as well as on general obligations arising from legislation to report on the project’s implementation, results, progress, and costs. Fulfilling these obligations may require the data controllers to process personal data to create and deliver reports.

In the Path to a diverse worklife -project, the personal data of Metropolia’s students and staff, as well as the project’s business partners, companies/organizations, and other target and stakeholder contacts are processed, which include the following:

Basic information:

• Students and staff: first name; last name, street address, education, position
• Representatives of the companies and stakeholders: first name; last name; email; phone; name of the represented company, company contact information, company business ID, company industry sector;

Other information processed in the project:

• Personal data that may be included in the individual’s responses to research and feedback surveys
• Information on participation in workshops and trainings
• Information on subscribed newsletters

Information on consents given by the data subject

The personal data are obtained from the data subjects themselves. We may also receive personal data from your employer or another party who registers you for an event or training we offer.

Both joint controllers may have access to personal data if the responsibilities of the party require it.

Personal data processing involves ICT service providers who act as data processors, as described above, and provides various technical systems and services in accordance with the agreements made and their data protection terms. If you would like more information about these ICT service providers, you can contact the contact points described in Section 2 by email.

Additionally, the project's personal data is disclosed to the project's funder in accordance with their right to access the information established by law.

In the Path to a diverse worklife -project, the primary aim is to provide services and conduct operations, as well as process personal data, using actors and services located within the EU or EEA. However, in some cases, services may also be implemented using actors, services, and servers located elsewhere, and this may involve the transfer of personal data between different countries. Such transfers can include the disclosure of personal data outside the EU or EEA to countries whose data protection legislation differs from Finnish and EU-level regulations, such as to the United States.

The international transfer of personal data to the United States and/or other areas outside the EU/EEA is primarily protected in accordance with the requirements of the EU's General Data Protection Regulation (GDPR) by using mechanisms such as the European Commission's adequacy decision or Standard Contractual Clauses, which are incorporated into the data processing agreement. In addition, appropriate safeguards are implemented.

The ICT service provider may not transfer or disclose personal data outside the EU/EEA or process data outside the EU/EEA without the explicit prior written consent of the data controller or contrary to the agreement made with the service provider.

Only necessary data is transferred, and the transfer is carried out in accordance with data protection legislation and within its limits. The security and privacy of the transfer are always agreed upon separately.

The personal data collected in the personal data register of the Path to a diverse worklife -project are, as a rule, retained in the register for five years after the completion of the project.

The determination of the retention periods is based on the following legislation:

• EU General Data Protection Regulation (679/2016)
• Data Protection Act (1050/2018)

University of Applied Sciences Act (932/2014)

The data subjects have the right to receive confirmation from the data controller of whether their personal data are being processed. Furthermore, the data subjects have the right of access to their personal data and the right to inspect their personal data stored in the register and to receive copies of them. The data subject may make requests by contacting the points of contact described in Section 3. When making a request, the data subject must verify their identity in a reliable manner. Under the GDPR, the data controller must respond to requests by the data subjects to exercise their rights within one month of receiving such a request.

A. Right of access to personal data

The data subjects have the right to check whether their personal data are stored in the personal data register.

B. Right to rectify personal data and to restrict processing

The data subjects have the right to request the data controller to restrict the processing of their personal data in the following cases:

• the data subject disputes the correctness of their personal data (right to rectify personal data), in which case processing will be restricted until the data controller can ascertain that the data is correct;
• processing violates the law and the data subject objects to the erasure of their personal data, instead requesting that the processing of the data be restricted;
• the data controller no longer needs the personal data for the purposes of the processing, but the data subject needs them in order to establish, exercise or defend a legal claim.

C. Right to erase personal data

The data subject has the right to the erasure of their personal data without undue delay if any of the following conditions are met:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• the data subject withdraws consent on which processing is based and there is no other lawful basis for processing;
• the personal data have been unlawfully processed; or
• the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.

D. Right to data portability (transfer of data from one system to another)

The data subject has the right to receive the personal data that they have provided to a controller, in a structured, commonly used, and machine-readable format, and to transmit that data to another controller if it is technically feasible.

The right applies to the automated processing of personal data, when the personal data concerns the data subject and have been provided by them, and when the basis for processing is:

• the consent of the data subject; or
• a contract to which the data subject is a party.

E. Right to not be subjected to a personal data breach

The data subject has the right to not be subjected to a personal data breach, as referred to in Article 33 of the EU’s General Data Protection Regulation, due to the data controller’s negligence in data protection and/or data security matters or due to negligence on the part of a data processor used by the controller in data protection and/or data security matters. The data subject has the right to be informed without undue delay if a personal data breach is likely to pose a high risk to the rights and freedoms of natural persons.

According to Article 21 of the EU’s General Data Protection Regulation, the data subjects have the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on point (e) of Article 6(1) (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller), such as profiling based on these provisions. The data controller may no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

If the processing of personal data is based on the data subject’s consent, the data subject has the right to withdraw their consent for processing at any time without the withdrawal of consent affecting the lawfulness of processing based on consent before its withdrawal.

Every data subject has the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of their personal data infringes the applicable data protection regulations.

The national supervisory authority in Finland is the Office of the Data Protection Ombudsman. Contact details:

Office of the Data Protection Ombudsman
Street address: Ratapihantie 9, 6th floor
00520 Helsinki, Finland
Postal address: PO Box 800
FI-00521 Helsinki

Telephone (switchboard): + 358 29 56 66700
Fax: + 358 9 56 66735
Email: tietosuoja [at] om.fi (tietosuoja[at]om[dot]fi)

The personal data register of Path to a diverse worklife -project is based on voluntary registration and it is used to manage the membership, activities, and communication, as well as to market the activities and services of the project.

It is not compulsory for anyone to participate in Path to a diverse worklife -project.

The personal data stored in the register have mostly been collected from the data subjects themselves.

The personal data register of Path to a diverse worklife -project and the data contained in it will not be used in automated decision-making or profiling.