Personal data register of Metropolia SIMHE services

This Privacy Notice is based on the EU's General Data Protection Regulation (2016/679, “GDPR”), namely the obligation to inform the data subjects (GDPR Articles 12–14), the data controller's obligation to maintain a record of processing activities under its responsibility (GDPR Article 30), as well as the obligations set out in the Finnish Data Protection Act (1050/2018) supplementing the GDPR.

Additionally, this Privacy Notice has been prepared with the aim of making it accessible in accordance with the requirements of the EU's Web Accessibility Directive (Directive (EU) 2016/2102 of the European Parliament and of the Council on the accessibility of the websites and mobile applications of public sector bodies) and the Finnish Act on the Provision of Digital Services (306/2019) supplementing it.

Purpose of the processing of personal data:

The personal data register of Metropolia SIMHE services (Supporting Immigrants in Higher Education in Finland) contains data regarding immigrants who apply for and take part in Metropolia SIMHE guidance and education services and events, including those of SIMHE projects. Metropolia provides SIMHE services for ~~highly educated~~ immigrants to recognise their competences and to guide them to suitable educational and career paths.

The purpose of the personal data register of Metropolia SIMHE services and the personal data it contains is to provide customers with guidance and education services suitable for their backgrounds and to manage and report Metropolia SIMHE services. Part of the data is reported to the Ministry of Education and Culture. The data related to project participants is reported to the funder based on the funding requirements.

The following privacy notices supplement the privacy notice of personal data register of Metropolia SIMHE services:

Legal basis for the processing of personal data:

The processing of the personal data contained in the personal data register of Metropolia SIMHE services is based mainly on the public interest and the exercise of official authority. In accordance with Universities of Applied Sciences Act (932/2014), the main mission of universities of applied sciences is to provide higher education.

In addition, processing of the personal data is based on consent obtained from the data subject. It is a matter of consent, when a person applies voluntarily to SIMHE services by filling in a registration form and by giving a consent for data processing in written on the form.

In addition, the processing of personal data is based on the explicit consent obtained from the data subject when processing sensitive personal data belonging to special categories of personal data, such as data on unemployment and integration training (Article 9 (2a) of the GDPR).

The data subjects in the personal data register of Metropolia SIMHE services are:

applicants and participants of SIMHE guidance services
immigrants applying to and taking part in other Metropolia SIMHE functions.

The following personal data of customers is stored in the personal data register of Metropolia SIMHE services:

Basic information of applicants: forename(s), last name, gender, country of birth, phone number, municipality of residence, age group, email address, length of stay in Finland
Applicant’s previously completed studies and the previously acquired degree in higher education
Data concerning work experience affecting professional choice and possible relevant leisure activities of the applicant and optionally a link to the LinkedIn profile and/or CV attachment
In addition, in different already finished projects and collaboration initiatives, other data might have been collected according to the funder’s requirements or otherwise relevant for providing the service, e.g. personal identity code, nationality, first language, address, copies of certificates

Customer/collaboration partner can choose to register for the following services requiring data processing:

For subscribing to SIMHE customer newsletter, email address is collected
For signing up for events, contact information and other necessary data (e.g. forename, last name, email address, phone number, title, organisation, special diet) are collected

In addition, applicants and participants in education programmes in SIMHE projects following data might be collected based on needs:

Data concerning application to studies and grounds for admission for each applicant, to the extent necessary for their participation in the studies of the various SIMHE projects
Data concerning result of admission, receiving the right to study and registration to the educational institute
The applicant’s approval or denial of disclosure of their personal data for purposes of direct educational marketing
Participants in education programmes are registered to Metropolia student register and study systems. In their case, the following privacy notices are applied
Metropolia’s Student and Education Data Register
Personal Data Register of Metropolia Continuing Education and Enterprise Services
Forwarding accident and damage reports of the students to the insurance company (when on the status of an open UAS student or continuing education student)

From collaboration partners, the following data is collected:

Contact information of various cooperation partners collected in connection with SIMHE services (forename, last name, email, organisation information)
Information related to collaboration, such as the date of contact, form of collaboration, outcome, website

In addition, the data of collaboration partners is managed as described in the Personal Data Register of Metropolia Continuing Education and Enterprise Services.

The personal data collected for and processed within the personal data register of Metropolia SIMHE services is, as a general rule, stored in the register as follows:

The personal data of participants of SIMHE path project is processed within the EURA2014 system for EU Structural Fund projects and also stored in it as required by the funder.
For applicants applying through the Studyinfo.fi service, data concerning the application to higher education and the result of admission is processed in Studyinfo.fi-service, maintained by the Finnish National Agency for Education, and stored for five (5) years, starting from the decision of student admission. However, data concerning receiving the right to study is stored permanently.
Records of educational/training activities that award credits are stored permanently. These permanently stored credits are saved into Metropolia’s OMA/Peppi student registry system (forming part of Metropolia’s student registry). Activities awarding credits are addressed in the legislation on national study and degree certificates.
For participants completing studies all data exported to student registry systems of universities of applied sciences, concerning the right to study, annual enrollment, compeleted degrees and studies and other data, is stored permanently in electronic format, from since the information has been available in electronic format
For participants completing studies all data exported to VIRTA data warehouse, concerning the right to study, annual enrollment, completed degrees and studies, is stored permanently and solely in electronic format

Documentation of SIMHE projects is stored for the prescribed time according to the requirements of the funder. The duration of the projects is as follows:

SIMHEapp II, funded by Ministry of Education and Culture, 1.4.2019-30.6.2022
Talent Helsinki project, funded by the Ministry of Economic Affairs and Employment, 1.5.2021-30.4.2022
SIMHE continuation project, funded by the Ministry of Education and Culture, 1.3.2019-31.8.2021
The International talents accelerating growth project, Talent Boost AIKO funded, 1.5.2019-31.7.2021
~~SOTE-silta project, ending 31.12.2020~~
Deploying Competence in Finland project, funded by the Finnish National Agency for Education, 26.6.2018-31.12.2020
SIMHE path, funded by European Union European Social Fund (ESF), 1.10.2018-31.12.2020
SIMHEapp, funded by Ministry of Education and Culture, 1.9.2017 - 31.10.2019

The following regulations have been observed when determining the retention times:

EU General Data Protection Regulation (“GDPR”, 2016/679)
Data Protection Act (1050/2018)
Universities of Applied Sciences Act (932/2014)
Decision of the National Archives of Finland on retention times – order given to universities of applied sciences concerning the permanent storage of data in electronic format (AL/20757/07.01.01.03.02/2016)

The data subjects have the right to receive confirmation from the data controller of whether their personal data are being processed. Furthermore, the data subjects have the right of access to their personal data and the right to inspect their personal data stored in the register and to receive copies of them. Under the GDPR, the data controller must respond to requests by the data subjects to exercise their rights within one month of receiving such a request.

A. Right of access to personal data

The data subjects have the right to check whether their personal data are stored in the personal data register. A data subject may submit a request for information by delivering the data subjects’ information request form, which can be found on Metropolia’s public website and/or Metropolia’s intranet, to one of the three offices of Metropolia’s Student and Admission Services. The form must be filled in carefully, printed and signed personally by the data subject. If the data subject is a member of staff, they can deliver the request form to Metropolia’s Human Resources Management unit. When submitting the request, the data subject must prove their identity in a reliable manner (for example by presenting an official personal identity document or driving licence to the Metropolia employee receiving the request).

The visiting addresses of the offices of Metropolia’s Student and Admission Services are:

Metropolia’s Myllypuro campus

Myllypurontie 1, 00920 Helsinki, Finland

Metropolia’s Arabia campus

Hämeentie 135 D, 00560 Helsinki, Finland

Metropolia’s Myyrmäki campus

Leiritie 1, 01600 Vantaa, Finland

Metropolia’s Karamalmi campus

Karaportti 2, 02610 Espoo, Finland

The visiting address of Metropolia’s Human Resources Management unit is:

Metropolia’s Myllypuro campus (Buildings C and D, 5th floor)

Myllypurontie 1, 00920 Helsinki, Finland

All information requests will be forwarded from the offices of Metropolia’s Student and Admission Services and/or the Human Resources Management unit to Metropolia’s Data Protection Officer (email: tietosuojavastaava [at] metropolia.fi (tietosuojavastaava[at]metropolia[dot]fi)).

Metropolia’s Data Protection Officer will respond to information request submitted by the data subjects. If necessary, the Data Protection Officer can be requested to provide additional information on progress in the processing of the request or on the content of the response.

B. Right to rectify personal data and to restrict processing

The data subjects have the right to request the data controller to restrict the processing of their personal data in the following cases:

the data subject disputes the correctness of their personal data (right to rectify personal data), in which case processing will be restricted until the data controller can ascertain that the data is correct;
processing violates the law and the data subject objects to the erasure of their personal data, instead requesting that the processing of the data be restricted;
the data controller no longer needs the personal data for the purposes of the processing, but the data subject needs them in order to establish, exercise or defend a legal claim.

Such a request for rectifying personal data in a Metropolia personal data register or restricting processing can be submitted in person to one of the above-mentioned offices of Metropolia’s Student and Admission Services or Metropolia’s Human Resources Management unit (staff only), where the data subject must prove their identity in a reliable manner when submitting the request.

C. Right to erase personal data

The data subject has the right to obtain from the controller the erasure of their personal data from a Metropolia register without undue delay if any of the following conditions are met:

the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
the data subject withdraws consent on which processing is based and there is no other lawful basis for processing;
the personal data have been unlawfully processed; or
the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.

Such a request for the erasure of personal data in a Metropolia personal data register can be submitted in person to one of the three above-mentioned offices of Metropolia’s Student and Admission Services or Metropolia’s Human Resources Management unit (staff only), where the data subject must prove their identity in a reliable manner when submitting the request.

D. Right to data portability (transfer of data from one system to another)

Partly applicable. Article 20 of the General Data Protection Regulation (GDPR) introduces a new right of data portability of a data subject. This right allows for data subjects to receive the personal data that they have provided to a data controller, in a structured, commonly used and machine-readable format, and to transmit those data to another data controller without hindrance. The new right to data portability aims to empower data subjects regarding their own personal data, as it facilitates their ability to move, copy or transmit personal data easily from one IT environment to another (whether to their own systems, the systems of trusted third parties or those of new data controllers).

In accordance with Article 20(1)(a) of the GDPR, in order to fall under the scope of data portability, processing operations must be based:

either on the data subject’s consent (pursuant to Article 6(1)(a), or pursuant to Article 9(2)(a) when it comes to special categories of personal data);
or, on a contract to which the data subject is a party pursuant to Article 6(1)(b).

The GDPR does not establish a general right to data portability for cases where the processing of personal data is not based on consent or contract.

Such a request pursuant to Article 20 of the GDPR can be submitted in person to one of the three above-mentioned offices of Metropolia’s Student and Admission Services or Metropolia’s Human Resources Management unit (staff only), where the data subject must prove their identity in a reliable manner when submitting the request.

E. Right to not be subjected to a personal data breach

The data subject has the right to not be subjected to a personal data breach, as referred to in Article 33 of the EU’s General Data Protection Regulation, due to the data controller’s negligence in data protection and/or data security matters or due to negligence on the part of a data processor used by the controller in data protection and/or data security matters. The data subject has the right to be informed without undue delay if a personal data breach is likely to pose a high risk to the rights and freedoms of natural persons.

General description of the technical and organisational security measures aiming at protecting the personal data of the data subjects and the personal data registers:

The protection of the register has been agreed upon with the system providers. If necessary, the responsibilities have been described in adequate detail in the appropriate agreements.

The employees and other personnel have undertaken to comply with the obligation of secrecy and to keep confidential the information they receive in connection with the personal data processing.

The system providers (personal data processors) undertake to maintain the register and the personal data relating to it in accordance with good data processing practices and comply with the obligation to absolute secrecy and confidentiality.

The data security of the personal data register of the data controllers and the confidentiality of the data contained therein are ensured with appropriate technical and administrative means in accordance with good data processing practices.

The data controllers have restricted user rights and authorisations to data systems, tools and other storage platforms in such a way that they can only be accessed and processed by the persons who are necessary for such processing due to their job duties or position.

The system containing personal data may only be used by employees who are entitled to process personal data due to their job duties and/or position. Such employees will be given the appropriate training for their duties.

Every user of a tool/system must identify themselves with their personal codes, which are issued when the right to access the tool/system is granted. The right of access will expire once the employee resigns or is transferred from the duties for which they were granted the right at Metropolia.

The data are collected in databases that are protected logically and physically.

The databases and their back-up copies are located in locked premises, and the data can only be accessed by certain pre-appointed persons.

Privacy Notice: Personal data register of Metropolia SIMHE services