Customer Relationship Management (CRM) system of Karelia University of Applied Sciences


General Data Protection Regulation of the European Union (679/2016) as of 25th May 2018, Data Protection Act (1050/2018)

Compiled on 25th April 2018

Customer Relationship Management (CRM) system of Karelia University of Applied Sciences

1. Register controller

Karelia Ammat­ti­kor­kea­koulu Oy / Karelia University of Applied Sciences Ltd.

Address: Tikka­rinne 9, 80200 Joensuu, Finland

Tel. +358 13 260 600, Email: info(at)

2. Person in charge of the register

CEO / President of Karelia UAS

3. Person in charge of customer relationship management

Head of Service Business, Mr Harri Mikkonen, tel. +358 50 502 0402

4. Contact person in matters related to customer relationship management

Service Business Coordi­nator, Ms Anne Prepula, tel. +358 50 311 9168, Tikka­rinne 9, 80200 Joensuu, Finland

5. Person in charge of data protection

Karelia Ammat­ti­kor­kea­koulu Oy, Tieto­suo­ja­vas­taava, Tikka­rinne 9, 80200 Joensuu, Finland

Tel. +358 50 525 0623, email: tietosuoja(at)

6. Purpose of processing personal data

According to the Univer­sities of Applied Sciences Act, the mission of univer­sities of applied sciences is to provide higher education for profes­sional expert jobs based on the requi­re­ments of working life and its development and on the premises of academic research and academic and artistic education and to support the profes­sional growth of students. They shall also carry out applied research, development and innovation activities and artistic activities that serve education in univer­sities of applied sciences, promote industry, business and regional development and regenerate the industrial structure of the region. In carrying out their mission, univer­sities of applied sciences shall promote lifelong learning. These are statutory tasks.

The term service business at Karelia University of Applied Sciences refers to services provided to customers outside the university of applied sciences. The business idea in service business is to produce high quality, produc­tised, or custo­mised expert services and supple­mentary education for companies, commu­nities and private people both locally, natio­nally and internationally.

Karelia University of Applied Sciences uses its CRM customer relationship management system to maintain its working life-related contacts and opera­tions. The system is a centra­lised and struc­tured place for maintaining infor­mation on customers, partners and interest groups and on business processes. These are called partnership activities.

The use of the customer relationship management system is based on a customer-oriented way of thinking and acting. The CRM system at Karelia University of Applied Sciences is a tool for the entire staff to maintain working life-related contacts and opera­tions. Infor­mation gathered in the system helps to plan and monitor working life activities, select the ways of working with customers and partners, and strengthen the relationships. It enables the identi­fication of customers and partners’ needs and sales management.

The CRM system helps to manage business processes. The system enables the creation of offers, sales orders, and invoices. The system provides statistics on the submitted offers and orders and on customer assign­ments. The contact infor­mation for working life partners is located in one place in the CRM system and it can be utilised in marketing commu­nication and in infor­mation distri­bution. Immediate feedback is also collected in the system and it can be compiled for the purpose of evaluation and development of operations.

7. Content of the register

The CRM system includes personal data for the following categories of people: UAS alumni, various interest groups such as strategic partners, key partners, opera­tional partners and inter­na­tional partners, and service business customers (companies, associa­tions, public organi­sa­tions, private people), including infor­mation on the staff, as well as Karelia UAS CRM system users in their different roles. The categories of personal data processed in the system are as follows: name, address, email, telephone number, employer, and person’s role or duties in the organisation.

8. Legal basis for processing personal data

The management of statutory duties is the legal basis for processing personal data in applied research, development and innovation activities and in artistic activities in promoting business and regional development and the local industrial structure. Partnership activities are based on agree­ments and the legal basis is contractual. As regards the service business of Karelia UAS, the basis for processing personal data is a legitimate advantage. Alumni infor­mation is obtained from data subjects by their own consent, so the legal basis for the processing of personal data is the consent of the data subject him/herself.

9. Grounds for providing personal data

Agreement-based partnership activities require having infor­mation on contact persons. Personal data in service business and in alumni activities is needed for providing the services.

10. Legitimate advan­tages of the register controller

Managing service business opera­tions. Emplo­yment-related issues of the staff of Karelia UAS.

11. Security of processing personal data

The CRM system of Karelia UAS, including the contents of the system, is located in a server facility monitored with an access control system. The use of the CRM system is based on access rights that depend on the person’s role and duties at Karelia UAS. Appropriate protection techno­logies are used for the transfer of data. Secure email is available to be used for confi­dential messaging.

12. Recipients or recipient groups of personal data

Mailing lists in Excel format are downloaded from the CRM system into a service by Koodi­vii­dakko Oy for the purpose of commu­nication and infor­mation distri­bution by Karelia UAS president’s office. The CRM system has a box that can be ticked to prohibit marketing commu­nication. The Meerkado system (see for Privacy Policy) by Solenovo Oy provides an Excel-format report that can be exported into the CRM system (name, telephone number, email address, company name), if needed. Karelia UAS uses the Report­ronic working time and project management system by Sebitti Oy that has a two-way connection for trans­ferring project staff data. The Microsoft O365 service used by Karelia UAS is inter­linked with the CRM system of Karelia UAS, which means, for example, that activities can be viewed using an Outlook plugin.

13. Transfer of personal data outside the European Union or the European Economic Area

Personal data will not be trans­ferred outside the EU or EEA.

14. Retention of personal data

Karelia University of Applied Sciences has a partnership programme in which the partners’ contact infor­mation is actively updated. Specific persons have been appointed in charge of the strategic and key partners of Karelia UAS and they are respon­sible for maintaining the data on respective partners and contact persons. It is not necessary in the CRM system to completely delete data, but e.g. a contact persons’ data can be removed (passivated/activated). When the activation of a contact person is removed, it cannot be edited or used with other records. Deacti­vated user accounts may be reacti­vated, if necessary. An alumnus can submit a data removal request via a web form. Customer relationship management documents (partnership agree­ments, partnership infor­mation) are stored according to the Karelia UAS archiving plan.

15. Rights of the regis­tered person

The rights of the regis­tered person are deter­mined according to the purpose of processing personal data. The regis­tered person has the right to inspect the data concerning him/herself stored in the register. The request for the inspection has to be made to the controller of the register. The regis­tered person has the right to request correction or removal of data, set limita­tions for the handling of his/her personal data, object the handling of the data, and s/he has the right to transfer data from one system to another. The regis­tered person has the right to withdraw his/her consent to the handling of his/her personal data at any time. In addition, the regis­tered person has the right to file a complaint with the super­visory authority. The contact person concerning the rights of the regis­tered person is the person in charge of data protection, whose contact details are in section 5 of this statement.

16. Automatic decision-making and profiling

Not in use.