Privacy statement: Processing of personal data contained in Webropol surveys

Privacy statement, Created on: 3.5.2023 Regulation of the European Union (679/2016) as of 25th May 2018, Data Protection Act (1050/2018)

1 Controller of the register

Karelia Ammat­ti­kor­kea­koulu Oy / Karelia University of Applied Sciences Ltd.

Address: Tikka­rinne 9, 80200 Joensuu, Finland

Tel. +358 13 260 600, Email: info(at)karelia.fi

2 Person in charge of the register

CEO / President of Karelia UAS

3 Processing of personal data contained in Webropol surveys of Karelia University of Applied Sciences staff

This notice/information sheet contains infor­mation for the data subject (natural person) in accor­dance with Articles 12 and 13 of the EU General Data Protection Regulation (EU) 679/2016. This notice is given to the data subject when personal data is collected.

4 Contact persons regarding Webropol surveys

The admins of Webropol surveys (service) at Karelia UAS are Mikko Penttinen and Tuula Hiltunen. Helpdesk(at)karelia.fi.

5 Data protection officer

Karelia Ammat­ti­kor­kea­koulu Oy, Data protection officer, Tikka­rinne 9, 80200 Joensuu, Finland

Tel. +358 50 525 0623, email: tietosuoja(at)karelia.fi

6 Purpose of processing personal data

Preparing and sending out surveys required for the statutory tasks of the UAS, collecting responses and enrol­ments, creating reports and organising events.

The legal basis for processing personal data is the perfor­mance of a task in the public interest, the exercise of public authority, the perfor­mance of a statutory task [Act on Univer­sities of Applied Sciences (932/2014) and Government Decree on Univer­sities of Applied Sciences (1129/2014)].

7 Description of categories of data subjects and personal data

The data subjects are the staff, students and persons of the UAS and other partici­pants in the events of the UAS. The personal data are personal data required for the purposes of surveys, responses, registra­tions, report generation and event organi­sation organised by the UAS.

8 Grounds for providing personal data

The personal data is necessary for the performing the controller’s tasks mentioned in section 6.

9 Legitimate advan­tages of the register controller

Emplo­yment-related issues of the staff of Karelia UAS.

10 Security of processing personal data

The persons processing the data are bound by confi­den­tiality. The obligation of profes­sional secrecy continues after the end of the emplo­yment relationship. Access to the systems is limited to those persons who need to process the data for their duties.

11 Recipients or recipient groups of personal data

Data may be disclosed on a case-by-case basis to the actors involved in the surveys, such as the reception staff. Webropol Oy processes personal data as a service provider.

12 Transfer of personal data outside the European Union or the European Economic Area

Personal data will not be trans­ferred outside the EU or EEA.

13 Retention of personal data

The appropriate retention period for the purpose of the survey is, for example, the time needed to organise and follow up on registra­tions for an event, up to 6 months after the event. On a case-by-case basis, it may be the time required for financial management, archiving or technical back-ups.

14 Rights of the regis­tered person

The rights of the regis­tered person are deter­mined according to the purpose of processing personal data. The regis­tered person has the right to inspect the data concerning him/herself stored in the register. The request for the inspection has to be made to the controller of the register. The regis­tered person has the right to request correction or removal of data, set limita­tions for the handling of his/her personal data, object the handling of the data, and s/he has the right to transfer data from one system to another. The regis­tered person has the right to withdraw his/her consent to the handling of his/her personal data at any time. In addition, the regis­tered person has the right to file a complaint with the super­visory authority. The contact person concerning the rights of the regis­tered person is the person in charge of data protection, whose contact details are in section 5 of this statement

15 Automatic decision making and profiling

Not in use.