Data Protection Statement for the Users of Equipment Loaning Service of the University of the Arts Helsinki

Articles 13 and 14 of the EU General Data Protection Regulation. Informing a data subject. Drawn up on May 21, 2018

1. Controller

University of the Arts Helsinki

Telephone: +358 294 47 2000 (exchange)

Postal address: P.O. Box 1, FI-00097 UNIARTS

2. Entity and person in charge of processing personal data

Production Secretary Miisa Järvi
E-mail address: firstname.lastname@uniarts.fi, telephone: +358 40 710 4334

3. Contact persons for handling personal data

Head of AV Department Marko Myöhänen
E-mail address: firstname.lastname@uniarts.fi, telephone: +358 40 710 4349

4. Data protection officer

Specialist Antti Orava works as Data Protection Officer at the University of the Arts Helsinki.

E-mail address: privacy@uniarts.fi

Telephone: +358 294 47 3568

Postal address: P.O. Box 1, FI-00097 UNIARTS

5. Name of register

Equipment loaning

As based on the Universities Act, the mission of the University of the Arts Helsinki includes social interaction and artistic activities. For studies, teaching, research, and artistic activities conducted or performed by students and staff, the University has a selection of loan equipment which can be booked and loaned for use. The equipment available for various user groups differs. We process students’ and staff members’ personal data in order to plan and to implement equipment-loaning activities, to follow and monitor use, and to establish statistics. The purpose of the equipment-loaning activities is to enable smooth progress in studies without the obligation for the student to acquire his or her own equipment and to support the artistic activities of both students and staff members.

In practice, personal data are processed as follows:

  • various user groups are offered possibilities to loan and book equipment as agreed 
  • a person’s booking and loaning information is maintained on file
  • steps are taken to have overdue equipment returned
  • the procedure for replacing broken and disappeared equipment is initiated

The processing of personal data is based on the legitimate interest of the University pursuant to the booking and loaning event of a piece of equipment.

7. What data do we process?

In conjunction with equipment loans and equipment booking, we use the following personal data:

  • basic information: name and e-mail address
  • contact information: telephone number
  • the time for booking and loaning the equipment

8. Where do we get information?

We obtain the personal data on a person entitled to use equipment management from the user management system of the University. The user gives his or her telephone number if he or she so wishes.  

9. To whom do we disclose and transfer data, and do we transfer data outside the EU or the EEA?

In processing, we use a third-party IT service provider with which we have concluded the agreements for processing personal data as required by the Data Protection Regulation. We do not transfer personal data beyond the EU or outside the EEA.

Only certain University employees who log into the system with their University of the Arts IDs are authorized to use the equipment-loaning system containing personal data. The students entitled to use to the system log also into the service with their own user information at the University of the Arts Helsinki. Personal data are gathered in databases protected with firewalls, passwords, and other technical means. The databases and their backup copies are situated in locked spaces, and the data can only be accessed by certain pre-named persons.

10. How do we protect data and how long will we keep them?

We keep personal data for as long as is necessary for the purpose for which they are used. The data are erased after the expiry of the access right.

We regularly evaluate the need to preserve data in keeping with the legislation. In addition, we will take such reasonable steps as are necessary to ensure that no personal information about data subjects that is incompatible with the purposes of data processing, outdated, or erroneous is kept in the register. We will rectify or erase such information without delay.

11. What are your rights as a data subject?

Data subjects are entitled to check the data concerning them and stored in the personal data register and require erroneous, outdated, unnecessary, or unlawful data to be rectified or erased. In case a data subject has personal access to their data, they can modify their data himself or herself. In case processing is based on a consent, a data subject also has the right to withdraw his or her consent or to alter it.

As of May 25, 2018, data subjects have, according to the Data Protection Regulation, the right to object to processing or to request restriction of processing of data as well as to lodge a complaint with a supervisory authority on processing personal data.

For specific reasons of personal nature, data subjects also have the right to object to processing activities concerning them when processing data is based on our legitimate interest. In conjunction with the request, the data subject shall specify the particular situation on the basis of which he or she objects to processing. We may refuse to execute an objection-related request only on the basis of grounds stated in law.

Should the data subject not be satisfied with the way the University has processed his or her personal data, he or she may demand the national data protection authority (in Finland, the Data Protection Ombudsman whose contact information is available in the web address http://www.tietosuoja.fi/en/) to look into the matter.

12. With whom can you get in touch?

All questions on the processing of personal data as described in this data protection statement are to be asked by getting in touch with the contact person named in Point three who will, in case of need, forward the matter to the data protection officer. In case you feel that your rights as mentioned in Point 11 are not respected, you may get directly in touch with the University Data Protection Officer named in Point four.