Privacy notice for case management

Published 31.1.2020 | Updated 30.7.2026

1. Controller

University of the Arts Helsinki (Uniarts Helsinki)
Postal address: P.O. Box 1, 00097 Uniarts
Phone number: +358 294 47 2000 (switchboard)

2. Unit and person in charge of processing personal data

Development Services, HR and Service Director Riikka Mäki-Ontto, firstname.lastname@uniarts.fi, +358 500 806 161

3. Contact person for processing personal data

Shared Development Services:

Coordinator Katjuska Sandholm
firstname.lastname@uniarts.fi, +358 50 387 7319

Specialist Taina Turpeinen
firstname.lastname@uniarts.fi, +358 40 860 9516

4. Data protection officer

Find contact details for Uniarts Helsinki’s data protection officer on the data protection homepage.

5. Name of the register

Case management register

6. Purpose and legal basis for the processing of personal data

The purpose of processing personal data is to register, monitor and manage matters submitted to, received and resolved by the university. The processing of personal data is a prerequisite for fulfilling our official obligations regarding the handling of submitted matters and implementing the principle of public access to documents.

In many processes, the submission of personal data is a necessary prerequisite for handling the matter.

The legal basis for processing personal data is:

• Statutory obligation in order to fulfil the duties of a public authority.
• General interest.

We do not use automated decision-making or profiling as referred to in the GDPR in our processing of personal data.

7. What data do we process?

In addition to personal data related to the case, we process the following information in the case management register:

• The initiator of the case and their contact details.
• The handler or responsible person.
• Persons to whom the case is forwarded for action or for information.

8. Where do we get data?

We mainly get data from the following sources:

• The case that has been initiated.
• The person who initiated the case.

In addition, personal data may be collected and updated for the purposes described in this privacy notice based on data gathered from public authorities, third parties, or public sources, within the limits of applicable legislation. Such updating of data is performed manually or by automated means.

9. To which parties do we disclose and transfer data and do we transfer data outside the EU or the EEA?

Uniarts Helsinki discloses personal data outside the university or processes it for purposes other than its original purpose only in situations that are lawful.

We use a third-party service provider in case management, and we have signed an agreement with them required for the processing of personal data.

We do not transfer data outside the EU or the EEA.

10. How do we protect data and for how long do we store it?

Only those of our employees who are authorised to process incoming cases due to their line of work are entitled to use the case management system (for adding and editing data). Each user has their own username and password in the system. The data is gathered in databases protected with firewalls, passwords and other technical means. The databases and their backup copies are situated in locked spaces, and the data can only be accessed by certain designated persons.

Public cases can be accessed by the administrative staff of Uniarts Helsinki by logging into the system with a personal username and password.

The paper printouts printed out from the case management register and registered documents are kept on file in the registry. Non-public documents are stored in a locked space. The paper printouts and the registered documents are transferred for storage in the archives in accordance with the university’s information management plan.

In addition to this, we take reasonable steps to ensure that the data subject’s personal data being retained in the register is not outdated, erroneous or incompatible with the purpose of processing. We immediately rectify or erase such data.

Personal data included in the case management register is stored in accordance with the university’s records management plan. Data necessary for the processing of a matter is retained for at least the duration of the process. After the matter has been concluded, the data and documents are securely destroyed either after the defined retention period has ended, or, if the National Archives has decided in its appraisal decision that the material is to be archived, they are transferred for permanent preservation in Uniarts Helsinki’s electronic archival system.

11. What are your rights as a data subject?

Data subjects have the following rights:

• Right to have access to their data.
• Right to receive information on the processing of their personal data.
• Right to have erroneous or inaccurate personal data rectified.
• Right to have data erased.
  • Not applicable if the basis for processing is a statutory duty or a duty in the public interest.
• Right to restrict processing.
• Right to object processing i.e. to ask that data is not processed.
• Right to have data transferred from one system to another.
  • Applicable when the processing is based on an agreement or consent.
• Right to withdraw their consent.
  • Applicable when the processing is based exclusively on consent.
  • The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
• Right to receive information on a personal data breach that results in a high risk.
• Right not to be subject to a decision based on automated processing.

Data subjects have the right to lodge a complaint especially to the supervisory authority of their permanent place of residence or work if they find that the processing of personal data violates the EU’s General Data Protection Regulation 2016/679. Data subjects also have the right to employ administrative appeals and other legal remedies (https://tietosuoja.fi/en/notification-to-the-data-protection-ombudsman).

12. Who can you contact?

All questions and comments on the processing of personal data as described in this privacy notice can be directed to the contact person mentioned in section 3, who may forward the matter to the data protection officer, if necessary. If you find that your rights mentioned in section 11 are not being fulfilled, you can contact the university’s data protection officer mentioned in section 4 directly.

13. Your responsibility

You are responsible for the data that you deliver or make available to Uniarts Helsinki. You must make sure that the information is true and accurate and in no way misleading.

14. Amendments to the privacy notice

When this privacy notice is updated, the date of the new version will be edited to the beginning of the notice. If we make changes to the content, we may take appropriate steps to inform you in a manner consistent with the significance of the changes.