Open search

Privacy notice for grant applicants

Articles 13 and 14 of the EU General Data Protection Regulation. Information for data subjects. Drawn up on 22 May 2018; updated on 14 July 2025.

|

1. Controller

University of the Arts Helsinki (Uniarts Helsinki)
Postal address: P.O. Box 1, 00097 Uniarts
Phone number: +358 294 47 2000 (switchboard)

2. Unit and person in charge of processing personal data

3. Contact person for processing personal data

Tuition fee waivers: Hanna Björksten.

Grants of the Academy of Fine Arts: Ulla Tissari, doctoral education Minna Luomala, University of the Arts Helsinki Foundation Marja-Leena Pétas-Arjava.

Grants of the Theatre Academy: Aapo Juusti, doctoral education Elina Raitasalo, University of the Arts Helsinki Foundation Marja-Leena Pétas-Arjava.

Grants of the Sibelius Academy: International grants Leena Veijonsuo, doctoral education Hannu Tolvanen and Sirpa Järvelä, University of the Arts Helsinki Foundation Marja-Leena Pétas-Arjava.

Email addresses: firstname.surname@uniarts.fi
Phone number: +358 294 47 2000 (switchboard)

4. Data protection officer

Find contact details for Uniarts Helsinki’s data protection officer on the data protection homepage.

5. Name of register

Grant register

The purpose for processing personal data is to manage the various grants awarded by Uniarts Helsinki and to enable applying for and granting them. Personal data is processed in preparing decisions on grants and tuition fee waivers, in making decisions, in announcing grant decisions, in compiling statistics, in paying grants, and in informing authorities (e.g. tax authorities) about grants and tuition fees.

In many processes, the submission of personal data is a necessary prerequisite for handling the matter.

Uniarts Helsinki’s right to process personal data is based on:

  • Performance of a task carried out in the public interest.
  • Compliance with a legal obligation (grant awarded to a student who is liable to pay the annual tuition fee, informing of the tax authorities).
  • A contractual relationship or actions preceding the signing of an agreement (the data subject’s grant application, awarding of the grant, paying of the grant and notifying of the authorities).
  • Legitimate interest.

We do not use automated decision-making or profiling as referred to in the GDPR in our processing of personal data.

7. What data do we process?

For the purpose of applying for and being awarded a tuition fee waiver as a student who is liable to pay tuition fees, the applicant must provide information on:

  • Success in studies
  • Possible reasons for delay in studies

As for other grant applications, we process slightly different data based on the application process in question, but typically, the grant applicant must provide the following information:

  • Name, date of birth or personal identity code, nationality and gender of the applicant as well as any contact information necessary.
  • Degree programme.
  • Host education institution and length of the exchange period in exchange programmes.
  • Bank details for the payment of the grant.
  • Connection of the grant being applied for with the studies, success in studies, transcript of records.
  • Grounds for the application, grant plan.
  • Details concerning assessments and the decision.
  • Data provided to the tax authorities and Mela Farmers’ Social Insurance Institution of Finland (working grants).
  • Research: a research plan, letter of motivation, statement by the supervisor, invitation to another university, doctoral degree certificate.
  • An account/a report on how the grant has been used.
  • As for grants awarded to staff, data on their employment relationship (title) is also gathered.

For the grant application, the applicant is also typically requested to provide a recommendation from a professor, the head of the degree programme, the head of the research unit or the person in charge of supervising the research as well as information about other possible grants awarded.

As regards minors participating in the Sibelius Academy’s Junior Academy, the university also gathers their guardians’ name and contact information and bank details in case the grant awarded to a Junior Academy student is paid via them.

8. Where do we get data?

We mainly get data from the applicants themselves.

In addition, Uniarts Helsinki gathers data from the following sources:

  • A favourable statement to the application is given by a professor, the person in charge of degree programme, the head of the applicant’s research unit or the applicant’s research supervisor.
  • Data on underage applicants is provided by their guardians.
  • In grant decisions of the university, student register data may also be used.

9. To which parties do we disclose and transfer data and do we transfer data outside the EU or the EEA?

Uniarts Helsinki discloses personal data outside the university or processes it for purposes other than its original purpose only in situations that are lawful.

Uniarts Helsinki discloses personal data to the following recipients:

  • Tax authorities.
  • Payroll office through which the grants are paid.
  • We use subcontractors in the processing of personal data, and we have concluded agreements for the processing of personal data with them in accordance with the GDPR.

We do not transfer personal data outside the EU/EEA.

10. How do we protect data and for how long do we store it?

Your data is processed only by the employees of Uniarts Helsinki or by the persons working under the mandate of and on behalf of Uniarts Helsinki who have the right to process personal data.
In the role of the data controller, Uniarts Helsinki has taken the necessary technical and organisational measures and also requires the service providers it uses to do so.

We store data for as long as is necessary for the purpose for which the personal data is used. The university complies with its information management plan when storing data.

We assess the need for retention of the data on a regular basis, taking into account any applicable legislation. In addition to this, we take reasonable steps to ensure that the data subject’s personal data being retained in the register is not outdated, erroneous or incompatible with the purpose of processing. We immediately rectify or erase such data.

11. What are your rights as a data subject?

Data subjects have the following rights:

  • Right to have access to their data.
  • Right to receive information on the processing of their personal data.
  • Right to have erroneous or inaccurate personal data rectified.
  • Right to have data erased.
    • Not applicable if the basis for processing is a statutory duty or a duty in the public interest.
  • Right to restrict processing.
  • Right to object processing i.e. to ask that data is not processed.
  • Right to have data transferred from one system to another.
    • Applicable when the processing is based on an agreement or consent
  • Right to withdraw their consent.
    • Applicable when the processing is based exclusively on consent
    • The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
  • Right to receive information on a personal data breach that results in a high risk.
  • Right not to be subject to a decision based on automated processing.

Data subjects have the right to lodge a complaint especially to the supervisory authority of their permanent place of residence or work if they find that the processing of personal data violates the EU’s General Data Protection Regulation 2016/679. Data subjects also have the right to employ administrative appeals and other legal remedies (https://tietosuoja.fi/en/notification-to-the-data-protection-ombudsman).

12. Who can you contact?

All questions and comments on the processing of personal data as described in this privacy notice can be directed to the contact person mentioned in section 2, who may forward the matter to the data protection officer, if necessary. If you find that your rights mentioned in section 10 are not being fulfilled, you can contact the university’s data protection officer mentioned in section 3 directly.

13. Your responsibility

You are responsible for the data that you deliver or make available to Uniarts Helsinki. You must make sure that the information is true and accurate and in no way misleading. Please make sure that the information you give does not contain material that violates the rights of a third party or that is harmful to Uniarts Helsinki.

14. Amendments to the privacy notice

When this privacy notice is updated, the date of the new version will be edited to the beginning of the notice. If we make changes to the content of this privacy notice, we will inform you, if this is deemed necessary considering the significance of the change.