Open search

Privacy notice for persons whose relationship with the university does not involve employment or studying

Articles 13 and 14 of the EU General Data Protection Regulation. Information for data subjects. Drawn up on 23 May 2018; updated on 10 April 2024.

|

1. Controller

University of the Arts Helsinki (Uniarts Helsinki)
Postal address: P.O. Box 1, 00097 Uniarts
Phone number: +358 294 47 2000 (switchboard)

2. Unit and person in charge of processing personal data

HR Services, HR and Service Director Riikka Mäki-Ontto, firstname.lastname@uniarts.fi, +358 500 806 161

3. Contact person for the processing of personal data

HR Services, HR Planner Milja Nevalainen, firstname.lastname@uniarts.fi, +358 50 467 0455

4. Data protection officer

Find contact details for Uniarts Helsinki’s data protection officer on the data protection homepage.

5. Name of the register

HR register

The recipients of a fee, a grant/scholarship, a work/expense compensation etc. paid for by the university are entered in the HR register. The register also includes personal data and contractual information about persons from outside the university community in case the university has concluded an agreement with the person in question stating their non-employment-based role as a member of the university community (e.g., a visitor, an emeritus/emerita, a trainee, a person in non-military service, a performer, etc.).

The purpose of the processing of personal data is to attend to a mutual contractual relationship and to related obligations such as payment of grants and fees or to provide working conditions in accordance with the agreement as well as to plan and develop activities in consideration of visitor relationships. We also process personal data as part of decision-making within multi-member organs that have been established based on the Universities Act or the university’s organisation.

Processing personal data is also a prerequisite for the planning and practical arrangement of the university’s basic tasks (i.e. teaching, research and artistic activity), services and management as well as for its internal communication.

The legal basis for processing personal data is:

  • Implementation of an agreement.
  • Legitimate interest, due to a contractual relationship.
  • The processing is necessary in order to fulfil the university’s statutory obligations.
  • The data subject has given their explicit consent for the processing of their personal data.

We do not use automated decision-making or profiling as referred to in the GDPR in our processing of personal data.

7. What data do we process?

We process the following personal data necessary for the payment of a remuneration/fee or a compensation or for the contractual relationship between the data subject and the university:

  • Basic information such as name, date of birth, personal identity code, gender, first language, identification number assigned by the university, degree, citizenship.
  • Contact information such as email address, phone number, address data, bank details (if needed for paying a fee, a grant or a compensation), the data subject’s photograph and other contact information such as the data subject’s homepage or equivalent.
  • Contractual information, such as the start and end date, job title, main duties, equipment, services and premises made available for use, information on any possible university compensation and other potential costs and how they are processed, copyright agreements.
  • Grounds for determination and payment of a fee or compensation, such as the grounds and amount of a fee, grant or compensation.
  • The work results* reported by the data subject such as information about artistic activities, publications, visits, merits in teaching, expert duties and projects.
  • The teaching given by the data subject as described in the information system for teaching as well as possible teaching-related feedback.
  • Data concerning the data subject’s work-related trips, if the university reimburses the expenses caused by the data subject’s trip (in part or in full).
  • Data subjects working in high-exposure duties, such as data subjects who work in duties exceeding noise exposure limits or who have reported symptoms related to indoor air quality at the workplace.
  • As regards a foreign fee recipient, a copy of their passport (due to sanction checks).
  • Additionally, your personal data is processed within the university for certain other purposes, too, and the privacy notices concerning these purposes can be found on the university’s data protection homepage.

Providing us with the personal data listed above and marked with an asterisk (*) is a prerequisite for us to fulfil our obligations in accordance with the contractual relationship.

8. Where do we get data?

We primarily obtain information from the data subjects themselves.

In addition, personal data may be collected and updated for the purposes described in this privacy notice from the following sources:

  • Publicly available sources and authorities.
  • Other third parties for the purposes described in this privacy notice within the limits of applicable legislation.

Updating of data is performed manually or by automated means.

9. To which parties do we disclose and transfer data and do we transfer data outside the EU or the EEA?

We disclose personal data in the manner permitted and obliged by current legislation in force to parties that are entitled to obtain information from the register based on law or an agreement, such as the tax authority, the Social Insurance Institution of Finland, the pension and accident insurance company and the employment and enforcement authorities. We may also disclose information for other purposes in accordance with Finnish law.

The data on a specific person is also available for the persons in charge of the agreement concluded with the specific person and for their supervisors in accordance with the organisational hierarchy of Uniarts Helsinki.

In processing personal data, we use subcontractors working for us in the following services, for example:

  • Financial administration and payroll.
  • Legal Services.
  • Telephone switchboard.

As has been agreed with you, the data is also used:

  • By the university switchboard (telephone directory information) and for the personnel directory published on the university internet and intranet pages.
  • In the expert database published on our internet pages; the database is also used as a system for collecting information about research and artistic activities.
  • Personal data and information on the contractual relationship is shared with the partner travel agency CWT Finland Oy for arranging university-funded trips.

We also disclose data to the following parties:

  • Sources of external funding: for the reporting required by the funder.
  • Information required by the Central Statistical Office of Finland, Confederation of Finnish Industries and Ministry of Education and Culture for reporting on staff and FTE numbers and for salary comparisons.

We have taken care of your data protection with our subcontractors by drafting processing agreements for the processing of personal data.

In cases where we transfer personal data outside the EU/EEA, we have taken appropriate security measures in connection with the transfer. We use the standard contractual clauses adopted by the EU.

10. How do we protect data and for how long do we store it?

Your data is processed only by the employees of Uniarts Helsinki or by the persons working under the mandate of and on behalf of Uniarts Helsinki who have the right to process personal data.
As the data controller, Uniarts Helsinki has taken the necessary technical and organisational measures and also requires the same from the service providers it uses.

We use subcontractors in the processing of personal data, and we have concluded agreements for the processing of personal data with them.

We keep personal data for as long as is necessary for the purpose for which the personal data is used, given the data retention periods to be observed in accordance with the applicable legislation such as the Employment Contracts Act, Accounting Act, Prepayment Act and Archives Act. We assess the need for retention of the data on a regular basis, taking into account any applicable legislation. In addition to this, we take reasonable steps to ensure that the data subject’s personal data being retained in the register is not outdated, erroneous or incompatible with the purpose of processing. We immediately rectify or erase such data.

11. What are your rights as a data subject?

Data subjects have the following rights:

  • Right to have access to their data.
  • Right to receive information on the processing of their personal data.
  • Right to have erroneous or inaccurate personal data rectified.
  • Right to have data erased.
    • Not applicable if the basis for processing is a statutory duty or a duty in the public interest.
  • Right to restrict processing.
  • Right to object processing i.e. to ask that data is not processed.
  • Right to have data transferred from one system to another.
    • Applicable when the processing is based on an agreement or consent.
  • Right to withdraw their consent.
    • Applicable when the processing is based exclusively on consent.
    • The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
  • Right to receive information on a personal data breach that results in a high risk.
  • Right not to be subject to a decision based on automated processing.

Data subjects have the right to lodge a complaint especially to the supervisory authority of their permanent place of residence or work if they find that the processing of personal data violates the EU’s General Data Protection Regulation 2016/679. Data subjects also have the right to employ administrative appeals and other legal remedies.

12. Who can you contact?

If you have any questions or comments about the processing of your personal data as described in this privacy notice, please contact the contact person mentioned in section 3, who will, if necessary, refer the matter to the data protection officer. If you consider that your rights set out in section 11 are not being fulfilled, you may contact the university’s data protection officer mentioned in section 4 directly.

13. Your responsibility

You are responsible for the data that you deliver or make available to Uniarts Helsinki. You must make sure that the information is true and accurate and in no way misleading.

14. Amendments to the privacy notice

When this privacy notice is updated, the date of the new version will be edited to the beginning of the notice. If we make changes to the content, we may take appropriate steps to inform you in a manner consistent with the significance of the changes.