Privacy notice for the selection of external members to the university board 2024

Published 26.5.2025 | Updated 31.7.2026

1. Controller

Uniarts Helsinki, University Collegium
P.O. Box 1, 00097 Uniarts
+358 294 47 2000 (switchboard)

2. Unit and person in charge of processing personal data

Tuire Kuusi, chair of the University Collegium’s working group preparing the board member selection, tuire.kuusi@uniarts.fi, +358 40 7104337

3. Contact person for the processing of personal data

Eeva-Liisa Vaivila, secretary to the University Collegium’s working group preparing the board member selection, eeva-liisa.vaivila@uniarts.fi; +358 40 7104340

4. Data protection officer

Find contact details for Uniarts Helsinki’s data protection officer on the data protection homepage.

5. Name of the register and brief description

Register concerning the selection of external board members

This privacy notice describes our data protection practices concerning the collecting and processing of personal information of persons who have given their consent to be a board member candidate in the selection process of Uniarts Helsinki board members from outside the university community.

6. Purpose and legal basis for the processing of personal data

The main purpose of processing personal data is to fill board member positions and manage the selection process of board members.

The grounds for processing the personal data of a board member candidate are:

• Safeguarding the rights of the board member candidate and Uniarts Helsinki and promoting the legitimate interests of Uniarts Helsinki in selecting board members; The legitimate interests of Uniarts Helsinki are based on the relationship between the university and the data subject. The relationship is established when the data subject agrees to be a candidate in the Uniarts Helsinki board member selection process. The processing of a candidate’s personal data is necessary for the purposes of the selection.
• The board member candidate’s explicit consent.
• Uniarts Helsinki’s mandatory statutory obligations (selection of board members from outside the university community) Safeguarding the rights of the board member candidate and Uniarts Helsinki and ensuring the university’s compliance with legislation applicable to recruitment.

The personal data will not be used for direct marketing or any purposes other than those mentioned in this notice.

We do not use automated decision-making or profiling as referred to in the GDPR in our processing of personal data.

7, What data do we process?

We only collect personal data that is relevant for the board member selection.

We ask the candidate to provide us a CV with information the person themselves want to share. We process, e.g., the following information eventually provided by the candidate:

• Basic information, such as name*, date of birth, first language, nationality and other information the data subject may provide.
• Contact information such as email address, phone number, address and other information the person may provide.
• Professional qualifications such as information concerning education and other training, job history, research-related, artistic, pedagogical merits and other special merits and competence relevant for the open position, language skills and other special competence areas.*
• Other information included in the CV, such as a photograph and a description of personal characteristics.
• Personal data provided by Mercuri Urval Oy, the service provider carrying out the board member search. The service provider is responsible for the processing of personal data on their side and provides a separate privacy notice to the candidate.

Providing us with the personal data listed above and marked with an asterisk (*) is a prerequisite for us to fulfil our obligations.

In addition, we record the joint discussion/interview with the candidates, and the recording is available to members and deputy members of the University Collegium. The recording will be destroyed at the end of the selection process (see section 10).

Sensitive personal data: Uniarts Helsinki does not request or collect sensitive personal data in connection with the process. However, if you do provide this information, it will not be made available in the process. Sensitive personal data includes, for example, information about racial or ethnic origin, physical or mental health, political opinions or religious beliefs, sexual orientation, trade union membership or genetic and biometric data used for identifying a person.

8. Where do we get data?

The names of board member candidates are collected from the members and deputy members of the University Collegium.

Other personal information that is processed is provided by the candidates (data subjects). After the person has expressed their willingness to be a board member candidate, we ask the data subject to provide their personal information (a CV).

9. To which parties do we disclose or transfer data and do we transfer data outside the EU or the EEA?

The recording is shared with the members of the University Collegium so that all members have the possibility to learn more about the candidates, their competence areas and views.

As a rule, we do not disclose information from the register to third parties.

We may disclose your information to third parties in the following situations:

• Compliance with the law or the requirements of a competent law enforcement authority, government agency, court or third party so that we can comply with legal process or law enforcement requirements or exercise or defend our legal rights.
• Requests for information on the selection. Our activities at Uniarts Helsinki are governed by the application of the Act on the Openness of Government Activities (621/1999). As a result of the application of the Act on the Openness of Government Activities, the university may be obliged to disclose information containing personal data to third parties.

We do not transfer data outside the EU or EEA.

10. How do we protect data and for how long do we store it?

Data concerning the board member candidate is processed only by the employees of Uniarts Helsinki or by the persons working under the mandate of and on behalf of Uniarts Helsinki who have the right to process the personal data.

As the controller, Uniarts Helsinki has taken the necessary technical and organisational measures and also requires the same from the service providers it uses.

We will keep the data provided by the board member candidate (CV, interview recordings) until the process is completed and the decision is made. The data will be kept for a maximum of 6 months after it has been provided to Uniarts Helsinki.

In accordance with Uniarts Helsinki’s information management plan, the minutes of the University Collegium meetings are kept permanently.

We will take reasonable steps to ensure that no personal data that is incompatible, outdated or inaccurate with the purposes of the processing are kept in the register. We will immediately rectify or erase such data.

The personal data of a candidate who has been selected as a board member will be processed in accordance with the data protection principles applied to employees.

11. What are your rights as a data subject?

Data subjects have the following rights:

• Right to have access to their data.
• Right to receive information on the processing of their personal data.
• Right to have erroneous or inaccurate personal data rectified.
• Right to have data erased.
• Not applicable if the basis for processing is a statutory duty or a duty in the public interest
• Right to restrict processing.
• Right to object processing i.e. to ask that data is not processed.
• Right to have data transferred from one system to another.
• Applicable when the processing is based on an agreement or consent.
• Right to withdraw their consent.
• Applicable when the processing is based exclusively on consent.
• The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
• Right to receive information on a personal data breach that results in a high risk.
• Right not to be subject to a decision based on automated processing.

Data subjects have the right to lodge a complaint especially to the supervisory authority of their permanent place of residence or work if they find that the processing of personal data violates the EU’s General Data Protection Regulation 2016/679. Data subjects also have the right to employ administrative appeals and other legal remedies (tietosuoja.fi/en/notification-to-the-data-protection-ombudsman).

12. Who can you contact?

If you have any questions or comments about the processing of your personal data as described in this privacy notice, please contact the contact person mentioned in section 3, who will, if necessary, refer the matter to the data protection officer. If you consider that your rights set out in section 11 are not being fulfilled, you may contact the university’s data protection officer mentioned in section 4 directly.

13. Your responsibility

You are responsible for the data that you submit or make available to Uniarts Helsinki. You must make sure that the information is true and accurate and in no way misleading.

14. Amendments to the privacy notice

When this privacy notice is updated, the date of the new version will be edited to the beginning of the notice. If we make changes to the content, we may take appropriate steps to inform you in a manner consistent with the significance of the changes.