Selection of board members from outside the university community

Published 26.5.2025 | Updated 26.5.2025

1. Controller

University of the Arts, Helsinki, University Collegium
Postal address: P.O. Box 1, FI-00097 UNIARTS
Tel. +358 294 47 2000 (exchange)

2. Entity and person in charge of processing personal data

Alina Savolainen, the chair of the working group responsible for preparing the selection of board members, alina.savolainen@uniarts.fi, tel: 040 0792 089. 

3. Contact person

Katja Kiviharju, the secretary of the working group responsible for preparing the selection of board members, katja.kiviharju@uniarts.fi, tel. 040 079 2014.

4. Data protection officer

DPO, Legal counsel Minna Eskola
Email: privacy@uniarts.fi
tel. +358 294 47 3940 
Postal address: P.O. Box 1, FI-00097 UNIARTS 

5. The name of the register and a short description

This data protection statement describes the data protection actions for collecting, sharing, and saving personal information of all who have given their consent to be available for a board-member post at the Uniarts, Helsinki.

6. What are the purpose and legal basis for processing personal data?

The main purpose of processing personal data is to fill board-member posts and manage the selection process of board members and the personal data collected during the process. The legitimate interests of the University of the Arts are based on the relationship between the University and the candidate (data subject). The relationship is established when the candidate agrees to stand for election to the Board. The processing of a candidate’s personal data is necessary for the purposes of the election.

The grounds for processing personal data  of the candidates are: 

• the candidate’s explicit consent for processing of his or her personal data. 
• safeguarding the rights of the candidate and the University of the Arts, and promoting the legitimate interests of the University of the Arts in selecting board members
•  ensuring fulfilling the controller’s and the candidate’s obligations and specific rights (electing board members);
• compliance with the laws applicable to the election

The personal data will not be used for direct marketing or any purposes other than those mentioned in this notice.

When processing personal data, we do not make use of automated decision-making and profiling as referred to in the Data Protection Regulation.

7. What data do we process?

We only collect personal data that is relevant for the board-member selection. No other information is collected.

We ask the candidate to provide us a CV with information the person themselves want to share. We process e.g., the following information eventually provided by the candidate: 

• Basic information, such as name*, date of birth, mother tongue, nationality, and other information the person wants to provide.
• Contact information such as email address *, phone number*, address, and other information the person wants to provide.
• Professional qualifications such as information concerning education; job history; scientific, artistic, educational/pedagogical merits; and other special competences relevant for a board member; linguistic abilities and other special competences.*
• The CV submitted by the candidate.
• Other information of the CV, such as a photograph and a description of personal characteristics.
• Personal data provided by the service provider assisting in the selection process (Oy M-U Consultants Ab). The service provider is responsible for the processing of personal data on their side and provides a separate privacy notice to the candidate.
• Video recording managed by the sub-contractor (Recright Oy) of the service provider assisting in the selection process, picture / photograph, voice and the information given in the interview.

The provision of the personal data listed above and marked with an asterisk (*) is a prerequisite for us to fulfill our obligations.

In addition, we record the joint discussion/interview with the candidates, and the recording is available to members and vice members of the University Collegium. The recording will be destroyed at the end of the selection process (see section 10).

Sensitive personal data: the University of the Arts does not request or collect sensitive personal data in the process. However, if you do provide this information, it will not be visible in the process. Sensitive personal information includes, for example, racial or ethnic origin, physical or mental fitness, political opinions or religious beliefs, sexual orientation, trade union membership, genetic information.

8. Where do we get information?

The names of board-member candidates are collected from the members and vice members of the University Collegium as well as from the service provider assisting in the selection process.

Other personal information is provided by the candidates (data subjects) themselves. After the person has approved the invitation to become a board-member candidate, we ask each of them (data subjects) to provide a CV.

9. To whom do we disclose or transfer data, and do we transfer data outside the EU or EEA?

The information provided by the service provider assisting in the selection process is shared with the members of the collegium, the deputy members of the collegium, and the secretary, as well as any legal services representative assisting the collegium, so that everyone has the opportunity to familiarize themselves with the candidates, their areas of expertise, and their views.

The information and any possible video recordings of the candidates who advance in the selection process are shared with the members of the collegium, the deputy members of the collegium, and the secretary, as well as any legal services representative assisting the board. The CV is stored in a location approved by the University of the Arts.

As a rule, we do not disclose information from the register to third parties.

We may disclose your information to third parties in the following situations:

• To comply with the law or the requirements of a competent law enforcement authority, government agency, court or third party in order to comply with legal process or law enforcement requirements or to exercise or defend our legal rights.
• Requests for information on selection. Our activities at the University of the Arts are governed by the application of the Publicity Act (621/1999). As a result of the application of the Publicity Act, the University may be obliged to disclose information containing personal data to third parties.
• We do not transfer data outside the EU or EEA.

10. How do we protect data and how long do we keep it?

The data is processed by only those employees of the University of the Arts or persons acting on behalf of the University of the Arts who are entitled to process personal data.

The University of the Arts, as the controller, has taken the necessary technical and organizational measures and requires such measures from the service providers it uses.

We will keep the data provided by the candidate (CV, interview recordings) until the process is completed and the decision is taken. The data will be kept for a maximum of 6 months after it has been submitted to the University of the Arts. The external service provider assisting with the selection is responsible for the data protection, storage, and disposal of the personal data in their possession in accordance with their own privacy notice.

In accordance with the University of the Arts’ information management plan, the minutes of the University Collegium meetings are kept permanently.

We will take reasonable steps to ensure that no personal data that are incompatible, outdated, or inaccurate with the purposes of the process are kept in the register. We will correct or delete such data without undue delay.

The personal data of a candidate who has been selected as a board member will be processed in accordance with the Data Protection Principles for Employees.

11. What are your rights as a data subject?

Data subjects have the right to check the personal data stored in the personal register concerning them and to request the rectification or erasure of inaccurate, outdated, unnecessary, or unlawful data. If the data subjects themselves have access to their own data, they can check and edit their data themselves. Where processing is based on consent, data subjects also have the right to withdraw or modify their consent.

In accordance with the GDPR, data subjects have the right to object to or request restriction of processing and to lodge a complaint about the processing of personal data with a supervisory authority.

For specific personal reasons, data subjects also have the right to object to processing operations concerning them where the processing is based on a legitimate interest of the University of the Arts. When making a request, the data subject must identify the specific situation on the basis of which they object to the processing. The University of the Arts may refuse to comply with a request to object only on the grounds provided for by law.

To the extent that the data subject is not satisfied with the way in which the University has processed their personal data, the data subject may request that the matter be clarified by a national data protection authority (in Finland, this is the the Data Protection Authority – for more information: http://www.tietosuoja.fi).

12. Who can you contact?

If you have any questions or concerns about the processing of your personal data as described in this privacy notice, please contact the contact person designated in section 3, who will, if necessary, refer the matter to the Data Protection Officer. If you consider that your rights set out in section 11 are not being respected, you may contact the University Data Protection Officer designated in section 4 directly.

13. Your own responsibility

You are responsible for the information you submit or make available to the University of the Arts. You must ensure that the information is true and accurate and not misleading in any way. Please ensure that the information you provide does not contain material that infringes the rights of any third party or is harmful to the University of the Arts. 

14. Changes to the data protection statement

When the statement is updated, the date of the latest update is recorded at the beginning of the statement. If we make changes to the content, we may take appropriate steps to inform you in a manner consistent with the significance of the changes.