1. Data controller
Lapland University of Applied Sciences Ltd
Jokiväylä 11 C
2. Data controller’s representative
Ari Konu, Director of Administration
tel. +358 40 7352 007
3. Data controller’s contact person
Saila-Inkeri Puukko, Project Manager
tel. +358 40 7528573
4. Data protection officer’s contact information
Pirjo Kärki-Koskinen, Data Protection Officer
Jokiväylä 11 C
tel. +358 40 510 0365
5. Purpose of processing personal data
Personal data is processed for information distribution and communication purposes connected to the Our Stories (Interreg Nord) project, such as providing information about future events and results of the project.
Furthermore, the project administrator (Lapland UAS) maintains a record of the people who have participated in the project for project statistics and reporting purposes, as required by the project funder.
6. Legal basis of processing personal data
The processing is based on Article 6 or 9 of the General Data Protection Regulation (at least one basis).
The European Union’s General Data Protection Regulation, Article 6, Paragraph 1, Subparagraphs a–f:
- the data subject’s consent
- performance of a contract (to which the data subject is party)
- compliance with the data controller’s legal obligation provisions: Universities of Applied Sciences Act 2014
- vital interests of the data subject or another natural person
- a task carried out in the public interest/in the exercise of official authority vested in the controller
- data describing a person’s position, duties or their performance
- official task carried out in the public interest
- scientific or historical research or statistics
- archiving of research materials and cultural heritage materials
- carrying out the legitimate interests of the data controller or of a third party
specification of the legitimate interest:
The European Union’s General Data Protection Regulation, Article 9 (special categories of personal data), Subparagraphs a–j:
- the data subject’s consent
- carrying out the obligations of the controller or of the data subject in the field of employment, social security or social protection law
- protecting the vital interests of the data subject or of another natural person
- legitimate activities by a foundation or association with a political, philosophical, religious or trade union aim
- the data has been made public by the data subject
- the establishment, exercise or defence of legal claims
- substantial public interest
- purposes of occupational medicine
- reasons of public interest in the area of public health
- archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
7. Categories of personal data processed and their storage periods
The data recorded for the Our Stories project includes the following data: name, sex, address, telephone number, e-mail address, country, company name and website and whether the person is under the age of 24 years (yes/no). The records do not include personal ID codes.
The records will be maintained for the duration of the project, until 30 June 2019. After this, data may be sent as needed regarding any further projects connected to the theme of story-telling.
As for the lists of participants, documents connected to carrying out the project must be documented and stored by the project organisation until 31 December 2032. If a longer period is required by Finnish law, such as the Accounting Act, it shall be complied with.
8. Information systems used for the processing
Electronic registration form (such as Google Forms/Webropol), Excel.
Internal information systems for processing: i.e Webtallennus, Populus, Reportronic.
9. Where is the personal data needed for the processing obtained? Is the data subject obligated to provide the necessary personal data? Consequences if the data subject does not provide the necessary personal data.
The data is obtained from the project’s existing contact information records.
If the data subject gives their personal data for processing, the basis for providing personal data is:
- the data controller’s legal obligation
- contract between the data controller and data subject
Cookies are used in browser-based information systems for processing personal data. A cookie is a small text file that the browser saves on the user’s computer. Cookies are used for providing services, making it easier to log in and facilitating service use statistics. Users can block cookies on their browser, but this may prevent the system from functioning properly.
Cookies are used in the processing of personal data:
11. Regular transfer and disclosure
The data will not be disclosed for other purposes or to third parties.
12. Data transfer or disclosure outside the EU or EEA and its basis
Only to project financiers (e.g Länstyrelsen, Lapin Liitto) and project partners (Ihana AS!, Sverigefinska folkhögskolan, JORD Ek. För., Studio E-city Ky)
13. Principles of personal data protection
Only the project’s administrator (Lapland UAS) and project partners (Ihana AS!, Sverigefinska folkhögskolan, JORD Ek. För., Studio E-city Ky) can access the records and electronic registration forms.
The registration data is not stored on the electronic form; it is deleted from the form after registration. The data is transferred manually from the electronic registration form to an Excel record on the project manager’s personal computer by the project manager. Project staff/partners must use a personal username and password to log in to the registration form.
14. Automated decision-making
There is no automated decision-making or profiling.
15. Rights of the data subject
The rights of the data subject are determined by Articles 15–22 of the European Union’s General Data Protection Regulation:
- Data subjects have the right to:
- review data concerning them
- request rectification of their data
- demand deletion of their da
- demand restriction of processing of personal data
- object to the processing of personal data
- request that the personal data they provided be transferred to another data controller
- withdraw their previously given consent if the processing of personal data is based on the data subject’s consent
- object to automated decision-making
To exercise their rights, data subjects can submit their request on a form that is available on the Lapland UAS website or contact the Lapland UAS Data Protection Officer.
Data subjects have the right to appeal to the Office of the Data Protection Ombudsman if they feel that the processing of their personal data has violated valid data protection legislation. Contact information: Office of the Data Protection Ombudsman, P.O. Box 800, FI-00521 Helsinki
For advice and instructions in matters connected to the rights of data subjects, please contact the Data Protection Officer, whose contact information is provided in Section 4.