Student register
Information to the data subject in accordance with the EU General Data Protection Regulation (2016/679) articles 13-14.
1. Controller
Arcada University of Applied Sciences Ltd
Jan-Magnus Janssonin aukio 1
00560 Helsinki
Business ID: 2553871-2
2. The controller’s representative
Head of Student Services Cecilia Jaakkola
Tel. 0294 282 639
E-mail address in the format firstname.surname
3. Contact person for the register
Senior System Developer Krister Karlström
Tel. 0294 282 509
International Coordinator Kátia Torres Airava
Tel. 0294 282 868
Head of Student Affairs Lilian Sjöberg
Tel. 0294 282 671
E-learning Coordinator Filip Levälahti
Tel. 0294 282 518
E-mail address in the format firstname.surname
4. Data protection officer
Data Protection Officer, Legal Counsel Anna Härmä
Tel. 0294 282 888
E-mail address dataprotection
5. Purposes of processing personal data
The students’ personal data is processed in order for Arcada to fulfill its obligations as a university. The obligation contains enabling students to take part in teaching and receive counseling, guidance and other services, to complete studies and receive study related certificates as well as degree certificates. The data may also be used for reporting to authorities.
There are six categories of students at Arcada:
- Degree students (bachelor and master degrees)
- Specialization students and further education students
- International exchange students
- Students at the Open University of Applied Sciences
- Students through national collaboration between universities (based on contracts)
- Other students (for example commissioned courses and programmes)
6. Legal basis for processing personal data
The processing of personal data is based on Arcada’s role as an organizer of higher education. The basis for processing is Arcada’s legal obligation as well as performance of tasks carried out in the public interest or in the exercise of official authority, and in some situations the student’s consent or a contract (General Data Protection Regulation, article 6).
The processing ensures that students’ study rights and legal protection is handled in an appropriate and equal way and the authorities’ need for information and data collection is accommodated.
Arcada processes data that belongs to special categories of personal data (according to the General Data Protection Regulation, article 9). Data about a student’s state of health is processed with the consent of the student to assess and accommodate the need for special arrangements in his or her studies and examinations. Data about the student’s state of health may also be used to assess the student’s suitability for degree programmes for which suitability requirements are stated in the legislation.
The central acts, regulations and provisions by authorities when processing personal data are:
Universities of Applied Sciences Act (932/2014)
Government Decree on Universities of Applied Sciences (1129/2014)
Act on the Openness of Government Activities (621/1999)
Decree on the Openness of Government Activities and on Good Practice in Information Management (1030/99)
Act on National Education and Degree Registers (884/2017)
Archives Act (831/1994)
The National Archive’s Decision on Permanent Storage of Thesis’ for Universities of Applied Sciences 16.9.2014 (AL/2897/07.01.01.03.01/2014)
Arcada’s Degree Statues
7. Categories of personal data and the duration of storage
1) Basic data
| Data | IT System | Storage |
|---|---|---|
| Name | SISU, itslearning, MoveOn | Permanently |
| Social security number | SISU, MoveOn | Permanently |
| Date of birth | SISU, MoveOn | Permanently |
| National student number | SISU, Mira CRM | Permanently |
| Gender | SISU, itslearning | Permanently |
| Nationality and/or country of birth | SISU, MoveOn | Permanently |
| Mother tongue & language of education | SISU | Permanently |
| Municipality of residence (at the beginning of the studies and during the studies) | SISU | Permanently |
| Earlier degrees and education | SISU | Permanently |
| Username to Arcada’s IT services | SISU, itslearning | Permanently |
| Local Register Office’s decision on prohibition to disclose address information | SISU | Permanently |
2) Contact information
| Data | IT System | Storage |
|---|---|---|
| Address and phone number, municipality of study | SISU | 2 years |
| Address and phone number. municipality of residence | SISU, MoveOn | 2 years |
| E-mail address | SISU, MoveOn | Permanently |
| Name, address and phone number of next of kin | MoveOn | 2 years |
3) Rights to study
| Data | IT System | Storage |
|---|---|---|
| Student code | SISU, itslearning, MoveOn | Permanently |
| Degree programme | SISU, itslearning, MoveOn | Permanently |
| Type of right to study | SISU, MoveOn | Permanently |
| Start and end date | SISU | Permanently |
| Reason for termination of right to study | SISU | Permanently |
| Decisions on extended, re-enrolled and renewed right to study | SISU | Permanently |
| Application for degree certificate | SISU | Permanently |
| Possible comments relating to the right to study | SISU | Permanently |
| Registrations for the academic year | SISU | Permanently |
| Payment information (tuition fees) | SISU | Permanently |
| Study plan | SISU | Permanently |
4) Study attainments, partial study attainments and examination results
| Data | IT System | Storage |
|---|---|---|
| Course name and code | SISU | Permanently |
| Study credits, grades, date of performance | SISU | Permanently |
| Examiner and date of registration | SISU | Permanently |
| Type of attainment (course, practical training, thesis) | SISU | Permanently |
| Start and end date of practical training | SISU, MoveOn | Permanently |
| Place, type and country of practical training | SISU, MoveOn | Permanently |
| Evaluation (grade, points, date) | SISU, itslearning | Permanently |
| Possible comments | SISU, MoveOn | Permanently |
5) Degree thesis
| Data | IT System | Storage |
|---|---|---|
| Title and language | SISU | Permanently |
| Supervisor and assessor | SISU | Permanently |
| Potential commissioner of thesis | SISU | Permanently |
| Potential partial study attainments | SISU | Permanently |
| Data on presentation of thesis and maturity test | SISU | Permanently |
| Data on submitted copies | SISU | Permanently |
6) International mobility (both studies and practical training, incoming and outgoing)
| Data | IT System | Storage |
|---|---|---|
| Start and end date of exchange period | MoveOn, SISU | Permanently |
| Country of departure and country of destination | MoveOn, SISU | Permanently |
| Type of exchange (studies or practical training) | MoveOn, SISU | Permanently |
| Exchange programme (eg. Erasmus+) | MoveOn, SISU | Permanently |
| Degree programme and field of study | MoveOn, SISU | Permanently |
| Sending and receiving institution | MoveOn, SISU | Permanently |
| Travel report | MoveOn | 10 years |
| Certificate of the exchange | MoveOn | 10 years |
| Photograph of the applicant | MoveOn | 10 years |
| Learning agreement | MoveOn | 10 years |
| Transcript of records | MoveOn | 10 years |
| Language certificate | MoveOn | 10 years |
| Identity documents (eg. passport copy) | MoveOn | 10 years |
| Application letters and attachments | MoveOn | 10 years |
| Potential project plan for thesis | MoveOn | 10 years |
| Motivation letter | MoveOn | 10 years |
| Housing preferences | MoveOn | 10 years |
| Need for special arrangements and support | MoveOn | 10 years |
| Grant information | MoveOn | 10 years |
| Potential additional information | MoveOn | 10 years |
7) Data collected by electronic forms management service e-lomake and attachments to it
| Data | Storage |
|---|---|
| Changes in attendance and absence | 10 years |
| Termination of studies | 10 years |
| Application for re-enrollment | 10 years |
| Application for renewed right to study | 10 years |
| Application for extended right to study | 10 years |
| Application for accreditation or validation | 10 years |
8) Data stored on paper, such as forms and annexes
| Form | Storage |
|---|---|
| Registration for academic year | 10 years |
| Certificate for student in need of special pedagogical support | Period of validity |
8. IT systems used when processing personal data
Sisu - system for study administration
Elomake - electronic form management
itslearning – online learning environment
Microsoft Teams - system for online teaching and online exam supervision
Mira Network CRM - system for administering graduated students
MoveOn – system for processing international student mobility
Urkund – system for plagiarism check
Sarake Sign - electronic signature service
TUUDO -mobile application connected to SISU
PowerBI - analysis tool for student data compiled in Arcada's data warehouse
Workseed - system for practica training management for health and social care students
9. Data sources
Basic data and contact information is transferred from Arcada’s applicant register. Students can and have an obligation to update their contact information in the register themselves.
10. Recipients of the personal data
Data is transferred to the national data warehouse VIRTA, from which most authorities have legal rights to collect information. In addition to the statutory purposes, Arcada also discloses data from VIRTA, to the following services when necessary:
- OILI (registration for the academic year, CSC)
- Follow-up questionnaires (Ministry of Education and Culture, CSC)
- AVOP/ARVO (student response, Ministry of Education and Culture and CSC)
- PURO (national study attainment transfer service, CSC)
- EMREX (international study attainment transfer service, Ministry of Education and Culture and CSC)
- UAF (University Admissions Finland consortium, international application service, CSC)
- FSHS (Finnish Student Health Service)
- FIONA (data for research purposes, Statistics Finland)
- TUUDO (mobile application, Tuudo Oy)
- Arcada Student Union - ASK (only with the student’s consent)
- Library register of borrowers (Arcada’s library, only with the student’s consent)
- Alumni register (only former students with their consent)
- User Administration Register
- The city of Helsinki’s social services and health care division (new students,yearly)
The disclosure of data to the authorities is based on legislation. Disclosure of data to other services is based on separate decisions made by Arcada.
Data can also be disclosed to research and, with the student’s consent, to organizations for marketing purposes or for carrying out opinion polls.
11. Transfer of personal data outside the EU and the EEA and the basis for the transfer
Personal data is not regularly transferred outside the EU or the EEA without the student’s consent.
If suppliers or services which require personal data to be transferred outside the EU or the ETA are used, Arcada will make sure that the requirements for adequate level of protection are met or that appropriate safeguards are provided in accordance with the General Data Protection Regulation 44-50.
12. Principles for the protection of personal data
Material in electronic format is stored in IT systems and on computers protected from unauthorized use with security measures including firewalls and passwords. The systems have different user levels, and users are granted access to the data only to the extent the user’s work tasks require.
Material in paper format is stored in locked rooms with limited access and access control.
13. Automated decision-making
Automated decisions and profiling are not made based on personal data within the register.
14. The data subject’s rights
Information about the data subject's rights can be found here.