Privacy Policy

Purpose of processing the data

The Student Council uses the highest decision-making power in the Student Union of the University of Oulu. The data of members of the Student Union of the University of Oulu who are running as candidates for the Student Councill are used for organising elections that are open to all members of the Student Union of the University of Oulu. The Student Council, including vice members, is formed based on the election result. The data of the elected Representative Council are used to organise the operation of the Student Council and its Student Council groups.

Basis of processing the data

Data Protection Regulation, Article 6, paragraph 1, point (e). Data Protection Act, Section 4.1, paragraph 1. Universities Act, Section 46.6, and Government Decree on Universities, Section 4. In the case of the potential political opinion of a candidate or member of the Representative Council, Data Protection Regulation, Article 9, paragraph 2, point (e).

Contact person

Secretary General of the Student Union of the University of Oulu (paasihteeri@oyy.fi)

Description of the categories of data subjects and categories of personal data

Name, personal ID, faculty, address, phone number, email address, name of electoral coalition, names of the representative and vice representatives of the electoral coalition. Names categorised by electoral coalition in the list of candidates. The list of members of the Student Council includes information about the election result for each candidate and electoral coalition.

Categories of recipients of the personal data

The names and electoral coalitions of those running in the Student Council elections are published at oyy.fi. Their contact details can be accessed by those taking part in organising the elections as well as employees who oversee the Student Council’s operation. The list of members of the Student Council is published at oyy.fi and meetings of the Student Council can be publicly livestreamed online.

Transfer of data to third countries

A system or cloud service that stores the data outside the EU may be used for processing the data. If any data are transferred outside the European Union or the European Economic Area, the transfer requires the country in question to guarantee a sufficient level of data protection or the data controller to provide sufficient guarantees on the protection of the data subjects’ privacy and rights through contractual clauses or other means or the data subject to have unambiguously consented to the transfer.

Planned time limits for the erasure of data

Candidate declaration forms, combined lists of candidates and documents from the meetings of the Central Election Committee and the Student Council are permanently archived.

Purpose of processing the data

The Student Union’s self-governance includes the right to decide on how to best organise its internal administration. When deciding on the compositions of administrative bodies, personal data are collected for the organisation of administration.

Basis of processing the data

Data Protection Regulation, Article 6, paragraph 1, point (e). Data Protection Act, Section 4.1, paragraph 1. Universities Act, Section 46.6. In the case of the potential political opinion of a candidate of member of the Representative Council, Data Protection Regulation, Article 9, paragraph 2, point (e).

Contact person

Secretary general of the Student Union of the University of Oulu (paasihteeri@oyy.fi)

Description of the categories of data subjects and categories of personal data

Name, Representative Council group (if applicable), student number, faculty, address, phone number, email address, position in the administrative body, title, special diets. Remuneration is paid for some of the positions of trust. In these cases, personal data that is required for paying the remuneration is collected: bank details, personal ID, tax card.

Categories of recipients of the personal data

The names and email addresses of those serving in positions of trust are displayed at oyy.fi and halloped.fi. Other data are available to the people involved in the Student Union’s administration.

Transfer of data to third countries

A system or cloud service that stores the data outside the EU may be used for processing the data. If any data are transferred outside the European Union or the European Economic Area, the transfer requires the country in question to guarantee a sufficient level of data protection or the data controller to provide sufficient guarantees on the protection of the data subjects’ privacy and rights through contractual clauses or other means or the data subject to have unambiguously consented to the transfer.

Planned time limits for the erasure of data

In each case, the data are stored for the duration of the term of the administrative body in question. After this, all data that is not included in the material to be archived are destroyed. Documentation created in the Student Union’s administration, including data on the people who participate in the administration, is permanently archived.

Purpose of processing the data

The Student Union’s statutory duties include appointing student representatives to the administrative bodies of the University of Oulu referred to in the Universities Act, Chapter 3. When making decisions on these student representatives, personal data are collected in order to appoint these individuals and arrange communication with them.

Basis of processing the data

Data Protection Regulation, Article 6, paragraph 1, point (e). Data Protection Act, Section 4.1. Universities Act, Section 46.2.

Contact person

Secretary general of the Student Union of the University of Oulu (paasihteeri@oyy.fi)

Description of the categories of data subjects and categories of personal data

Name, student number, address, phone number, email address. 

Categories of recipients of the personal data

The names and email addresses of those serving in positions of trust are displayed at halloped.fi. Other data are available to the people involved in the Student Union’s administration.

Transfer of data to third countries

A system or cloud service that stores the data outside the EU may be used for processing the data. If any data are transferred outside the European Union or the European Economic Area, the transfer requires the country in question to guarantee a sufficient level of data protection or the data controller to provide sufficient guarantees on the protection of the data subjects’ privacy and rights through contractual clauses or other means or the data subject to have unambiguously consented to the transfer.

Planned time limits for the erasure of data

In each case, the data are stored for the duration of the term of the administrative body in question. After this, all data that is not included in the material to be archived are destroyed. Documentation created in the administration of the Student Union of the University of Oulu, including data on people who have served as student representatives in administration, is permanently archived.

Purpose of processing the data

The Student Union of the University of Oulu organises events and other informal activities, rents out items, provides guidance, maintains contacts with student associations and other interest groups, concludes agreements, creates surveys, maintains email lists and rewards distinguished individuals such as members, people active in organisations, teaching personnel and alumni. Data collected while performing these functions are used to conduct practical arrangements as expediently as possible and to provide services.

General bases of processing the data

EU’s Data Protection Regulation 2016/679, Article 6, paragraph 1, point (b).

Categories of personal data

Data is collected in the Student Union’s informal activities on a case-to-case basis as needed for the activities in question.

• Data source: the person themselves
• Storage period: Documentation created in the Student Union’s administration is permanently archived.
• Possible recipients of data: People organising the events and activities in question, necessary administrative personnel
• Possible transfer of data to third countries: The data may be stored and transferred to third countries using technical devices if this serves some purpose.

Bases of processing the data and categories of personal data

Ordering the Student Card

General bases of processing the data

EU’s Data Protection Regulation 2016/679, Article 6, paragraph 1, point (a).

Data: Name, email address, Student number, date of birth and picture. The data is transferred to the service provider encrypted.

Organisational data: data on the people in charge of organisations

Basis: EU’s Data Protection Regulation 2016/679, Article 6, paragraph 1, point (b).

Data: Name, email address and phone number of the chair of the organisation’s board or another person in charge of communication. The organisation’s email address and street/postal address are also collected, and these may be the same as the address of the chair or another member of the board. In addition to this, the names and email addresses of vice chairs, members of the board, treasurers and other people involved in the organisation are collected based on voluntary declarations.

EVENT DATA: INVITATION AND PARTICIPANT DATA (FOR TRAINING AND OTHER EVENTS)

Basis: EU’s Data Protection Regulation 2016/679, Article 6, paragraph 1, point (b); in the case of allergy information, EU’s Data Protection Regulation 2016/679, Article 9, paragraph 2, point (a).

Data: Name, phone number, email address, possible organisation the person is representing, title, position in the association, special diets, allergies, name of companion and, if needed, payment details.

DATA ON COOPERATION PARTNERS / CONTRACT PARTNERS

Basis: EU’s Data Protection Regulation 2016/679, Article 6, paragraph 1, point (b); in the case of allergy information, EU’s Data Protection Regulation 2016/679, Article 9, paragraph 2, point (a).

Data: contact person’s name, email address and phone number. For events, also special diets, organisation or company, position in the organisation or company, allergies, name of companion and, if needed, payment details.

REWARDING: HONOURS AWARDED BY THE STUDENT UNION

Basis: EU’s Data Protection Regulation 2016/679, Article 6, paragraph 1, point (f): processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Data: data on the person being nominated and the persons nominating them to facilitate contacts with them. Name, email address, phone number, title, field of study and possible support organisation of the person nominated for honours as well as the justifications for the nomination given by the party making the proposal and their contact details. People who have received honours in previous years are recorded in a shared file, which means that the database grows every year.

EMAIL LISTS

Basis: EU’s Data Protection Regulation 2016/679, Article 6, paragraph 1, point (a): the data subject has given consent to the processing of his or her personal data for one or more specific purposes.

Data: email address and name (voluntary).

DATA SUBMITTED THROUGH SURVEYS

Basis: EU’s Data Protection Regulation 2016/679, Article 6, paragraph 1, point (a)

Data: name (on a voluntary basis), phone number and email address.

Right to access, right to rectification, right to erasure, right to restriction, right to object

People participating in the Student Union’s other activities have the right to access the data collected on them and to get any possible mistakes rectified. The erasure of the data and the restriction of the processing of the data cannot be requested while the activity in question is still ongoing without also waiving the right to receive the service, product or right in question. In this case, too, all commitments concerning the person in question that have been created up to that time will remain in place.

Transfer of data to third countries

A system or cloud service that stores the data outside the EU may be used for processing the data. If any data are transferred outside the European Union or the European Economic Area, the transfer requires the country in question to guarantee a sufficient level of data protection or the data controller to provide sufficient guarantees on the protection of the data subjects’ privacy and rights through contractual clauses or other means or the data subject to have unambiguously consented to the transfer.

Planned time limits planned for the erasure of data

In each case, the data are stored for the duration that is necessary to provide the service or activity in question. After this, all data that is not included in the material to be archived are destroyed. Documentation created in the Student Union’s administration is permanently archived.

Contact person

Secretary general of the Student Union of the University of Oulu (paasihteeri@oyy.fi)

Principles of the protection of personal data

With the consent of the data subject, personal data may be collected using any kinds of means. However, any collected data is only processed, transferred and stored using means that are equivalent to the original collection method or more secure than it.