Data protection notice

We handle only necessary data.

The data processed by the Student Union of the University of Oulu (the Student Union) is divided into the following categories:

  • Student data from the student register
  • The data collected when the administration of the Student Union of the University of Oulu is organized: the Student Council, other positions of trust, student representatives in administration and employees
  • The Student Union’s other activities and services

The Student Union’s activities follow the Act on the Publicity of Official Documents (Laki viranomaisten toiminnan julkisuudesta (621/1999)). All documents that the Student Union creates and receives are public with the exception of confidential documents. The right of access to public documents is provided in the aforementioned Act.

Student data from the student register

As provided in the Universities Act (Yliopistolaki (558/2009)), the Student Union is a public corporation, and it consists of the students of the University of Oulu. The Student Union can also admit students from other universities as members. The criteria for admitting students from other universities as members has been decided in the Student Union’s Executive Board meeting 8/2017. The University of Oulu maintains a student register, which is also used as the Student Union’s membership register. The Student Union accesses the student register to verify its members’ information via technical contact, that is agreed together with the University of Oulu. The data is processed regarding the Student Union membership to verify the member’s student status and for communication purposes. The main purpose is to fulfill statutory obligations and to provide services efficiently. 

The grounds for data processing

The data processing is based on the General Data Protection Regulation (EU) 2016/679 or the applicable regulation of the national legislation as well as the agreement between the University of Oulu and the Student Union on transferring and accessing the data.

  • Payment of the membership fee: Section 46 of the Universities Act (Yliopistolaki (558/2009) 46 §)
  • Verifying the eligibility of candidates in the Student Council election and the Student Council members during their term: statutory obligation: Point (c) of Article 6(1) of Regulation (EU) 2016/679, Section 46(6) of the Universities Act (Yliopistolaki (558/2009) 46.6 §), Section 4 of the Universities Decree (Valtioneuvoston asetus yliopistoista (770/2009) 4 §)
  • Consent: Point (a) of Article 6(1) of Regulation (EU) 2016/679
  • Entering a member into the electoral register of the Student Council election (right to vote): statutory obligation: Point (c) of Article 6(1) of Regulation (EU) 2016/679, Section 46(6) of the Universities Act (Yliopistolaki (558/2009) 46.6 §), Section 4 of the Universities Decree (Valtioneuvoston asetus yliopistoista (770/2009) 4 §)
  • Verifying the eligibility to represent students in the University’s administration bodies during the selection process and the term of office: Point (e) of Article 6(1) of Regulation (EU) 2016/679, statutory obligation: point (c) of Article 6(1) of Regulation (EU) 2016/679, Section 46(2) of the Universities Act (Yliopistolaki (558/2009) 46.2 §)
  • Ensuring efficient services, when the student cards, paper, Oulu Student Magazine, recognitions, cockades, references or certificates of position of trust are mailed to the members if necessary: Point (a) of Article 6(1) of Regulation (EU) 2016/679, statutory obligation: Chapter 6, Section 7 of the Employment Contracts Act (Työsopimuslaki (55/2001) 6:7 §), justified benefit
  • Section 4(1) of the Data Protection Act (Tietosuojalaki (1050/2018) 41.1 §) 

Contact person

Secretary General of Student Union of the University of Oulu (paasihteeri@oyy.fi, +358405231822)

Personal data groups

Through the student register, the Student Union accesses the following data: name, address, date of birth, student number, phone number, student-account, Student Union membership, right to study.

  • Origin of the data: the student register maintained by the University of Oulu, the information provided by the students themselves
  • Storing period: the Student Union does not store the data, only accesses it.
  • The data is accessed by Student Union’s officials.

Rights of access, correction, deletion, restriction and objection

All demands to correct or delete the data are to be addressed to the University of Oulu. A member of the Student Union does not have a right to demand restrictions on transferring their information to the Student Union. 

Right of appeal to the supervising authority

Data protection ombudsman: tietosuoja@om.fi.

Principles of personal data protection

Student Union of the University of Oulu does not store the data, but only has access to it. The data is accessed through a secure connection to the student register of the University of Oulu. If necessary, the data can be stored in order to fulfill statutory obligations.

The data collected when the administration of the Student Union of the University of Oulu is organized

The purpose of data processing

The Student Council has the highest decision-making powers of the Student Union. Information about the candidates for the Student Council election is used in order to organize open elections. The Student Council, including substitute members, is formed according to the election results. The newly chosen Student Council’s information is used for organizing activities of the Student Council and the Council groups.

The grounds for data processing

Point (e) of Article 6(1) of the Regulation (EU) 2016/679. Section 4(1) of the Data Protection Act (Tietosuojalaki (1050/2018) 4.1 § kohta 1). Section 46(6) of the Universities Act (Yliopistolaki (558/2009) 46.6 §) and Section 4 of the Universities Decree (Valtioneuvoston asetus yliopistoista (770/2009) 4 §). Point (e) of Article 9(2) of the Regulation (EU) 2016/679 applies to candidate’s and Student Council member’s possible political views.

Contact person

Secretary General of Student Union of the University of Oulu (paasihteeri@oyy.fi, +358405231822).

Description on groups of registered and personal data groups

Name, electoral alliance, date of birth, student number, faculty, address, phone number, email address (student-account). The list of Student Council members includes information about the election results according to the candidates and electoral alliances. 

Groups that receive personal data

Names, electoral alliances and faculties of all candidates for the Student Council are published at oyy.fi. Those who participate in organizing the elections have access to the candidates’ contact information. The list of Student Council members is published at oyy.fi and Student Council meetings are streamed on the internet for all to see. Council groups have access to the data about Student Council members. The Student Council follows the Act on the Publicity of Official Documents (Laki viranomaisten toiminnan julkisuudesta (621/1999)).

Data transfer to third countries

A system or a cloud service that keeps the information outside of EU can be used for data managing purposes. In case the data is transferred outside the European Union or the European Economic Area, it is required that the country in question guarantees a sufficient level of data protection, or that the registrar gives a guarantee of privacy and data protection with contract clauses or other adequate means, or that the registered has given a clear permission for the data transfer. Data transfer to the United States of America is based on the European Commission Decision on an adequate level of protection (‘Adequacy Decision’) as provided in Article 45 of the General Data Protection Regulation (EU) 2016/679 and on so-called Privacy Shield agreement.

Data storing period

The information is stored during the Student Council’s term of office. Candidate combinations, documents from the central election committee’s meetings and documents from the Student Council meetings are archived permanently. Stream recordings of the Student Council meetings are stored for time being to ensure transparency of the decision-making process.

The purpose of data processing

The Student Union’s self-government includes a right to decide how the internal administration is organized in the best way possible. Personal data is collected to organize administration when new administrative bodies are formed.

The grounds for data processing

Point (e) of Article 6(1) of the Regulation (EU) 2016/679. Section 4(1) of the Data Protection Act (Tietosuojalaki (1050/2018) 4.1 § kohta 1). Point (e) of Article 9(2) of the Regulation (EU) 2016/679 applies to candidate’s and Student Council member’s possible political views.

Contact person

Secretary General of Student Union of the University of Oulu (paasihteeri@oyy.fi, +358405231822).

Description on groups of registered and personal data groups

Name, electoral alliance (if there is one), student number, faculty, address, phone number, email address (student-account), diet. Some positions of trust are paid. In these cases, the information for paying the fee is needed: banking connection, social security number, tax deduction card.

Groups that receive personal data

Names and email addresses of those in positions of trust are available at oyy.fi and halloped.fi. Other information is available for members of Student Union administration.

Data transfer to third countries

A system or a cloud service that keeps the information outside of EU can be used for data managing purposes. In case the data is transferred outside the European Union or the European Economic Area, it is required that the country in question guarantees a sufficient level of data protection, or that the registrar gives a guarantee of privacy and data protection with contract clauses or other adequate means, or that the registered has given a clear permission for the data transfer. Data transfer to the United States of America is based on the European Commission Decision on an adequate level of protection (‘Adequacy Decision’) as provided in Article 45 of the General Data Protection Regulation (EU) and on so-called Privacy Shield agreement.

Data storing period

The information is stored during the body’s term of office. Afterwards the data that is not included in the archived material is destroyed. The documentation (including personal information of those, who took part in the administration) that is created in the Student Union’s administration is archived permanently.

The purpose of data processing

The Student Union’s statutory functions include appointing student representatives in certain administrative bodies of the University of Oulu as provided in the Section 3 of the Universities Act. When making the decision about student representatives, the candidates’ personal data is collected in order to appoint them and to communicate with them. Public administration bodies and bodies exercising public authority are governed by Section 4a of the Act on Equality between Women and Men (Laki naisten ja miesten välisestä tasa-arvosta (609/1986) 4a §).

The grounds for data processing

Point (e) of Article 6(1) of the Regulation (EU) 2016/679. Section 4(1) of the Data Protection Act (Tietosuojalaki (1050/2018) 4.1 § kohta 1). 

Contact person

Secretary General of Student Union of the University of Oulu (paasihteeri@oyy.fi, +358405231822).

Description on groups of registered and personal data groups

Name, student number, rights to study, address, phone number, email address (student-account).

Groups that receive personal data

Names and email addresses of those in positions of trust are available at oyy.fi and halloped.fi. Other information is available for members of Student Union administration.

Data transfer to third countries

A system or a cloud service that keeps the information outside of EU can be used for data managing purposes. In case the data is transferred outside the European Union or the European Economic Area, it is required that the country in question guarantees a sufficient level of data protection, or that the registrar gives a guarantee of privacy and data protection with contract clauses or other adequate means, or that the registered has given a clear permission for the data transfer. Data transfer to the United States of America is based on the European Commission Decision on an adequate level of protection (‘Adequacy Decision’) as provided in Article 45 of the General Data Protection Regulation (EU) and on so-called Privacy Shield agreement.

Data storing period

The information is stored during the body’s term of office. Afterwards the data that is not included in the archived material is destroyed. The documentation (including personal information of student representatives in administration) that is created in the Student Union’s administration is archived permanently.

The purpose of data processing

Employees’ personal data is collected and stored in order to fulfill obligations related to employment. 

The grounds for data processing

The statutory obligations related to employment. Points (b) and (c) of Article 6(1) of the Regulation (EU) 2016/679. Point (b) of Article 9(2) of the Regulation (EU) 2016/679 related to special personal data groups.

Contact person

Secretary General of Student Union of the University of Oulu (paasihteeri@oyy.fi, +358405231822).

Description on groups of registered and personal data groups

Name, social security number, address, email address, phone number, trade union membership (if the membership fee is paid at the same time with the salary), diet, work-hour records, sick leaves, bank contact, tax deduction card.

Groups that receive personal data

The names and photos of the employees are available at oyy.fi to ensure transparency in administration. Other information is available for the employer and financial administration.

Data transfer to third countries

A system or a cloud service that keeps the information outside of EU can be used for data managing purposes. In case the data is transferred outside the European Union or the European Economic Area, it is required that the country in question guarantees a sufficient level of data protection, or that the registrar gives a guarantee of privacy and data protection with contract clauses or other adequate means, or that the registered has given a clear permission for the data transfer. Data transfer to the United States of America is based on the European Commission Decision on an adequate level of protection (‘Adequacy Decision’) as provided in Article 45 of the General Data Protection Regulation (EU) and on so-called Privacy Shield agreement.

Data storing period

The information is stored as long as is defined in the national legislation. Afterwards the data that is not included in the archived material is destroyed. The documentation about Student Union’s current and previous employees is recorded in the archived material.

The purpose of data processing

The Student Union organizes events and other informal activities, rents premises and things, gives guidance, keeps in touch with student societies and alumni, concludes agreements, carries out surveys, maintains email lists and rewards distinguished students and members of faculties. The data collected in these activities is used for practical arrangements and offering services. 

The grounds for data processing

Consent: Point (a) of Article 6(1) of the Regulation (EU) 2016/679. 

Agreement: Point (b) of Article 6(1) of the Regulation (EU) 2016/679. 

Student Union’s justified benefit: Point (f) of Article 6(1) of the Regulation (EU) 2016/679. 

Personal data groups

In the Student Union’s informal activities relevant data for the activity is collected case by case. 

  • Origin of the data: participants themselves.
  • Data storing period: Until the end of the event or activity or, for example, until a possible payment from the participant is confirmed.
  • Possible recipients: Event organizers, necessary administration personnel.
  • Possible data transfers to third countries: The data can be kept in or transferred to third countries with a technical device for appropriateness.
  • Publicity or confidentiality: The data collected by the Student Union is public unless there is a special ground for concealment.

Grounds for data processing and personal data groups

Ordering the student ID cards

Grounds: Point (a) of Article 6(1) of the Regulation (EU) 2016/679. 

Data: name, email address, student number, date of birth and photo. The data is transferred securely to the student card service provider.

Student society information: persons in charge

Grounds: Points (d) and (e) of Article 6(1) of the Regulation (EU) 2016/679. 

Data: name, email address and phone number of student society’s president. Society’s email address and street/mailing address that can be the same as the president’s or other board member’s addresses. In addition, the names and email addresses of the board members are collected. 

Event information: participant information (training and other events that are free of charge. See chapter below about contracting parties for events with a participation fee)

Grounds: Point (a) of Article 6(1) of the Regulation (EU) 2016/679, for allergy information: Point (a) of Article 9(2) of the Regulation (EU) 2016/679. 

Data: name, phone number, email address, possible society, diet, allergies and field of study.

Information about partners and contracting parties, both data handling actions and own renting activities, as well as own partners 

Grounds: Point (b) of Article 6(1) of the Regulation (EU) 2016/679, for allergy information: Point (a) of Article 9(2) of the Regulation (EU) 2016/679. 

Data: contact person’s name, email address and phone number. For events: diet, society or company, position in the society/company and social security number in some occasions.

Rewarding: THE Student Union’s recognitions

Grounds: Point (e) of Article 6(1) of the Regulation (EU) 2016/679.

Data: information of the nominee and the proposer is collected in order to contact them if necessary. The reward nominee’s name, email address, phone number, field of study, possible society as well as the proposer’s arguments for the reward and the proposer’s information. Names of previously rewarded are recorded in a single document, so the database expands annually. 

Alumni register

Grounds: Point (a) of Article 6(1) of the Regulation (EU) 2016/679.

Data: name, email address, year of activity and previous tasks in the Student Council. 

Email lists 

Grounds: Point (a) of Article 6(1) of the Regulation (EU) 2016/679.

Data: email address and name (it is not compulsory to provide a name, and this is noted in the form as well). In addition, the subscriber creates a password and selects the language. 

Information gathered from surveys 

Grounds: Point (a) of Article 6(1) of the Regulation (EU) 2016/679.

Data: name (voluntarily), phone number and email address.

Rights of access, correction, deletion, restriction and objection

The participant in the Student Union’s other activities has a right to request the data of themselves and correct possible mistakes in it. The data cannot be deleted or restricted on demand for the duration of the activity unless the person is willing to abandon their rights to access the service, product or privilege in question. Even in that case, all the person’s commitments remain until that point.

Data transfer to third countries

A system or a cloud service that keeps the information outside of EU can be used for data managing purposes. In case the data is transferred outside the European Union or the European Economic Area, it is required that the country in question guarantees a sufficient level of data protection, or that the registrar gives a guarantee of privacy and data protection with contract clauses or other adequate means, or that the registered has given a clear permission for the data transfer. Data transfer to the United States of America is based on the European Commission Decision on an adequate level of protection (‘Adequacy Decision’) as provided in Article 45 of the General Data Protection Regulation (EU) and on so-called Privacy Shield agreement.

Data storing period

The data is stored as long as is necessary in order to perform the service or activity. Afterwards the data that is not included in the archived material is destroyed. The documentation that is created in the Student Union’s administration is archived permanently. 

Contact person

Secretary General of Student Union of the University of Oulu (paasihteeri@oyy.fi, +358405231822).

Principles of data protection

Personal data can be collected with person’s consent by whichever device. However, the collected data is managed, transferred and stored only tools that are as secure as or even more secure than the original collection method.

Skip to content