Data protection notice

The personal data used by the Student Union are divided in the following groups:

• Student data from the student register
• Information collected in connection with the organisation of the Student Union administration: Student Union Council, other positions of trust, student representative in the administration and staff
• Other activities and services of the Student Union

The activities of the Student Union comply with the Act on the Openness of Government Activities (621/1999); documents produced or received by the Student Union are public unless a specific non-disclosure basis applies. The publicity of documents is provided in the said Act.

Cookies on our website

When you visit our web service, cookies, i.e. small text files, may be saved on your device.

If needed, such as when logging in or filling a form, the website sets technical cookies that are necessary for the functioning of the website in those situations.

We also use cookies to monitor visitors with the help of Piwik Pro. With the help of the service, we can find out the ways in which the visitors use the website and to improve the contents and user experience of the website. You can opt out of these cookies if you want to.

Our website also stores your IP address in the site's log files whenever you log in to the site or fill out forms on the site (including the contact form). Information about the IP address is stored in the site's Log data for one month.

 

Student data from the student register

Purpose of the processing of data

The Student Union of the University of Turku is a public corporation provided in the Universities Act, and all students completing a basic degree in the University of Turku are members thereof. The Student Union may also admit other university students as its members. The University maintains a student register, which serves under the above-mentioned principles also as a member register of the Student Union. The Student Union uses the student register to control the data of its members through a technological connection separately agreed with the University. The data is used in matters related to Student Union membership for purposes of controlling membership and communication. The purpose is to fulfil legal obligations and the effectiveness of services.

Basis on which we use information

Data usage is based on EU Data Protection Regulation (2016/679) or provisions of national legislation applied in a certain matter as well as on the agreement between the Student Union and the University of Turku on data disclosure and usage.

• payment of the membership fee: Universities Act (558/2009) Section 46
• controlling the eligibility for elections in Student Union Council elections and during the Student Union Council terms for those elected: legal obligation: EU Regulation 2016/679, Article 6(1c), Universities Act (558/2009) Section 46(6), Universities Decree (770/2009) Section 4
• consent: EU Regulation 2016/679, Article 6(1a)
• in order to enter members in the election list of Student Union Council elections (right to vote): legal obligation: EU Regulation 2016/679, Article 6(1c), Universities Act (558/2009) Section 46(6), Universities Decree (770/2009) Section 4
• controlling the eligibility to represent students in an administration organ of the University when elected and during administration term: use of public authority: EU Regulation 2016/679, Article 6(1e) legal obligation: Article 6(1c), Universities Act (558/2009) Section 46(2)
• in order to ensure the effectiveness of services when students are sent, if necessary, the following items by mail: student cards, Turku Student Newspaper, marks of honour, badges, certificates on employment contracts or positions of trust: consent: EU Regulation 2016/679, Article 6(1a), legal obligation: Employment Contracts Act (55/2001) Chapter 6, Section 7, legitimate interest

Contact person

Secretary General of the Student Union (tyy-paasihteeri@utu.fi)

Categories of personal data

Through the student register, the Student Union uses the following data: name, address, date of birth, student number, phone number, utu id, membership of the Student Union, degree entitlements

• Origin of data: Student register maintained by the University, data provided by the student
• Retention time: The Student Union does not store data, it only uses them.
• Data is used by functionaries of the Student Union.

Right of access, right to rectification, right to erasure, right to restriction, right to object

All requests related to rectification or erasure of rights have to be addressed to the University of Turku. A member of the Student Union is not entitled to demand restrictions in the disclosure of their data to the Student Union.

Right to complain to the surveillance authority

Data Protections Officer of UTU: dpo@utu.fi

Data Protection Ombudsman of Finland: https://tietosuoja.fi/en/notification-to-the-data-protection-ombudsman

Principles for the protection of personal data

The Student Union does not primarily store data, it only uses them. The usage is done through a protected connection with the student register of the University. If necessary, the data may be stored in order to fulfil legal obligations. Data is used, stored and transferred only with the technological data transfer tools of the University.

Information collected in connection with the organisation of the Student Union administration

 

1. Student Union Council

 

Purpose of the processing of data

The Student Union Council holds the highest decision-making authority in the Student Union. Data on a person standing as a candidate for the Student Union Council is utilised in order to organise elections open to all members of the Student Union. On the basis of the elections, the Student Union Council including deputy members is formed. Data concerning the elected Student Union Council is used to organise the activities of the Student Union Council and its groups. The gender division of the participants to the Student Union Council meetings is collected in statistics.

Basis on which we use information

Data Protection Regulation Article 6(1e). Act on the Protection of Privacy, Section 41(1). Universities Act Section 46(6) and Universities Decree Section 4. For eventual political opinion of a candidate or Student Union Council Member, Data Protection Regulation Article 9(2e).

Contact person

Secretary General of the Student Union tyy-paasihteeri@utu.fi.

Categories of personal data

Name, electoral coalition, date of birth, gender, student number, faculty, address, telephone number, email address (utu id). The member list of the Student Union Council includes information on the election results by candidates and electoral coalitions. The list also includes preventions announced by the Student Union Council members from participating in Council meetings in a certain period.

Groups receiving personal data

Names, electoral coalitions and faculties of those standing as a candidate for the Student Union Council are published at tyy.fi Their contact details can only be accessed by those participating in the organisation of elections. The list of members of the Student Union Council is published at tyy.fi and the meetings of the Student Union Council are streamed online available for all. Data on Student Union Council members is disclosed for the use of Student Union Council groups. The Act on the Openness of Government Activities is complied with in the activities of the Student Union Council.

Data transfer to third countries

If data is transferred to third countries, it is announced while the data is collected. A system or cloud service that stores data outside the EU can be used for the processing of data. A transfer of data outside the European Union or European Economic Area may take place where the country in question ensures an adequate level of protection or if the controller or processor has provided appropriate safeguards through contractual clauses or otherwise or the data subject has explicitly consented to the proposed transfer. Transfer of data to the United States is based in accordance with the Article 45 of the Data Protection Regulation on a Commission decision on adequate level of protection and so-called Privacy Shield agreement.

Planned time to erase the data

The data is stored during the term of the Student Union Council. Complete candidate lists, documents of the meetings of the Central Election Committee and documents of the Student Union Council meetings are permanently archived. The online records of the Student Union Council meetings are stored for the openness of decision-making until further notice.

 
2. Other positions of trust

 

Purpose of processing the data:

The self-government of the Student Union Council includes the right to decide on the organisation of internal administration in the manner deemed optimal. When deciding on the composition of organs, personal data is collected to organise the administration.

Basis on which we use information

Data Protection Regulation Article 6(1e). Act on the Protection of Privacy, Section 41(1). Universities Act, Section 46(6). For eventual political opinion of a candidate or Student Union Council Member, Data Protection Regulation Article 9(2e).

Contact person

Secretary General of the Student Union tyy-paasihteeri@utu.fi.

Description of the data subject categories and categories of personal data

Name, Student Union Council group (if applicable), gender, student number, faculty, address, telephone number, email address (utu id), dietary requirements. Fee is paid for some of the positions of trust. In these cases, data necessary for the payment of the fee is collected: bank contact, identity number, tax deduction card.

Categories of recipients of personal data:

Names of the persons acting in positions of trust are visible at tyy.fi. Other data can be used by the persons participating in the administration of the Student Union.

Data transfer to third countries:

If information is transferred to third countries, it is announced while the data is collected. A system or cloud service that stores data outside the EU can be used for the processing of data. A transfer of data outside the European Union or European Economic Area may take place where the country in question ensures an adequate level of protection or if the controller or processor has provided appropriate safeguards through contractual clauses or otherwise or the data subject has explicitly consented to the proposed transfer. Transfer of data to the United States is based in accordance with the Article 45 of the Data Protection Regulation on a Commission decision on adequate level of protection and so-called Privacy Shield agreement.

Planned time to erase the data

The data is stored in each case during the term of the organ, after which the data that is not included in the material to be archived is erased. Documentation created in the administration of the Student Union, including data on the persons participating in the administration, is permanently archived.

 

3. Student representatives in the administration

 

Purpose of processing the data:

Legal obligations of the Student Union include appointing student representatives in the University organs provided in Chapter 3 of the Universities Act. When deciding on student representatives, personal data is collected to appoint these persons and in order to organise communication. Act on Equality between Women and Men is applied in the organs utilising public authority.

Basis on which we use information

Data Protection Regulation Article 6(1e). Act on the Protection of Privacy, Section 41(1). Universities Act, Section 46(2).

Contact person

Secretary General of the Student Union tyy-paasihteeri@utu.fi.

Description of the data subject categories and categories of personal data

Name, gender, student number, degree entitlements, address, telephone number, email address (utu id).

Categories of recipients of personal data:

Names of the persons acting in positions of trust are visible at tyy.fi. Other information can be used by the persons participating in the administration of the Student Union.

Data transfer into third countries:

If information is transferred into third countries, it is announced while the data is collected. A system or cloud service that stores data outside the EU can be used for the processing of data. A transfer of data outside the European Union or European Economic Area may take place where the country in question ensures an adequate level of protection or if the controller or processor has provided appropriate safeguards through contractual clauses or otherwise or the data subject has explicitly consented to the proposed transfer. Transfer of data to the United States is based in accordance with the Article 45 of the Data Protection Regulation on a Commission decision on adequate level of protection and so-called Privacy Shield agreement.

Planned time to erase the data

The data is stored in each case during the term of the organ, after which the data that is not included in the material to be archived is erased. Documentation created in the administration of the Student Union, including data on the persons serving as student representatives in administration, is permanently archived.

 

4. TYY Staff

 

Purpose of processing the data:

In order to fulfil the obligations related to employment contracts, personal data is collected and stored on employees.

Basis on which we use information

Legal obligations related to employment contracts. Data Protection Regulation Article 6(1b, c). For special groups of personal data, Article 9(2b).

Contact person

Secretary General of the Student Union tyy-paasihteeri@utu.fi.

Description of the data subject categories and categories of personal data

Name, identity number, address, email, telephone number, membership in a trade union, dietary requirements, sick leaves, back contact, tax deduction card.

Categories of recipients of personal data:

Names and pictures of the employees are visible at tyy.fi for the purposes of open administration. Other data can be used by the representatives of the employer and the financial administration.

Data transfer to third countries:

If information is transferred to third countries, it is announced while the data is collected. A system or cloud service that stores data outside the EU can be used for the processing of data. A transfer of data outside the European Union or European Economic Area may take place where the country in question ensures an adequate level of protection or if the controller or processor has provided appropriate safeguards through contractual clauses or otherwise or the data subject has explicitly consented to the proposed transfer. Transfer of data to the United States is based in accordance with the Article 45 of the Data Protection Regulation on Commission decision on adequate level or protection and so-called Privacy Shield agreement.

Planned time to erase the data

The data is stored for the duration set in law, after which the data that is not included in the material to be archived is erased. A record on the employees of the Student Union is stored in the archived material.

 

Other activities and services of the Student Union

 

Purpose of the processing of data

The Student Union organises events and other informal activities, rents premises and items and provides counselling, holds contact with student organisations and its alumni, concludes agreements, drafts surveys, maintains mailing lists and rewards successful students and teaching staff. Data collected in connection with these functions is used for the purposeful realisation of practical arrangements and provision of services.

Basis for the processing of data in summary

Consent: EU Regulation 2016/679, Art 6(1 a)

Agreement: EU Regulation 2016/679, Art 6(1 b)

Legitimate interest of the Student Union: EU Regulation 2016/679, Art 6(1 f)

Categories of personal data

Informal activities of the Student Union collect data case-specifically if necessary for the activities.

• Origin of data: From the persons themselves
• Retention time: Until the event or activity ends or e.g. until the confirmation of the payment of an eventual participant.
• Eventual recipients: Actors organising the event, necessary administrative staff
• Eventual data transfer into third countries: Data can be stored or transferred into third countries through a technological tool if purposeful.
• Publicity or concealment: Data collected by the Student Union are public unless specific non-disclosure basis applies.

Basis for the processing and categories of personal data

Organisation data: data on persons responsible in organisations

Basis: Article 6(1k d, e)

Data: name, email address and telephone number of the Chair of the organisation's Board. In addition, the email address and address of the organisation is collected, which may be equivalent to those of the Chair or other member of the Board. Furthermore, name and email of Vice-Chair, Treasurer, Communications Officer, persons responsible for promotion of student interests, academic affairs, sports, culture, journals and events. The IP address of the sender is simultaneously stored.

Event data: participant data (on training and other cost-free events. For paid events, see the list below on agreement partners)

Basis: Article 6(1k(a)), for allergy information, Article 9(2k(a))

Data: in addition to name, e.g. telephone number, eventual organisation, dietary requirements; name, email, subject-specific organisation, allergies and discipline.

Data on cooperation partners/agreement partners: both processing activities and separate borrowing activities, their cooperation partners

Basis: Article 6(1k(b)), for allergy information, Article 9(2k(a))

Data: name, email address and telephone number of the contact person. For events, also dietary requirements, organisation and allergies, identity number in some cases.

Data received through the contact form

Basis: Article 6(1k(a))

Data: name, email address and reason for contact. The same applies to the feedback form of the Legal Aid Committee, asking three separate questions for feedback on the activities of the Legal Aid Committee. All online forms also store the IP address of the sender.

Awards: Teacher and course of the year, super tutor, marks of honour of the Student Union

Basis: Article 6(1k(e))

Data: teacher or course (and the person responsible) proposed and data on the proposers in order to contact them. Names and email addresses for persons proposed to receive a mark of honour and justifications of the proposer for a mark of honour. Persons awarded in previous years are recorded in a joint file, and the "database" extends every year.

Alumni register

Basis: Article 6(1k(a))

Data: Name, email address, prior tasks in the Student Union.

Mailing lists

Basis: Article 6(1k(a))

Data: email address and name (it is not obligatory to provide name, which is stated in the form). In addition, a password is created, and language is chosen.

Data provided in surveys

Basis: Article 6(1k(a))

Data: name (voluntarily), telephone number and email address.

Right of access, right to rectification, right to erasure, right to restriction, right to object

A person participating in other activities of the Student Union is entitled to receive the collected data and correct any eventual errors. Data cannot be demanded to be erased or their processing restricted as long as the activities last without the person giving up the right to receive the service, product or right in question. In this case, too, all commitments created by the person up to the moment in question remain valid.

Data transfer to third countries

If information is transferred to third countries, it is announced while the data is collected. A system or cloud service that stores data outside the EU can be used for the processing of data. A transfer of data outside the European Union or European Economic Area may take place where the country in question ensures an adequate level of protection or if the controller or processor has provided appropriate safeguards through contractual clauses or otherwise or the data subject has explicitly consented to the proposed transfer. Transfer of data to the United States is based in accordance with the Article 45 of the Data Protection Regulation on a Commission decision on adequate level of protection and so-called Privacy Shield agreement.

Planned time to erase the data

The data is stored in each case as long as it is necessary to conduct the service or activity, after which data that is not included in archived material is erased. Documentation created in the administration of the Student Union is permanently archived.

Right to complain to the surveillance authority

Data Protections Officer of UTU: dpo@utu.fi

Data Protection Ombudsman of Finland: https://tietosuoja.fi/en/notification-to-the-data-protection-ombudsman

Contact person

Secretary General of the Student Union (tyy-paasihteeri@utu.fi)

Principles for the protection of personal data

With the person's consent, personal data can be collected with any tool. Collected data is, however, only processed, transferred and stored in the tools similar or more protected than the original tool.

• Register of the persons joining Tyyali mailing list after TYY tours
• Register of persons from other Student Unions collecting TYY's annual sticker