Privacy statement: Financial administration
Data controller
Diaconia University of Applied Sciences Ltd
PO Box 12, 00511
Contact person for matters related to data protection
Kyläsaarenkuja 2, 00580 Helsinki
tietosuojavastaava@diak.fi
Name of privacy statement
Financial administration services privacy statement
Purpose of the processing of personal data
- Handling contact information for Diak staff, students and other customers for the purposes of sales invoicing and debt collection.
- Processing of personal data of Diak staff, students and partners for the purposes of sales payment of travel expenses and other expenses.
- In Diak’s travel portal.
- Working time adjustments, e.g. for projects
Legal basis of processing of personal data
According to Article 6 of the General Data Protection Regulation, data processing is lawful only if, and only to the extent that, at least one of the following conditions is met:
a) The data subject has given their consent
b) The processing is necessary for implementing an agreement to which the data subject is a party
c) The data processing is necessary for compliance with the statutory obligations of the data controller
d) The data processing is necessary for safeguarding the vital interests of the data subject or some other natural person
e) The data processing is necessary for performance of some duty in the public interest, or the processing is necessary for the data controller ‘s exercise of their public power
f) The processing is necessary for fulfilment of the legitimate interests of the data controller or of a third party
The conditions to be met are a, c and f.
Personal data groups to be processed and storage periods for personal data
Personal data to be processed: Personal ID number, Email address, Telephone, Address, Name
Other data to be processed: Bank account number
Periods for which data is stored: The data is stored in different systems (Raindance, Payment Services, M2) in accordance with the archive creation plan. Information related to reservation of trips is retained on the travel office portal for the duration of the employment relationship.
Whether sensitive information (race/ethnicity, origin, political opinion, religious or philosophical belief, membership of a trade union, health-related information, sexual orientation or behaviour) is processed. Article 9: No
Information systems used and system-specific privacy statements
- Raindance
- M2
- Maksuliikenne payment transactions service
- Travel office portal
- InvoiceReady
- Network disc
Regular sources of information
- Information obtained from the data subject themselves
- Sympa
Regular data disclosure
- Tax administration
- Debt collection agency
Transfer of information outside the EU or the European Economic Area
The data is not transferred outside the EU or the European Economic Area.
Principles of protecting registers
A) Manual material
Is there manual data? Yes.
If yes, how is the material stored and protected?
The material is archived in locked cupboard that are accessible only to the financial department personnel.
Part of the material is stored in locked archive facilities.
B) Digitally processed data
Is there data in electronic form? Yes.
If yes, how is the material stored and protected? The material is stored in the aforementioned systems (section 7) and in the Aili server folders, which can only be accessed by creator of the material and the financial department personnel.
Rights and responsibilities of data subjects
The data subject has the right to request access to personal data concerning him or her, the right to request correction or erasure of such data and the right to request restriction of the processing of it, the right to oppose processing or it, and the right to transfer from one controller to another.
The data subject has the right to withdraw their consent at any time without this affecting the lawfulness of the processing carried out prior to this withdrawal, if the processing of personal data is based on the consent of the data subject.
Upon request, the data subject may use the Diaconia University of Applied Sciences’ own model form.
The data subject has the right to file a complaint with the Office of the Data Protection Ombudsman.
Profiling is not carried out on the basis of personal data contained in the register.
If personal data is processed for direct marketing purposes, the data subject has the right at any time to oppose the processing of their personal data for such marketing, including profiling when it is related to such direct marketing.
The data protection officer is the contact person in matters relating to the rights and obligations of the data subjects. The contact details of the data protection officer are given at the beginning of the privacy statement.