Privacy statement: Student services

Student services privacy statement

• Managing information of applicants to Diak;
• Student information and credit management in Diak’s student management system and other registers;
• Transfer of data from various authorities;
• Receiving and maintaining student work;
• Entry and storage of student assessments;
• Agreements related to the student’s progress in their studies;
• Assessment of student work;
• Monitoring of student work;
• Decisions on continuation, restoration or change to the right to study;
• Termination of the right to study;
• Processing of fraudulent conduct by a student;
• Investigation of a student’s irregular situation (since 2018) Managing students’ international mobility;
• Collection of student feedback.

According to Article 6 of the General Data Protection Regulation, data processing is lawful only if, and only to the extent that, at least one of the following conditions is met:

a) The data subject has given their consent.
b) The processing is necessary for implementing an agreement to which the data subject is a party
c) The data processing is necessary for compliance with the statutory obligations of the data controller
d) The data processing is necessary for safeguarding the vital interests of the data subject or some other natural person
e) The data processing is necessary for performance of some duty in the public interest, or the processing is necessary for the data controller‘s exercise of their public power
f) The processing is necessary for fulfilment of the legitimate interests of the data controller or of a third party.

The conditions to be met are a, b, c, e and f.

Personal data to be processed: Personal ID number, email address, telephone, address, photo.

Other information to be processed: information related to student selection tests and study credits.

Periods for which data is stored: According to the archive creation plan (AMS, available on the Diaconia University of Applied Sciences intranet).

Whether sensitive information (race/ethnicity, origin, political opinion, religious or philosophical belief, membership of a trade union, health-related information, sexual orientation or behaviour) is processed. Article 9: Yes.

If yes, is the processing based on consent? Yes and no.

If sensitive information is processed without the data subject’s consent, please indicate the reason for the processing: SORA-related matters. The aim of the SORA regulations (the act on vocational education (531/2017), vocational education act (531/2003) and the Universities Act (558/2009)) is to improve the security of education and subsequent employment, and to enhance the ability of education and training providers to intervene in issues relating to the incapacity of students and safety considerations. In situations of incapacity for study, solutions are arrived at that apply to the student as an individual. SORA-related matters concern the use of public power and decision-making related to the status and situation of the student.

Data systems:

• MyDiak
• Studyinfo.fi
• Oili
• Efecte
• Primus
• Diakle
• Fronter
• Jobiili
• Learning systems (e.g. Diakle) or other institutes of higher education Mobility Online
• Dynasty

Manual registers (paper)

• Manual registers, admission services
• Manual registers, study counselling
• Manual registers, curator services
• Manual registers, student affairs office services
• Manual registers, training results area Manual registers, international mobility services

Electronic registers (e.g. Excel)

• Manual registers, admission services
• Manual registers, study counselling
• Manual registers, curator services
• Manual registers, student affairs office services
• Manual registers, training results area Manual registers, international mobility services

• Sympa
• Oili
• Studyinfo.fi

Is there regular data disclosure? Yes.

If yes, to where / what party is the data disclosed? Transfer of data from various authorities: VIRTA publications information service, Statistics Finland, the Social Insurance Institution of Finland.

Is there transfer of information outside the EU or the European Economic Area? No.

A) Manual material

Is there manual data? Yes.

If yes, how is the material stored and protected? Manual material is stored in accordance with the archive creation plan. The material is stored in locked cabinets on different campuses and is accessible only to the student service staff.

B) Digitally processed data

Is there data in electronic form? Yes.

If yes, how is the material stored and protected? The data will be stored in accordance with Diaconia University of Applied Sciences’ archive plan (AMS). Electronic material is processed based on the user’s rights of access to such systems (see privacy statements).

The data subject has the right to request access to personal data concerning him or her, the right to request correction or erasure of such data and the right to request restriction of the processing of it, the right to oppose processing or it, and the right to transfer from one controller to another.

The data subject has the right to withdraw their consent at any time without this affecting the lawfulness of the processing carried out prior to this withdrawal, if the processing of personal data is based on the consent of the data subject.

Upon request, the data subject may use the Diaconia University of Applied Sciences’ own model form.

The data subject has the right to file a complaint with the Office of the Data Protection Ombudsman.

Profiling is not carried out on the basis of personal data contained in the register.

The purpose of profiling is to follow the student’s academic success and, for example, to prevent interruption of a student’s studies and help them to complete their degree.

If personal data is processed for direct marketing purposes, the data subject has the right at any time to oppose the processing of their personal data for such marketing, including profiling when it is related to such direct marketing.

The data protection officer is the contact person in matters relating to the rights and obligations of the data subjects. The contact details of the data protection officer are given at the beginning of the privacy statement (section 2).