Oamk Student and Study Register

Oulu University of Applied Sciences Ltd (hereafter “Oamk”)

Visiting address
Yliopistokatu 9
FI-90570 Oulu

Postal address
PO Box 222, FI-90101 Oulu

Business ID
2509747–8

Phone
+358 20 611 0200

Oamk’s operations require the processing of students’ personal data. Therefore, data protection must be considered in all operations, and personal data is processed within the framework of legislation and agreements.

Oamk processes students’ personal data in order to carry out its tasks laid down in the Universities of Applied Sciences Act. Personal data are processed to enable studies and to maintain user authorisations and data security.

Oamk is also responsible for data protection when the processing of personal data has been acquired as a service from an external supplier.

The data subject has the right to obtain confirmation from the controller as to whether their personal data are being processed. The data subject always has the right to request from the controller access to and copies of their personal data, as well as the right to request rectification or erasure of such data or restriction of processing and to object to processing. As a rule, this is handled by enabling students to update their contact information directly in the register. If the data subject does not have access to the register in which they wish to review their data, they may submit a request for review or rectification to Oamk.

In accordance with the General Data Protection Regulation, the controller must respond to a request for exercising the data subject’s rights within one month after receiving the request.

The right to erasure does not extend to personal data that the University of Applied Sciences processes on the basis of a statutory task or in the public interest, or for which the University of Applied Sciences has another retention obligation.

At Oamk, the use of personal data is based on legislation.

Your personal data are processed:

• To maintain personal and contact details
• To implement the right to study and in applications and maintenance
• To manage course and exam enrolments
• To provide teaching and exams
• To organise entrance and proficiency examinations
• To manage completed courses degrees
• In connection with student counselling and guidance
• To issue certificates and extracts of studies as well as diplomas
• In applications related to the right to study, including accreditation of prior learning or notification of an extension to the right to study
• For statistics
• The development of teaching and student selection
• To ensure the safety of students and other members of the community, as well as the physical safety and data security of the study environment
• For the customer register of library services

In addition, Oamk may process personal data for historical or scientific research purposes. In accordance with the transfer permissions you have granted, your personal data may be disclosed for the student card, as well as for recruitment purposes related to studies or for other specific purposes.

Oamk’s right to process students’ personal data as a data controller is based on

• The performance of a task carried out in the public interest or in the exercise of official authority
   (Article 6(1)(e) of the EU General Data Protection Regulation) 
• Compliance with a legal obligation
  (Article 6(1)(c) of the EU General Data Protection Regulation, Act on Universities of Applied Sciences (932/2014), Government Decree on Universities of Applied Sciences (1129/2014), Act on the National Registers of Education Records, Qualifications and Degrees (884/2017).  
• In certain cases, a contract or consent
  (Article 6(1)(a) and (b) of the EU Data Protection Regulation (2016/679))
• Oamk has the right to process special categories of personal data as a controller when the processing is necessary for reasons of substantial public interest (Article 9(2)(g) EU General Data Protection Regulation) or with the explicit consent of the data subject (Article 9(2)(a) EU General Data Protection Regulation).

The data are processed in accordance with the Act on the Openness of Government Activities (621/1999) and data protection legislation. The data are partly confidential under the Act on the Openness of Government Activities.

The following personal data are stored in the student and study register:

• First names, nickname, last name, former last name, national learner ID, home university, student number, personal identity code, date of birth, gender, contact information (postal address, phone number, email address)
• Username
• Citizenship
• Native language
• Language of transaction
• Language of basic education
• Home municipality
• Municipality of residence
• Country of residence
• Passport number of foreign student

• Education classification
• Degree programme
• Orientation options
• Group
• Form of education
• Place of teaching
• Language of instruction
• Type of study
• Degree
• Degree title
• Scope to be completed
• Required scope
• Educational background
• Information about attendance, graduation and termination
• Period of study right
• Maximum terms
• Terms used
• Certificate entries and qualifications
• Financial information
• Organisation unit
• Additional information related to the right to study and role
• Permissions to disclose data
• Any information concerning cheating and its processing

• Student’s personal data (first names, nickname, last name, personal identity code, learner number)
• Address details
• Native language and language of transaction
• Citizenship
• Educational background
• Information related to the option available for application and education
• Enrolment and payment details
• Information related to the permission to publish student admissions results

• Studies (study modules and courses)
• Organisation of studies
• Personal study plan (psp) and related information
• International study and training periods

• Completed studies
• Assessment of studies and exams
• Assessors of studies and exams
• Dates of completion
• Scopes completed
• Progress in studies
• Completion status

• Details about the archiving of the information described above

• Communication between the student and the student counsellor, and/or teacher concerning studies by email or in the OMA/Peppi system

• In view of university applications and special arrangements during student admissions, the applicant can disclose information about their health or functional capacity.
• Information provided by the applicant about any health issues that must be taken into account in student admissions or the organisation of the entrance examination can be recorded in the student register.

• Students in health and social care degree programmes, who have the opportunity to complete their practical training period among children and young people, are requested, based on SORA legislation, to visit Oamk’s study and applicant services to present a criminal record extract stating that they do not have a criminal history that would prevent them from completing a training period with children and adolescents. Only information indicating that the person has not submitted the requested criminal record extract is stored in Oamk’s student and study register. No actual criminal and/or conviction information is stored in Oamk’s student and study register.

As a rule, the personal data contained in Oamk’s student and study register is not transferred outside the EU or EEA or to international organisations.

Personal data contained in the personal data register may be transferred outside the EU or the EEA for the purpose of carrying out IT services required for work or the completion of studies, based on case-by-case evaluation.

As a rule, Oamk does not disclose data outside the EU/EEA. However, in cases where this is necessary, the international transfer of personal data from the Oamk personal data register to countries outside the EU/EEA is primarily secured by using the safeguards laid down in Article 46, Chapter V, of the EU General Data Protection Regulation (GDPR), that is, standard contractual clauses. Standard contractual clauses will be included as part of the personal data processing agreement drawn up with the ICT service provider. Information about any transfers is provided in the privacy policies of individual systems.

Only the necessary data are transferred and the transfer is made in accordance with and within the limits set by data protection legislation. The security and data protection of the transfer is always agreed separately.

The storage period of personal data collected in Oamk’s student and study register is based on the regulations and decisions of the National Archives, the Archives Act (831/1994), the Act on the National Registers of Education Records, Qualifications and Degrees (884/2017), and Oamk’s information management plan. Some of the data collected in Oamk’s student and study register must be retained for a fixed period of time. Some of the data is subject to permanent storage on the basis of legislation.

Study attainments that have earned credits are stored permanently. They are stored in Oamk’s Peppi information system, from which they are also transferred via VIRTA data transfer to the national VIRTA database for permanent storage. All study attainments that have earned credits are regulated by the Act on the National Registers of Education Records, Qualifications and Degrees.

To a certain extent, the processing of personal data in the register is based on information that the applicant has provided about their health or functional capacity. Health information is the kind of information the student applying to the higher education institution has wanted to make known so it can be taken into account in student admissions. The processing of these data is based on the data subject’s consent, partly on the exercise of official authority and partly on the Non-Discrimination Act. The data are stored for a maximum of four years and are deleted from the register no later than four years after their entry in it. (Processing sensitive information, section 40 of the Universities of Applied Sciences Act, 932/2014).

In accordance with the Universities of Applied Sciences Act, Oamk stores written study attainments (e.g. paper examinations) for six months from the publication of the results. After this, the teachers and assessors destroy the paper versions by using a shredder and/or a data protection container designated for this purpose.

Other data in Oamk’s student and study register and their storage is regulated by an order issued by the National Archives to universities of applied sciences.

Link to the order of the National Archives:

Permanent storage of data in the information systems of universities of applied sciences in exclusively electronic format

Data security also plays an important role in the protection of personal data. Oamk uses appropriate technical, organisational and administrative safety measures to protect the personal data in its possession. Personal data are processed by Oamk’s employees or by personal data processors acting on Oamk’s behalf only in connection with their duties, having appropriately identified themselves.

Oamk’s IT systems and services are protected against unauthorised access in accordance with good industry practice, their functioning is ensured to the extent required, and their life cycle is managed.

Data security is largely dependent on people’s actions. Everyone is responsible for data security for their part. Taking care of safety requires focusing on the basics and actively following bulletins.

Usernames and passwords must be taken care of so they do not fall into the hands of third parties.

You can find the contact details and forms for reporting any data security issue on the page ict.oulu.fi.

The personal data contained in Oamk’s student and study register is not used for automated decision-making or profiling.