Data privacy notice - e-Forms

This Privacy notice applies to the e-Forms/electronic forms system of the University of Oulu and the information of its users that is collected and processed in the system. University of Oulu implement its legal obligations and tasks electronically using processes in the eForms system.

This notice is an informative document in accordance with the EU's General Data Protection Regulation (EU 679/2016) and supplements the general data privacy notice of the University of Oulu, from which you can read more detailed descriptions listed by group or subject, e.g. from the purposes and legal basis for data processing and transfer of personal data.
Data privacy notice updated on 07.07.2021.

Data controller

University of Oulu is the data controller.

Postal address:

P.O. Box 8000

FI-90014 University of Oulu

Street address:

Pentti Kaiteran katu 1, Linnanmaa

Tel:

+358 294 48 0000

university.of.oulu(at)oulu.fi

Contact information of the responsible unit

ICT Services of the University of Oulu: ict(at)oulu.fi

Contact information of the Data Protection Officer

University Data Protection Officer: dpo(at)oulu.fi

For what purposes is your personal data used and what is the legal basis for processing?

The purpose of processing personal data is to carry out obligations and tasks that belong to the University using electronic forms system. Such tasks are to pay salaries, fees, grants and travel or other expenses, to plan, maintain, monitor, and keep statistics of personnel, salaries, and employment related matters, to manage the legal obligations of the employer, and to implement human resources customer services. The tasks performed by electronic forms depends on the available forms.

Students' personal data is processed so that the university can carry out its teaching tasks, such as organizing teaching, collecting, and maintaining study and degree information, and providing student services.

The following information is collected about the personnel:

• Sap ID (personnel number)
• Personal ID
• Name
• Email address
• Username
• Contract number
• Title
• Unit
• Start of employment contract
• End of employment contract
• Faculty organization code
• Faculty name
• Manager’s name
• Manager’s username
• Manager’s email address

Data collected from other users:

• Name
• email address

In addition, such data is collected that the user adds itself when using eForms.

Origin of personal data (if the data is not received from the registered person

Electronic forms system imports personnel data of staff from other university systems. From other users only a name and email address are collected at login. Data is not collected from other sources.

Who has access to your personal data?

Your personal data may only be processed by persons whose work requires it. Access to your personal data is protected with usernames and passwords together with user roles within secure IT network and telecommunications. Data is kept on the university's server.

Transfer of personal data

The University of Oulu transfers your data only to such parties that have legal basis for obtaining the data for purposes defined by law, or to whom the transfer is necessary to carry out tasks related to employment or employer obligations, or to whom the data transfer is based on a given consent by the data subject.

How long will your personal data be processed, and will the data be archived?

Retention time of personal data handled by electronic forms is based on legislations and guidelines of the University of Oulu. When legislation and guidelines do not determine the retention time, data will be preserved for as long it is needed for the information in question. The archiving of data is implemented according to the retention schedule of the University of Oulu.

What kind of rights do you have as a data subject?

You have the following rights as a data subject:

• Right to access your data
• Right to have inaccurate data corrected (make sure to keep your contact information up to date)
• In certain situations, the right to have data erased ("right to be forgotten")
• In certain situations, the right to restriction of processing
• In certain situations, the right to object to processing
• In certain situations, the right to have data transferred from one system to another if the processing is based on consent or agreement and is performed automatically

Please note that the applicability and scope of your rights will be specified on a case-by-case basis in accordance with the EU General Data Protection Regulation. Depending on e.g., the grounds for processing the data, you do not have the above-mentioned rights in all cases.

How can you exercise your rights?

If you have any questions about your rights, you can communicate with the University's Data Privacy Officer or the contact person of the responsible unit.

If you want to use the above-mentioned rights, please send a request to the University’s registry office: kirjaamo(at)oulu. fi, where you will get the necessary additional instructions.

Right of appeal to the supervisory authority

In addition to the rights mentioned above, you have the right to file a complaint about the processing of your personal data with the Office of the Data Protection Ombudsman as the supervisory authority. The contact details and opening hours can be found on the website of the Data Protection Ombudsman.

General description of technical and organizational safeguards

The University as a Data Controller uses appropriate technical and organizational measures to protect personal data from unauthorized or unlawful processing, as well as the damage or loss of personal data.