Data privacy notice – Proposals for external members of the University Board of Directors

This privacy notice concerns to proposals collected by the University Collegium of the University of Oulu for external members of the University Board of Directors. The privacy notice describes the data protection practices that apply to the personal data collected and processed in connection with the submitted proposals.

Data privacy notice updated 09.09.2026

Data controller

University of Oulu
Pentti Kaiteran katu 1, Linnanmaa
P.O. Box 8000
90014 University of Oulu
Phone +358 294 48 0000

University Data Protection Officer:

dpo(at)oulu.fi

Purpose of processing personal data and legal basis for processing personal data

Purpose of processing personal data

The task of the University Collegium is to decide the number of members of the University Board of Directors, the length of the term of office of the board and its members, and select the members referred to in section 15, subsection 4 of the University Act (Section 22 of the University Act).

Proposals for external members of the University Board of Directors are collected from the university's students and staff. Proposers submit their proposals anonymously. The Collegium will not process proposals that contain special categories of personal data, also known as sensitive personal data.

Legal basis for data processing

The controller's legal obligation

The task of the University Collegium is to decide the number of members of the University Board of Directors, the length of the term of office of the board and its members, and select the members referred to in section 15, subsection 4 of the University Act (Section 22 of the University Act).

Personal data to be processed

The name of the proposed person.
Publicly available information about the merits of the proposed person.

Data source and description of the data source (if the personal data has not been obtained from the data subject)

Information is collected from the following sources:

The data are collected from those submitting proposals via an electronic form.

Recipients or categories of recipients of personal data

Registration details are collected on a form that is typically provided by an external service provider.
The data is processed by the University Collegium members.

Information of transfers of personal data to third countries or international organisations

Personal data is not passed on to third parties or outside the European Union or the European Economic Area.

Information of data storage time

The personal data collected will be erased when processing is no longer necessary or once any necessary communication following the decision-making process has been completed.

Data subject rights

You have the following rights as a data subject:

  • Right to access your data
  • Right to have inaccurate data corrected (make sure to keep your contact information up to date)
  • In certain situations, the right to have data erased ("right to be forgotten")
  • In certain situations, the right to restriction of processing
  • In certain situations, the right to object to processing
  • In certain situations, the right to have data transferred from one system to another if the processing is based on consent or agreement and is performed automatically.

Please note that the applicability and scope of your above-mentioned rights will be specified on a case-by-case basis in accordance with the EU General Data Protection Regulation, depending on e.g. the grounds for processing the data, and that you do not have the above-mentioned rights in all cases.

How can you exercise your rights?

If you have questions concerning your rights, you can contact the data protection officer or unit’s contact person.

If you wish to exercise your rights mentioned above, please send your request to: kirjaamo(at)oulu.fi.

You will get a reply with necessary instructions.

Right of appeal to the supervisory authority

In addition to the rights mentioned above, you have the right to file a complaint about the processing of your personal data with the Office of the Data Protection Ombudsman as the supervisory authority.

The contact details and opening hours can be found on the website of the Data Protection Ombudsman.

Automated decision-making or processing the personal data for other purposes

No

General description of the technical and organisational protection measures

The University as the Data Controller uses appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against damage or loss of personal data.