Privacy notice - Customer participation in teaching students studying psychology or logopedics

The University of Tampere and Tampere University of Technology were merged on 1 January 2019 to create the new Tampere University. Together the new Tampere University (Tampere University Foundation sr) and Tampere University of Applied Sciences Ltd comprise Tampere Universities.

Why we process personal data

Students who study psychology or logopedics at Tampere University practice working with customers under supervision in the course of their study.

Lawful basis for processing personal data

Students who study psychology or logopedics at Tampere University practice working with customers in the course of their study.

Lawful basis for processing personal data:

• Data subjects have provided their consent for processing their personal data as set out in the EU’s General Data Protection Regulation (GDPR; article 1, paragraph 1a).
• Processing is necessary to comply with a legal obligation to which the data controller is subject as set out in the EU’s General Data Protection Regulation (GDPR; article 1, paragraph 1c).

Main regulations:

• The EU’s General Data Protection Regulation (GDPR, EU 2016/679)
• Data Protection Act (1050/2018)
• Universities Act (558/2009)

The types of personal data we process

The following types of personal data will be processed while working with customers: contact information of customers and their parent/guardian if customers are minors, matters discussed during customer sessions, patient documents if applicable, video and audio, notes taken during customer sessions and a summary thereof. Assessment forms and the results of evaluations may also be processed in the context of providing services. The records contain health data.

How we collect personal data

Personal data is collected from customers or their parent/guardian and, with the customer’s consent, from private healthcare providers and municipal social and healthcare services.

How we process your personal data

Your personal data stored in our information system will only be processed for the purposes for which the data were initially collected. Data will be processed by students attending a given course and their supervisors. All personal data will be stored in compliance wth data protection requirements.

How long we retain your personal data

Data that is recorded during individual customer sessions will be retained for the duration of the customer relationship.

Students who study logopedics write a plan, feedback report and a final report relating to their work with customers. These written works will not include information that could be used to identify customers. The written works will be retained for six months after the course ends. The contact information of customers who participated in the course will be retained until the next practice period begins but in no event longer than one year.

Data about customers will be securely destroyed immediately after the customer relationship ends. Reports drawn up by psychology students will be retained for six months after the end of the course during which such reports are created.

Who we may share your data with

Personal data that is processed in the course of providing the services described herein is not shared with any third parties.

Transfer of personal data outside of the EU/EEA

Personal data will not be transferred outside of the EU/EEA.

How we protect personal data

We process all personal data securely and in compliance with legal requirements. We have carefully assessed the potential risks associated with our processing activities and taken the necessary measures to control the risks.

Notes taken during customer sessions will be stored in a locked room for the duration of the customer relationship. All materials will be kept strictly confidential.

Rights of data subjects

Right of access (GDPR, Article 15)

You have the right to know what personal data we process and hold about you.

Right to rectification (Article 16)

You have the right to have any incorrect, inaccurate or incomplete personal details that we hold about you revised or supplemented without undue delay. You are also entitled to have any unnecessary personal data erased from our records.

Right to be forgotten (Article 17)

In certain circumstances, you have the right to have your personal data erased from our records. The right to erasure does not apply, if the processing is necessary for us to comply with our legal obligations or perform tasks carried out in the exercise of official authority.

Right to restrict processing (Article 18)

In certain circumstances, you have the right to request us to restrict processing your personal data until the accuracy of your data, or the lawful basis for processing your data, has been appropriately reviewed and potentially revised or supplemented.

Right to data portability (Article 20)

You have the right to obtain a copy of the personal data that you have submitted to the University in a commonly used, machine-readable format and transfer the data to another data controller. This right applies to situations where data is processed automatically on the basis of consent or contract.

This means that the right to data portability does not apply to data processing that is necessary for the performance of a task carried out in the public interest or to fulfil legal obligations imposed on the data controller. Consequently, this right does not generally apply to the University’s personal data registers.

Right to object (Article 21)

You may at any time object to the processing of your personal data for special personal reasons, if the basis for processing is a task carried out in the public interest, the exercise of official authority, or the University’s legitimate interests. After receiving such a request, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for processing your data.

Right to lodge a complaint with a supervisory authority (Article 77)

You have the right to lodge a complaint with a supervisory authority, if you consider that the processing of your personal data violates the provisions of the GDPR (2016/679). In addition, you may follow other administrative procedures to appeal against a decision made by a supervisory authority or seek a judicial remedy.

Office of the Data Protection Ombudsman

Street address: Lintulahdenkuja 4
Postal address: PO Box 800, FI-00531 Helsinki, Finland
Email: tietosuoja [at] om.fi
Switchboard: +358 2956 66700

Questions about personal data

If the personal data we hold about you is incorrect, please request a correction by contacting Education Specialist Helena Siipo at helena.siipo [at] tuni.fi.

Please deliver all subject access requests to the data protection officer of Tampere Universities  (by email at dpo [at] tuni.fi or by post to the following address: Data Protection Officer, Tampere University, FI-33014, Tampere, Finland).

This privacy notice was updated on 1 November 2021.