Skip to main content

Privacy notice - Students and student services

 

The University of Tampere and Tampere University of Technology were merged on 1 January 2019 to create the new Tampere University. Together the new Tampere University (Tampere University Foundation sr) and Tampere University of Applied Sciences Ltd comprise Tampere Universities.

Why we process personal data

We may process your personal data for the purpose of delivering and administering education in order to:  

  • maintain students’ personal information and contact information
  • maintain information about rights to study
  • manage information about individuals who have enrolled for courses and exams
  • manage teaching activities, internships and exams
  • assess student performance and record grades
  • supervise and examine theses
  • offer academic advising services and student guidance, and provide and develop services to support learning
  • manage relationships with customers who use learning and well-being support services
  • manage academic records and degree information, compile related statistics and issue documents, transcripts and degree certificates
  • communicate information about studies and learning
  • compile statistics
  • develop teaching
  • collect and analyse data about learning
  • monitor and process possible tuition fees
  • maintain the physical safety of students and other members of the university community and protect their data
  • appoint members to the administrative bodies of Tampere Universities

In addition, the University may process personal data:

  • for research purposes
  • for study-related marketing purposes or other special purposes

With your consent, the University may use your personal data for teaching purposes.

Lawful basis for processing personal data

We primarily process students’ personal data based on legislation that applies to Tampere Universities and the associations operating within Tampere University and Tampere University of Applied Sciences and, under some special circumstances, based on students’ consent. Tampere Universities are authorised to process students’ personal data for the following purposes:

  • Legal obligation of the data controller (GDPR, article 6, paragraph 1c)
  • Public interest or the exercise of official authority (GDPR, article 6, paragraph 1e)
  • In some cases, consent or contract (GDPR, article 6, paragraphs 1a and 1b)

The University has the right to process special category data when such processing is necessary for the purpose of public interest (GDPR, article 9, paragraph 1g) or in case the data subject has provided his or her explicit consent (GDPR, article 9, paragraph 1a).

Main regulations:

  • The EU’s General Data Protection Regulation (GDPR, EU 2016/679)
  • Data Protection Act (1050/2018) Universities Act (558/2009)
  • Universities of Applied Sciences Act (932/2014)
  • Government Decree on University Degrees (794/2004)
  • Act on National Study and Degree Register (884/2017)
  • Act on the Openness of Government Activities (621/1999)
  • Regulations of Tampere University
  • Tampere University’s Degree Regulations and Legal Protection Regulations
  • Decisions issued by the University or the President regarding teaching and learning
  • Permanent regulations issued by the faculties at Tampere University

The types of personal data we process

We process the following types of personal data:

Basic information:

  • personally identifiable information (name, personal identity number, student number, national learner ID, username)
  • background information (admission results, gender, nationality, language)
  • contact information (email address, phone number, postal address).

Information about studies:

  • right to study for a degree or parts thereof
  • completed degrees
  • semester registration
  • membership in the student union or its associations
  • academic records (including theses, exam answers and other assignments counted towards your degree and the awarded grades and marks)
  • thesis publication records
  • exam and course enrolment, information about class attendance (including possible special arrangements of which students inform teachers when they enrol for courses)
  • video surveillance footage recorded when taking electronic examinations
  • study plans and other information related to student guidance and support
  • internships
  • international student exchange
  • tuition fees
  • information about attending paid training programmes and related payment records
  • other study-related payments (such as sports fees)
  • grants and scholarships awarded by the University
  • student feedback (student surveys, graduate surveys, and post-graduate surveys, such as graduate destination surveys)
  • teacher training
  • information provided when booking appointments with learning and well-being support services as well as booked and cancelled appointments 
  • information provided when booking appointments with learning and well-being support services as well as booked and cancelled appointments 
  • surveys and feedback relating to the development of learning, teaching and related support services
  • student union membership
  • decisions concerning academic dishonesty or disciplinary action.

In addition, personal data may be processed in the following contexts:

  • services concerning facility management, safety and surveillance
  • library services
  • ICT services
  • HR and financial services
  • continuous learning services
  • alumni relations and stakeholder services
  • to organise student tutoring services for new students (tutors’ student number, contact information, nationality, size of the tutor shirt, specialisation/degree programme).

Study-related information that may include special category data (sensitive personal data):

  • information about individual special arrangements or support
  • information about an extension to the time limit for degree completion or the reinstatement of the right to study
  • descriptions of disturbances relating to studies and their consequences.

How we collect personal data

We collect personal data directly from you and from the following sources:

  • students’ personal data and information about their right to study is retrieved from the nationwide student admission records maintained by the Finnish National Agency for Education (L884/2017)
  • national or institution-specific application and admission systems
  • international application and admission systems
  • other Finnish or foreign higher education institutions (for example, through a student exchange programme)
  • online payment and registration services
  • university staff
  • the population information system (to verify and update names and contact details)
  • we may also process personal data that is observed or retrieved based on your use of our IT services or equipment or collected by different control and surveillance services (such as video surveillance).

In cases where data subjects provide their personal data to be processed, the lawful basis for processing personal data is the data controller’s legal obligation.

How we process your personal data

Your personal data stored in our information systems will only be processed for the purposes for which the data were initially collected. Students’ personal data will only be processed by our employees or partners who are authorised to process students’ personal data in connection with functions that are directly related to studies or students. Personal data may also be used for statistical and research purposes. As a rule, personal data that is used for statistical or research purposes is anonymised so that individuals cannot be identified. All personal data will be stored in compliance with data protection requirements.

Who we may share your data with

Personal data is primarily processed by teaching staff and student services staff. In addition, personal data may be processed by ICT Services staff, HR Services staff, Financial Services staff and Communications staff.
Tampere University may also engage external data processors, such as companies that provide system services and process personal data on behalf of Tampere University under a data processing agreement. This does not constitute the transfer of personal data as the data controller remains legally responsible for the processing of personal data.

Tampere Universities may disclose necessary personal data to the following recipients, either directly or via the nationwide database for higher education institutions in Finland:

  • the Finnish Student Health Service (FSHS)
  • the Ministry of Education and Culture
  • internationalisation services of the Finnish National Agency for Education
  • student admission records
  • study and degree information services of the Finnish National Agency for Education
  • the social security institution Kela
  • the National Supervisory Authority for Welfare and Health (Valvira)
  • Statistics Finland
  • employment authorities
  • Education Fund
  • Tampere University’s student union
  • an external supplier of student cards
  • Tampere Student Housing Foundation (TOAS)

In addition, Tampere University may disclose students’ personal data:

  • for research purposes
  • to meet legal obligations pursuant to the Act on the Openness of Government Activities or other legislation
  • to other Finnish higher education institutions to process rights to study and transfer credits, for example, in connection with educational collaboration
  • to foreign higher education institutions outside the EU/EEA area in connection with student exchange, the implementation of double or joint degree programmes or the transfer of academic records.
  • with a student’s consent, contact information may be disclosed to external parties for limited purposes that support learning and information about graduates may be disclosed to associations in their field of study, for survey purposes and for marketing and recruitment purposes.

Permanently retained student data and student mobility data is stored in the nationwide database for higher education institutions.

Transfer of personal data outside of the EU/EEA

As set out in the data protection policy of Tampere Universities, we are committed to taking special data protection measures in the event that personal data is transferred outside of the EU or the European Economic Area (EEA) to countries that are not covered by the GDPR. Any transfers of personal data outside of the EU/EEA will be managed in strict compliance with the GDPR.

How long we retain your personal data

The retention periods for personal data and materials that are manually stored in our information systems are based on applicable legislation and our archive management policy/data management plan.
Tampere University will store the following personal data relating to studies on a permanent basis to comply with its legal obligations:

  • your national learner ID, personal identity number or other personal identifier
  • information about the degrees and specialist training that you have completed, the courses that you have completed and the grades thereof
  • information about your right to study towards a degree or specialist qualifications, information about your acceptance of a study place, your enrolment for a programme leading to a degree or specialist qualifications.

Rights of data subjects

Right of access (GDPR, Article 15)

You have the right to know what personal data we process and hold about you. Many of the University-provided information systems allow you to view the data that we have stored about you when you are logged in.

Right to rectification (Article 16)

You have the right to have any incorrect, inaccurate or incomplete personal details that we hold about you revised or supplemented without undue delay. You are also entitled to have any unnecessary personal data erased from our records.

Right to be forgotten (Article 17)

In certain circumstances, you have the right to have your personal data erased from our records. The right to erasure does not apply, if the processing is necessary for us to comply with our legal obligations or perform tasks carried out in the exercise of official authority.

Right to restrict processing (Article 18)

In certain circumstances, you have the right to request us to restrict processing your personal data until the accuracy of your data, or the lawful basis for processing your data, has been appropriately reviewed and potentially revised or supplemented.

Right to data portability (Article 20)

You have the right to obtain a copy of the personal data that you have submitted to the University in a commonly used, machine-readable format and transfer the data to another data controller. This right applies to situations where data is processed automatically on the basis of consent or contract.
This means that the right to data portability does not apply to data processing that is necessary for the performance of a task carried out in the public interest or to fulfil legal obligations imposed on the data controller. Consequently, this right does not generally apply to the higher education institution’s personal data registers.

Right to object (Article 21)

You may at any time object to the processing of your personal data for special personal reasons, if the basis for processing is a task carried out in the public interest, the exercise of official authority, or the higher education institution’s legitimate interests. After receiving such a request, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for processing your data.

Right to lodge a complaint with a supervisory authority (Article 77)

You have the right to lodge a complaint with a supervisory authority, if you consider that the processing of your personal data violates the provisions of the GDPR (2016/679). In addition, you may follow other administrative procedures to appeal against a decision made by a supervisory authority or seek a judicial remedy.

Office of the Data Protection Ombudsman

Street address: Lintulahdenkuja 4
Postal address: PO Box 800, FI-00531 Helsinki, Finland
Email: tietosuoja [at] om.fi
Switchboard: +358 2956 66700

Questions about data protection

You can view the personal data we hold about you by logging into many of the information systems owned or maintained by Tampere Universities. You can request to have any inaccurate personal data rectified in connection with the process where the data is generated. Contact Tampere University’s Student Affairs Office by email at opintotoimisto.tau [at] tuni.fi and the Open University at avoin.tau [at] tuni.fi. To contact the Student Affairs Office of Tampere University of Applied Sciences, send an email to opintotoimisto.tamk [at] tuni.fi.

Please deliver all subject access requests to the data protection officer of Tampere Universities (by email at dpo [at] tuni.fi or by post to the following address: Data Protection Officer, Tampere University, FI-33014, Tampere, Finland).

This privacy notice was updated on 1 November 2021.