ÅBO AKADEMI UNIVERSITY
www.abo.fi

PRIVACY NOTICE
According to the EU General Data Protection Regulation GDPR (EU 679/2016), Art. 13-14

The notice concerns:
Development, evaluation, other (events, etc.)

Doctoral Conferral Ceremony at Åbo Akademi University, Promovendi

__________________________________________________________________________

Data controller

Åbo Akademi University
Tuomiokirkontori 3
20500 Turku
Finland

Responsible unit for the processing that is described in this document:

University Services and Research Services

Contact person: Tom Grönroos, Event Producer, tom.gronroos@abo.fi, +358504080882
Data Protection Officer at Åbo Akademi University: dataskydd@abo.fi, +358 2 215 31 (switchboard)

Why Do We Process Your Personal Data?

Participation in this event is essentially open to the public, but the information about and registration for the event is targeted toward specific groups. The personal data of the following individuals may be processed in connection with the event: graduated doctoral students from Åbo Akademi University who have not previously participated in a conferral ceremony, and their invited guests.

Participants can be categorized into the following groups:

A. Promovendi at Åbo Akademi University

• The promovendi participate in the program following academic tradition after completing their doctoral studies and earning their degree at Åbo Akademi University.

B. External Attendees

• Participation as a guest of a promovendi.

The processing of personal data is necessary for the following specific purposes:

1. Execution of the Event, Including:

• Receiving registrations through sign-ups (consent).
• Sending event-related information (via CRM system) or communicating with participants before, during, and after the event (via CRM or email) (consent).
• Ensuring the safety and accessibility of the event for participants: the participant list (containing names) may be shared with Åbo Akademi University’s safety officer via email (legitimate interest).
• Arranging catering (including handling special dietary requests): necessary details may be forwarded to third parties (consent).
• Organizing practical arrangements (e.g., accessibility requests) (legitimate interest).
• Managing practical arrangements for and at the event (legitimate interest).
• Publishing the conferral booklet (task in the interest of the public).

2. Documenting the Event Through Photography or Video Recording

The purpose is to inform about Åbo Akademi University’s activities:

• Selected photographs and video recordings may be published on Åbo Akademi University’s internal and external websites and shared through Åbo Akademi University’s or its units’ social media channels (task in the interest of the public).
• Åbo Akademi University may also provide photographs to third parties (e.g., newspapers) for journalistic purposes (task in the interest of the public).
• The printed conferral booklet will be archived in Åbo Akademi University’s archives (task in the interest of the public).

A. Promovendi at Åbo Akademi University
• The promovendi participate in the program following academic tradition after completing their doctoral studies and earning their degree at Åbo Akademi University.

B. External Attendees
• Participation as a guest of a promovendi.

According to GDPR, there must be a legal basis for processing personal data. The legal basis for processing your personal data is as follows:

1. Execution of the Event

The legal basis is specified separately for each group below:

A. Promovendi at Åbo Akademi University participating in the program:

• Contractual obligation (Article 6.1.b).

B. External Attendees:

• Consent (Article 6.1.a).

2. Documentation of the Event through Photography or Video Recording for the Purpose of Informing about Åbo Akademi University’s Activities: Consent (Article 6.1.a)

When the event is documented through photography or video recording for the purpose of informing about Åbo Akademi University’s activities, personal data captured in the photographs or video recordings is processed based on consent.

The individual identifiable in the photograph or video recording provides their consent voluntarily after receiving information on how their personal data will be processed. Consent is given when the photographer requests participation, and the individual completes a form (paper or electronic) by providing their name and checking the box:
“Yes, I consent to Åbo Akademi University processing my personal data as shown in the photograph/video recording during the conferral ceremony at Åbo Akademi University, as outlined in the data protection notice.”

When consent is the legal basis for processing personal data, participants have the right to withdraw their consent at any time. Withdrawal can be communicated by sending an email, preferably to the contact person listed in this data protection notice or to registrator@abo.fi. Any processing conducted before consent is withdrawn remains unaffected. Withdrawal of consent results in the deletion of personal data from Åbo Akademi University’s internal and external storage locations, as well as any publications on the social media platforms used by Åbo Akademi University that may feature the personal data.

3. Long-Term Storage of Selected Photographs and Video Recordings of Cultural and Historical Significance: Public Interest (Article 6.1.e)

Only selected photographs and videos of cultural and historical significance—those deemed essential for preserving the memory and history of society and the organization—will be stored permanently based on the legal basis of public interest.

What Personal Data is Processed and Who Processes It?

Personal data that may be collected during registration:

• First name
• Last name
• Email address
• Postal address for payment/invoicing
• Details of degrees for the conferral publication (only for doctoral candidates, jubilee doctors, and honorary doctors)
• Names and number of guests for doctoral candidates
• Requests regarding catering (including dietary requirements)
• Requests for practical arrangements (e.g., accessibility needs)

Personal data that may be collected on-site:

• Photographs and video recordings where event participants can be identified visually and/or audibly

Who processes the personal data?

The personal data is handled by staff at the respective units within Åbo Akademi University, deemed necessary for their role. This includes, but is not limited to:

1. Event Producer (the contact person specified in the data protection notice):
   • Has access to all personal data processed as part of their overall responsibility for the event.
2. Åbo Akademi University’s Communications Unit:
   • Responsible for collecting photographs and videos and processing them.
   • Responsible for texts and the compilation and publication of the conferral booklet.
3. Åbo Akademi University’s Security Manager:
   • Receives the participant list to ensure the safety of event participants, including determining necessary security arrangements.
4. Åbo Akademi University’s Financial Services and Partners:
   • Certia Oy and Aboa Events (as per agreements):
     • Handle invoicing of participation fees and collection of registration information.

Where Are Your Personal Data Collected From and How Are They Processed?

Personal data collected through registration:

• Collection: Personal data is collected directly from the individual via a registration form.
• Recording: Registration data is stored in the CRM system. No personal profile is created.
• For catering and/or practical arrangements: If the event requires catering (including dietary requests) and/or practical arrangements (e.g., accessibility requests), relevant personal data may be shared with a third party contracted by Åbo Akademi University to handle these arrangements.
• Storage and deletion:
  • Registration data is stored in the CRM tool and an Excel sheet accessible to personnel involved in organizing the event.
  • The Excel sheet is stored on Åbo Akademi University’s local computer system, belonging to one of the authorized personnel. It is not shared via cloud services.
  • The University’s Security Manager also has access to the registration data through this Excel sheet.
  • Personal data outside the CRM tool is manually deleted once all post-event work, reporting, and documentation are completed and the data is no longer necessary, but no later than one year after the event.

Personal data collected through photographs and videos:

• Collection: A photographer, either employed by Åbo Akademi University or Aboa Events, will be present during the event. Only tools provided by Åbo Akademi University or Aboa Events are used for capturing material.
• Editing: Photo and video editing is conducted using licensed software from Åbo Akademi University or Aboa Events.
• Distribution:
  • Åbo Akademi University’s external website: Selected photos and videos (with captions, e.g., names) may be published on the University’s and its units’ external web pages. Published material may be distributed globally.
  • Åbo Akademi University’s social media: Selected photos and videos (with captions, e.g., names) may be shared on the University’s social media channels. As these accounts are public, published content is distributed globally. Data is also transferred to Meta (owner of Instagram and Facebook) when posted.
  • Media release: Åbo Akademi University may provide photos/videos (including captions, e.g., names) to third parties (e.g., newspapers) for journalistic purposes.
• Storage and deletion:
  • After collection, material is transferred to Åbo Akademi University’s network drive. It is then deleted from the device used for collection (e.g., camera or phone).
  • Photos and videos (with captions, including names) are stored for a maximum of five years after the event and are then manually deleted.
  • Selected photos and videos of cultural and historical significance (e.g., with captions including names) are stored permanently.
  • Åbo Akademi University’s external website: Published material is generally not removed from the external website.
  • Åbo Akademi University’s social media: Published material is generally not removed from social media platforms.

Are Your Personal Data Transferred to Third Parties (Outside Åbo Akademi University) for Processing?

• When registering via Certia Oy or the Aboa Events CRM system, personal data is transferred to Certia Oy and their CRM system provider.
• If the event involves catering (including dietary preferences) or practical arrangements (e.g., accessibility requests), personal data related to these preferences may be transferred to third parties contracted by Åbo Akademi University to handle these arrangements.

Are Your Personal Data Disclosed to Third Parties (Outside Åbo Akademi University) for Their Own Use?

Yes, personal data may be disclosed to third parties for their own purposes:

• When photos or videos are published on Instagram or Facebook, personal data contained in the material is transferred to Meta Platforms Inc. Meta processes the content on its platforms for its own purposes. For more information, read Meta’s Privacy Policy: Meta Privacy Policy.
• Selected photos may also be shared with newspapers for journalistic purposes.

Are Your Personal Data Transferred Outside the EU/EEA?

Yes, personal data may be transferred outside the EU/EEA:

• When Åbo Akademi University publishes photos or videos on Instagram, Facebook (owned by Meta Platforms Inc.), or LinkedIn, the personal data in the material is transferred to Meta Platforms Inc. and LinkedIn Corporation. This constitutes a transfer outside the EU/EEA.
• In July 2023, the European Commission decided that the U.S. provides an adequate level of data protection. Organizations transferring personal data from the EU to the U.S. can certify themselves under the EU-U.S. Data Privacy Framework in accordance with this adequacy decision. Certification ensures an adequate level of protection for transferred personal data. Meta Platforms Inc. is certified under this framework.
• If selected photos are shared with newspapers for journalistic purposes, the photos may become publicly accessible, including outside the EU/EEA, when published in the newspaper.

What rights do you have when Åbo Akademi University processes your personal data?

Åbo Akademi University is responsible for taking appropriate technical and organisational measures to protect personal data against unauthorized or illegal processing and against damage to or loss of personal data. Personal data must always be processed in a fair and transparent manner in accordance with applicable data protection regulations.

According to the EU General Data Protection Regulation GDPR (art.12-22), you have the right to

– get transparent information on how your personal data is processed and how you can exercise your rights (Art. 12)

– get access to your personal data at Åbo Akademi University and information on the processing of data (Art. 15)

– have your personal data corrected (Art. 16). Note that employees and students at Åbo Akademi University can in most cases correct their own data according to the instructions on the intranet.

– have your data erased (“the right to be forgotten”) in certain situations (Art. 17)

– restrict the processing of your personal data in certain situations (Art. 18)

– have your personal data transferred between systems in certain situations (Art. 20)

– object to the processing of your personal data in certain situations (Art. 21)

– not be subject to automated decision-making, with certain exceptions (Art. 22)

You have also the right to be informed of a personal data breach involving a high risk for your personal data (Art. 34).

When the purpose of the processing is scientific research, statistics or archival purposes, the rights may be restricted by the Data Protection Act (1050/2018). Restrictions on rights always require special protective measures.

If you have questions about your rights, you can contact the responsible contact person (see above) or the ÅAU Data Protection Officer (dataskydd@abo.fi). See also the overall information on the processing of personal data on the ÅAU website www.abo.fi/en/processing-of-personal-data-at-abo-akademi-university

You have the right to lodge a complaint with the data protection authority if you believe that the processing of your personal data is an infringement of the General Data Protection Regulation (GDPR).

Contact information to the data protection authority

Office of the Data Protection Ombudsman
PL 800
00531 Helsinki
+358 29 566 6700 (switchboard)
tietosuoja@om.fi
tietosuoja.fi