ÅBO AKADEMI UNIVERSITY
www.abo.fi

PRIVACY NOTICE
According to the EU General Data Protection Regulation GDPR (EU 679/2016), Art. 13–14

The notice concerns:

Development, evaluation, other (events, etc.)

Micro Credentials at HHÅA (The School of Business and Economics at Åbo Akademi)

Data controller

Åbo Akademi University
Tuomiokirkontori 3
20500 Turku
Finland

Åbo Akademi University is controller for the personal data collected and processed in the university’s activities – in teaching, guidance, research, administration, and cooperation, internally and externally.

Responsible unit for the processing that is described in this document:
Faculty of Social Sciences, Business and Economics, and Law

Contact person: Anna-Greta Nyström, Handelshögskolan vid Åbo Akademi, anna-greta.nystrom@abo.fi, +358 46 921 6657.

Data Protection Officer at Åbo Akademi University: dataskydd@abo.fi, +358 2 215 31 (switchboard).

Why do we treat your personal data?

The purpose of collecting personal data is so that the School of Business and Economics at Åbo Akademi University can offer micro-credentials (short courses) for those who choose to register for the courses. Anyone can register for the courses, i.e., the courses are open to the public. The courses will be offered online and in a hybrid format (online + physical). We offer two course modules, which include short courses worth 2 credits. The modules are ‘Business Development’ and ‘The Business of Human Rights’.

It is necessary to process personal data to:

• receive registrations
• communicate with participants before, during, and after the course in the form of information related to participation
• conduct the course and distribute course materials to participants (This is done via Moodle on digicampus.fi where personal login and registration are required, see the terms of use for digicampus.fi.)
• allow participants to submit assignments related to the course
• maintain attendance lists on the courses
• contact external clients if needed during the course (in connection with course projects)
• stream the course if necessary
• create a certificate at the end of the course
• register study credits (this means that personal data is transferred to the Centre for
  Lifelong Learning at Åbo Akademi (CLL), for more information see the data protection notice for the registration database for the Open University at Åbo Akademi.)
• if necessary, collect information about work experience and previous studies through a survey to develop the courses and their marketing (only pseudonymous data is collected)
• collect feedback on the course

According to GDPR there must always be a legal basis for processing personal data. The legal basis for processing your personal data is:

Consent: You give consent fully voluntarily after having read the information about how your personal data is processed, by ticking the box in when registering “Yes, I agree that Åbo Akademi processes my personal data as stated above in connection with my participation in the micro-credential course or microcredential- courses at HHÅA.”

Additionally, you need to give your consent for your personal data to be processed according to the data protection notice for the CRM system used by Åbo Akademi. The data protection notice for the CRM is linked at the registration.

When consent is the legal basis for processing your personal data, you have the right to withdraw it at any time. You can notify that you have withdrawn your consent by sending an email to registrator@abo.fi. The processing carried out before you withdrew your consent is not
affected.

Which personal data is processed and by whom?

Information collected via registration for those who choose to sign up for the courses:
First name
Last name
Email address
Social security number

When we communicate with participants before, during, and after the course, first name, last name, and email address may be processed to reach out to participants via email or on digicampus Moodle.

To conduct the course and distribute course materials to participants, first name, last name, and email address are processed when email and digicampus Moodle are used.

Assignments may be collected during the course. In connection with these, first name, last name, and email address are processed.

First name, last name, and email address are processed if the teacher chooses to have attendance lists in connection with the courses.

If the course has a course project, participants are divided into groups. In this case, someone in the group may need to act as a contact person for external clients. In this case, the contact person may be asked to provide first name, last name, email address, and phone number to the external client. This is voluntary and will be communicated in advance.

If the course is streamed, the participant’s voice will be processed if they choose to have their microphone on, and moving images where the participant’s face may be visible if they choose to have their camera on during the lecture. Participants can choose whether to have their camera and sound on.

When the participant completes the course, they receive a certificate of participation. At that time, first name, last name, and email address are processed.

When the participant completes the course and receives a certificate, study credits are registered in Åbo Akademi’s study register. At that time, first name, last name, email address, and social security number are transferred to the Centre for Lifelong Learning at Åbo Akademi (a separate unit within Åbo Akademi).

During the course, information about work experience and previous studies may be collected to develop and market the courses (only pseudonymous personal data is collected). If this is done, participants will be informed in advance, and it is voluntary to submit the information.

When collecting feedback from the course, personal data (first name, last name, and email address) may be processed. Providing feedback is voluntary.

Who processes the personal data?
The personal data is processed by the individuals at Åbo Akademi who needs the personal data for the implementation of the courses and the registration of study achievements. The administrators in Åbo Akademi’s contact register (CRM) have access to the personal data.

From where do we collect your personal data and how is the data processed?

Personal data collected via registration:
Personal data is collected from the individual via a registration form in Åbo Akademi’s contact register (CRM = customer relationship management). The registration information is saved in the CRM tool. A profile is not created in the CRM contact register. The registration information can also be compiled in an Excel list that is internally available to the micro-credential course staff. The Excel list is stored in the case management system Docsy or on the home area of a computer belonging to Åbo Akademi, belonging to the person in question. The list is not shared in cloud services. The personal data is stored during the academic year in which the course took place, and the following two academic years (according to Åbo Akademi’s instructions for examination and assessment, paragraphs 14 & 43).

Personal data processed in connection with communication regarding the course:
The micro-credential course staff sends out information about the courses to participants using digicampus Moodle or Åbo Akademi’s email. The contact information (first name, last name, and email address) is obtained from the CRM tool, where the personal data was saved in connection with the registration (see the previous section). The information sent (email + digicampus Moodle) is stored during the academic year in which the course took place, and the following two academic years (according to Åbo Akademi’s instructions for examination and assessment, paragraphs 14 & 43).

The micro-credential course staff uses the personal data collected via registration (first name, last name, and email address) to communicate with participants before, during, and after the course. The contact information (first name, last name, and email address) is obtained from the CRM tool, where the personal data was saved in connection with the registration (see the first section). The information sent (email + digicampus Moodle) is stored during the academic year in which the course took place, and the following two academic years (according to Åbo Akademi’s instructions for examination and assessment, paragraphs 14 & 43).

Personal data processed in connection with using Digicampus.fi:
To conduct the course and distribute course materials to participants, digicampus.fi (Moodle) is used. For this, participants need to create their own login and registration. See how your personal data is processed in this tool.

The person responsible for the course has access to the contact information (first name, last name, and email address) saved in digicampus Moodle in connection with the registration. Participants in the course also see the personal data (name + email address) of the other participants when they use Moodle on digicampus.fi.

The personal data saved on digicampus Moodle is stored during the academic year in which the course took place, and the following two academic years (according to Åbo Akademi’s instructions for examination and assessment, paragraphs 14 & 43).

Personal data processed in connection with practical arrangements for the course (assignments, attendance lists, course projects, and possible streaming of the course):
To allow participants to submit assignments via Digicampus Moodle or email, first name, last name, and email address are processed. The personal data is processed by the person responsible for the course, and the assignments are stored only in Digicampus Moodle and on the home area of a computer belonging to Åbo Akademi, belonging to the person in question. The personal data saved in connection with assignments on Digicampus Moodle or on the home area of a computer belonging to Åbo Akademi is stored during the academic year in which the course took place, and the following two academic years (according to Åbo Akademi’s instructions for examination and assessment, paragraphs 14 & 43).

The course responsible may, if necessary, collect attendance lists digitally in digicampus Moodle or have printed name lists in connection with attendance registration. The personal data processed in this case is first name, last name, and email address. These lists are stored only in digicampus Moodle and on the home area of a computer belonging to Åbo Akademi. The digital attendance lists are stored during the academic year in which the course took place, and the following two academic years (according to Åbo Akademi’s instructions for examination and assessment, paragraphs 14 & 43). The printed lists are destroyed immediately after the course has ended.

If course projects in collaboration with external partners/clients (e.g., a company) occur during the course, one of the participants may be asked to be the contact person. In this case, the person in question provides their contact information (name, email address, and phone number) to the external client. This is voluntary, and the course responsible will inform about this well in advance. The contact person agrees on the details with the external client on how the contact information is stored with the external client.

If the course is streamed, personal data (voice, moving image where the person’s face may be visible) is processed during the lecture. In this case, the Zoom program is used.

Personal data processed upon course completion:
If the participant wants a certificate after the course, first name, last name, and email address are processed. Certificates are primarily created using Digicampus Moodle’s own certificate program. If another program is used, the information in the data protection notice is updated, and participants are informed of the update before processing begins. The completed certificates are stored by the micro credential courses’ staff, either on Digicampus Moodle or on a computer belonging to Åbo Akademi, belonging to the person in question. The certificates are stored during the academic year in which the course took place, and the following two academic years (according to Åbo Akademi’s instructions for examination and assessment, paragraphs 14 & 43).

The personal data is transferred to CLL (Centre for Lifelong Learning, a separate unit within Åbo Akademi) in connection with the registration of study credits. For more information, see the data protection notice for the registration database for the Open University at Åbo Akademi.

If necessary, information about work experience and previous studies (only pseudonymous data) can be collected through a survey during the course. This is done through Digicampus Moodle. Answering these questions is voluntary. The responses are stored by the microcredit courses’ staff, either on Digicampus Moodle or on a computer belonging to Åbo Akademi, belonging to the person in question. The pseudonymous data is stored during the academic year in which the course took place, and the following two academic years.

When collecting feedback, personal data (first name, last name, and email address) can be processed if the course responsible so wishes. Providing feedback on the course is voluntary. Feedback is collected via Digicampus Moodle or through a form created by the course
responsible. The responses are stored by the micro credential courses’ staff, either on Digicampus Moodle or on a computer belonging to Åbo Akademi, belonging to the person in question. Feedback responses are stored during the academic year in which the course took place, and the following two academic years, after which they are deleted.

Is your personal data transferred to a third party (outside Åbo Akademi University) for processing?

Yes, the personal data will be transferred for processing outside Åbo Akademi.

The CRM tool is provided to Åbo Akademi by Mira Network. Therefore, Mira Network acts as the data processor. The personal data transferred to Mira Network are those registered in the CRM tool in connection with the registration.

Is your personal data transferred to a third party (outside Åbo Akademi University) for the needs of the third party?

No, personal data will not be transferred outside Åbo Akademi University.

Is your personal data transferred outside EU/EEA?

No, personal data is not transferred outside EU/EEA.

What rights do you have when Åbo Akademi University processes your personal data?

Åbo Akademi University is responsible for taking appropriate technical and organisational measures to protect personal data against unauthorized or illegal processing and against damage to or loss of personal data. Personal data must always be processed in a fair and transparent manner in accordance with applicable data protection regulations.

According to the EU General Data Protection Regulation GDPR, you have the right to

• get transparent information on how your personal data is processed and how you can exercise your rights (Art. 12)
• get access to your personal data at Åbo Akademi University and information on the processing of data (Art. 15)
• have your personal data corrected (Art. 16). Note that employees and students at Åbo Akademi University can in most cases correct their own data according to the instructions on the intranet.
• have your data erased (“the right to be forgotten”) in certain situations (Art. 17)
• restrict the processing of your personal data in certain situations (Art. 18)
• have your personal data transferred between systems in certain situations (Art. 20)
• object to the processing of your personal data in certain situations (Art. 21)
• not be subject to automated decision-making, with certain exceptions (Art. 22)

You have also the right to be informed of a personal data breach involving a high risk for your personal data (Art. 34).

When the purpose of the processing is scientific research, statistics or archival purposes, the rights may be restricted by the Data Protection Act (1050/2018). Restrictions on rights always require special protective measures.

If you have questions about your rights, you can contact the responsible contact person (see above) or the ÅAU Data Protection Officer (dataskydd@abo.fi). See also the overall information on the processing of personal data on the ÅAU website

You have the right to lodge a complaint with the data protection authority if you believe that the processing of your personal data is an infringement of the General Data Protection Regulation (GDPR).

Contact information to the data protection authority:
Office of the Data Protection Ombudsman
PL 800
00531 Helsinki
+358 29 566 6700 (switchboard)
tietosuoja@om.fi
tietosuoja.fi