Privacy Policy

Data controller

University of Lapland, business ID: 0292800-5
PL 122
96101 Rovaniemi

Controller’s representative and contact persons

The contact persons can be contacted for any questions related to the processing of
personal data. You may also address any request concerning the exercise of your rights to
the contact person mentioned above

Contact details of the Data Protection Officer

The Data Protection Officer of the Lapland University Consortium is lawyer Jari Rantala.
You can contact him at tietosuoja@ulapland.fi.

Purpose of processing personal data

The information will be used for event planning and communications

Legal basis for processing

Personal data are processed in compliance with the Article 6(1) of the General Data
Protection Regulation (GDPR 2016/679)

• participant’s consent

Categories of personal data processed and their retention periods

The registration form collects the following information

• First name
• Last name
• Cell phone
• Email
• Organization
• Special diet

The data will be held for as long as necessary for the purposes of organizing the event.
The data will be destroyed when it is no longer needed.

Data sources

Personal information is collected via the registration form

Safeguards to protect personal data

Access to the data in the registry requires a separate access right to the information
system. Logging into the system requires the use of a personal username and password.
Physical security complies with the university’s information security regulations.
The system’s servers are located within the EU.

Information systems used for processing

Information systems

The data is collected using the Webropol system and, once the registration period has
ended, it is transferred to the University of Lapland’s network drive. Only the event
organizers have access to both systems

Regular transfers and disclosures of data

Personal data will not be transferred or shared with third parties.

Transfer or disclosure of personal data to countries outside the EU/European Economic Area

No personal data will be transferred or disclosure outside of the areas of the European
Union or the European Economic Area

Automated decisions

No automated decisions are made.

Your rights as a data subject, and exceptions to these rights

The contact person in matters concerning the rights of the data subject mentioned in section 1 of this privacy notice.

Rights of data subjects

Right to withdraw your consent (GDPR, art. 7)
You have the right to withdraw your consent if the processing of your personal data is
based on consent. Withdrawal of consent does not affect the lawfulness of the processing
carried out on the basis of consent before its withdrawal.

Right of Access (GDPR, art. 15)
You have the right to know whether and what personal data about you is being processed.
You may also request a copy of the personal data processed, if you wish.

Right to Rectification (GDPR, art. 16)
If there are inaccuracies or errors in the personal data processed, you have the right to
request their correction or completion.

Right to Erasure (GDPR, art. 17)
You have the right to request the erasure of your personal data in the following cases:
(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
(b) you withdraw the consent on which the processing is based and where there is no other legal ground for the processing;
(c) you object to the processing (see below for a description of this right) and there are
no overriding legitimate grounds for the processing;
(d) the personal data have been unlawfully processed; or
(e) the personal data have to be erased for compliance with a legal obligation under Union or Member State law to which the controller is subject.

However, there is no right to erasure if, in certain individual cases, the erasure of data is not allowed on the reasons defined in the General Data Protection Regulation or Finnish data protection legislation.

Right to Restrict Processing (GDPR, art. 18)
You have the right to restrict the processing of your personal data in any of the following
circumstances:
(a) you contest the accuracy of the personal data, in which case the processing shall be limited for a period of time within which the University of Lapland can verify the accuracy of the personal data;
(b) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
(c) the University of Lapland no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims
(d) you have objected to the processing of personal data (see below for more details), pending verification of whether the controller’s legitimate grounds override those of the data subject.

Right to Data Portability (GDPR, art. 20)
You have the right to receive the personal data you have provided to the University of Lapland in a structured, commonly used and machine-readable format, and have the right to transmit those data to another controller without the University of Lapland’s
hindrance, where the legal basis for the processing is consent or a contract, and the processing is carried out automatically. If you use your right to transfer data portability, you have the right to have the personal data transferred directly from one controller to another, where technically possible.

Right to Object (GDPR, art. 21)
You have the right to object the processing of your personal data if the processing is based on a public interest or a legitimate interest. In this case, the University of Lapland may not process your personal data unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or where it is necessary for the establishment, exercise or defense of legal claims. The
University of Lapland may also continue to process your personal data where it is necessary for the performance of a task carried out in the public interest.

Exceptions to rights
The rights described in this paragraph may be derogated from in certain individual cases on the grounds defined in the General Data Protection Regulation and the Finnish Privacy Legislation. The need to derogate from the rights will always be assessed on a case-by case basis.

Right to lodge a complaint
You have the right to submit lodge a complaint with the Data Protection Ombudsman’s Office if you think your rights have been breached.

Contact details:
Data Protection Ombudsman’s Office (Tietosuojavaltuutetun toimisto)
Link: Notification to the Data Protection Ombudsman
Visiting address: Lintulahdenkuja 4, 00530 Helsinki
Postal address: P.O. Box 800, 00531 Helsinki, Finland
E-mail: tietosuoja(at)om.fi
Switchboard: +358 (0)29 566 6700
Registry: +358 (0)29 566 6768
THIS FORM MUST ALSO BE COMPLETED AND SUBMITTED TO THE REGISTRY. (kirjaamo@ulapland.fi)