Data privacy notice concerning data on the web service of the University of Oulu

Data controller

University of Oulu
Pentti Kaiterankatu 1
P. O. Box 8000
90014 University of Oulu

Unit in charge of the processing
University of Oulu, Communications, marketing and public affairs
Communications Director Marja Jokinen, e-mail address: viestinta(at)oulu.fi

University Data Protection Officer: dpo(at)oulu.fi

Purpose of processing personal data and legal basis for processing personal data

The University of Oulu is fulfilling the statutory task of serving humanity at large as laid down in section 2 of the Universities Act (2009/558) through studying, teaching and engaging in social interaction. The purpose of processing your personal data is to maintain and develop the technology and contents of the University of Oulu’s (later referred to as UO) web service, and to develop and target the functionalities of the web service.

Using the service creates log entries. These log entries are used for ensuring data security, developing the technical features of the service, and detecting, preventing and resolving failures.

Data recorded on the UO web service includes, for example, information submitted with different forms. The web service uses cookies that are necessary for the operation, as well as information stored by cookies of third-party services. The purpose of the cookies is to enable the web service to remember certain preferences for a certain period of time. Therefore, you do not have to to make the same selections when navigating from one page to another during the same session.

Third-party service cookies are stored on a visitor's terminal device, which then enable the collection of anonymous data of the visitor such as the browser, operating system or terminal used and information of use of the web service such as the site from which the visitor arrived at website, pages loaded and timestamp.

For accepting cookies the Oulu.fi web service uses a cookie banner which can be found at the bottom of each page. The cookie banner contains information about the cookies used in the service. The strictly necessary cookies are only used to ensure the technical performance of the website and they are not used for other purposes. These cookies do not require the user's consent. When visiting the web service, the user may consent to the use of non-essential cookies in the cookie banner.

Cookies are used only with the consent of the user of the web service. The user can change cookie consent at the cookie banner at any time. After giving your consent for using of the cookies, the cookie banner is minimized at the bottom left of the page behind the icon, where it can be re-opened by clicking on the cookie banner icon.

Google Analytics is used in the development and quality control of the web service to measure the usage data of the online service and to analyze the data collected. Visitor tracking does not identify individuals. A visitor's IP address can be used to determine for which organization that IP address is registered and what the visitor's geographic location is. For more information on Google Analytics. Preventing the installation of cookies may affect the functionalities of the website and the use of services provided by the web service.By using the website, you accept the processing of your personal data.

In addition, the University of Oulu’s website contains third-party community plug-ins: for example, Google Tag Manager, Juicer, Instagram, Twitter, Facebook, LinkedIn and YouTube. The third-party community plug-ins are visible on the UO web service, but their contents are downloaded directly from the service providers’ own servers. Information on the community plug-in services used by visitors to connect to social media is transferred to the monitoring data of the third-party service in question. The UO web service does not send information on users via social extensions.

All services offered by third parties and applications supplied by third parties that are available on the UO web service are subject to the terms of use and other regulations of the third party in question.

Personal data to be processed

For the purposes defined in this Data Privacy Notice, the University of Oulu’s website collects the following necessary data on users: Data collected and derived from service use:

• UO collects data on website users through e.g. the use of cookies. A cookie is a small text file sent to the user's browser, and it usually contains an anonymous identification number. Cookies do not damage the terminal device.
• Statistics are compiled on the use of the website, including the number of users, country of use, time of use, the used browser, and the contents that the visitors have examined. In addition, a statistical entry is made of whether the user is an UO internal or external user. An individual user is not identifiable on the basis of this data.

Information you submit to the University of Oulu:

• The website requests your name and your email address and other possible information in contact forms and feedback opportunities.

Recipients or categories of recipients of personal data

We transfer personal data only within the University of Oulu organisation and only to the extent necessary for the technical maintenance and development of the website and for the maintenance, analysing, development and targeting of content-related communications and marketing. The personal data is processed by the Communications, marketing and public affairs unit at the University of Oulu and by other online support services.

The University of Oulu will disclose personal data to third parties only in so far as the third parties need access to the processed personal data to provide the University of Oulu with services for the purposes specified in this Data Privacy Notice. This refers to, for example, the Google Analytics analysis tools supplied by Google. The University may disclose anonymous data to third parties who assist the University in the development of the website and in resolving failures.

Data storage time

Data is stored for the time needed for these purposes and will not be used for any other purpose.

Data transfers

Some third-party services may be located in countries outside the European Economic Area.

The University is not responsible for your use of third party services through the The University of Oulu web service (for example, Facebook, Twitter, YouTube, LinkedIn).

Data subject rights

You have the following rights as a data subject:

• Right to access your data
• Right to have inaccurate data corrected (make sure to keep your contact information up to date)
• In certain situations, the right to have data erased ("right to be forgotten")
• In certain situations, the right to restriction of processing
• In certain situations, the right to object to processing
• In certain situations, the right to have data transferred from one system to another if the processing is based on consent or agreement and is performed automatically.

Please note that the applicability and scope of your above-mentioned rights will be specified on a case-by-case basis in accordance with the EU General Data Protection Regulation, depending on e.g. the grounds for processing the data, and that you do not have the above-mentioned rights in all cases.

If you have any questions about your rights, you can communicate with the University's Data Privacy Officer or the contact person of the responsible unit.

If you want to use the above-mentioned rights, please send a request to the University’s registry office: kirjaamo(at)oulu.fi, where you will get the necessary additional instructions.

Right of appeal to the supervisory authority

In addition to the rights mentioned above, you have the right to file a complaint about the processing of your personal data with the Office of the Data Protection Ombudsman as the supervisory authority. The contact details and opening hours can be found on the website of the Data Protection Ombudsman.

General description of the technical and organisational protection measures

The University as the Data Controller uses appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against damage or loss.