Data privacy notice - Scholarship Fund

Data controller

University of Oulu
Pentti Kaiterankatu 1
P. O. Box 8000, 90014 OULU

Unit in charge of the processing:
Financial Services / CFO Pekka Riuttanen talouspalvelut(at)oulu.fi

University Data Protection Officer: dpo(at)oulu.fi

Purpose of processing personal data and legal basis for processing personal data

The collected personal data will be used for processing grant applications and awarded grants, as well as for communication and to enable and develop monitoring the usage of the electronic service. Information given in the grant applications and information concerning the payments of awarded grants is stored in the register, as well as information concerning research and project progress and final reports.

Contact details of the grant applicant, members of the work group and referees of the applicant are collected in Grant system. This information is collected from the grant applicants.

In addition, payment details of grants, information on the applicant’s behaviour on the grant portal and technical information related to the portal’s usage, such as log entries, are collected. Additionally, data about the internal communication within the grant system between the data subject and the data controller is collected.

Legal basis for processing personal data:

The European Data Protection Regulation Art. 6 (1)( b) Contract
- The register processes personal data based on an agreement related to applying for, awarding, paying and notifying the authorities.

The European Data Protection Regulation Art. 6(1) (c) Legal obligation
- The controller has a statutory obligation to notify the Tax Administration and the pension provider of the grant and its recipient.

The European Data Protection Regulation Art. 6(1)( f) Legitimate interest
- The personal data of the University of Oulu staff, grant applicants and possible reference/referrer are processed based on a legitimate interest of the controller. If the grant applicant provides the name and contact details of a third party, such as referee, in his/her application, the grant applicant is responsible for informing these persons themselves.

In order for the application to be accepted for processing, the applicant is required to give personal data with an application form and its attachments. If sufficient personal data is not given, the application might not be processed.

Personal data to be processed

Information during the application period

• user IDs and related personal data
• unfinished applications
• the application assessment data
• the applications and their attachments

Information related to payments

• social security number
• bank details

Messages

• log data related to the application and payment phase
• other possible correspondence

At the University of Oulu, data is processed only by those employees of the UOulu or persons acting on behalf of the UOulu who need it in their duties.

Recipients or categories of recipients of personal data

Information on grants awarded is provided to the pension insurance company (MELA) if the duration and amount of the grant exceed the limits defined by the MELA. Information on paid grants is also disclosed to the Tax Administration. The recipients and amounts of awarded grants are published on the University of Oulu website. The university may also disclose information to other organisations awarding grants.

The University of Oulu may use external processors of personal data, such as companies providing system services, that process personal data on behalf of the University of Oulu on the basis of a service agreement.

The University of Oulu transfers your data only to such parties that have legal basis for obtaining the data for purposes defined by law, or to whom the transfer is necessary in order to carry out tasks related to employment or employer obligations.

In addition, data is disclosed for scientific and historical research purposes and statistical purposes on the basis of separate disclosure requests.

Transfers of personal data to third countries or international organizations

The data protection policy of the University of Oulu is to exercise particular care when transferring personal data outside the EU and the EEA to countries that do not offer the data protection required by the European General Data Protection Regulation (GDPR). Transfers of personal data outside the EU and EEA are done in accordance with the requirements of the GDPR.

Data storage time

User IDs and related personal data

• Inactive users will be removed from the system at the earliest two years after the last login event.

Unfinished applications

• The applicant can delete unfinished applications.
• The unfinished applications will be removed when it is not necessary to store them for awarding grants.

The application assessment data

• The assessment data will be removed at the same time as the applications.

The applications and their attachments

• The attachments on both accepted and denied grant applications simultaneously with the applications will be removed. The applications and their attachments are kept for a period of retention as defined by the Finnish accounting act and decree.

Payment data

• Information is stored for a necessary period taking into consideration authoritative notices, possible audits and the period of retention as defined by the Finnish accounting act and decree.

Messages

• Messages related to the application will be deleted once the application is removed.

Data subject rights

You have the following rights as a data subject:

• Right to access your data
• Right to have inaccurate data corrected (make sure to keep your contact information up to date)
• In certain situations, the right to have data erased ("right to be forgotten")
• In certain situations, the right to restriction of processing
• In certain situations, the right to object to processing
• In certain situations, the right to have data transferred from one system to another if the processing is based on consent or agreement and is performed automatically.

Please note that the applicability and scope of your above-mentioned rights will be specified on a case-by-case basis in accordance with the EU General Data Protection Regulation, depending on e.g. the grounds for processing the data, and that you do not have the above-mentioned rights in all cases.

If you have any questions about your rights, you can communicate with the University's Data Privacy Officer or the contact person of the responsible unit.

If you want to use the above-mentioned rights, please send a request to the University’s registry office: kirjaamo(at)oulu.fi, where you will get the necessary additional instructions.

Use of personal data for automated decisions and profiling

Personal data is not used for automated decisions, including profiling.

Right of appeal to the supervisory authority

In addition to the rights mentioned above, you have the right to file a complaint about the processing of your personal data with the Office of the Data Protection Ombudsman as the supervisory authority. The contact details and opening hours can be found on the website of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman
Postal address: PL 800, 00531 Helsinki, Finland
Tel: +358 29 566 6700
E-mail: tietosuoja(at)om.fi

General description of the technical and organisational protection measures

The University as the Data Controller uses appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing and against damage or loss.