Data privacy notice - UniOulu Sign

This Privacy notice applies to UniOulu Sign Electronic signing service and the information of its users that is collected and processed in the system. University of Oulu implement its legal obligations and tasks using electronic signing service.

This notice is an informative document in accordance with the EU's General Data Protection Regulation (EU 679/2016) and supplements the general data privacy notice of the University of Oulu, from which you can read more detailed descriptions listed by group or subject, e.g. from the purposes and legal basis for data processing and transfer of personal data.

Data controller

University of Oulu

P.O. Box 8000

90014 UNIVERSITY OF OULU

Contact person of the responsible unit: Service Manager / Records Management, Katariina Alha

University Data Protection Officer: dpo@oulu.fi

The purposes and legal basis for the processing of your personal data

The University of Oulu processes the personal data of its staff members, students and those employed by its contracting partners to enable the electronic signing of contracts and other legally binding documents of the University of Oulu with UniOuluSign e-signing service (”Service”). The staff members refer e.g. to the university’s duly authorised signatories and preparers of the contracts. Students are, for example, students taking a degree at the University of Oulu.

The Service provider may further, where necessary, process the above-mentioned user groups’ personal data in order to implement operating, maintenance, support, development and communications services of the Service.

The University of Oulu processes your personal data because processing is necessary to comply with the legal obligations of the university or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the university as a data controller.

The University of Oulu has several legal obligations based on, for instance, the Universities Act and employer legislation, which require entering into agreements and decision-making. Such processes again require signing of contracts. Similarly, the university’s tasks carried out in the public interest, such as scientific research, education and the exercise of official authority, require both entering into agreements and decision-making as well as the signing thereof.

Regular sources of personal data

The University of Oulu receives the personal data of its staff members from the university’s HR Information System. As a member of the University of Oulu staff, you will update your data either by logging into the Service or by requesting an update of your information in the HR Information System. The data of the signatories belonging to students of the University of Oulu is obtained from the University's Student Information system. Some of your personal data is collected from you during your use of the Service.

The University of Oulu collects information about the contracting partner and its signatories from the contracting partner and its signatories themselves. The University of Oulu may also collect personal data of its contracting partners’ signatories from publicly available sources.

We process the following personal data

The signatories and other Service users of the University of Oulu

• name, person ID number, Study ID number, registration information (username, password, some other unique identifier, if any)
• email address, phone number, office address, IP address, user signature transaction information
• For personnel, data concerning employment: organisation, position
• For students, information related to study rights, such as information relating to the degree programme or courses of study

The signatories of a contracting partner

• name, email address, phone number, position
• IP address of the user’s computer, signature transaction information, registration information (password and another unique identifier, if any)
• organisation details of the signatory: organisation name, business ID, organisation address

Retention and access to personal data

Personal data will be retained in accordance with the University of Oulu’s archive compilation plan indefinitely. The retention times are based on the Archives Act (831/1994) and other legislation.

In the Service, contact information of university staff and students can be viewed by preparers, i.e., signatories of a signature request. Documents sent through the service can be viewed in addition to the preparer by anyone who has been entered in the signature request: the actual signatories, the persons to whom the signature request has been sent for information, and the so-called peer users to whom the sender of the signature request has set the same rights as for themselves.

The service's main users, who are staff members at the University of Oulu, have access to contact information and to signing requests. The system administrator of the supplier of the Service, Sarake Ltd., have access to all the content of the Service.

Receivers of the personal data

At the University of Oulu, data can be processed by those university employees or persons commissioned by or acting on behalf of the University of Oulu who need them in their tasks.

Personal data will be disclosed to Sarake Ltd. and its subcontractor Nebula Ltd. in order to implement the Service for the university. Sarake Ltd. may outsource the processing of personal data to a third party only with the consent of the University of Oulu.

Personal data will not be disclosed to any third parties other than those listed above. Personal data will not be transferred outside the European Union or the European Economic Area.

Your rights pertaining to your personal data

You have the right to request from the controller access to and rectification of your personal data. You also have the right to request erasure of your personal data or restriction of processing your personal data or oppose to the processing of your personal data.

Please note that the university has several legal obligations to process your personal data and for this or some other reason, we may not be able to comply with your above request. To take use of your rights listed above and for further information, please contact the Registry of the University of Oulu at kirjaamo@oulu.fi.

You have the right to lodge a complaint with a supervisory authority, the Data Protection Ombudsman (Tietosuojavaltuutettu). Please find the contact information and office hours for information service at the Data Protection Ombudsman website: www.tietosuoja.fi.

Obligation to provide the personal data

Providing the personal data is a prerequisite to enable the electronic signing of contracts and other legally binding documents of University of Oulu.

No automated decision-making or processing the personal data for other purposes

We will not use your personal data for automated decision-making or for any other purposes than mentioned in this document (see paragraph 2).