Alumni and customer relations

South-Eastern Finland University of Applied Sciences

P.O. Box 68 (Patteristonkatu 3)

50101 Mikkeli

Business ID: 2472908-2

The person in charge of the Alumni and Relationships information group

Tomi Heimonen, Head of unit

firstname.surname@xamk.fi

Data Protection Officer

Markus Häkkinen, Project Manager

040 198 1150

tietosuojavastaava@xamk.fi

The purpose of processing personal data is to manage customer and stakeholder relations in the context of cooperation in the working life of teaching and RDI activities, the sale of services and the implementation of cooperation projects, as well as to inform alumni cooperation.

Customer and stakeholder cooperation. Collecting and processing data to manage stakeholder cooperation. At Xamk, workplace contacts and interactions are maintained in a CRM system, which is a centralised and structured place for maintaining customer, partner and stakeholder data and business processes. Registered groups include potential personal and organisational customers, alumni, customer and stakeholder organisations, contacts in these organisations, as well as customer and project target group activities.

Xamk’s CRM system is a tool for maintaining the information and activities of your own work-life contacts. The information collected in the system is used to plan, monitor and report on activities and to further develop cooperation with customers and partners. It enables the identification and knowledge of the needs of customers and partners and, as a result, a better service delivery for companies and organisations. It provides information on project cooperation and enables the creation of new projects that support employment and regional development. The information of the employment contacts is in one place and can be used for marketing communication and information.

The purpose of the CRM Stakeholder Management System is to maintain Xamk’s corporate, community and other stakeholder information for the following purposes:

• communication
• marketing
• traineeship and thesis placements and contacts
• project cooperation sites
• RDI activities
• paid service activities
• continuing training
• international activities
• events
• reporting on own activities

Aluminium system. All Xamk graduates will be automatically added to the alumni register from 31.1.2020. You can also join the Alumni Register manually via the Alumni Portal (alumni.xamk.fi). The Alumni Register is a register of students who have graduated from Xamk, Kyamk and Mamk. Membership of the register does not imply any obligation. Members of the register receive, for example, information about Xamk
alumni activities and training courses. The information in the register will not be made available to third parties. Due to the national career monitoring surveys, it is very important that Xamk reaches out to graduates.

The processing of personal data is based on

• For research, development, innovation and educational cooperation in the performance of tasks in the public interest (GDPR 6 art. 1.e) and for statutory tasks of a university of applied sciences, as described in the University of Applied Sciences Act (932/2014).
• In the management of customer and stakeholder cooperation for the performance of tasks in the public interest (GDPR 6 art. 1.e) and in particular the Act on Universities of Applied Sciences 14.11.2014/932 6§ “cooperation with the operating environment”.
• For the purposes of the legitimate interests of the controller or a third party (GDPR 6 Art. 1.f), when processing data for the management and development of business activities and, when processing data of potential customers.
• For participants in the events organised, the processing of personal data is based on the consent (GDPR 6 Art. 1.a) given by the data subjects when registering for the event.
• Otherwise, the processing of personal data in the register is based on a material connection or the performance of a contract to which the data subject is party (GDPR Art. 6 Art. 1.b).

The above-mentioned legitimate interest of the controller may exist, for example, where there is a relevant and appropriate relationship between the data subject and the controller, which arises when the data subject has a relationship with the controller related to the purpose of the processing and when the processing is carried out for purposes which the data subject could reasonably have expected at the time and in the context of the collection of the personal data. For example, the alumni system. Personal data are stored at this stage in order to contact a potential customer.

Stakeholder management

• name and contact details
• employer details/role related information
• cooperation history

For alumni, the system handles the above-mentioned supplements.

• date of birth
• Education
• qualifications obtained
• name of the higher education institution
• year of commencement of studies
• year of graduation
• place of study

As a rule, the telephone and address data recorded are contact details related to the person’s place of work. If the contact details are obtained from the person himself/herself, they may also be home telephone and home address details. In the case of alumni, the data may be processed more extensively if they themselves provide this information separately via the Alumni Portal.

The register of alumni is released on a regular basis (national data repository, research and statistics). The data is combined with the data of the Xamk Student Register. The collected data will be transmitted to the CSC – Centre for Scientific Computing by secure mail for the implementation of a national career monitoring survey.

No data from the register will be disclosed to other parties.

No data from the register will be transferred outside the EU or EEA.

Personal data will be kept for as long as the need for their use continues to exist. Documents and registers are kept in accordance with Xamk’s data management plan and retention periods are defined.

• Stakeholder management – Duration of stakeholder membership
• Alumnus register information – Duration of alumni membership
• Handling of customer data such as sales invoicing, contract management, etc. – 10 years (20 years for project contracts)

If the data subject requests the deletion of personal data concerning him or her, the data will be deleted from the register (not in cases of public interest). If a person withdraws his or her consent to the use of his or her data for a specific purpose, this will be recorded in the system in the data of that person.

The information is stored in the customer management system. Users have personal user IDs. Data maintenance is protected by an AD ID and password. The data stored in the system are kept in the register and are available to a restricted group of users. Access to and use of the data in the system is restricted to those data controllers who are authorised to access the data on the basis of their job description.

Customer data is collected from a number of different sources, from which the data is transferred to the customer management system. This is to ensure that customer data is processed in a consistent and correct way, in terms of data protection and security. Contact data may be used for statistical purposes, whereby the data is stored anonymously where necessary.

Right of access to personal data. The data subject may request information about him or herself. The request must be made in writing to the Data Protection Officer or by using the online form (available at: www.xamk.fi/tietosuojailmoitus). In the request, the data subject must specify which data are concerned.

Right to rectification. The data subject may submit a request for rectification of his/her data to the Data Protection Officer. The controller will also update the personal data contained in its customer and stakeholder register on its own initiative whenever a processor acting on behalf of the controller receives information about them, either from the data subject or from public sources.

Right to erasure. The data subject may object in writing or orally to the use of his or her personal data for Xamk’s marketing and information purposes. This prohibition will be recorded in the register. The data subject may also request the deletion of personal data concerning him or her from the customer and stakeholder register. The data will be deleted if the University of Applied Sciences of South-Eastern Finland has no legal reason to retain the data, for example to fulfil a contractual obligation or to carry out teaching or IT work.

Right to restriction of processing. The data subject has the right to restriction of processing if one of the following occurs:

• If the data subject contests the accuracy of the personal data, processing is limited to a period of time during which the controller can verify the accuracy of the data.
• The processing is unlawful and the data subject objects to the erasure of the personal data and requests instead the restriction of their use
• The controller no longer needs the personal data concerned for the purposes of the processing, but the data subject needs them for the establishment, exercise or defence of legal claims
• The data subject has objected to the processing of personal data under Article 21 pending verification whether the legitimate grounds of the controller override those of the data subject.

The right to transfer data from one system to another. The data subject has the right to receive in machine-readable form the personal data concerning him or her which he or she has provided to the controller, provided that the processing is based on consent and is carried out automatically.

Information about the right to withdraw consent at any time (If processing is based on consent). Where the processing of personal data is based on consent (e.g. participants in events), the data subject may withdraw his or her consent by notifying the Data Protection Officer in writing.

The right to lodge a complaint with a supervisory authority. Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State where he or she has his or her habitual residence or place of work or where the alleged breach has occurred, if the data subject considers that the processing of personal data concerning him or her infringes this Regulation. The complaint should be addressed to the EDPS. www.tietosuoja.fi

Personal data in the customer and stakeholder register is obtained from public sources, such as websites or business directories, or from the data subjects themselves. Contact details of alumni are obtained from the institution’s student register.