Student information

South-Eastern Finland University of Applied Sciences

P.O. Box 68 (Patteristonkatu 3)

50101 Mikkeli

Business ID: 2472908-2

Person in charge of the student information data group

Leena Kurki-Pölönen, Student services manager

040 717 9992

firstname.surname@xamk.fi

Data Protection Officer

Markus Häkkinen, Project Manager

040 198 1150

tietosuojavastaava@xamk.fi

The purpose of using student and study data is the maintenance of students and their study and performance data, as well as the production of various study-related certificates and reports for own and research activities, as well as data transfers to the authorities.

Information on study rights, registration, degrees and study results processed by higher education institutions is compiled for centralized storage and use in a national database, through which this content is provided in a secure technical connection for the use of the student selection register and the joint student selection services of higher education institutions (Act 1058/1998 chapter 1 a).

The processing of student and study data is necessary for Southeastern Finland University of Applied Sciences to enable the planning, implementation, evaluation and monitoring of operations. Registered persons are involved in matters related to the study administration of Southeastern Finland University of Applied Sciences. The information systems process only the information necessary for managing the task of the university of applied sciences’ study administration, planning, implementing, monitoring and evaluating the activities.

Submitting personal information about oneself is a prerequisite for the student’s studies at Xamk.

Student and study information is maintained to protect the student’s rights and interests. The basis for processing personal data in the register is

a) general interest, when the processing of personal data is based on the legislation concerning the university of applied sciences:

• Ammattikorkeakoululaki (932/2014)
• Valtioneuvoston asetus ammattikorkeakouluista (1129/2014)
• Laki valtakunnallisista opinto- ja tutkintorekistereistä (884/2017)
• Valtioneuvoston asetus korkeakoulujen yhteishausta (293/2014)
• Hallintolaki (434/2003)
• Hallintolainkäyttölaki (586/1996)
• EU yleinen tietosuoja-asetus (EU 2016/679)
• Tietosuojalaki
• Laki viranomaisen toiminnan julkisuudesta (621/1999)
• Julkisuusasetus (A1030/1999)
• Laki yksityisyyden suojasta työelämässä (L477/2001
• Kaakkois-Suomen ammattikorkeakoulun tutkintosääntö

b) legitimate interest, in which case the processing is necessary to implement the legitimate interests of the controller or a third party (GDPR 6 art. 1.f).

Above mentioned legitimate interest of the data controller may exist, for example, when there is a relevant and appropriate relationship between the data subject and the data controller, which arises when the data subject is in a relationship with the data controller related to the purpose of use of the register, and when the processing takes place for purposes that the data subject could reasonably have expected at the time of the collection of personal data and its in connection with.

Xamk processes the following information about students

• The student’s basic information
  • student information
    • student number
    • username
    • learner national identifier (OID)
    • surname, first names, nickname, (former surname)
    • social security number, date of birth, gender
    • citizenship
    • mother tongue, language of business, language of school education
    • contact information (address, phone number, email)
    • next of kin’s information
    • home municipality, municipality of residence, country
    • the foreigner’s passport number
      
  • study and degree information
    • education classification, education program/training, group, template information
    • form of education
    • Teaching point
    • Language of instruction
    • type of study
    • degree, degree title, scope to be completed, required scope
    • basic education
    • attendance, graduation, separation information
    • study right period, seasonal maximums, seasons used
    • personal study plan (HOPS)
    • course reports and assessment, as well as exams
    • study progress
    • certification marks, directives and qualifications
    • financing
    • organizational unit
    • additional information related to the right to study and the role
    • authorizations for data disclosure

• Study information
  • studies (study units and periods)
  • realizations of the course
  • personal study plan (HOPS) and related information
  • international study and internship exchanges

• Study performance information
  • studies carried out
  • evaluations of studies and exams
  • evaluators of studies and exams
  • performance dates
  • performed scopes
  • progress in studies
  • completion status

• Applicant information
  Applicant information imported from Opintopolku/Oili services
  • the student’s personal information (first names, nickname, last name, first name,
  • student number)
  • address information
  • mother tongue and business language
  • citizenship
  • basic training information
  • information related to the application and education
  • registration and payment information
  • information related to the permission to publish the results of the student selection

• Course feedback information
  • Identification information internal to the information system
  • Email address
  • Information related to study rights and performance
  • Course feedback answers (may contain personal information)
  • Role in the organization
  • Organizational units

• Cross study
  Cross-study refers to the opportunity offered to a higher education student to complete studies at another higher education institution. Updated information is in italics.
  
  • Study information
    • Educational classification
    • Starting organization
      
  • Cross study
    • Identification of the right to study (in Kotikk)
    • Type of study right
    • Training program
    • Degree
    • Education sector
    • Email (in Kotikk)
    • Organization
    • Start and end date of the right to study
    • Educational classification
    • Degree title (AMK)
    • Type of training
      
  • Personal information
    • Last name
    • Nickname
    • First names
    • Date of birth
    • Social security number (if any)
    • Learner ID (if any)
    • Citizenship
    • Gender
    • Mother tongue
    • Business language
      
  • Contact information tab
    • Phone number (not updated if there is a security ban)
    • Place of residence
    • Other email address
    • Home county (The value is 999 if there is a security ban)
    • Security prohibition
      
  • Data transfer permission tab
    • security ban

Remotely supervised exams in exceptional situations (e.g. Covid-19)

• The university supervises the completion of exams to ensure equal treatment of students. In remote monitoring, the university can primarily use a live image or login, activity and log data collected by information systems.
• The university can check your identity for the exam.
• Participation in remote monitoring in a private location of your choice is voluntary. By participating in remote monitoring, you agree to the terms of the monitoring, such as keeping your camera on. You have the right to interrupt supervision during the exam, for example due to an unexpected situation, but interrupting supervision may lead to the rejection of your exam performance.
• When processing personal data, the university’s data protection and information security guidelines are followed.
• Your teacher will provide more detailed information about other details of the exam.
  

The key regulations concerning remotely supervised exams

• In accordance with the University of Applied Sciences Act, education, teaching and awarding degrees are part of the statutory duties of the university of applied sciences.
• Universities of applied sciences must organize their activities in such a way that e.g. in education and teaching, a high international level is ensured by following ethical principles and good scientific practice.
• Students’ skills can be assessed with an exam, quiz or other equivalent coursework.
• The basis for examination supervision and related personal data processing is the performance of a statutory task (data protection regulation 6 art 1 c and e).
• The proctor of the exam is obliged to remain silent if he learns something about the personal circumstances of the examinee while carrying out measures related to the processing of personal data (Data Protection Act 1050/2018 § 35).
• Test results are confidential documents (Act on the Publicity of Officials 24.1 § 30).

Students’ personal information is stored in the student administration system, where its users have personal user IDs. The use of the system is based on user rights. The information in the system can be accessed and used only by those persons of the controller who have the right to it for their work, e.g. student services and teaching staff.

1. Regular disclosures of information

In the cases stipulated by law, student and study data are disclosed to the following parties

• Student, credit and degree performance data to Statistics Finland, which forwards the data to the Board of Education and the Ministry of Education and Culture. (Statistics L 280/2004).
• Student and study performance information for the National Pension Service (OpintotukiL 65/1994 § 41).
• To the labor authority, the National Pension Institute or the unemployment fund for processing the conditions for receiving labor market support and unemployment allowance (TyöttömyysturvaL 1290/2002, L on public employment and business services 1295/2002)
• To the National Pension Service upon request for the evaluation of social benefits (study certificate, transcript, progress of studies)
• To the immigration authority and the police authority, upon request, for checking the residence permit (notice of acceptance as a student, acceptance notice of a place of study, study certificate and
• transcript).
• For scientific research (JulkiL 621/1999 and HetiL 523/1999). The requester must present to the data controller the purpose of use of the data as well as other facts necessary to clarify the conditions for handing over the data. If necessary, an explanation of how data protection is to be provided
• is to be organized.
• To the municipality organizing student health care in accordance with the Public Health Act (66/1972) and to other organizers of student health care in accordance with the aforementioned law for the purpose of performing this task
• SORA legislation, University of Applied Sciences Act 932/2015, University of Applied Sciences Decree 1129/2014, Act on Student Legal Protection Board 956/2011, Act on Amending Section 6 of the Criminal Records Act 955/2011 (14.11.2014/932)
• For CSC (Tieteen tietotekniikan keskus Oy) VIRTA and via VIRTA to the OILI service. VIRTA is a national database of higher education institutions.
• For Valvira, qualifications and degree information, decisions to cancel and restore the right to study.

As the data controller, Xamk can transfer personal data to its own registers that are closely related to the purposes of use of this register, the data subject could reasonably have expected at the time and in connection with the collection of personal data. In addition, student data is disclosed:

• To the user management system of the Southeastern Finland University of Applied Sciences for the creation of online and e-mail IDs (student number, surname, nickname, group, education/training program, campus, attendance information, social security number, address information, language of business, degree information, Kela meal subsidy right
• For Southeast Finland’s own use for creating email lists (email address). Lists are still not handed over for use other than what they were created for. Email messages are sent so that the recipient cannot see to whom the same message has been sent.
• The necessary information is transferred to Xamki’s database for internal use of the Southeastern Finland University of Applied Sciences, for reporting and operational management.
• To the library system of the library of the University of Applied Sciences of Southeast Finland for creating user IDs and borrowing rights (first name, last name, social security number, street address, zip code, post office, phone number, email address).
• Career and recruitment system of universities of applied sciences in Jobiili (student number and date of birth).
• International mobility management system. For outgoing exchanges, the student number, exchange destination and country, exchange dates, mobility program (long exchanges) and type of exchange are transferred. The information necessary to create both the person and the statistical mobility period is transferred from the incoming exchanges.
• Paid training management system
• Alumni system. Name, date of birth, phone number, e-mail address, postal address, completed degrees, start year of studies, year of graduation and place of study are transferred from graduated students.
• Study course feedback program of Southeastern Finland University of Applied Sciences. The course feedback program uses the student’s personal data registered in the study management system. The program processes data anonymously so that program users cannot access the student’s personal data. The feedback is processed completely anonymously in the program. To ensure anonymity, teachers cannot see the feedback given for the course until at least five have been given for the course. At no point do the students see each other’s feedback. Open feedback given by students can be published as such, but it is done in such a way that the feedback cannot be linked to an individual course and thus identify an individual student. Course-specific open feedback is not published for students.
• Cross study service. The cross-study service manages the information sent to and received from the national cross-study service. Cross-study refers to the opportunity offered to a higher education student to complete studies at another higher education institution. The defined personal and contact information is transferred from the home university to the target university when it is a completely new identity. If the person has a previous right to study at the target university, the information is not updated through the national service.
• Xamk hands over information from its register to the Continuing Learning and Employment Service (Jotpa) to perform its statutory duties. Legislation and the service center’s right to access information that is the basis for the transfer of information. According to Section 2, Subsection 1, Clause 3 of the Act on the Continuing Learning and Employment Service Center, the service center’s task is to finance training and other skills services aimed especially at those in work and those outside the labor force and supplementing other publicly supported training offerings. In addition, according to Section 2, Subsection 1, Clause 2 of the Act on the Service Center for Continuous Learning and Employment (628/2021), the task of the service center is to analyze knowledge and labor demand forecast information related to its industry. The information is extracted through information already stored in the VIRTA study information service.
• Student well-being and guidance service management system (name, phone number, e-mail address, business language, degree, place of business).

2. Irregular disclosures of information

The student gives his consent to the use of his name and address information through the student interface of the student and study information system. The student gives permission to hand over his contact information for the following purposes:

For direct marketing. Even if the student has given permission for direct marketing, the transfer of data will never happen automatically, but on a case-by-case basis by the main user of the system. As a general rule, information is not disclosed.

For educational marketing. For the purposes of supporting studies, to associations and foundations, professional associations and mainly to regional authorities for mailing information that

• is intended to promote studies, professional skills or placement in a profession
• is intended to improve study or work conditions
• is intended to promote the student’s connections with his home region
• for other purposes that support studying, for example research, surveys or conducting opinion polls

Publication of graduation information. The student can give permission to publish his graduation information. As a general rule, information is not disclosed.

Internet. The student’s e-mail address can be included in the e-mail address search engine on the intranet page of the university of applied sciences. In this case, you can find the student’s e-mail address on the internal pages of the Southeast Finland University of Applied Sciences when you know his name.

Xamk does not transfer personal data to countries outside the EU or EEA.

However, Xamk provides students with access to Microsoft services, such as email and storage space in the cloud (OneDrive). As a rule, Microsoft processes data in the EU/EEA and in regional data centres. Microsoft is committed to complying with the EU General Data Protection Regulation. Microsoft’s Privacy Statement can be found at: https://privacy.microsoft.com/fi-FI/privacystatement

Data is stored in accordance with the storage periods defined in the data management and filing plan of the South-Eastern Finland University of Applied Sciences.

• Students have the right to access their personal data. The student has the opportunity to check the information registered about him also via the student connection.
• The student has the right to demand that XAMK correct inaccurate and incorrect personal data concerning him without undue delay. The student can correct his contact information himself through the student user interface.
• The student has the right to delete data to the extent that the legislation does not oblige them to keep it.
• The student has the right to limit processing in situations regulated by Article 18 of the EU Data Protection Regulation.
• The student has the right to object to the processing of his/her personal data in situations governed by Article 21 of the EU Data Protection Regulation.
• Regarding the data whose processing is based on consent, the student has the right to transfer the data from one system to another or to withdraw the consent he has given to the processing of his personal data at any time.
• The request is made in writing to the data protection officer or with an electronic form (xamk.fi/tietosuoja).
• The student has the right to file a complaint with the supervisory authority.

Xamk receives student information from the following sources

• Opintopolku, the national applicant register maintained by the Board of Education
• National OILI register maintained by the Board of Education
• Information provided by applicants for applications outside the study path on the application form
• User management system
• Examination system
• International mobility management system
• Paid training management system
• Cross study service