Student register

Information to the data subject in accordance with the EU General Data Protection Regulation (2016/679) articles 13-14.

1. Controller

Arcada University of Applied Sciences Ltd
Jan-Magnus Janssonin aukio 1
00560 Helsinki
Business ID: 2553871-2

3. Contact person for the register

Senior System Developer Krister Karlström
Tel. 0294 282 509

International Coordinator Kátia Torres Airava
Tel. 0294 282 868

Head of Student Affairs Lilian Sjöberg
Tel. 0294 282 671

E-learning Coordinator Filip Levälahti
Tel. 0294 282 518

E-mail address in the format firstname.surname@arcada.fi, the study coordinator studentaffairs@arcada.fi

5. Purposes of processing personal data

The students’ personal data is processed in order for Arcada to fulfill its obligations as a university. The obligation contains enabling students to take part in teaching and receive counseling, guidance and other services, to complete studies and receive study related certificates as well as degree certificates. The data may also be used for reporting to authorities.

There are six categories of students at Arcada:

  1. Degree students (bachelor and master degrees)
  2. Specialization students and further education students
  3. International exchange students
  4. Students at the Open University of Applied Sciences
  5. Students through national collaboration between universities (based on contracts)
  6. Other students (for example commissioned courses and programmes)

The processing of personal data is based on Arcada’s role as an organizer of higher education. The basis for processing is Arcada’s legal obligation as well as performance of tasks carried out in the public interest or in the exercise of official authority, and in some situations the student’s consent or a contract (General Data Protection Regulation, article 6).

The processing ensures that students’ study rights and legal protection is handled in an appropriate and equal way and the authorities’ need for information and data collection is accommodated.

Arcada processes data that belongs to special categories of personal data (according to the General Data Protection Regulation, article 9). Data about a student’s state of health is processed with the consent of the student to assess and accommodate the need for special arrangements in his or her studies and examinations. Data about the student’s state of health may also be used to assess the student’s suitability for degree programmes for which suitability requirements are stated in the legislation.

The central acts, regulations and provisions by authorities when processing personal data are:

Universities of Applied Sciences Act (932/2014)
Government Decree on Universities of Applied Sciences (1129/2014)
Act on the Openness of Government Activities (621/1999)
Decree on the Openness of Government Activities and on Good Practice in Information Management (1030/99)
Act on National Education and Degree Registers (884/2017)
Archives Act (831/1994)
The National Archive’s Decision on Permanent Storage of Thesis’ for Universities of Applied Sciences 16.9.2014 (AL/2897/07.01.01.03.01/2014)
Arcada’s Degree Statues

7. Categories of personal data and the duration of storage

1) Basic data

Data IT System Storage
Name ASTA, itslearning, MoveOn Permanently
Social security number ASTA, MoveOn Permanently
Date of birth ASTA, MoveOn Permanently
National student number ASTA Permanently
Gender ASTA, itslearning Permanently
Nationality and/or country of birth ASTA, MoveOn Permanently
Mother tongue & language of education ASTA Permanently
Municipality of residence (at the beginning of the studies and during the studies) ASTA Permanently
Earlier degrees and education ASTA Permanently
Username to Arcada’s IT services ASTA, itslearning Permanently
Local Register Office’s decision on prohibition to disclose address information ASTA Permanently

2) Contact information

Data IT System Storage
Address and phone number, municipality of study ASTA 2 years
Address and phone number. municipality of residence ASTA, MoveOn 2 years
E-mail address ASTA, MoveOn Permanently
Name, address and phone number of next of kin ASTA, MoveOn 2 years

3) Rights to study

Data IT System Storage
Student code ASTA, itslearning, MoveOn Permanently
Degree programme ASTA, itslearning, MoveOn Permanently
Type of right to study ASTA, MoveOn Permanently
Application number ASTA Permanently
Start and end date ASTA Permanently
Reason for termination of right to study ASTA Permanently
Decisions on extended, re-enrolled and renewed right to study ASTA Permanently
Application for degree certificate ASTA Permanently
Possible comments relating to the right to study ASTA Permanently
Registrations for the academic year ASTA Permanently
Payment information (tuition fees) ASTA Permanently

4) Study attainments, partial study attainments and examination results

Data IT System Storage
Course name and code ASTA Permanently
Study credits, grades, date of performance ASTA Permanently
Examiner and date of registration ASTA Permanently
Type of attainment (course, practical training, thesis) ASTA Permanently
Start and end date of practical training ASTA, MoveOn Permanently
Place, type and country of practical training ASTA, MoveOn Permanently
Examination (grade, points, date) ASTA, itslearning Permanently
Possible comments ASTA, MoveOn Permanently

5) Degree thesis

Data IT System Storage
Title and language ASTA Permanently
Supervisor and assessor ASTA Permanently
Potential commissioner of thesis ASTA Permanently
Potential partial study attainments ASTA Permanently
Data on presentation of thesis and maturity test ASTA Permanently
Data on submitted copies ASTA Permanently

6) International mobility (both studies and practical training, incoming and outgoing)

Data IT System Storage
Start and end date of exchange period MoveOn Permanently
Country of departure and country of destination MoveOn Permanently
Type of exchange (studies or practical training) MoveOn Permanently
Exchange programme (eg. Erasmus+) MoveOn Permanently
Degree programme and field of study MoveOn, ASTA Permanently
Sending and receiving institution MoveOn Permanently
Travel report MoveOn 10 years
Certificate of the exchange MoveOn 10 years
Photograph of the applicant MoveOn 10 years
Learning agreement MoveOn 10 years
Transcript of records MoveOn 10 years
Language certificate MoveOn 10 years
Identity documents (eg. passport copy) MoveOn 10 years
Application letters and attachments MoveOn 10 years
Potential project plan for thesis MoveOn 10 years
Motivation letter MoveOn 10 years
Housing preferences MoveOn 10 years
Need for special arrangements and support MoveOn 10 years
Grant information MoveOn 10 years
Potential additional information MoveOn 10 years

7) Data collected by electronic forms management service e-lomake and attachments to it

Data Storage
Changes in attendance and absence 10 years
Termination of studies 10 years
Application for re-enrollment 10 years
Application for renewed right to study 10 years
Application for extended right to study 10 years
Application for accreditation or validation 10 years
Application for degree certificate 10 years

8) Data stored on paper, such as forms and annexes

Form Storage
Registration for academic year 10 years
Certificate for student in need of special pedagogical support Period of validity

8. IT systems used when processing personal data

ASTA – system for study administration
e-lomake - electronic form management
Insight – system for follow-up of study progress
itslearning – online learning environment
Microsoft Teams - system for online teaching and online exam supervision
Mira Network CRM - system for administering graduated students
MoveOn – system for processing international student mobility
Urkund – system for plagiarism check
Sarake Sign - electronic signature service 
Sisu - new system for study administration (system is being introduced) 
TUUDO -mobile application connected to ASTA
Zoom - system for online teaching and online exam supervision

9. Data sources

Basic data and contact information is transferred from Arcada’s applicant register. Students can and have an obligation to update their contact information in the register themselves.

10. Recipients of the personal data

Data is transferred to the national data warehouse VIRTA, from which most authorities have legal rights to collect information. In addition to the statutory purposes, Arcada also discloses data from VIRTA, to the following services when necessary:

  • OILI (registration for the academic year, CSC)
  • Follow-up questionnaires (Ministry of Education and Culture, CSC)
  • AVOP/ARVO (student response, Ministry of Education and Culture and CSC)
  • PURO (national study attainment transfer service, CSC)
  • EMREX (international study attainment transfer service, Ministry of Education and Culture and CSC)
  • UAF (University Admissions Finland consortium, international application service, CSC)
  • FSHS (Finnish Student Health Service)
  • FIONA (data for research purposes, Statistics Finland)
  • TUUDO (mobile application, Tuudo Oy)
  • Arcada Student Union - ASK (only with the student’s consent)
  • Library register of borrowers (Arcada’s library, only with the student’s consent)
  • Alumni register (only former students with their consent)
  • User Administration Register
  • The city of Helsinki’s social services and health care division (new students,yearly)

The disclosure of data to the authorities is based on legislation. Disclosure of data to other services is based on separate decisions made by Arcada.

Data can also be disclosed to research and, with the student’s consent, to organizations for marketing purposes or for carrying out opinion polls.

11. Transfer of personal data outside the EU and the EEA and the basis for the transfer

Personal data is not regularly transferred outside the EU or the EEA without the student’s consent.

If suppliers or services which require personal data to be transferred outside the EU or the ETA are used, Arcada will make sure that the requirements for adequate level of protection are met or that appropriate safeguards are provided in accordance with the General Data Protection Regulation 44-50.

12. Principles for the protection of personal data

Material in electronic format is stored in IT systems and on computers protected from unauthorized use with security measures including firewalls and passwords. The systems have different user levels, and users are granted access to the data only to the extent the user’s work tasks require.

Material in paper format is stored in locked rooms with limited access and access control.

13. Automated decision-making

Automated decisions and profiling are not made based on personal data within the register.