Privacy statement
Updated 14.6.2024
1 Introduction
This Privacy statement describes how personal data are processed in Opin.fi service. It also explains what rights you have as a data subject and how you can use them. The Privacy statement applies to learners who use the site. Opin.fi service is part of the Finnish higher education institutions’ shared Digivision 2030 project. The participating institutions are the controllers of personal data.
This Privacy statement will be updated regularly. You can also find the most recent version at: privacy statement(Avautuu uuteen välilehteen).
2 Controller’s and Data Protection Officer’s contact details
Finnish higher education institutions are joint controllers of the Opin.fi service. The service provider, HigherEd Hub Finland Oy, is your contact point for data protection matters. You can contact them by email: tietosuoja@opin.fi.
For an up-to-date list of the joint controllers and their contact details, visit: joint controllers(Avautuu uuteen välilehteen)
3 Purposes of processing, data types, applicable legal bases and storage periods
| Purpose of data processing | Data types | Applicable legal | Storage period |
|---|---|---|---|
| Publication of study options |
| Public interest | until further notice |
| Identification of users |
| Agreement | 1 year from last login |
| Processing of information on the learner's completed studies |
| Consent | 1 year from last login while consent remains valid |
| Recommendations for suitable courses |
| Consent | 1 year from last login while consent remains valid |
| Analysis and statistics relating to site use and participation in courses |
| Consent | 2 years after collection |
| Ensuring the technical security of the site and investigating abuses |
| Legitimate interest | 2 years |
4 Source of information
As a rule, profile information is collected directly from the learner. In connection with identification, the learner’s personal data are obtained through HAKA user identification and from the learner number register of the Finnish National Agency for Education: learner number register(Avautuu uuteen välilehteen). Information on completed studies is obtained from Virta higher education achievement register. Technical information on site use is collected by using cookies.
5 Disclosures to third parties and international data transfers
User data can be disclosed to higher education institutions in connection with course registrations. Statistical data on course participation are also disclosed to higher education institutions. To implement the service, external service providers are used for the following purposes:
- Service provision and profile management
- Analytics
The service providers we use have a contractual obligation to ensure a high level of data protection when processing the data.
6 Data subjects’ rights
6.1 Using your rights
As a data subject you have many rights by which you can influence the way your personal data are processed. You can use the rights listed below directly through your profile or by emailing a request to: tietosuoja@opin.fi.
6.2 Right to be informed
Data subjects have the right to be informed about personal data processing we carry out in a transparent and easily understandable form. This Privacy statement provides basic information about the processing of personal data. If you have any questions about data protection, please contact: tietosuoja@opin.fi for more information.
6.3 Access to data
Data subjects have the right to be informed of which personal data concerning them we process and to receive a copy of the data in question if they wish.
6.4 Rectification of data
Data subjects have the right to request rectification or correction of their data, in which case we will supplement inaccurate or incorrect data.
6.5 Restricting the processing of data
Data subjects have the right to demand that the processing of their personal data is restricted. This means that the data are retained but, in other respects, they are only processed based on consent, to meet a legal requirement, to protect the rights of another person or for an important reason of public interest of the European Union or one of its Member States. The restriction of processing can be used if, for example, the lawfulness of data processing has been disputed. In this case, the processing of the data will be restricted until its lawfulness has been verified.
6.6 Objecting to the processing of data
Data subjects have the right to object to the processing of personal data for a personal reason if the processing is based on a legitimate interest, public interest or the exercise of official authority. The processing of the data will be discontinued unless it is necessary for some other justified reason.
6.7 Transferring information
Data subjects have the right to request that their personal data are transferred from one system to another (‘right to data portability’). This right may be used when the personal data have been obtained directly from the data subject and their processing has been based on an agreement or consent.
6.8 Erasure of data
Data subjects have the right to have all of their personal data erased (‘right to be forgotten’). This right may be used if, for example, the data subject withdraws their consent on which the processing was based and no other legal basis is applicable to the processing.
6.9 Lodging a complaint
Data subjects have the right to lodge a complaint with the competent supervisory authority concerning the processing of personal data. The data protection authority in Finland is the Office of the Data Protection Ombudsman.