Privacy policy – Peppi student and study register

EU General Data Protection Regulation (2016/679)

Updated on September 30, 2025

1 Name of the register

Peppi student and study information register

2 Controller

Jyväskylä University of Applied Sciences Ltd
PL 207, 40101 Jyväskylä
+358 20 743 8100

3 Contact person

Director responsible for the register: Vice Rector for Education

Process owner responsible for the register: Head of Education Services

Content administrator: Head of Education Services

Technical administrator: ICT Services

firstname.lastname[a]jamk.fi

4 Processing of personal data and its purpose

The collected personal data are used for teaching, to provide student services and for student administration.

The registered persons (students, teachers, other staff) are parties related to Jamk’s study information management and studies.

The student and study information register of Jyväskylä University of Applied Sciences processes data to enable studying at the university and to administer the university’s study information. This includes planning, implementation, monitoring, and evaluation of teaching. The purpose of Jamk’s student and study information register is to record, manage, and maintain information about students and their studies and performance, to produce various study-related certificates and reports for its own and research activities, and to transfer data to authorities. The student and study information register is an essential tool for Jamk in planning, implementing, evaluating, and monitoring its activities.

The joint controllers of Jamk’s student selection register are the Finnish National Agency of Education and Jamk. The Finnish National Agency of Education is responsible for compiling the data in the student selection register and for the nationwide implementation of the application systems, as well as for general information, guidance, and counseling related to applying for education and student admission. As an education and training provider, Jamk is responsible for the accuracy of the data it stores and the data subject’s right to rectify the data. The Finnish National Agency of Education is responsible for other obligations imposed on the controller by the General Data Protection Regulation.

VIRTA data repository is a national data repository for the centralized storage and use of data on higher education institutions’ right to study, enrollment, degrees, and study performance. The VIRTA data repository compiles the student data from higher education institutions. Through this, the data is made available in a secure manner for the student selection register and the joint student selection services of higher education institutions. The joint controllers of the VIRTA data repository are the Ministry of Education and Culture and Jamk. The Ministry of Education and Culture is responsible for the general operation of the data repository and the technical connection for the storage, processing, and transfer of data. Jamk is responsible for the accuracy of the data it stores and the right of the data subject to correct the data. The Ministry of Education and Culture is responsible for other obligations imposed on the controller by the General Data Protection Regulation.

Cross-study programs between higher education institutions comply with the jointly agreed principles for the processing of personal data implemented by CSC: Processing of personal data – Cross-study service – Eduuni wiki

5 Data content of the register

The data subjects are the staff and students of the university of applied sciences, including the following information:

Study information—curricula, studies (study modules and periods), course implementations
Resource planning and reservation information – work schedules, teaching facilities
Basic staff information: user ID, surname, first name, job title, email address, organizational unit

The basic register contains the following information:

Basic student information: student information: student number, username, national learner ID (OID), last name, first names, nickname, (former last name), personal ID number, date of birth, gender, nationality, native language, language of communication, language of schooling, contact details (address, telephone number, email), details of next of kin, municipality of residence, country of residence, foreign passport number, study and degree details: education classification, education program/education, group, template information, form of education, teaching location, language of instruction, type of student, degree, degree title, scope to be completed, required scope, basic education, attendance, graduation information, dismissal information, period of study entitlement, maximum periods, periods used, personal study plan (HOPS), study achievements and assessment, study progress, certificate entries, directives and qualifications, funding, organizational unit, additional information related to study rights and roles, permissions for disclosure of information
Applicant information, applicant information imported from the Opintopolku/Oili services: student personal data (first names, nickname, last name, personal identification number, student number address details, native language and language of communication, nationality, basic education details, information related to the application target and education, registration information and payment information, information related to the publication of student selection results
Study and study performance data – studies (study modules and periods), course implementations, personal study plan (PLP) and related information, international study and training exchanges -completed studies, study and exam assessments, study assessors, completion dates, completed scope, study progress, graduation status
Staff information – first name, last name, user ID, email, supervisor, organization code, office code, cost center code, title, activity information (whether employed).

In addition, numerical and verbal feedback from students about course implementations is collected in the Peppi course feedback system (OJP). Feedback is reported anonymously. The data may include textual data that enables the identification of an individual person. Information about course implementations, their teachers and students in the Peppi course feedback system is used in the grouping of data.

Course feedback (OJP) and artificial intelligence-assisted processing (AI)

• After removing personal and identification data, feedback summaries can be analyzed using an AI application to develop education.

• Data may only be processed in the Peppi course feedback (OJP) system and with software approved by the Jamk ICT services, with Jamk credentials.

• Before using the AI, the handler must permanently remove the personal data from the feedback.

• Conclusions about the person may not be drawn from the material processed by the AI.

• The data handlers can submit anonymized and AI-assisted results to those responsible for education development at Jamk.

• AI-assisted results are processed by the management of Jamk and units, the quality manager and quality officers, the managers responsible for education, and the education and degree coordinators.

The following personal data is stored in the student and study information register:

STUDENT’S BASIC AND CONTACT INFORMATION: First names Nickname Last name Former last name; National student ID (OID) Student number Personal identity number Date of birth Gender User ID Nationality Native language Language of communication Language of instruction Contact details (postal address, telephone number, email address) Home municipality Municipality of residence Country of residence Foreign student’s passport number

STUDY AND DEGREE INFORMATION Education classification Education program Specialization options Group; Form of education Teaching location Language of instruction Type of study Degree Degree title; Scope to be completed Required scope Basic education Attendance, completion and withdrawal information Period of study entitlement Maximum number of terms used Certificate entries and qualifications Financial information Organizational unit Additional information related to study entitlement and role Permissions for disclosure of information

APPLICANT INFORMATION/ APPLICANT INFORMATION FROM THE OPINTOPOLKU.FI SYSTEM Student’s personal information (first names, nickname, last name, personal identification number, student number) Address details Native language and language of communication Citizenship Basic education details Information related to the application target and education Enrollment and payment details Information related to the publication of student selection results

STUDY DATA Studies (study modules and periods) Study period implementations Personal study plan (HOPS) and related information; International study and training exchange periods

STUDY PERFORMANCE DATA Completed studies Study and exam assessments Study and exam assessors Completion dates Completed scope Study progress Graduation status

INFORMATION ON THE ARCHIVING OF STUDENT STUDY DATA Information on the archiving of the above-mentioned data

COMMUNICATION DATA RELATED TO STUDENT STUDY DATA Communication between the student and the study counselor and/or teacher regarding study matters by email or in the Peppi system

6 Basis for processing

Statutory duty/obligation

The processing of personal data in Jamk’s student and study information register is based:

for the most part, the statutory obligation of the controllers and the exercise of public authority with regard to the processing of study, personal, and contact data
Act on Universities of Applied Sciences (932/2014)
Act on the National Registers of Education Records, Qualifications and Degrees (884/2017)
EU General Data Protection Regulation (2016/679)
Data Protection Act (1050/2018)
Act on the Openness of Government Activities (621/1999)
Act on the Protection of Privacy in Working Life (759/2004)
Administrative Procedure Act (434/2003)
Non-Discrimination Act (1325/2014)
Jamk Degree Regulations
Statistics Act (280/2004)
Student Financial Aid Act (65/1994)
Unemployment Security Act (1290/2002)
Act on Public Employment and Business Services (916/2012)
Public Health Act (66/1972)
Aliens Act (301/2004)
Archives Act (831/1994)
Consent

7 Regular sources of information

Personal data is mainly obtained from the data subject themselves. In addition, data is obtained from the following regular sources of information in Jamk’s student and study information register:

Applicant data from the national Opintopolku.fi service maintained by the Finnish National Agency for Education

The OILI register of enrolments, which is maintained by CSC Ltd (Center for Science and Technology Ltd) but falls under the responsibility of the Finnish National Agency of Education, provides information on students’ enrolment as present or absent

From the application forms of applicants outside the Opintopolku.fi service (information provided by the applicant themselves)

From updates provided by the student themselves, changes to contact details, and permissions to transfer data directly to different systems

The Digital and Population Data Services Agency

Jamk’s user administration

MobilityOnline system for international mobility (i.e., student exchange)

The cross-study service maintained by CSC.

The management system for fee-based education

Other higher education institutions and educational institutions through Recognition and Accreditation of Prior Learning.

8 Regular disclosure of data and transfer of data outside the EU or the European Economic Area

Yes, data is disclosed from the register on a regular basis. In the cases provided for by law, the following information is disclosed from the student and student information system:

Information for the Ministry of Education and Culture to support research, evaluation, development, monitoring and guidance. Student, study attainment and degree attainment data to Statistics Finland, which also forwards the data to the Finnish National Agency for Education and the Ministry of Education and Culture. (Statistics Act 280/2004).

AVOP survey to the Ministry of Education and Culture in the form of a student feedback survey coordinated by the Ministry of Education and Culture aimed at students in the graduation phase.

Responses given to the Finnish National Agency for Education’s ARVO impact information service in the form of a questionnaire (Technical administrator is by CSC Oy).

With regard to international student mobility, the Finnish National Agency for Education, the European Union and other potential funders of the mobility programme in order to enable the monitoring of the activities

CSC (IT Center for Science Ltd) to VIRTA and through VIRTA to the OILI service. VIRTA is a national information repository for higher education institutions. (Act on the National Registers of Studies and Qualifications 884/2017).

The following are transferred to the Opin.fi service from Peppi: the offering of the Open University of Applied Sciences (study modules, courses and implementations) and the related description information, themes and classifications. The teacher’s name information is transferred from Peppi to the Opin.fi service. The student’s attainment data is transferred from Peppi to the Opin.fi service through the Virta service with the student’s consent.

The following are transferred to the Opin.fi service from paid education: the offering of the Open University of Applied Sciences (study modules, courses and implementations) and the related description information, enrolment periods and price information.

The technical administrator of the Opin.fi service is HigherEdHub Finland Oy (HEHF) higher education cooperation (Data processing agreement between higher education institutions and HEHF).

Student and study attainment data is disclosed to the Social Insurance Institution of Finland (Kela) at its request for the purpose of assessing student social benefits (study certificate, transcript of records, study progress) (Act on Student Financial Aid 65/1994).

To a municipality organising student health care in accordance with the Public Health Act and to another organiser of student health care in accordance with the said Act for the performance of this task. (Public Health Act 66/1972).

To the employment authority, the Social Insurance Institution of Finland (Kela) or an unemployment fund for processing the conditions for receiving labour market subsidy and unemployment allowance (Unemployment Security Act 1290/2002 and the Act on Public Employment and Business Service 916/2012).

To the Finnish Immigration Service and the police upon request for a check of the residence permit (notification of student acceptance, notification of acceptance of a study place, certificate of study and transcript of records). (Aliens Act 301/2004).

For scientific research (Act on the Openness of Government Activities 621/1999 and Data Protection Act 1050/2018). The requester must present the controller with the purpose of use of the data and other matters necessary to determine the conditions for disclosing the data. If necessary, an explanation must be provided as to how the protection of the data is to be arranged.

From Jamk’s degree programmes in social and health care, the degree data and professional qualifications of graduates are forwarded to the National Supervisory Authority for Welfare and Health (Valvira). Valvira maintains a national register of health care professionals (Terhikkiä) for the purpose of confirming and monitoring professional qualifications.

In addition, student data is disclosed:

Students have the opportunity to give their consent to the use of their name and address information through the Peppi system’s student interface. If they wish, the student can give permission to disclose their contact information for the following purposes:

Direct marketing: Even if the student has given their consent to direct marketing, the disclosure of data is never automatic, but on a case-by-case basis by the responsible users of the system. As a rule, the data is not disclosed.

For educational marketing: For educational support purposes to associations and foundations, professional associations and mainly regional authorities for the purpose of mailing information that:

is intended to promote studies, professional skills or professional placement
is intended to improve study or working conditions;
is intended to promote the student’s connections with their home region
for other purposes that support studying, such as surveys, surveys or conducting opinion polls

Data is transferred outside the EU or EEA and/or to international organisations

The personal data contained in Jamk’s student and study data register may be transferred outside the EU or EEA in connection with international student admissions and student exchanges, as well as in a situation where the student participates in international RDI activities (research, development and innovation activities).
In addition, in order to implement the ICT services necessary for the completion of studies, the personal data contained in Jamk’s student and study data register may be transferred outside the EU or EEA. Only necessary data will be transferred and the transfer will be carried out in accordance with and within the limits set by data protection legislation. The security and data protection of the transfer are always agreed upon separately.
In addition, there are exceptions to situations where the student activates a separate service, such as the Microsoft Office 365 service. In this case, the service in question will be provided with the necessary information it needs. However, in such an exceptional case, the student will be asked for permission separately and the acceptance of the terms of use will be required.

9 Principles of register protection

In the processing of the data in the register, care is taken to ensure that students’ privacy is not unjustifiably endangered. Material:

are stored and protected in such a way that they cannot be seen by outsiders and cannot be accidentally destroyed, altered, disclosed, transferred or otherwise unlawfully processed. • Employees have the right to see only such information about the student that they need for their work
documents containing personal data are destroyed by shredding or as data protection waste
Network and server equipment are centralized in locked Jamk premises, which have strict access. The network and servers are properly secured.
Access rights are limited by user group. The visibility of information and the right to update the system are determined by security roles for different user groups.
Only those who have been granted access to the system have access to the data. The right to use the system is determined by the person’s work duties or study status. The staff is bound by the confidentiality obligation defined in the employment contract.

10 Retention period of personal data or criteria for determining the retention period

The personal data collected in Jamk’s student and study data register is stored as follows:

Credited credits: Credited credits are stored permanently. They are stored in the Peppi information system, and through the VIRTA data transfer, they are also transferred to the national VIRTA data repository for permanent storage. All credits are regulated by the Act on National Study and Degree Certificates.

Special data related to the organisation of student admissions (including health data):The processing of personal data in the register is to a certain extent based – with regard to applying for student admission and registering in the student admissions register – on information provided by the applicant about his or her state of health or functional capacity. The information concerning the applicant’s state of health is such that the applicant to the higher education institution has wanted to bring into account when organising the admissions. The processing of this data is based on the consent of the data subject, partly on the exercise of public authority and partly also on the implementation of the Non-Discrimination Act. They are stored for a maximum of 4 years and they are removed from the register no later than four years after the entry of the data. (Processing of sensitive data, section 40 of the Universities of Applied Sciences Act, 932/2014).

Written study attainments (e.g. paper exam answers): In accordance with the Universities of Applied Sciences Act, Jamk stores written study attainments (e.g. paper exam answers) for six months from the publication of the results. After this, teachers and examiners destroy the paper versions of the deliverables in a shredder and/or a dedicated data protection container.

Other data in the Student and Study Data Register: Other data in Jamk’s Student and Study Data Register and their storage are regulated by the National Archives of Finland’s regulation on the permanent storage of data in the information systems of universities of applied sciences only in electronic format

11 Profiling and automated decision-making

The data in the register is not used for automated individual decisions or profiling.

12 Rights of the data subject

More information on data protection, the rights of the data subject and their implementation can be found in Jamk’s data protection statement and on the Data subject’s rights page.