Peppi Paid Education – Privacy Statement
EU General Data Protection Regulation (2016/679)
Updated 16.10.2024
1 Name of the Register
Peppi Paid Education
2 Data Controller
Jyväskylä University of Applied Sciences Ltd
PL 207, 40101 Jyväskylä
+358 20 743 8100
3 Contact Person for Register Matters, Contact Information During Office Hours
Register Manager: Vice Rector, Education
Process Owner: Education Services Manager
Content Administrator: Educational Development Services
Technical Administrator: ICT Services
firstname.lastname[a]jamk.fi
4 Processing of Personal Data and Its Purpose
Personal data is collected to organize open university courses, free supplementary education, and specialization education at Jyväskylä University of Applied Sciences (Jamk). This includes creating offerings, tracking registrations, and admitting students to studies. The student and study information register for paid education is essential for Jamk’s planning and monitoring activities. Paid education also requires the payer’s personal identification number and contact information (person/employer).
Personal data is processed and maintained in accordance with national data protection legislation and the General Data Protection Regulation. Only Jamk employees with granted access and whose duties include processing personal data handle the information.
Personal data is stored in the system’s personal register. To enable studies, it is transferred programmatically to the Peppi study information system maintained by Jamk.
5 Content of the Register
The registered individuals are staff and students of the university of applied sciences. The study register for Peppi’s paid education includes the following study-related information:
Study details and their capacity
Payment and accounting information, and registration details
Basic information of the study contact person and recorder: first name and last name
The student register for paid education includes the following information. The student’s personal and contact information is transferred to the Peppi student and study register, where study and performance information is recorded.
Student’s personal information: last name, first names, preferred name, nationality, personal identification number, date of birth, gender, mother tongue, and communication language
Student’s contact information: street address, postal code, city, municipality, country, phone number, and email address
Applicant profile: highest completed degree and main activity at the time of registration
6 Legal Basis for Processing
Statutory duty/obligation
The processing of personal data in Jamk’s Peppi paid education student and study information register is based on:
Mainly the statutory obligation and public authority use for processing study, personal, and contact information
University of Applied Sciences Act (932/2014)
Act on National Study and Degree Registers (884/2017)
EU General Data Protection Regulation (2016/679)
Data Protection Act (1050/2018)
Act on the Openness of Government Activities (621/1999)
Act on the Protection of Privacy in Working Life (759/2004)
Administrative Procedure Act (434/2003)
Equality Act (1325/2014)
Statistics Act (280/2004)
Student Financial Aid Act (65/1994)
Unemployment Security Act (1290/2002)
Act on Public Employment and Business Service (916/2012)
Public Health Act (66/1972)
Aliens Act (301/2004)
Archives Act (831/1994)
Consent
7 Regular Data Sources
Personal data is primarily obtained from the registered individual.
Updates to contact information and data disclosure permissions are provided by the student directly to various systems.
Data is obtained from the Population Information System, Digital and Population Data Services Agency.
Data is obtained from Jamk’s ICT services user management.
8 Regular Data Disclosures and Data Transfer Outside the EU or European Economic Area
Yes, data is regularly disclosed from the register. In legally mandated cases, student and study information is disclosed:
Student information (e.g., participant numbers and credits) to Statistics Finland, which also forwards information to the Finnish National Agency for Education and the Ministry of Education and Culture. (Statistics Act 280/2004).
Additionally, student information is disclosed:
Students have the option to consent to the use of their name and address information through the Peppi paid education system’s student interface. If desired, the student can give permission to disclose contact information for the following purposes:
Direct marketing: Even if the student has given permission for direct marketing, data disclosure never occurs automatically but is considered case-by-case by the system’s responsible users. Generally, data is not disclosed.
Educational marketing: For purposes supporting studies to associations and foundations, professional associations, and mainly regional authorities for mailing information intended to promote studies, professional skills, or employment.
For purposes supporting studies, such as research, surveys, or opinion polls.
Through the Peppi student and study information system, data is transferred for various purposes. Read more in Peppi’s privacy statement: : https://help.jamk.fi/tietosuoja/fi/opiskelija-opetus/tietosuojaseloste-peppi/
exceptions are situations where the student activates a separate service such as Microsoft Office 365. In such cases, the necessary information is provided to the service. In such exceptional cases, the student’s consent and acceptance of the terms of use are separately requested.
9 Principles of Register Protection
In processing register data, care is taken to ensure that students’ privacy is not unduly endangered. The material:
Is stored and protected so that outsiders cannot see it and it cannot be accidentally destroyed, altered, disclosed, transferred, or otherwise illegally processed.
Employees have the right to see only the student-related information they need for their job duties.
Documents containing personal data are destroyed by shredding or as confidential waste.
Network and server equipment are centralized in locked Jamk premises with strictly limited access. The network and servers are properly protected.
Access rights are limited by user groups. The visibility and update rights to information in the system are determined by access roles for different user groups.
Only those with system access rights can access the information. System access is determined by the person’s job duties or student status. Staff are bound by the confidentiality obligation defined in the employment contract.
10 Retention Period or Criteria for Determining Retention Period of Personal Data
Personal data collected in Jamk’s paid education student and study information register is retained as follows:
Information in the student and study information register: The retention of information in Jamk’s paid education student and study information register is regulated by the National Archives’ order for universities of applied sciences: Permanent retention of information in university of applied sciences’ information systems exclusively in electronic form.
11 Profiling and Automated Decision-Making
No, the register’s data is not used for automated individual decisions or profiling.
12 Rights of the Data Subject
More information on data protection, the rights of the data subject, and their implementation is provided in Jamk’s privacy statement and the Rights of the Data Subject page.