Peppi Paid Education – Privacy Statement
EU General Data Protection Regulation (2016/679)
Updated 23.3.2026
1 Name of the Register
Peppi Paid Education
2 Data Controller
Jyväskylä University of Applied Sciences Ltd
PL 207, 40101 Jyväskylä
+358 20 743 8100
3 Contact Person for Register Matters, Contact Information During Office Hours
Register Manager: Vice Rector, Education
Process Owner: Education Services Manager
Content Administrator: Educational Development Services
Technical Administrator: ICT Services
firstname.lastname[a]jamk.fi
4 Processing of Personal Data and Its Purpose
Personal data is collected and processed for the purposes of student enrollment and payment transactions related to the Jamk’s continuing education.
After enrollment, Jamk processes student data to organize studies. This is described in the privacy policy for the student and study register; you can read it here.
5 Content of the Register
Applicant’s personal information: last name, first names, preferred name, nationality, personal identification number, date of birth, gender, mother tongue, and communication language. These come automatically from the identification service (Suomi.fi, HAKA or Telia Tunnistautuminen) or from the applicant.
Applicant’s contact information: street address, postal code, city, municipality, country, phone number, and email address
Applicant profile: highest completed degree and main activity at the time of registration
6 Legal Basis for Processing
Statutory duty/obligation
The processing of personal data is based on the statutory obligation and public authority use.
7 Regular Data Sources
Personal data is primarily obtained from the applicant. Some of the data is transferred from the identification service.
8 Regular Data Disclosures and Data Transfer Outside the EU or European Economic Area
Personal data is disclosed to Paytrail Oyj for the purpose of processing payments. Paytrail processes and discloses the data to payment service providers in accordance with its own privacy policy (open the policy here).
The applicant may consent to use their contact information in Jamk marketing and educational marketing.
9 Principles of Register Protection
In processing register data, care is taken to ensure that students’ privacy is not unduly endangered. The material:
Is stored and protected so that outsiders cannot see it and it cannot be accidentally destroyed, altered, disclosed, transferred, or otherwise illegally processed.
Employees have the right to see only the student-related information they need for their job duties.
Documents containing personal data are destroyed by shredding or as confidential waste.
Network and server equipment are centralized in locked Jamk premises with strictly limited access. The network and servers are properly protected.
Access rights are limited by user groups. The visibility and update rights to information in the system are determined by access roles for different user groups.
Only those with system access rights can access the information. System access is determined by the person’s job duties or student status. Staff are bound by the confidentiality obligation defined in the employment contract.
10 Retention Period or Criteria for Determining Retention Period of Personal Data
The retention of information in Jamk’s paid education student and study information register is regulated by the National Archives’ order for universities of applied sciences: Permanent retention of information in university of applied sciences’ information systems exclusively in electronic form.
11 Profiling and Automated Decision-Making
No, the register’s data is not used for automated individual decisions or profiling.
12 Rights of the Data Subject
More information on data protection, the rights of the data subject, and their implementation is provided on Data protection at Jamk -page (open it here).