Privacy statement for SeAMK's alumni activities

The EU General Data Protection Regulation (2016/679) grants the Data Subject the following rights:

Right to access the data (Article 15)

The General Data Protection Regulation grants you the right to obtain a copy of personal data concerning you. No specific format has been laid down for making this request. If necessary, we may ask you for more information to enable us to confirm your identity.

If you submit your request concerning this right electronically, we will provide the data in a commonly used electronic format. While such requests are fulfilled free of charge in principle, under certain conditions we may charge you for the administrative costs of fulfilling the request, or refuse it.

The General Data Protection Regulation sets the time limit of one month for responding to your request. Where necessary, this period may be extended by a maximum of two months, taking into account the complexity and number of the requests.

Right to rectification (Article 16)

The Data Subject has the right to demand the rectification of erroneous information in the register. The request for rectification is submitted in writing.

Right to withdraw consent (Article 17)

The data subject has the right to withdraw his or her consent at any time, if their consent has been requested.

Right to erasure (Article 17)

The Data Subject has the right to demand the erasure of their personal data if one of the following grounds applies:

• The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed
• the Data Subject withdraws consent on which the processing is based, and there is no other legal ground for the processing
• The Data subject objects to the processing and there are no overriding legitimate grounds for the processing (Article 21)
• The personal data have been unlawfully processed
• the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the Controller is subject

Right to restriction of processing (Article 18)

The Data Subject has the right to obtain from the controller restriction of processing where one of the following applies):

• The accuracy of the personal data is contested by the Data Subject, for a period enabling the controller to verify the accuracy of the personal data
• The processing is unlawful, and the Data Subject opposes the erasure of the personal data and requests the restriction of their use instead
• The Controller no longer needs the personal data for the purposes of the processing, but they are required by the Data Subject for the establishment, exercise or defence of legal claims
• The Data Subject has objected to processing pursuant to Article 21 pending the verification whether the legitimate grounds of the controller override those of the Data Subject.

Right to data portability (Article 20)

The Data Subject has the right to receive the personal data concerning them, which they have provided to a controller, in a machine-readable format if the processing is based on consent and the processing is carried out by automated means.

Requests for the use of the above rights are addressed to:

Seinäjoen Ammattikorkeakoulu Oy
Data Protection Officer
P.O. Box 412 (Kampusranta 11)
60101 Seinäjoki

Rectification of errors

The Controller shall, without unnecessary delay, spontaneously or at the Data Subject’s demand rectify, erase or complete personal data that are erroneous from the perspective of processing, unnecessary, insufficient or outdated.

Having detected an error, the person in charge of register-related matters shall immediately rectify the error or notify a person with the sufficient rights to do it. The Data Subject has the right to demand the rectification of the data, and the data is rectified without unnecessary delay. If the rectification is refused, a written refusal certificate is provided. The Data Subject has the right to submit the matter to be resolved by the Data Protection Ombudsman, address Tietosuoja-valtuutetun toimisto, PL 315, 00181 Helsinki. The Data Protection Ombudsman may issue the Data Controller an order to rectify the data.

The demand for rectification is submitted in writing or orally to the person in charge of register-related matters and, if necessary, the Data Subject’s identity is verified.

For other cases, a demand for rectification is addressed to:

Seinäjoen Ammattikorkeakoulu Oy
Data Protection Officer
P.O. Box 412 (Kampusranta 11)
60101 Seinäjoki

Other rights related to the processing of personal data

Checking of identity

Unless the person requesting data is not known from before or their identity cannot be verified in other ways, they shall always prove their identity before the transfer of data.

Identity can be proved with an official identification including a photo, such as driving licence, passport, identity card issued by the police authority, and the Kela card.

Prohibition of transfer of address data

The Data Subject has the right to prohibit the transfer of their personal data from the population information system and related documents

• for direct marketing, telemarketing and other direct marketing, as well as market research and opinion polls (Personal Data Act 30 §)
• as an address service (Population Information Act 25 § 5)
• for a register (Personal Data Act 30)
• for genealogy (Personal Data Act 30).

The prohibition of the transfer of the above data is applied for from the Population Register Centre or a city administrative court. After the prohibition has come into effect, the Population Register Centre no longer transfers data as an address service to the University of Applied Sciences. A Data Subject not willing to give their address data is responsible of the inconvenience and damage caused by the impossibility of reaching them.

Non-disclosure

If a person has reasonable grounds for suspecting their security or that of their of family is under threat, the city administrative court can at their request rule that their domicile or address information shall not be transferred from the population information system to other actors than the authorities. The city administrative court requires a written, justified request from the applicant of a non-disclosure, or at least a visit to the office. For the first time, the non-disclosure order may be valid for five years maximum. It can be prolonged for two years at a time. If a person has a non-disclosure, their address is in many cases not transferred even to the authorities. The authorities that receive the person’s contact data to their systems, are also informed of the non-disclosure.

A person with a non-disclosure shall notify the person in charge of register-related matters.

Restraining order

A restraining order means that, in order to protect the person’s life, health, freedom or piece someone else can be prohibited to contact them. A restraining order can be applied for by anyone who with good reason feels threatened or disturbed by someone else. A restraining order is applied for from the police or directly from the local court.

A person who has been granted a restraining order shall, when necessary, notify the person in charge of register-related matters.