Privacy policy statement
Åbo Akademi University Foundation (hereinafter “Foundation”) processes personal data in compliance with the EU’s General Data Protection Regulation (GDPR) and other currently valid legislation.
The Foundation is responsible for all processing of personal data within its operations. This document describes how your personal data may be processed by the Foundation.
What does the Foundation need personal data for?
Within its operations, the Foundation needs to handle personal data in connection with, for example, the payment of scholarships and grants, rental activities, recruitment of employees, and the statutory reporting on transactions with related parties. Only personal data necessarily required for these purposes will be processed.
What personal data does the Foundation collect?
Which particular information will be processed depends on the reason to the processing of personal data. Relevant data may include, for example, the following:
- Contact details, such as name, address, phone number and email address;
- Personal ID code whenever it is needed to verify your identity;
- Bank and other financial information for payment or invoicing purposes;
- Names of your family members and other close relatives, as well as the names and Business ID’s of those organisations in which you have a controlling interest, if you are included in the related parties of the Foundation;
- Information about your usage of our website for the purpose of improving user experience, for example, via cookies;
- Personal data required for employment or job application purposes;
- Borrower information, if you are a customer of the Donner Institute Library (this processing of personal data is governed by the policies of Åbo Akademi Library).
The majority of the information collected by the Foundation is received directly from you. In certain cases, the Foundation also collects data from other sources, such as, for example, the credit information service of Intrum Oy.
How is your personal data protected?
The Foundation makes sure that the processing of personal data is protected by appropriate technical and organisational measures. The measures used shall ensure a level of security appropriate to the risk of processing. Data security includes confidentiality, integrity and availability as well as appropriate technical protection. This refers to, for example, restricting access to the data to authorised personnel only, encryption of the data, storing of the data in secured and protected premises, and back-up copying.
Who are your personal data shared with?
Your personal data may be disclosed to the co-operative partners of the Foundation, such as ICT service or software providers, or other third parties that need to obtain information on the basis of a contract between yourself and the Foundation, a task carried out in the public interest, the exercise of public authority, or a legal obligation of the Foundation.
When transferring data to a third party, the Foundation will take all reasonable legal, organisational and technical measures necessary to protect your personal data.
The Foundation will not disclose your personal data to third parties without a legal ground.
For how long will the Foundation store personal data?
The Foundation will retain your personal data as long as needed for the purpose of processing, or as long as required by legislation. Personal data included in the minutes of the Board or the Delegation, or their appendices, will be stored permanently.
Data transfer to third countries
The Foundation will not transfer your personal data to any third countries outside the EU or European Economic Area (EEA).
Your rights under the GDPR
The GDPR provides you, as an individual, a number of rights that obligate the Foundation:
Right of access
You have the right to ask the Foundation to confirm whether or not it is processing your personal data, and the right to receive a free copy of your personal data being processed. If you ask for several copies, the Foundation will charge you a fee corresponding to the administrative costs. In connection with such a request, the Foundation will also provide further information including, for example, the purposes of processing, the categories of personal data being processed and the planned storage period.
The Foundation will not disclose to the scholarship or grant applicants any written evaluations or assessments concerning their applications. By doing so, the Foundation will safeguard the integrity and neutrality of the assessment process as a whole.
Right to rectification
You have the right to demand the rectification of your personal data processed by the Foundation if it is incorrect or incomplete, by providing the person responsible for the relevant register with correct information. The Foundation is not obligated to correct your personal data if it is no longer actively processed.
Right to erasure and right to be forgotten
You have the right to have your personal data erased from the Foundation’s registers if any of the following conditions is met:
- The personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
- You withdraw the consent on which the processing was based and there is no other legal basis for the processing;
- The personal data has been processed unlawfully.
If the Foundation has disclosed your personal data to third parties, the Foundation shall take all reasonable measures to inform these parties about your request of erasure.
There may be regulations requiring the Foundation not to erase your data, for example, the provisions on the archiving of accounting material as set out in the Accounting Act. Nor is the right to erasure applicable if the processing of your personal data is necessary, for example, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
Right to restrict the processing of your personal data
You have the right to request that the processing of your personal data be restricted, which means that the Foundation shall make sure that your personal data is only processed for certain specific purposes. The Foundation will restrict the processing in the following cases:
- You claim that the personal data being processed is inaccurate and the Foundation needs time to verify the accuracy of the personal data;
- The Foundation no longer needs the personal data, but you would like it to continue storing the data because you need it for the purposes of legal claims;
- You object to the processing carried out by the Foundation. In this case, the processing will be restricted until it has been assessed if the Foundation’s legitimate grounds override your grounds for the opposition;
- You consider that the Foundation should erase your personal data but, for some reason, it cannot do so.
Right to data portability
In certain situations, you have the right to request the Foundation to transfer your personal data to another data controller. The right to transfer the data, that is, data portability, applies to any personal data you have provided to the Foundation actively and knowingly, and when the processing of the personal data is based on a contract or your consent. The right to data portability does not apply to data created or generated by the Foundation. The data must be transferrable in a structured, commonly used and machine-readable format.
Right to object to the processing
In certain situations, you have the right to object to the processing of your personal data by the Foundation. The right to object applies to data processing for the purposes of carrying out a task in public interest, or the realisation of a legitimate interest of the Foundation or a third party. The right to object also applies to the processing of personal data for the purposes of direct marketing.
The Foundation will cease processing your personal data if there are no compelling grounds for continuing it, or if the processing is necessary in order to defend the Foundation’s legal claims.
Automated decision-making and profiling
The Foundation does not make use of automated decision-making or profiling.
Right to lodge a complaint with the supervisory authority
If you feel that the Foundation is violating your above-described rights, you have the right to report the matter to the Data Protection Ombudsman.
Register descriptions
Further information about the processing of your personal data by the Foundation is given in the register.