Aarresaari.net - Privacy Statement
The following universities belong to Aarresaari, the Career Services Network of Finnish Universities: Aalto University, Hanken School of Economics, University of Helsinki, University of Eastern Finland, University of Jyväskylä, University of Lapland, Lappeenranta University of Technology, University of Oulu, Tampere University of Technology, University of Tampere, University of Turku, University of Vaasa and Åbo Akademi. They process personal data to provide information on jobs, trainee positions and thesis topics offered by employers for publication on university platforms and to allow the universities' career services to inform employers of the services they offer, either individually or collectively as the Aarresaari network. The personal data of the users of the Paikkavahti service is collected to send information about published vacancies to their email addresses. This statement describes how this data is processed.
The career services of the universities that belong to the network (hereinafter 'university') must process personal data to be able to identify the users.
1. The controller responsible for the processing of data is Hanken School of Economics
Hanken School of Economics is the controller of the Aarresaarisaari.net system and the university coordinating the Aarresaari network in 20182019.
Address: Arkadiankatu 22
P.O. BOX 479, 00101 HELSINKI, FINLAND
The controller's contact person is Susanna Paul, Recruiting Coordinator (firstname.lastname@example.org). Hanken's data protection officer is Urpo Kaila. He can be reached by email at email@example.com.
2. Why is personal data processed, i.e. what is the purpose of the processing?
The universities that belong to the Aarresaari network (listed above) need personal data to be able to publish the jobs, trainee positions and thesis topics offered by employers. It must be possible to contact the employers or advertisers in case of questions. This also allows them to verify that the advertisements are real.
The universities also collect personal data to be able to communicate, individually and collectively as the Aarresaari network, the services they offer to employers. Consent for communication can be granted to the Aarresaari network plus all of the universities or only selected universities.
To use the Paikkavahti job watch service, the users have to save their name and email address to allow the service to send the offered vacancies that fulfil the criteria to the users' email.
3. Why are universities allowed to process your personal data, i.e. what is the legal basis for the processing?
The use of personal data is based on the consent of the user.
The Aarresaari.net system promotes the educational mission and social impact of the universities. Universities Act 558/2009.
4. Who are the users of the Aarresaari.net system?
The main user groups of the Aarresaari.net system include:
- Students, university alumni and others
In several universities, the Paikkavahti service is placed on a public website and the information of the users is not verified, meaning that the users are not necessarily students or alumni of that university
- Administrative users of universities
5. What type of personal data do the universities process?
The universities process the following personal data:
- When posting an advertisement, the advertiser provides the name and email address. Information related to the content of the advertisement is also processed. Such information may include personal data, such as the name, email address, address and phone number of the organisation's contact person.
- As regards marketing consent, the name of the organisation/company, name of the person and email address are updated to a separate register.
- To use the Paikkavahti job watch service, the users have to save their email address in the system.
6. Who processes the data?
The personnel of each university process the data. The administrative users usually consist of the personnel of the career and recruitment services. The name of the unit varies in different universities.
Also the appropriate personnel of the supplier responsible for the maintenance and development of the service (Verkkoasema Oy) has access to all information in the service. The controller and the supplier have entered into an agreement on the processing of personal data.
7. What rights do the users have?
Right to inspection and rectification of personal data
The users have the right to know what information have been collected concerning them to the Aarresaari.net system. They also have the right to prohibit the use of personal data or to request rectification. The requests can be sent to: firstname.lastname@example.org.
Correcting the data
You can access and modify your personal data. Within the set period of time, the employer can amend the information using an advertisement-specific password and an advertisement-specific link produced by the system and emailed to the employer when submitting the advertisement. The advertiser sets the advertisement-specific password.
A user who grants a consent for communication or orders the Paikkavahti service cannot edit the entered information but an opportunity to cancel the service is provided with every message. You can first cancel the order and then place another order using correct information.
The right to withdraw consent
The users have the right to withdraw their consent at any time.
The right to lodge a complaint with a supervisory authority
The users have the right to request the Data Protection Supervisor to assess the lawfulness of the operation of the Aarresaari network. (email@example.com)
8. What is the source or the origin of the personal data?
All personal data is provided by the users themselves, and the users are responsible for the correctness of the information.
9. How long is personal data kept?
Advertisements that are over 1.5 years old are archived annually from the system. At the same time, all information about the advertiser is removed from the system. Archived advertisements are kept for approximately 3 years.
Information about users who have granted a consent for communication is kept in the register until the permission is withdrawn or the information is no longer valid. Outdated information is removed from the system. You have the right to withdraw the permission for communication at any time.
The Paikkavahti service is valid for 13 months, as selected by the user. After this period, the information is automatically removed from the system. The opportunity to cancel the Paikkavahti service is also provided with every message. This information is not archived.
10. Transfer of the data outside the EU or EEA
Personal data is not transferred outside the EU or EEA.
11. Where is the data located and how is data security ensured?
Physical location of the service
The service and the contained data are located in a cloud service environment of the service provider, provided on the service provider's own virtual server in Finland.
The service is mainly used over SSL. Some of the information included in the services, such as lists of advertisements and their RSS feeds are also available without encryption. Their encryption is not necessary because the information is public.
Passwords are encrypted in the database and their minimum length is 8 characters. The data is backed-up daily for 7 days.