Data Protection Statement for Prospective Employees

Published 3.2.2020 | Updated 30.1.2023

1. Controller

University of the Arts Helsinki

Telephone: +358 294 47 2000 (exchange)

Postal address: P.O. Box 1, FI-00097 UNIARTS

2. Entity and person in charge of processing personal data

HR and Service Director Riikka Mäki-Ontto
E-mail address: firstname.lastname@uniarts.fi, telephone: +358500806161

3. Contact persons for handling personal data

Coordinator Milja Nevalainen
E-mail address: firstname.lastname@uniarts.fi, telephone: +358504670455

4. Data protection officer

Legal Counsel Minna Eskola works as Data Protection Officer at the University of the Arts Helsinki.

E-mail address: privacy@uniarts.fi

Telephone: +358 294 47 3490

Postal address: P.O. Box 1, FI-00097 UNIARTS

5. Name of register

Job seeker register

6. What are the purpose and the legal basis for processing personal data?

The grounds for processing personal data is: 

• fulfilling the controller’s and the data subject’s obligations and specific rights in the field of labour law;
• the data subject’s explicit consent for processing of his or her personal data.

The purpose for processing personal data are measures related to our recruitment and the management of our recruiting procedure and of the data relating to people having sought employment in our service (data subjects) in order to enable the contacts required. We process personal data i.a. in the decision-making within multi-member organs pursuant to the University Act or on the basis of the University organization in accordance with the recruitment practices adopted by the University. Recruitment for duties may involve recruitment for an employment relationship or inclusion into staff not subject to an employment relationship (such as a visitor relationship). 

When processing personal data, we do not make use of automated decision-making and profiling as referred to in the Data Protection Regulation.

7. What data do we process?

We process the following personal data provided by prospective employees in connection with the job seeker register:

• basic information on a data subject such as name, date of birth, mother tongue, and other information eventually provided by the data subject in person;
• contact information of a data subject such as e-mail address, telephone number, address data or other information eventually provided by the data subject;
• other information provided to the controller by the data subject about his or her person, background etc. in connection with the employment-seeking process such as a photograph, information about studies and other education-related information, job history, scientific, artistic, educational/pedagogical merits and other special competences of central importance in relation with the employment applied for, linguistic abilities, and other special competences, a description of personal characteristics, and various certificates and assessments with which the data subject wishes to illustrate his or her merits and suitability for the employment applied for;
• the application documents submitted by the data subject

Providing the personal data as described above is a prerequisite for seeking employment.

We will also process the following applicant-related information:

• information about the employment applied for by the data subject such as information about the position being applied for including information about the form and quality of the employment relationship and about the person in charge designated in the employment-searching process;
• information about the progress of the data subject’s recruitment process such as information about any forthcoming follow-up interview or about the suspension of the recruitment process;
• evaluation statements on the data subject such as (public) suggestions presented by preparatory work groups or applicant assessments made in the course of the recruitment process (such as evaluations of scientific, artistic, or pedagogical merits, a suitability assessment, or any other evaluation of the applicants’ merits, competences or suitability) as well as statements by eventual organs or corresponding instances as to the applicants’ merits or suitability for the position.

When processing personal data, we do not make use of automated decision-making and profiling as referred to in the Data Protection Regulation.

8. Where do we get information?

We mainly get information from the data subject in person.

Additionally, personal data may also be collected and updated, with the data subject’s consent, from sources indicated by him or her (e.g. references and web publications), from third parties on the basis of the recruitment practices adopted by the University (e.g. expert or suitability assessments or feedback on the data subject’s activities) within the limits of applicable legislation. Such updating of data is performed manually or by automatic means.

9. To whom do we disclose and transfer data, and do we transfer data outside the EU or the EEA? 

As a rule, we do not disclose register data to third parties.

In processing personal data, we use subcontractors with which we have concluded agreements on processing personal data.

We do not disclose data beyond the EU or outside the EEA.

10. How do we protect data and how long will we keep them?

Only those of our employees who are authorized to process applicant information in their line of work are entitled to use the system containing personal data. Each user has a personal user ID and a password into the system. The data are gathered in databases protected with firewalls, passwords, and other technical means. The databases and their backup copies are stored in locked spaces, and the data can only be accessed by certain pre-named persons.

We keep personal data and application documents relating to the employment-seeking process for a period of two years and erase the related data at the latest four years after the application process has come to an end. However, application documents submitted by people seeking employment as a professor are kept on a permanent basis if the scientific, artistic, and other merits of the applicant have been assessed in the manner required by the University Act. The application documents of people chosen for the duties are also kept on a permanent basis.

We regularly evaluate the need to preserve data in keeping with the applicable legislation. In addition, we will take such reasonable steps as are necessary to ensure that no personal information on data subjects that is incompatible with the purposes of data processing, outdated, or erroneous is kept in the register. We will rectify or erase such information without delay.

11. What are your rights as a data subject?

Data subjects are entitled to check the data concerning them and stored in the personal data register and require erroneous, outdated, unnecessary, or unlawful data to be rectified or erased. In case a data subject has personal access to their data, they can modify their data himself or herself. In case processing is based on a consent, a data subject also has the right to withdraw his or her consent or to alter it.

As of May 25, 2018, data subjects have, according to the Data Protection Regulation, the right to object to processing or to request restriction of processing of data as well as to lodge a complaint with a supervisory authority on processing personal data.

For specific reasons of personal nature, data subjects also have the right to object to processing activities concerning them when processing data is based on our legitimate interest. In conjunction with the request, the data subject shall specify the particular situation on the basis of which he or she objects to processing. We may refuse to execute an objection-related request only on the basis of grounds stated in law.

Should the data subject not be satisfied with the way the University has processed his or her personal data, he or she may demand the national data protection authority (in Finland, the Data Protection Ombudsman whose contact information is available in the web address http://www.tietosuoja.fi/en/) to look into the matter.

A person has at all times the right to withdraw his or her consent for electronic direct marketing via the Unsubscribe feature of direct-marketing letters or by contacting the contact person of account management.

12. With whom can you get in touch?

All questions on the processing of personal data as described in this data protection statement are to be asked by getting in touch with the contact person named in Point three who will, in case of need, forward the matter to the data protection officer. In case you feel that your rights as mentioned in Point 11 are not respected, you may get directly in touch with the University Data Protection Officer named in Point four.