Your data protection rights related to the processing of personal data

Data subject refers to the person whose personal data is processed. Check out your rights on this page.

Right to information on the processing of personal data

You have the right to know for what purposes and on what grounds we process your personal data.
We will inform you about the processing of your data before the start of data collection, when the data is collected from you and at the latest within one month of the start of processing if the data is obtained from another source.
Information on the processing of your data can be found in the privacy notice provided to you or made available to you. It contains information on the controller or joint controllers responsible for the processing. The Privacy Notice also contains information about your rights as a data subject in such processing and how you can exercise them.
Privacy notices for permanent and long-term processing are published on our website. The privacy notice may also be available to you in other ways, such as as an attachment to a letter you have received, in connection with the service you are using or on the website of the research project.
If informing the data subject personally about the processing of personal data is impossible, unreasonably difficult or would prevent the conduct of scientific research, legislation in some situations allows exceptions to personal information and we publish the information either on our public website or on the research project's website.
Everyone has the right of access to a public document held by an authority. A copy of the privacy notice can be requested from our e-service (registry).

Right to access and check your data

You have the right to know whether we process personal data concerning you.
You can request and receive access to your personal data stored in our services by submitting a data request registered in our e-service.
You have the right to be informed about:
- Where your personal data was obtained from
- Why your personal data is needed
- how long we keep your personal data
- whether your personal data has been disclosed and, if so, to which
- whether your personal data has been transferred outside the EU and which protection measures under the General Data Protection Regulation have been applied to the transfers;
- whether automated processing is used, and
- how you can exercise your rights in relation to personal data.
The right to inspect one's own data enables the exercise of other data protection rights, such as the right to rectification or erasure of data.
Further information on the right to personal data on the website of the Data Protection Ombudsman.

Right to rectification

If you notice that your data is incomplete or incorrect, you can ask us to correct it. Explain what information is incorrect and explain why. Please also tell us how the information should be changed. Send a written request for rectification to our e-service.
If your data is rectified, we are obliged to notify everyone to whom the data has been disclosed of the rectification.
More information on the right to rectification can be found on the website of the Data Protection Ombudsman.

Right to erasure

You have the right to have your data erased (right to be forgotten) if:
- your personal data is no longer needed for the purposes for which it was collected or processed, you withdraw your consent to the processing of your data, and there is no other legal basis for the processing;
object to the processing of your personal data for direct marketing purposes; or you object to any other processing of your data and there are no legitimate grounds for the processing
your personal data has been processed unlawfully
the personal data must be erased in order to comply with a legal obligation under Union or Member State law to which the controller is subject;
your personal data has been collected in connection with the provision of information society services;
The right to erasure (to be forgotten) does not apply if the processing of the data is necessary:
- for scientific or historical research, archiving or statistical purposes in the public interest, and the erasure of the data is likely to prevent or seriously impair such processing;
- for compliance with a legal obligation to which the controller is subject, for the performance of a task carried out in the public interest or in the exercise of official authority vested in it;
- for reasons of public interest in the area of public health
- to exercise the right to freedom of expression and information
- for the establishment, exercise or defence of legal claims;
For example, there is no right to erasure of data when there is an order on the permanent storage of data.
More information on the right to erasure can be found on the website of the Data Protection Ombudsman.

Right to restriction of processing

If you have informed us that your data is inaccurate, you have the right to request that its processing be restricted until we have verified the accuracy of your data. You can also request restriction of processing if you suspect that it is being processed unlawfully or if you have objected to the processing of your data. In this case, in addition to storing your data, we may only process it:
- Consent
- for the establishment, exercise or defence of legal claims;
- to protect the rights of another person
- for reasons of public interest.
If we restrict the processing of data on the basis of your request, we are obliged, where possible, to inform all parties to whom the data has previously been disclosed of the restriction.
The processing of data may also be restricted as a result of your other requests without your specific request.

Further information on the right to restrict the processing of data can be found on the website of the Data Protection Ombudsman.

Right to data portability

You have the right to have your personal data transferred to another controller when:
- you have provided us with your data yourself
- they are in electronic form
- the processing is based on your consent or a contract with you
- The transfer does not adversely affect the rights and freedoms of third parties.
Further information on the right to data portability on the website of the Data Protection Ombudsman.

Right to object

You have the right to object to the processing of your data on grounds relating to your particular situation, i.e. to request that it not be processed at all if your data is processed:
- for the performance of a task carried out in the public interest; or
- in the exercise of official authority vested in the controller or
- for the purposes of the legitimate interests pursued by the controller or third parties.
If you object to the processing of your personal data, we may no longer process your personal data unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.
There is no right to object to the processing of data if the processing is based on the fulfilment of a legal obligation. There is also no right to object if the data are processed for scientific or historical research purposes or statistical purposes and the processing is necessary for the performance of a task carried out in the public interest.
Further information on the right to object to data processing can be found on the website of the Data Protection Ombudsman.

Right not to be subject to automated decision-making

You have the right to prohibit automated decision-making concerning you that produces legal effects concerning you or similarly significantly affects you. You can demand that the decision concerning you be made by a human instead of an automated decision.
There are exceptions to the right to prohibit automated decision-making. Automated decision-making is permitted if:
- it is necessary for the conclusion or performance of a contract between the data subject and the controller;
- it has been adopted by Union or Member State law to which the controller is subject;
- The processing is based on your explicit consent.
For justified personal reasons, you have the right to object to automated decision-making.
Further information on the right to object to automated decision-making on the website of the Data Protection Ombudsman.

Right to withdraw consent to data processing

If you are asked for consent to the processing of your data, you must also be informed of your right to withdraw consent and how it is done in practice. The right to withdraw consent is described in the privacy notice and in every electronic marketing message and newsletter.
Withdrawing consent must be as easy as giving it. It must be possible to do this at any time and free of charge.
You can unsubscribe from marketing messages, newsletters and service newsletters via the function at the end of the message.
After the withdrawal of consent, processing based on consent will be terminated. If there is no other basis for storing your data than your consent, your data will be deleted.
Your consent may only be stored for as long as necessary to verify that the processing of your data was based on your consent.

Further information on consent and the right to withdraw consent can be found on the website of the Data Protection Ombudsman.

Right to be informed of a personal data breach

You have the right to the protection of your personal data.
If a personal data breach occurs and is likely to cause you a high risk, we will notify you as soon as possible and primarily by personal message.
If you receive a notification of a personal data breach, it will tell you what happened, the likely consequences and what measures we have taken. The report may include information on what you should do to mitigate the side effects that have occurred. In the notification, you will find the contact information of the person providing additional information.

Right to lodge a complaint with a supervisory authority

You can complain or lodge a complaint about the processing of your data with the Data Protection Ombudsman.
Further information on the right to lodge a complaint on the website of the Data Protection Ombudsman:

Notification to the Data Protection Ombudsman

Contacting us to exercise your rights

Information about the controller and its contact details for exercising your rights as a data subject can be found in the privacy notice. If a privacy notice is available to you, please check that you are sending your request to the correct recipient.
The request to exercise the rights of the data subject is made to the controller himself.
We will verify the identity of the person making the request before executing it.
Children under the age of minors have the same rights as adults.
The rights of the data subject may be exercised on behalf of or alongside a minor child by his/her guardian. We will ensure custody before executing the request. The guardian may only use the information requested for inspection to exercise the right of inspection.
We will process your request without delay, within a maximum of one month of receiving it. In exceptional situations permitted by the General Data Protection Regulation, the processing time may not exceed three months.
We may need additional information from you to process your request.
If your request cannot be accustomed, we will explain why.
You can make a registered request to our e-service.

Service address of the University of Tampere: asiointipalvelu [at] tuni.fi (asiointipalvelu(at)tuni.fi)

Service address of the Tampere University of Applied Sciences: tamk [at] tuni.fi (tamk(at)tuni.fi)

Right to advice

If you need more information about your rights as a data subject, please contact our Data Protection Officer. You have the right to contact the Data Protection Officer in all matters related to the processing of your personal data and the exercise of your rights.

Contact information of the Data Protection Officer of Tampere University Foundation sr (2844561–8):

Sanna Vartia

University of Tampere
Kalevantie 4, 33014 University of Tampere
+358 (0)294 5211 (switchboard)

E-mail: dpo(at)tuni.fi

Contact information of the Data Protection Officer of Tampere University of Applied Sciences Ltd (1015428-1):

Niku Hinkka

Tampere University of Applied Sciences
Kuntokatu 3, 33520 Tampere
+ 358 (0) 294 5222 (switchboard)

E-mail: tietosuoja.tamk(at)tuni.fi