Privacy policy

Data Protection Act 2018/1050, EU General Data Protection Regulation 2016/679. The data protection statement contains information that must be communicated to data subjects when processing personal data. Because of the data protection statement, it forces the controller to provide proof. The obligation to provide information is central to the regulation in principle and means that the data controller must comply with national legislation related to data protection.

This document details the information about the processing of personal data on a research or project basis. The data protection notice of the alumni ja customer relations category can be found at https://www.xamk.fi/en/data-privacy/alumni-and-customer-relations/

1. Controller

South-Eastern Finland University of Applied Sciences
P.O. Box 68 (Patteristonkatu 3)
50101 Mikkeli
Business ID: 2472908-2

2. Data protection officer and contact details

Markus Häkkinen
Project Manager, Data Protection officer (DPO)
South-Eastern Finland University of Applied Sciences
PL 68 (Patteristonkatu 3 D), 50101 Mikkeli
tietosuojavastaava@xamk.fi
+358 40 198 1150

Persons responsible for the register and data related to the register

Kati Viljakainen
Project Manager
South-Eastern Finland University of Applied Sciences
firstname.lastname@xamk.fi

Martin Schiel
Project Manager
Kosmoskosmos
firstname.lastname@kosmoskosmos.de

3. Scope of the privacy statement

This privacy statement applies to the Time for (S) Heroes (Creative Europe acronym CREASHeroes) website’s registration and Digital Portal and the related processing of personal data. The service is provided and maintained by Kosmoskosmos. The Digital Portal is an online platform for only logged in users with learning contents and features to connect the participants. The processing of data is partly automated and it is possible to form a unified register or separate registers of the data.

4. Purposes of processing personal data and legal basis for processing

Purpose of processing personal data 

• Implementation of teaching, working life collaboration, and research, development, and innovation activities (RDI activities)
• Managing user, customer and stakeholder relations including project events, Open Call competition and evaluation
• Marketing and communication

In cases related to research, development, and innovation activities, as well as collaboration in education, the processing of personal data is based on the statutory tasks of the University of Applied Sciences, as described in the University of Applied Sciences Act 932/2014, and project-specific funding conditions.

The processing of personal data in the register is based on a relevant connection or the performance of a contract in which the data subject is involved.

The legal basis for processing is the legitimate interest of the University of Applied Sciences when it comes to business and the processing of information of potential customers. Personal data is stored at this stage to establish contact with potential customers. Personal data of potential customers is completely removed from the register if no customer relationship or stakeholder collaboration is established.

5. Categories of personal data processed

The following personal data is collected from the registered users who created the user account:

• The name by which the user account was created.
• E-mail address
• Password (in cryptographically secure format)
• Topics and keywords by which the user can be found.
• Photo (not required)
• Profile info
• Additional links to portfolios (not required)

6. Processors of personal data

The processors of personal data are natural persons in the context. Kosmoskosmos, which produces and maintains the website and the Digital Portal, acts as a processor of the register on behalf of Xamk. The processor complies with Xamk's instructions on the processing of personal data and data protection.

Project information

Time for (S)heroes in fashion, costume design, and art installations for sustainable future, zero waste, digital processes, and co-design
Implementation time: 1.10.2024–30.9.2028
Lead partner: South-Eastern Finland University of Applied Sciences (Xamk)
Partial partners: Espronceda- Institute of Art & Culture, Tallinn Creative Incubator (TCI), Latvian Technological Centre (LTC), The Northern Dimension Partnership on Culture (NDPC), Kosmoskosmos

The project partners process personal data only to the extent necessary for fulfilling their responsibilities as event organizers, including tasks required by the lead organizer. The evaluation of the open call competition is carried out based on separate applications, and Xamk coordinates the work of the jury without disclosing personal data beyond what is essential for the assessment process.

7. Information on the transfer of data to third countries

The register owned by Xamk and described in this statement is not transferred outside the EU or EEA. However, the information published in the Digital Portal is displayed individually in the service, from where it can be searched globally for those who have a license to the service. Depending on the terminal device used to access the Digital Portal and its settings, it is possible that certain identifiers that can be linked to a natural person may be transferred outside the EU or EEA to countries whose data protection practices may differ from the EU's General Data Protection Regulation.

8. Retention period of personal data

Personal data will be stored for as long as the need to use it still exists. In project activities, personal data is stored according to the archiving period of 10 years.

If the data subject requests the erasure of personal data concerning him or her, they will be deleted from the register. Deleted users lose their access to the Digital Portal. If a person withdraws his or her consent to the use of his or her data for a specific purpose, this will be recorded in the system in the data of that person.

9. Rights of the data subject

9.1. Right of access to personal data

Users create an account to access the portal, and the personal data required for registration is collected at that stage. Once logged in, users have the ability to access their profile, review the personal data held about them, and modify or update this information whenever needed.

In addition, the data subject may request the data concerning him or her. The request must be made in writing to the person responsible for the register (2. Data protection officer and contact details).

In the request, the data subject must specify which data the request concerns.

9.2. Right to rectification

The data subject may submit a request for rectification of his or her data to the person responsible for the register (2. Data protection officer and contact details).

The controller also updates the personal data in its register on its own initiative whenever persons acting in the name of the controller receive information about them either from the data subject himself or from public sources.

9.3. Right to erasure

The data subject may indicate in writing the prohibition of the use of his or her personal data. This prohibition shall be entered in the register.

The registered entity may also request the erasure of personal data concerning him or her from the register. The data will be deleted if South-Eastern Finland University of Applied Sciences Ltd does not have a legal reason to retain the data, such as fulfilling a contractual obligation or conducting RDI work.

9.4. Right to restriction of processing

The data subject has the right to restriction of processing if one of the following is fulfilled:

• The accuracy of the personal data is contested by the data subject, in which case the processing is restricted for a period during which the registrant can verify their accuracy.
• The processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of their use instead.
• The controller no longer needs the personal data for the purposes of the processing, but the data subject needs them for the establishment, exercise, or defense of legal claims.
• The data subject has objected to the processing of the personal data pursuant to Article 21, pending verification whether the legitimate grounds of the controller override those of the data subject.

9.5. Right to object

The data subject has the right to object, on specific grounds, to the processing of his or her personal data based on the legitimate interest of the controller.

9.6. Right to data portability

The data subject has the right to receive in a machine-readable format the personal data concerning him or her that he or she has provided to the controller, provided that the processing is based on consent and the processing takes place by automated means.

9.7. Withdrawal of consent

The data subject must be informed of the right to withdraw consent at any time (If the processing is based on consent or explicit consent).

9.8. Right to file a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement, if the data subject considers that the processing of personal data concerning him or her infringes this Regulation.

10. Legal or contractual requirement

In the case of a customer relationship or cooperation for which a written agreement is drawn up, the conclusion of the agreement requires the receipt of sufficient personal information necessary for the preparation and implementation of the agreement.

11. Information on the existence of automated decision-making

Personal data is not used for profiling the data subject or for automated decision-making.

12. Information on where the personal data was obtained (When the data have not been obtained from the data subject)

No personal data is obtained by any other means than by directly acquiring it from the data subject.