Privacy statement

Registrar 

Haaga-Helia University of Applied Sciences Oy 

social security number 2029188-8 

Ratapihantie 13, 00520 Helsinki 

Contact person: 

Sami Nykter 

sami.nykter@haaga-helia.fi 

tel. +358 50 3422 308 

Data Protection Officer: 

tietosuojavastaava@haaga-helia.fi 

tel. +358 29 447 1222 

Description of personal data processing operations 

On the circular economy academy’s website A visiting customer can leave a contact request via the website. The information is stored in the e-mail service of Haaga-Helia University of Applied Sciences in the e-mail account at kiertotalousakatemia@haaga-helia.fi. With the customer’s consent and based on the information provided, the contact request is forwarded to one of the operators of the circular economy academy network. 

Personal data groups 

List of personal data groups subject to processing operations 

• name 
• email address 
• phone number 

Purpose of personal data processing 

Personal data is processed to implement the services offered by the circular economy academy network. The registrar processes the data himself, and discloses the data to the members of the circular economy academy network with the customer’s consent. 

Processing basis

The processing is based on the data subject’s consent.

Disclosure of personal data to third parties

The contact request received through the circular economy academy’s website and the personal information provided by the re-registered person with it can, with the consent of the registered person, be handed over to the member organization of the circular economy academy network. 

Transfers of personal data outside the EU/EEA area

In principle, the data in the register is not transferred outside the EU or the EEA, nor is it processed outside the EU or the EEA. 

Personal data retention period

The personal data collected in the register is stored only for as long and to the extent as is necessary for each personal data group in relation to the purpose of processing the personal data. In addition, personal data is stored in accordance with the storage period based on any law, official regulations or contract. 

The controller evaluates the necessity of data storage regularly in accordance with its internal codes of practice. 

Principles of personal data protection

Access to databases and systems and use of the register are only those employees of the register manager or subcontractors acting on its behalf and on its behalf, who have the right to process the information contained in the register as part of their work. Each user using the register has a personal username and password for the systems. 

Materials containing personal data are stored in locked rooms, to which access is only available to designated and authorized persons due to their duties. 

The database containing personal data is on a server, which is kept in a locked state, to which only designated and authorized persons have access due to their duties. The server is protected with an appropriate firewall and technical protection. 

Rights of the registrant

The registrant has the following rights according to the EU General Data Protection Regulation: 

• The right to access their own personal data. 
•  The right to withdraw the consent that is the legal basis for processing actions at any time without giving a reason. However, the withdrawal of consent does not affect the legality of the processing activities performed on the basis of consent before its withdrawal. 
• The right to demand that the controller correct inaccurate and incorrect personal data concerning the registrant without undue delay, and the right to have incomplete personal data completed in relation to the purposes of the processing operations. 
• The right to have the data controller delete personal data concerning the data subject without undue delay, provided that 

• personal data is no longer needed for the purposes for which it was collected or for which it was otherwise processed; 
• the data subject withdraws the consent on which the processing was based, and there is no other legal basis for the processing; 
• the data subject objects to the processing on grounds related to his personal special situation and there is no justified reason for the processing, or the data subject objects to the processing for direct marketing purposes 
• personal data has been processed illegally; or 
• personal data must be deleted in order to comply with the statutory obligation applicable to the registrar of the basic residence under Union law or national legislation. 

• The right to have the data controller restrict the processing if 

• the data subject disputes the accuracy of the personal data, in which case the processing is limited to a period during which the controller can verify their accuracy, 
• the processing is against the law and the data subject opposes the deletion of personal data and instead demands the restriction of their use or 
• the controller no longer needs the personal data in question for the purposes of processing, but the data subject needs them to prepare, present or defend a legal claim. 
• The data subject has objected to the processing of personal data on grounds related to his personal special situation pending verification of whether the legitimate grounds of the data controller supersede the grounds of the data subject. 

• The right to receive the personal data concerning himself, which the data subject has provided to the data controller, in a structured, commonly used and machine-readable format, and the right to transfer the data in question to another data controller without the hindrance of the data controller to whom the personal data has been delivered, if the processing is carried out automatically. 

• The right to file a complaint with the Data Protection Commissioner if the data subject considers that the processing of personal data concerning him/her violates the EU’s general data protection regulation (instructions on the website of the Data Protection Commissioner’s office at tietosouja.fi). 

Requests regarding the use of registered rights are primarily submitted to the controller using the electronic form on Haaga-Helia’s website (www.haaga-helia.fi/tietosuoja).