This privacy notice describes how the University of Oulu collects and processes your personal data when you act as a user of the VISU Secure Processing Environment. Users of the VISU secure processing environment include individuals processing datasets under the Finnish Secondary Use Act, individuals processing datasets outside the scope of the Secondary Use Act, and members of the University of Oulu staff who serve as system administrators.
Data Controller
University of Oulu
Pentti Kaiteran katu 1
P.O. Box 8000
FI-90014 University of Oulu, Finland
Person responsible for matters concerning the VISU Secure Processing Environment:
Chief Digital Officer Heikki Mikkonen
Contact point for matters concerning the VISU Secure Processing Environment:
VISU-support@oulu.fi
Contact details of the University of Oulu Data Protection Officer:
dpo@oulu.fi
Purpose of Processing Personal Data and Legal Basis for Processing
Holders of permits granted under the Finnish Secondary Use Act may process datasets specified in their permits within VISU, the secure processing environment provided by the University of Oulu. VISU may also be used to process data for purposes other than those covered by the Secondary Use Act.
Personal data of individuals specified as authorized processors in permits granted under the Secondary Use Act, processors of datasets outside the scope of the Act, and University of Oulu staff acting as system users are processed for the purposes of managing user accounts, enabling access to and processing of datasets, and monitoring such processing.
The environment complies with the Finnish Social and Health Data Permit Authority (Findata) regulation “Requirements for Secure Processing Environments Provided by Other Service Providers” (1/2022, Ref. THL/214/14.00.07/2022), referred to in Section 24(2) of the Secondary Use Act. Compliance with these requirements necessitates the processing of personal data belonging to users and administrators of the secure processing environment.
Legal Bases for Processing Personal Data
Personal data are processed on the following legal bases under Article 6(1) of the General Data Protection Regulation (GDPR):
- Article 6(1)(c): Processing is necessary for compliance with a legal obligation to which the controller is subject.
- Article 6(1)(b): Processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract.
Personal Data Processed
The following categories of personal data are processed within the secure processing environment:
Personal data of permit holders and individuals authorized to process datasets under a permit (“users”)
- First and last name
- Finnish personal identity code
- Contact information
- User account identifier
- Login information and access timestamps
- Network identification data, such as log information including date, time, IP address, and browser type
Personal data of University of Oulu staff acting as system administrators
- First and last name
- User account identifier
- Login information and access timestamps
- Network identification data, such as log information including date, time, IP address, and browser type
Sources of Personal Data
Users’ personal data, including names, personal identity codes, and contact details, are obtained when the customer of the secure processing environment completes the service order form. Other personal data are recorded when the environment is provisioned and during its use.
Recipients and Categories of Recipients of Personal Data
In addition to the University of Oulu, personal data contained in the service order form, specifically users’ names and contact details, are processed by the supplier of the service management system. Personal data are not routinely disclosed to other data controllers.
Transfers of Personal Data
Personal data are processed in Finland for the operation and provision of the service.
Data stored in the service management system, including users’ names, personal identity codes, and contact details contained in the service order form, are stored in a cloud-based database located within the EU/EEA.
Personal data are not transferred outside the EU/EEA or to international organizations.
Retention Period
Personal data relating to users and system administrators are retained for 12 years after their access rights have ended.
Usage log data are retained for 12 years after the expiration of the permit authorizing the use of the data.
The retention periods are defined by the Finnish Secondary Use Act.
Automated Decision-Making and Profiling
Your personal data are not used for automated decision-making or for any purpose other than those specified in this privacy notice.
General Description of Technical and Organizational Security Measures
The VISU Secure Processing Environment complies with the security control requirements defined in Findata’s regulation “Requirements for Secure Processing Environments Provided by Other Service Providers.”
Your personal data may only be processed by persons whose job duties require such access. The University of Oulu implements appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction, or damage.
Rights of the Data Subject
As a data subject, you have the following rights:
- Right of access to your personal data
- Right to rectification of inaccurate personal data (please ensure that your contact information remains up to date)
- Right to erasure (“right to be forgotten”) in certain circumstances
- Right to restriction of processing in certain circumstances
- Right to object to processing in certain circumstances
- Right to data portability in certain circumstances where processing is based on consent or a contract and carried out by automated means
Please note that the applicability and scope of these rights are determined on a case-by-case basis under the GDPR and depend, among other things, on the legal basis for processing. Therefore, not all rights may be available in all situations.
If you have questions regarding your rights, you may contact the University’s Data Protection Officer or the contact person of the responsible unit.
To exercise your rights, please submit a request to the University Registry Office:
kirjaamo@oulu.fi
Additional instructions will be provided upon request.
Right to Lodge a Complaint with a Supervisory Authority
In addition to the rights described above, you have the right to lodge a complaint regarding the processing of your personal data with the competent supervisory authority, the Office of the Data Protection Ombudsman of Finland.
Information regarding the telephone advisory service and opening hours of the Office of the Data Protection Ombudsman is available on its website.