A. External audience:

• The listener is not employed by Åbo Akademi University and takes part of his or her own free will
• The listener is a student or an employee of Åbo Akademi University but does not take part as a student or an employee and takes part of his or her own free will

B. External speakers

• The speaker is not employed by Åbo Akademi University and has been asked to speak at the event
• The speaker is employed by Åbo Akademi University but does not speak as an employee of Åbo Akademi University, i.e. the performance is not a part of the person’s work assignments at Åbo Akademi University

C. Student of Åbo Akademi University as audience or speaker

• The participant takes part as student of Åbo Akademi University, i.e. participation is included in the studies

D. Employees of Åbo Akademi University as audience or speakers

• The participant is employed by Åbo Akademi University and performs as an employee of Åbo Akademi University, i.e. the performance is part of the person’s work assignments
• The participant is employed by Åbo Akademi University and takes part as an employee of Åbo Akademi University, i.e. participation is included in the person’s work assignments

It is necessary to process personal data for following specific purposes:

1. Conducting events described above, among other things by

• receiving registrations
• sending information about the program, when necessary, by e-mail
• communicating with participants before, during, and after the events in the form of participation-related information by e-mail
• ensuring the safety of the participants at the events.
• arranging refreshments (including handling any requests for special diets)
• practical arrangements (e.g. requests for accessibility)
• arranging journeys to and from the event
• streaming the event if it is arranged in whole or in part remotely

2. Immortalising the event through photography or video recording to inform about the activities at the faculty

• selected photographs can be published on Åbo Akademi University’s external website and shared in social media channels belonging to Åbo Akademi University or its units
• Åbo Akademi University can transfer photographs to third parties, such as newspapers, for their journalistic purposes

The personal data that is necessary to process varies depending on the event and only such data that is necessary for the event in question is collected and processed. Which data is needed for a specific event will be seen in the registration form of the event.

According to the GDPR, there must be a legal basis for processing personal data. The legal basis for processing your personal data is:

1. Conducting events

The legal basis is stated separately for each group mentioned below:

A. External audience: consent (art. 6.1.a)

When an external person (either a person who is not employed by Åbo Akademi University or a student or employee at Åbo Akademi University who is not attending as student or employee of Åbo Akademi University and the participation is fully voluntary) participates as listener at an event, his or her personal data is processed on the legal basis consent.

You give consent voluntarily after being informed about how your personal data will be processed, by, in connection with registration, checking the box ”Yes, I consent to Åbo Akademi processing my personal data for conducting this event at the Faculty of Science and Engineering, Åbo Akademi, as described in the privacy notice”.

When consent is the legal basis for processing your personal data, you have the right to withdraw it at any time. You can notify that you have withdrawn your consent by sending an email to the contact person named in this privacy notice, or to registrator@abo.fi. The processing carried out before you withdrew your consent will not be affected.

B. External speakers: contract (art. 6.1.b)

When an external person (either a person not employed by Åbo Akademi University or a person employed by Åbo Akademi University whose work assignments at Åbo Akademi University do not include performing the speech) is asked to speak at the event, a contract concerning the speech is established between the speaker and Åbo Akademi University. Processing of personal data is then necessary for the performance of the contract in which the speaker is party, and therefore his or her personal data is processed on the legal basis contract.

C. Student at Åbo Akademi University as audience: public interest (art. 6.1.e)

If the studies of a student at Åbo Akademi University require that the student takes part as audience in such an event this privacy notice refers to, the legal basis of processing his or her personal data is public interest on the basis of that the duties of Åbo Akademi University include imparting highest teaching based on research and fostering students to serve the fatherland and humanity. (Universities Act, § 2)

D. Employees at Åbo Akademi University as audience or speakers: legitimate interest (art. 6.1.f)

When it is required that employees at Åbo Akademi University take part in an event, either as audience or as speakers, and participation is included in their work assignments their personal data is processed on the legal basis legal interest.

2. Immortalising the event through photography or video recording to inform about the activities at the faculty: consent (art. 6.1.a)

When the event is immortalised through photography or video recording to inform about the activities at the faculty, personal data that are revealed in the photograph/video recording are processed on the basis of consent.

The person who can be identified in the photograph/video recording has given his or her consent fully voluntarily after examining the information on how his/her personal data will be processed by, when asked to participate in a photograph/video recording, giving his/her name and checking the box, “Yes, I consent to Åbo Akademi processing my personal data shown in the photograph/video recording during the event at the Faculty of Science and Engineering, Åbo Akademi University, as described in the privacy notice”.

When consent is the legal basis for processing your personal data, you have the right to withdraw it at any time. You can notify that you have withdrawn your consent by sending an email to the contact person named in this privacy notice, or to registrator@abo.fi. The processing carried out before you withdrew your consent will not be affected.

The list below contains all data that can be collected in connection with different events (only that data that is necessary for each individual event is collected).

Data that can be collected at registration:

• First name
• Last name
• Telephone number
• Email
• Professional title
• Date of birth
• Country
• Preferences for refreshments (including handling any requests for special diets)
• Preferences for practical arrangements (e.g. concerning accessibility)

Information that can be collected on-site:

• Photographs and video recordings where participants at the event can be identified by being shown and/or heard.

The personal data is processed by the individuals at the Faculty of Science and Engineering who are deemed to need the information for the execution of the event.

In addition, lists of names of the participants are transferred to the Financial Services of Åbo Akademi University by being entered into the accounting system to make Åbo Akademi University capable of answering questions from tax authorities at a possible tax control.

Where are your personal data collected from and how are they processed?

Personal data collected via registration:

Collection: Personal data is collected directly from the individual via a registration form in Åbo Akademi’s contact register (CRM).

Registration: The registration details are recorded in the CRM tool. A profile for the individual is not created.

In connection with streaming: If the event is organised in whole or in part in distance, the event will be streamed via Zoom but not recorded. Those participating via Zoom in a smaller group meeting where participants are discussing with each other can choose themselves whether to have the camera (can be identified by face) and microphone (can be identified by voice) on. When larger events are streamed, both camera and microphone should be off.

In connection with arranging refreshments and/or practical arrangements: In case arranging refreshments is required at the event (including handling of possible requests of special diets) and/or practical arrangements (e.g. requests of accessibility), personal data related to these requests can be transferred to a third party hired by Åbo Akademi University that is in charge for the refreshments and the practical arrangements respectively. In connection with arranging journeys and accommodation: In case arranging journeys to and from the event and accommodation is required for the event, personal data necessary for the travel service is transferred to the service provider.

Storage and deletion: The registration details are stored in the CRM tool and in an Excel sheet accessible to the individuals at the Faculty of Science and Engineering who are deemed to need the information for the execution of the event. The Excel sheet is stored on the local drive of a computer belonging to Åbo Akademi University, belonging to one of the individuals in question. The list is not shared on cloud services. The personal data is deleted manually when all post-event work, reporting, and documentation are completed and the data is no longer necessary, but no later than 1 year after the events have been held.

Photographs and video recordings collected during the event:

Collection: A photographer from Åbo Akademi asked by the arranger will be present during the event. As tools to produce the material, only tools provided by Åbo Akademi University are used.

Editing: If the photographs are edited, it is done with tools provided by Åbo Akademi University.

Distribution:

• Åbo Akademi University’s website: Selected photographs and video recordings (including captions with e.g. names) can be published on the external website of Åbo Akademi University and its departments. Information in the published material may spread all over the world.
• Åbo Akademi University’s social media: Åbo Akademi University’s website: Selected photographs and video recordings (including captions with e.g. names) can be published on social media channels belonging to Åbo Akademi University or its departments. As the social media accounts are public, the published information spreads all over the world. In connection with the publication, the information is transferred to Meta (owner of Instagram and Facebook) as well as to LinkedIn.
• Transfer to news media: Åbo Akademi University can transfer photographs/video recordings (including captions, e.g. names) to a third party (e.g. newspapers) for their journalistic purposes.

Storage and deletion:

• After collection, the material is, when required, transferred to a local drive of a computer belonging to Åbo Akademi University. At the same time, the material is deleted from the tool used in the collection (e.g. camera). Photographs and video recordings (including captions with names) are stored as long time as the registration details, i.e. at its most 1 year after the event was executed. After that they are deleted manually.
• Åbo Akademi University’s website: As starting point, the published material is not deleted from the website of Åbo Akademi University.
• Åbo Akademi University’s social media: As starting point the published material is not deleted from the social media of Åbo Akademi University.

Is your personal data transferred to a third party (outside Åbo Akademi University) for processing?

Yes, personal data will be transferred to a third party for processing.

In connection with a registration via the CRM system of Åbo Akademi the personal data is transferred to the provider of the CRM system.

If the event is organised wholly or in part in distance the event will be streamed via Zoom and the personal data of the persons who participate via Zoom and choose to have their camera and/or microphone on will be transferred to Zoom.

If the event requires that refreshments are arranged (including processing possible requests of special diets) and/or practical arrangements (e.g. requests of accessibility) can personal data relating to these requests be transferred to a third party engaged by Åbo Akademi University to be responsible for the refreshments and practical arrangements respectively.

Is your personal data transferred to a third party (outside Åbo Akademi University) for the needs of the third party?

Yes, personal data can be transferred to a third party for the needs of the third party.

When photographs and video recordings are published in Instagram and Facebook, the personal data emerging from the material is transferred to Meta Platforms Inc. Meta Platforms Inc processes content that is published in Meta’s platforms for its own purposes. Read more in Metas privacy notice:  https://www.facebook.com/privacy/policy/.

When photographs and videos are published in LinkedIn, the personal data emerging from the material is transferred to LinkedIn Corporation. LinkedIn Corporation processes content published in LinkedIn for its own purposes. Read more in LinkedIn’s privacy notice: https://www.linkedin.com/legal/privacy-policy.

Selected photographs can even be transferred to newspapers for their journalistic purposes.

If the event is organized as excursion (e.g. cruise), the personal data necessary for the travel service (e.g. data required for passenger lists) is transferred to the service provider.

Is your personal data transferred outside EU/EEA?

Yes, personal data can be transferred outside EU/EEA.

If the event is arranged wholly or in part in distance, the event is streamed via Zoom, and the personal data of the persons participating via Zoom who choose to have their camera and/or microphone on will be transferred to Zoom and thereby even outside EU/EEA.

When Åbo Akademi University publishes photographs or video recordings in Instagram, Facebook (owned by Meta Platforms Inc) and LinkedIn, the personal data emerging from the material is transferred to Meta Platforms Inc and LinkedIn Corporation and thereby even outside EU/EEA.

In July 2023, the European Commission made a decision that the USA has an adequate level of data protection. Organizations transferring personal data from the EU to the USA can certify themselves under the EU-U.S. Data Privacy Framework in accordance with the adequacy decision. Upon certification, an adequate level of protection is considered to be provided for the personal data transferred to these organizations.

Zoom, Meta Platforms Inc, and LinkedIn Corporation are certified under the framework.

If selected photographs are transferred to newspapers for their journalistic purposes can photographs in connection with publication become available for anyone to see, outside EU/EEA, too.

If personal data in connection with transfer to a provider of travel services are transferred outside EU/EEA, Åbo Akademi University assures that an appropriate ground for transfer will be used.

What rights do you have when Åbo Akademi University processes your personal data?

Åbo Akademi University is responsible for taking appropriate technical and organisational measures to protect personal data against unauthorized or illegal processing and against damage to or loss of personal data. Personal data must always be processed in a fair and transparent manner in accordance with applicable data protection regulations.

According to the EU General Data Protection Regulation GDPR (art.12-22), you have the right to

– get transparent information on how your personal data is processed and how you can exercise your rights (Art. 12)

– get access to your personal data at Åbo Akademi University and information on the processing of data (Art. 15)

– have your personal data corrected (Art. 16). Note that employees and students at Åbo Akademi University can in most cases correct their own data according to the instructions on the intranet.

– have your data erased (“the right to be forgotten”) in certain situations (Art. 17)

– restrict the processing of your personal data in certain situations (Art. 18)

– have your personal data transferred between systems in certain situations (Art. 20)

– object to the processing of your personal data in certain situations (Art. 21)

– not be subject to automated decision-making, with certain exceptions (Art. 22)

You have also the right to be informed of a personal data breach involving a high risk for your personal data (Art. 34).

When the purpose of the processing is scientific research, statistics or archival purposes, the rights may be restricted by the Data Protection Act (1050/2018). Restrictions on rights always require special protective measures.

If you have questions about your rights, you can contact the responsible contact person (see above) or the ÅAU Data Protection Officer (dataskydd@abo.fi). See also the overall information on the processing of personal data on the ÅAU website www.abo.fi/en/processing-of-personal-data-at-abo-akademi-university

You have the right to lodge a complaint with the data protection authority if you believe that the processing of your personal data is an infringement of the General Data Protection Regulation (GDPR).

Contact information to the data protection authority

Office of the Data Protection Ombudsman
PL 800
00531 Helsinki
+358 29 566 6700 (switchboard)
tietosuoja@om.fi
tietosuoja.fi