1. Purpose of Processing Personal Data

Personal data is processed for the following purposes:

• Organizing and providing individual guidance and support services
• Client relationship management
• Statistical reporting and monitoring of activities
• Evaluation of service quality and effectiveness

Personal data is not processed for marketing purposes, nor is it used for identifiable student analytics or profiling. Data is not combined with other registers without the student’s explicit consent.

2. Legal Bases for the Processing of Personal Data

• Pursuant to Article 6(1)(a) of the General Data Protection Regulation (GDPR), the data subject has given consent to the processing of their personal data.
• Pursuant to Article 6(1)(c) of the GDPR, processing is necessary for compliance with a legal obligation to which the controller is subject.

3. Legal Bases for the Processing of Special Categories of Personal Data

The processing of data concerning a student’s health and functional capacity is based on the student’s explicit consent (GDPR Article 9(2)(a)) or, in situations where the work of the School Social Worker is considered part of student healthcare and wellbeing services, on the provision of health or social care services (GDPR Article 9(2)(h)).

4. Data Subjects

The register includes students of Vaasa University of Applied Sciences who have used the School Social Worker guidance services through appointments, contacts, or other support services.

This privacy notice is continuously available on the university’s website. Information about the register and the processing of personal data is also provided to students at the time of booking an appointment and in the School Social Worker’s email signature.

5. Sources of Personal Data

• The student
• Peppi Student Information System

6. Categories of Personal Data Processed

Data collected when booking an appointment:

• First and last name
• Email address
• Phone number
• Appointment date
• Student number
• Student’s own description of their situation and/or expectations for the discussion

Data collected for statistical purposes (anonymized):

• Date of appointment
• Number of visits and topic of the meeting
• Degree programme/unit and year of study
• Meeting format
• Type of guidance provided (e.g., individual guidance, multidisciplinary guidance, email support)

Additional data that may be processed:

• Assessment forms, expert statements, or other evaluation results provided by the student
• Creation of personal user credentials for the Arvio digital reading assessment tool (digiLukiseula), including information necessary for completing and reviewing the assessment

7. Requirement to Provide Personal Data

Providing essential personal data is necessary for booking an appointment and delivering the service. Providing more detailed health-related or background information is voluntary but may be necessary for arranging individualized and appropriate support.

8. Information Systems Used

• Peppi (student administration and agreement management)
• Microsoft Bookings (appointment scheduling)
• Microsoft Teams (remote meetings)
• Microsoft Outlook
• Webropol (surveys, feedback collection, and registrations)
• V-drive (network storage)
• Arvio (digiLukiseula)

9. Retention Periods

• Data in Microsoft Bookings, Outlook emails, and calendar entries are retained in accordance with the organization’s general email and calendar retention policies.
• Personal data collected through Webropol is retained only for as long as necessary and justified for its intended purpose.
• Anonymous statistics are compiled each semester and retained indefinitely for service evaluation purposes.
• Data in the digiLukiseula system is retained for four (4) years, after which it is automatically deleted.
• Remote meetings conducted via Microsoft Teams are not recorded.
• Data stored on the V-drive is retained until the student graduates.

10. Data Protection and Security Measures

The processing of personal data is carried out in a manner that safeguards the privacy of data subjects and complies with applicable legislation.

Manual records

Any paper-based records are stored in a locked office and in locked cabinets. Records may subsequently be transferred to the V-drive. Unnecessary records are securely destroyed, either by shredding or as confidential waste.

Electronic records

Electronic records are stored on the V-drive. All information systems are protected through personal user accounts and passwords. Networks and servers are protected using appropriate security measures.

11. Access Control and Monitoring

Personal data is processed only by individuals whose work duties require access to the information. Access rights are restricted through personal user credentials and are reviewed regularly, at least annually.

12. Transfer of Data Outside the EU/EEA

Personal data is not transferred outside the European Union (EU) or the European Economic Area (EEA).

13. Regular Disclosures of Personal Data

As a rule, students’ personal data is disclosed only with the student’s consent. However, the Universities of Applied Sciences Act (932/2014) permits disclosure without consent in certain situations where it is necessary to safeguard studies, wellbeing, or safety.

Universities of Applied Sciences Act (932/2014), Section 65 – Right to Obtain and Disclose Information

Notwithstanding confidentiality provisions, information concerning a student’s health and functional capacity that is necessary for the performance of duties may be disclosed to:

• The Rector of the University of Applied Sciences and other persons responsible for institutional safety, where necessary to ensure study safety
• Personnel responsible for academic guidance, for the purpose of directing students to other studies or support services
• Student healthcare personnel, to ensure the student’s health and safety and facilitate referral to necessary support services
• Persons responsible for practical training placements, to ensure the safety of the student, staff, and clients at the placement site
• The police and the university representative primarily responsible for investigating a security threat, when assessing an immediate safety threat or where a student has been determined through a health assessment to present a risk to the safety of others

14. Your Rights as a Data Subject

You have the right to:

• Receive information about the processing of your personal data
• Access and review your personal data
• Request correction of inaccurate or incomplete personal data
• Request erasure of your personal data (except where processing is required by law)
• Request restriction of processing of your personal data
• Object to the processing of your personal data
• Request the transfer of personal data you have provided from one controller to another (data portability)
• Withdraw your consent at any time where processing is based on consent

Requests concerning access, rectification, restriction, or deletion of personal data should be submitted to the Data Protection Officer of Vaasa University of Applied Sciences.

You also have the right to lodge a complaint with the Office of the Data Protection Officer if you believe that the processing of your personal data violates applicable data protection legislation.