Privacy policy

Personal data

Personal data are primarily collected from the user themself in connection to subscribing for a newsletter, submitting a contact request or registering for an event or training.

Data provided by the user:

• contact information, such as name and email address in the newsletter subscription.
• information required to register depending on the event and training, such as name, title, organisation, telephone number, address, email address and payment information
• other information collected with the user's permission

Data obtained when observing service usage:

• The IP address of the device used is recorded in the logs for page load requests that bypass the CDN cache. Log data are stored for three months.

Other information

• access and browsing data for site features using Matomo Analytics
• feedback on the use of the site based on the user's consent using the Askem tool
• other information collected with the user's permission

The Finnish National Agency for Education does not normally disclose any personal data. However, your personal data may be disclosed in the following situations:

1. Your consent
   a. With your explicit consent, personal data can be disclosed, for example, to a third party for a service provided by it 
    
2. Communities
   a. As a rule, personal data is not shown to other users of services of the Finnish National Agency for Education. In some services, users may themselves share their information with other users, for example, by using an alias (commenting on a blog).
    
3. Subcontractors and service providers
   a. The Finnish National Agency for Education uses subcontractors and service providers for the technical maintenance of its services and for customer services, customer communication and research. Personal data can be disclosed to subcontractors and service providers only to the extent they participate in the implementation of the services of the Finnish National Agency for Education and for the purposes described in this privacy policy statement.
   
   Subcontractors and service providers must not use the personal data disclosed to them for any other purposes than those described in this privacy statement and those determined by the Finnish National Agency for Education. The Finnish National Agency for Education obliges subcontractors and service providers to maintain the confidentiality of the data and to ensure that appropriate data security and data protection are implemented to protect personal data.
    
4. International data transfers
   a. The Finnish National Agency for Education makes efforts to always implement the services and to process personal data primarily within the EU and the EEA, using operators and services established in these areas. If this principle is exceptionally and on a case by case basis deviated from, thorough reports regarding the implementation of data protection and data security in the service concerned are required from the service.
    
5. Use in research
   a. We may disclose data for scientific or other studies, provided that the data concerned has first been changed into a form in which individual persons can no longer be identified.
    
6. Disclosures due to mandatory legislation
   a. Under the law, your personal data can be disclosed to other authorities for official use.
    
7. Data transfer to third countries
   a. Apart from exceptional cases, we do not transfer data outside the EU or the EEA. If data is transferred outside the EU or the EEA, we will ensure the adequate level of protection for personal data, for instance, by agreeing on matters related to the confidentiality of personal data and its processing as required by legislation, for example, by using model contract clauses approved by the European Commission and in other ways so that personal data is processed in accordance with this privacy policy.

The registers are maintained and protected through different technical and organisational measures. We ensure that our system is fault tolerant and that it is possible to recover data. These protection measures include access control, physical access control, technical solutions such as firewalls, and password protection. These measures enable access to the stored data only for named employees of the Finnish National Agency for Education and for service providers with a contractual relationship with the Agency.

We inform the police and the National Cyber Security Centre Finland of possible data security threats and data security violations directly through the services. We may also temporarily close services to protect personal data.

The Finnish National Agency for Education stores the user's data in accordance with the legislation in force at the time and only as long as necessary to fulfil the purposes described in this privacy policy. When the grounds for processing your personal data no longer exist, we will remove your personal data.

The Finnish National Agency for Education constantly develops its services and may from time to time make changes to this privacy policy without prior notice. However, if this privacy policy is substantially altered, the Finnish National Agency for Education will display a notification of it at the beginning of this privacy statement for a duration of at least 30 days. Changes may also be based on a change in legislation. We recommend that you view this privacy statement from time to time to find out about the possible changes that have been made to the privacy policy.