Data protection and the processing of personal data

EU General Data Protection Regulation (679/2016/EU)
The Finnish Data Protection Act (1050/2018)

Privacy Notice
Data Controller’s Information Notice
9 June 2025

1. Name of the Register

Customer Service Activities In Educational Fields

2. Data Controller

Samiedu Municipal Education and Training Consortium
(Business ID 0207390-8)
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna

3. Person Responsible for the Register

Director of Education
Samiedu Vocational College
Pohjolankatu 4-6, 57200 Savonlinna
Tel. +358 44 550 6511

4. Contact Person for Data Protection Matters

Data Protection Officer of Samiedu Municipal Education and Training Consortium
tietosuojavastaava@savonlinna.fi

5. Purpose and Legal Basis for the Processing of Personal Data

The purpose of processing personal data is to provide customer service and to ensure safe customer service.

Personal data is processed, for example, in connection with making appointments, preparing offers and contracts, issuing statutory inspection reports for electrical work, and invoicing for services and work performed.

The legal basis for the processing of personal data is Article 6(1)(c) of the General Data Protection Regulation (GDPR), i.e. the processing is necessary for compliance with a legal obligation to which the data controller is subject.
The legal basis for the processing of health data is Article 9(2)(a) of the GDPR, i.e. the data subject has given explicit consent to the processing of such personal data.

Key Legislation:
Act on Vocational Education and Training (531/2017)
Government decree on Vocational Education and Training, VET (673/2017)

6. Contents of the Register

• Customer data: name, address, email address
• Date of birth and personal identity code
• Year of birth, chronic illnesses, allergies and medication (wellbeing services)
• Billing information

Some of the data contained in the register is confidential (health-related data).

Legal Basis for Confidentiality:
Act on the Openness of Government Activities (621/1999, Section 24)

7. Sources of Personal Data

• Customers
• The Finnish Transport and Communications Agency Traficom (vehicle repair services)

8. Data Processors

The data processor is the information system provider contracted for the systems used in managing the register.

9. Disclosures of Personal Data

No regular disclosure of personal data.

10. Transfer of Personal Data Outside the EU or the European Economic Area (EEA)

Personal data is not transferred outside the EU or the EEA.

11. Retention Period of Personal Data

The data contained in the register is retained in accordance with the document management plan of the municipal education and training consortium (e.g. contracts, inspection reports) or for as long as necessary for managing the customer relationship.

The retention period is based on:
guidelines issued by the National Archives of Finland
recommendations by the Association of Finnish Local and Regional Authorities
the Act on Vocational Education and Training (531/2017)

12. Information Systems Used for Maintaining the Register and Data Protection Principles

A. Electronic Register Systems and Their Security

The following systems are used for maintaining the register:

• the TIMMA booking system (wellbeing services)
• the HitsariPro system (welding services)
• AutoFuture (vehicle repair services)
• MS Office 365 tools

The security of the register is ensured by restricting access rights to the information systems to vocational college staff and students only.

In addition, security is supported by appropriate system updates as well as technical safeguards related to network infrastructure and the physical placement of equipment.

B. Paper-Based Records and Their Protection

No paper-based records are maintained.

EU General Data Protection Regulation (679/2016/EU)
The Finnish Data Protection Act (1050/2018)

Privacy Notice
Data Controller’s Information Notice
18 June 2025

1. Name of the Register

Case Management and Document Management

2. Data Controller

Samiedu Municipal Education and Training Consortium
(Business ID 0207390-8)
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna

3. Person Responsible for the Register

Director of Administration
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna
Tel. +358 44 550 6363

4. Contact Person for Data Protection Matters

Data Protection Officer of Samiedu Municipal Education and Training Consortium tietosuojavastaava@savonlinna.fi

5. Purpose and Legal Basis for the Processing of Personal Data

The register is used to manage electronic documents as well as decisions made by governing bodies and officials, and to archive these documents.

The legal basis for the processing of personal data is compliance with a statutory obligation.

Key Legislation:
Act on Information Management in Public Administration (906/2019)
Act on the Openness of Government Activities (621/1999)
Local Government Act (410/2015)

6. Contents of the Register

The main data content of the register consists of the following:

• metadata related to cases and documents
• the content of documents
• parties involved in the processing of a case
• parties involved in the processing of a case

Documents stored in the register contain the information necessary for each specific purpose of use, such as:

Students: name, personal identity code or date of birth, contact details, information related to the right to study, certificates issued

Employment relationships: name, personal identity code, contact details, type of employment relationship, job title and unit, working hours and salary information

Contracts: parties to the contract, content and purpose of the contract, contract period, and signatories

Elected representatives: name, contact details

Some of the data contained in the register is confidential.

Legal Basis for Confidentiality:
Act on the Openness of Government Activities (621/1999, Section 24)
Confidentiality obligations under specific legislation

7. Sources of Personal Data

The data is obtained from the data subjects themselves, from organisations and authorities, from the case handler, from contractual partners, and from elected representatives.

8. Data Processors

Auditors who have access to personal data in accordance with their duties and client relationship.
Representatives of the contracted information system provider also act as data processors.

9. Disclosures of Personal Data

Agendas and minutes of governing bodies that are public are published on a public network after the agenda and minutes have been finalised.
Unnecessary personal data is not published.

Personal data is not disclosed for direct marketing, telemarketing, address services, or market and opinion surveys.

10. Transfer of Personal Data Outside the EU or the European Economic Area (EEA)

Personal data is not transferred outside the EU or the EEA.

11. Retention Period of Personal Data

The data contained in the register is retained in accordance with the institution’s information management plan, either permanently or for a fixed period.

The retention period is based on:
guidelines issued by the National Archives of Finland
recommendations by the Association of Finnish Local and Regional Authorities

12. Information Systems Used for Maintaining the Register and Data Protection Principles

A. Electronic Register Systems and Their Security

The M-Files system is used for case management and archiving.
Electronic meeting management is an integral part of the system.

The protection of the register is ensured by restricting access rights to the information system, implementing appropriate updates, and applying technical safeguards related to network infrastructure and the physical placement of equipment.

An agreement has been concluded between the data controller and the system providers regarding data protection and technical requirements related to the environment.

The system provider ensures the retention of the register and the data contained in it in accordance with good data processing practices, so that the register remains technically intact and reliable.
B. Paper-Based Records and Their Protection

No paper-based records are maintained.

EU General Data Protection Regulation (679/2016/EU)
The Finnish Data Protection Act (1050/2018)

Privacy Notice
Data Controller’s Information Notice
12 June 2025

1. Name of the Register

Human Resources Services

2. Data Controller

Samiedu Municipal Education and Training Consortium
(Business ID 0207390-8)
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna

3. Person Responsible for the Register

HR Manager
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna
Tel. +358 44 550 6225

Property Services Coordinator (Access Control and Key Management)
Tel. +358 44 550 6395

4. Contact Person for Data Protection Matters

Data Protection Officer of Samiedu Municipal Education and Training Consortium
tietosuojavastaava@savonlinna.fi

5. Purpose and Legal Basis for the Processing of Personal Data

The purposes of processing personal data are:

• the management of personnel and employment-related matters
• the payment of salaries and remuneration
• the performance of the employer’s statutory duties and obligations
• the payment of remuneration to elected representatives
• working time planning and monitoring, access control and key management
• recruitment (acquisition of workforce)
• management of employee travel
• competence management
• human resource management
• compliance with occupational safety obligations
• monitoring of human resources administration (reporting and statistics)
• statistical reporting and cooperation with authorities (e.g. Statistics Finland, the Incomes Register, Kela)

The legal basis for the processing of personal data is based on Article 6(1) of the General Data Protection Regulation (GDPR), in particular: (b) processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;
(c) processing is necessary for compliance with a legal obligation to which the data controller is subject;
(f) processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party.

The legal basis for the processing of special categories of personal data is Article 9(2)(b) and (h) of the GDPR.

Key Legislation:
Employment Contracts Act (55/2001)
Act on Municipal and County Officials (304/2003)
Act on the Protection of Privacy in Working Life (759/2004)
Act on the Openness of Government Activities (621/1999)
Local Government Act (410/2015)
Occupational Safety and Health Act (738/2002)

6. Contents of the Register

a) The register contains the data required by the municipal education and training consortium for managing employee information:

• Basic information: name, personal identity code, address, telephone number, municipality of residence, employment history and educational background
• Employment relationship data (e.g. start date, end date, job title, pension scheme, organisational unit, applicable collective agreements, working hours, employment periods)
• Bank details: bank name, account number
• Tax withholding details (e.g. withholding percentage, type of taxation)
• Annual leave information: leave entitlement and holiday periods
• Basis for salary: employment history, salary components, fringe benefits, trade union membership (confidential data, stored separately)
• Degrees and competence-related information, performance and career development conversations
• Payroll and salary payment
• Enforcement-related data (e.g. amount, enforcement district, duration – confidential data, stored separately)
• Pension insurance
• Determination of employee benefits
• Work schedules and working time planning, working time records and access control
• Sick leave, participation in training and other leaves of absence (e.g. period, reason code, paid/unpaid status)
• Confidential health data stored separately (e.g. medical certificates related to sick leave)
• Work-related travel information
• Key management and access rights
• HR reporting

b) The register contains the data required by the municipal education and training consortium for fulfilling its statutory obligations concerning elected representatives:

• Basic information: name, personal identity code, address, telephone number
• Information on the position of trust (e.g. start date, end date)
• Bank details: bank name, account number)
• Tax withholding details (e.g. withholding percentage, type of taxation)
• Payroll and salary payment
• Enforcement-related data (e.g. amount, enforcement district, duration – confidential data, stored separately)
• Pension insurance
• Travel information
• HR reporting
• Political party tax data

Some of the data contained in the register is confidential, including trade union membership data, sick leave data, and health data.

Legal Basis for Confidentiality:
Act on the Openness of Government Activities (621/1999, Section 24)
EU General Data Protection Regulation (679/2016/EU, Article 9)

7. Sources of Personal Data

Data is obtained from:

• employees, recipients of salaries, remuneration and pensions, as well as job applicants
• persons responsible for decisions concerning employment relationships
• the Finnish Tax Administration for tax withholding purposes
• pension insurance companies for employer contributions
• insurance companies for employer contributions
• authorities (e.g. employee-related payments)
• occupational health care
• Kuntarekry, national public sector job search service and recruitment service for municipal employers and wellbeing services counties ()

8. Data Processors

The data processors are the information system providers contracted for the systems used in managing the register.

9. Disclosures of Personal Data

Personal data is disclosed on the basis of legislation or consent to the following parties:

• Authorities, including: the Incomes Register and Keva
• Statistics Finland, trade unions, insurance companies and enforcement authorities
• With consent, for online publication
• For elected representative data, to political parties (political party tax collected per individual)
• Information on an employee’s work ability (self-reported statement or medical certificate/opinion submitted by the employee) may be disclosed to the occupational health care service provider for the purposes defined in the Occupational Health Care Act (1383/2001), unless the employee has prohibited the disclosure (Act on the Protection of Privacy in Working Life 759/2004, Section 5(3))
• Payroll and remuneration payment data to banks and for accounting purposes

10. Personal data is not transferred outside the EU or the EEA.

11. Retention Period of Personal Data

The data contained in the register is retained in accordance with the municipal education and training consortium’s information management plan, either permanently or for a fixed period.

The retention period is based on:
guidelines issued by the National Archives of Finland
recommendations by the Association of Finnish Local and Regional Authorities

12. Information Systems Used for Maintaining the Register and Data Protection Principles

A. Electronic Register Systems and Their Security

The personnel administration system consists of the following systems:

• Employment relationship data: Personec F
• Payroll system: Personec F
• Electronic services: Personec F ESS7
• Competence management: Personec OSS
• Work shift planning: Työvuorovelho
• Working time records: TuntiVelho
• Annual working time planning and monitoring: TAIKA working time management system
• Access control and key management: i-LOQ
• Travel management: M2Blue
• Online publications: the intranet and the external websites of the Samiedu Municipal Education and Training Consortium
• Recruitment: Kuntarekry
• Email: Microsoft 365 (staff and elected representatives use work email accounts as part of their employment relationship to process personal data related to their dutie)

The protection of the register is ensured by restricting access rights to the information systems. In addition, security is supported by appropriate system updates as well as technical safeguards related to network infrastructure and the physical placement of equipment.

An agreement has been concluded between the data controller and the system providers regarding data protection and technical requirements related to the environment. The system providers ensure the retention of the register and the data contained in it in accordance with good data processing practices, so that the register remains technically intact and reliable.

B. Paper-Based Records and Their Protection

The records are stored in locked premises, and access to the records is restricted to persons who are authorised to process the data as part of their duties.

EU General Data Protection Regulation (679/2016/EU)
The Finnish Data Protection Act (1050/2018)

Privacy Notice
Data Controller’s Information Notice
9 June 2025

1. Name of the Register

Video Surveillance

2. Data Controller

Samiedu Municipal Education and Training Consortium
(Business ID 0207390-8)
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna

3. Person Responsible for the Register

Principal IT Architect
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna
Tel. +358 44 550 6206

4. Contact Person for Data Protection Matters

Data Protection Officer of Samiedu Municipal Education and Training Consortium
tietosuojavastaava@savonlinna.fi

5. Purpose and Legal Basis for the Processing of Personal Data

Surveillance of properties owned by the municipal education and training consortium in order to protect property, prevent crime, and investigate incidents.

Register data may be used, where necessary, to investigate criminal offences and incidents as well as to identify persons present in the surveillance area.

The legal basis for the processing is Article 6(1)(e) of the General Data Protection Regulation (GDPR), i.e. processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

6. Contents of the Register

Video footage recorded by cameras within the surveillance area, including the time and location of recording.
The recorded video material does not include audio.
The area is clearly marked with signs or stickers indicating video surveillance.

Some of the data contained in the register is confidential.
Legal Basis for Confidentiality:
Act on the Openness of Government Activities (621/1999, Section 24)

7. Sources of Personal Data

Video footage captured by cameras within the surveillance area.

8. Data Processors

Where necessary, the police authority may act as a data processor.

9. Disclosures of Personal Data

Data from the video surveillance register is disclosed only to the police or to another competent authority that, for a purpose specified by law, requests access to specific data from the register.

10. Transfer of Personal Data Outside the EU or the European Economic Area (EEA)

Personal data is not transferred outside the EU or the EEA.

11. Retention Period of Personal Data

Video recordings are generally retained for one month from the time of recording. At the separate request of an authority, the recordings may be retained for the period required for the handling of the matter.

12. Information Systems Used for Maintaining the Register and Data Protection Principles

A. Electronic Register Systems and Their Security

The recording devices are located in monitored premises. Access rights to the video recordings have been defined and are restricted to persons authorised to access them in accordance with their job responsibilities.

The protection of the register is ensured by restricting access rights to the records, implementing appropriate updates, and applying technical safeguards related to network infrastructure and the physical placement of equipment.

B. Paper-Based Records and Their Protection

No paper-based records are maintained.

EU General Data Protection Regulation (679/2016/EU)
The Finnish Data Protection Act (1050/2018)

Privacy Notice
Data Controller’s Information Notice
9 June 2025

1. Name of the Register

Internationalisation in Education

2. Data Controller

Samiedu Municipal Education and Training Consortium
(Business ID 0207390-8)
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna

3. Person Responsible for the Register

Specialist, Internationalisation and Education Technology
Samiedu Vocational College
Pohjolankatu 6, 57200 Savonlinna
Tel. +358 44 550 6237

4. Contact Person for Data Protection Matters

Data Protection Officer of Samiedu Municipal Education and Training Consortium
tietosuojavastaava@savonlinna.fi

5. Purpose and Legal Basis for the Processing of Personal Data

Samiedu Municipal Education and Training Consortium / Samiedu Vocational College annually applies for Erasmus+, European Commission and EDUFI funding to finance international activities and cooperation.
In practice, for students, the activities consist of work-based learning periods abroad, carried out in cooperation with a network of partners.

For staff, the activities involve development work within international networks.
The purpose of the register is to manage international activities in education and for students.

The legal basis for the processing of personal data is compliance with a statutory obligation of the data controller and the data subject’s consent.
Key Legislation:
Act on Vocational Education and Training (531/2017)
Government decree on Vocational Education and Training, VET (673/2017)

6. Contents of the Register

The following data is stored in the register:

• Basic personal data (name and year of birth)
• Contact details: email address, address, telephone number)
• Information on willingness to participate in student mobility abroad
• Destination country and timing of the international mobility period
• CV and cover letter for applying for work placements

7. Sources of Personal Data

Personal data is obtained directly from the data subject when they enter their information into systems and applications used for managing international activities.

8. Data Processors

• Employees of Samiedu Vocational College who have access rights to the register in accordance with their duties.
• A representative of the partner institution in the destination country and a representative of the receiving workplace.
• Students themselves, with regard to their own personal data.
• The project funder.
• Data processors also include the providers of the information systems used for managing the register.

9. Disclosures of Personal Data

• Personal data is disclosed to project funders in accordance with their guidelines.
• The student’s CV and motivation letter are shared with a foreign project partner for the purpose of finding a work placement, with the student’s consent. The project partner is committed to not disclosing the data to any third party outside the process.

Personal data is not disclosed for direct marketing, telemarketing, address services, or market and opinion surveys.

10. Transfer of Personal Data Outside the EU or the European Economic Area (EEA)

Personal data is not transferred outside the EU or the EEA.

11. Retention Period of Personal Data

Data is retained in the systems for the duration of the project or cooperation. After the project has ended, the data is archived in paper form for the retention period required for each project. For example, accounting records and other project-related documentation (such as participant lists, Europass documents and certificates of employment) related to projects funded by the Finnish National Agency for Education (EDUFI), the European Commission and Erasmus+ must be retained for 10 years from the project end date specified in the funding decision.

12. Information Systems Used for Maintaining the Register and Data Protection Principles

A. Electronic Register Systems and Their Security

International student mobility and activities are managed using several systems, including:

• application through the Wilma student administration system
• an Excel file stored in OneDrive for organising mobility periods
• Europass CV and motivation letters used to find work placements abroad
• the OLS system (Online Linguistic Support), used to assess the language proficiency of participants in Erasmus+ projects
• the Beneficiary Module system, used by the funder to collect data on participants in Erasmus+ projects
• a Blogger platform, where students report on their learning anonymously
• Microsoft Teams, where teachers and coordinators guide students’ learning
• EU Survey, used by the funder to collect information on the success of Erasmus+ mobility processes

Privacy descriptions of the different systems are provided below.

• Microsoft OneDrive: https://account.microsoft.com/privacy
• Google https: //policies.google.com/privacy?hl=fi&gl=ZZ
• OLS: https://erasmusplusols.eu/fi/privacy-statement/
• EU LOGIN: Privacy statement
• Beneficiary Module https://webgate.ec.europa.eu/erasmus-esc/index/

The security of the register is ensured by restricting access to the information systems to staff of the vocational college and to contractual partners in accordance with the relevant agreements.
In addition, security is supported by appropriate updates to the institution’s system environment, as well as technical safeguards related to network infrastructure and the physical placement of equipment.
B. Paper-Based Records and Their Protection

Stored in locked premises and protected from unauthorised access.

EU General Data Protection Regulation (679/2016/EU)
The Finnish Data Protection Act (1050/2018)

Privacy Notice
Data Controller’s Information Notice
21 August 2025

1. Name of the Register

Student Counsellors’ Customer Register

2. Data Controller

Samiedu Municipal Education and Training Consortium
(Business ID 0207390-8)
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna

3. Person Responsible for the Register

Pedagogical Manager
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna
Tel. +358 44 550 6627

4. Contact Person for Data Protection Matters

Data Protection Officer of Samiedu Municipal Education and Training Consortium
tietosuojavastaava@savonlinna.fi

5. Purpose and Legal Basis for the Processing of Personal Data

Provision of individual student welfare services and management of the customer relationship.

The legal basis for the processing of personal data is compliance with a statutory obligation.

Key Legislation:
Student Welfare Act (1287/2013)

6. Contents of the Register

Student information: first name and surname, personal identity code, home address, educational institution, survey forms, and records of meetings, phone calls, Wilma messages, verbal support discussions, online collaboration and support measures.

Parent/guardian/next-of-kin information: first name and surname, home address and telephone number, type of guardian

The data contained in the register is confidential.

Legal Basis for Confidentiality:
Act on the Openness of Government Activities (621/1999, Section 24)
Student Welfare Act (1287/2013)

7. Sources of Personal Data

• The student themselves, in connection with support discussions
• Parents/guardians, teachers, other staff and other cooperation networks (e.g. social services, mental health and substance abuse services, youth services, the police, etc.)
• Observations made by student welfare staff
• Health care professionals, with the consent of the student or guardian
• MultiPrimus student information system

8. Data Processors

The data processor is the information system provider contracted for the system used in managing the register.

9. Disclosures of Personal Data

The disclosure of personal data is based on the explicit consent of the student/guardian or on applicable legislation.

Personal data is not disclosed for direct marketing, telemarketing, address services, or market and opinion surveys.

10. Transfer of Personal Data Outside the EU or the European Economic Area (EEA)

Personal data is not transferred outside the EU or the EEA.

11. Retention Period of Personal Data

The data contained in the register are retained in accordance with the document management plan of the municipal education and training consortium.

The retention period is based on:
guidelines issued by the National Archives of Finland
recommendations by the Association of Finnish Local and Regional Authorities
the Act on Vocational Education and Training (531/2017)

12. Information Systems Used for Maintaining the Register and Data Protection Principles

A. Electronic Register Systems and Their Security

The register is maintained in the Kuraattori section of the MultiPrimus system.

The security of the register is ensured by restricting access rights to the information systems to student welfare staff only.

In addition, security is supported by appropriate system updates as well as technical safeguards related to network infrastructure and the physical placement of equipment.

An agreement has been concluded between the data controller and the system provider regarding data protection and technical requirements related to the environment.
The system provider ensures the retention of the register and the data contained in it in accordance with good data processing practices, so that the register remains technically intact and reliable.

B. Paper-Based Records and Their Protection

A possible paper-based customer register, including various forms and materials (such as drawings produced by the student during support discussions). Stored in locked premises and protected from unauthorised access.

EU General Data Protection Regulation (679/2016/EU)
The Finnish Data Protection Act (1050/2018)

Privacy Notice
Data Controller’s Information Notice
9 June 2025

1. Name of the Register

User Management

2. Data Controller

Samiedu Municipal Education and Training Consortium
(Business ID 0207390-8)
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna

3. Person Responsible for the Register

Principal IT Architect
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna
Tel. +358 44 550 6206

4. Contact Person for Data Protection Matters

Data Protection Officer of Samiedu Municipal Education and Training Consortium
tietosuojavastaava@savonlinna.fi

5. Purpose and Legal Basis for the Processing of Personal Data

The purpose of processing personal data in the register is to maintain user accounts and access rights for staff and students to the network of the Samiedu Municipal Education and Training Consortium and its related services.

The purpose of the register includes:
– management of user accounts in information systems
– identification of users within the internal information network
– use of the user directory for access control to the network and the services it provides.

In addition to the above, user data may be transferred to external systems that utilise the user directory of the municipal education and training consortium for authentication.

Furthermore, the data is used for resolving technical issues, customer support, contact management, and for the collection and monitoring of log data in IT systems.

The legal basis for processing personal data is compliance with a statutory obligation.

Key Legislation:
Act on Vocational Education and Training (531/2017)
Government decree on Vocational Education and Training, VET (673/2017)
Act on Electronic Communications Services (917/2014)

6. Contents of the Register

Rekisteri sisältää seuraavat käyttäjätiedot:

Staff: first name and surname, telephone number (work phone), work email address, workplace postal address, job title, department/unit, name of the organisation, employee ID (number), username

Students: first name and surname, student email address, group/class and unit, name of the organisation, student ID (number), username, telephone number (optional field)

7. Sources of Personal Data

Employee data is obtained from personnel administration, and student data is obtained from the Primus system via a DW (data warehouse) data cube.

8. Data Processors

Data processors include suppliers operating under contracts for the information systems and service providers used for managing the register.

9. Disclosures of Personal Data

No regular disclosure of personal data.

10. Transfer of Personal Data Outside the EU or the European Economic Area (EEA)

User accounts and access rights are managed in the Entra ID user database and directory service of the organisation.

The use of Microsoft solutions may result in the transfer of personal data outside the EU or the European Economic Area (EEA). You can find more detailed information on Microsoft’s data protection practices on the Microsoft website:
https://www.microsoft.com/en-us/privacy/privacystatement

11. Retention Period of Personal Data

Personal data is retained for employees for the duration of their employment relationship and for students for the duration of their studies.

12. Information Systems Used for Maintaining the Register and Data Protection Principles

A. Electronic Register Systems and Their Security

User accounts and access rights are managed in the Entra ID user database and directory service of the organisation, which contains information on users, computers and network resources.

Personal data of staff and students is included in the management of user information for the information systems and software used and administered by the municipal education and training consortium.

Access rights to the systems are granted based on job responsibilities. The protection of the register is ensured by restricting access rights to the records, implementing appropriate updates, and applying technical safeguards related to network infrastructure and the physical placement of equipment.

B. Paper-Based Records and Their Protection

No paper-based records are maintained.

EU General Data Protection Regulation (679/2016/EU)
The Finnish Data Protection Act (1050/2018)

Privacy Notice
Data Controller’s Information Notice
19 June 2025

1. Name of the Register

Marketing and Communications Register

2. Data Controller

Samiedu Municipal Education and Training Consortium
(Business ID 0207390-8)
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna

3. Person Responsible for the Register

Director of Services for Working Life
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna
Tel. +358 44 550 6500

4. Contact Person for Data Protection Matters

Data Protection Officer of Samiedu Municipal Education and Training Consortium
tietosuojavastaava@savonlinna.fi

5. Purpose and Legal Basis for the Processing of Personal Data

The purpose of processing personal data is to manage customer and partner relationships of the Samiedu Municipal Education and Training Consortium, as well as to carry out communications and marketing activities.

The legal basis for processing personal data for the management of customer and partner relationships is Article 6(1)(e) of the General Data Protection Regulation (GDPR), i.e. processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.

The legal basis for processing personal data for communications and marketing purposes is Article 6(1)(a) of the GDPR, i.e. the data subject’s consent.

6. Contents of the Register

• For customer and partner relationship management, newsletters, communications and contact purposes:
  contact details of the individual, including name, address, telephone number and email address.
• For marketing and communications purposes: name, address, telephone number, email address, and photo/video/audio recordings of the individual.

7. Sources of Personal Data

Data is primarily collected from the data subjects themselves (e.g. subscription to newsletters, requests to join mailing lists, and consent or agreement forms for photography/recording).

Contact details (email addresses) are also collected from public sources, such as media outlets and the websites of stakeholder organisations, as well as from the databases of the Finnish National Agency for Education (EDUFI).

8. Data Processors

The data processors are the information system providers contracted for the systems used in managing the register.

9. Disclosures of Personal Data

Personal data may be disclosed to the media or to cooperation partners with the consent of the customer.

10. Transfer of Personal Data Outside the EU or the European Economic Area (EEA)

Personal data is not transferred outside the EU or the EEA.

11. Retention Period of Personal Data

Data is retained for different periods depending on the type of data.
The data contained in the register are retained in accordance with the document management plan of Samiedu Municipal Education and Training Consortium. Personal data is processed for communications and marketing purposes only for as long as the consent given remains valid. Consent may be withdrawn at any time.

The retention periods are based on guidelines issued by the National Archives of Finland, recommendations by the Association of Finnish Local and Regional Authorities, as well as the Act on Vocational Education and the Local Government Act.

12. Information Systems Used for Maintaining the Register and Data Protection Principles

A. Electronic Register Systems and Their Security

Register data is maintained in the systems for the purposes for which it has been collected. Data processors, i.e. system suppliers, are responsible for the technical protection and information security of personal data in accordance with the terms of their contracts.
The protection of the register is ensured by restricting access rights, implementing appropriate updates, and applying technical safeguards related to network infrastructure and the physical placement of equipment.

B. Paper-Based Records and Their Protection

Any paper-based records are stored in locked premises.

EU General Data Protection Regulation (679/2016/EU)
The Finnish Data Protection Act (1050/2018)

Privacy Notice
Data Controller’s Information Notice
9 June 2025

1. Name of the Register

Provision of Education

2. Data Controller

Samiedu Municipal Education and Training Consortium
(Business ID 0207390-8)
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna

3. Person Responsible for the Register

Director of Development
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna
Tel. +358 44 550 6341

4. Contact Person for Data Protection Matters

Data Protection Officer of Samiedu Municipal Education and Training Consortium
tietosuojavastaava@savonlinna.fi

5. Purpose and Legal Basis for the Processing of Personal Data

The purpose of processing personal data is to manage the application process and student admissions, as well as to maintain personal competence development plans (PCDP) for students, records of study achievements, assessments of learning and competence, and information related to workplace-based learning.

The register is also used for the planning, implementation and monitoring of teaching, as well as for maintaining student and teacher information both in the main education system and in various online learning environments.

The legal basis for the processing of personal data is compliance with a statutory obligation.

Key Legislation:
Act on Vocational Education and Training (531/2017)
Government decree on Vocational Education and Training, VET (673/2017)

6. Contents of the Register

Applicants:

• Personal data: name, personal identity code, gender, municipality of residence, nationality, contact details of guardians for underage applicants,
• student admission decision

Enrolled students:

• Personal data: name, address details, email address, telephone number, personal identity code, gender, mother tongue, nationality and municipality of residence,
• Study and accommodation information,
• Contact details of parents/guardians,
• Study-related data: student group, qualification or qualification unit, PCDP Counsellor, information related to the personal competence development plan (PCDP) and its monitoring, assessment data related to study achievements, additional information included in transcripts and certificates
• Attendance and interruption data (e.g. dates and reasons),
• Education and funding-related information,
• Information related to workplace-based learning,
• Information on previous studies,
• Information related to special support plans, where applicable

Information on teachers and other staff: name, personal identity code, email address, telephone number, gender, role/job description
Information on workplace-based learning: workplace instructor’s/contact person’s information: name, telephone number, email address; Company information: name, address, Business ID, bank account number

Some of the data contained in the register is confidential, including data related to the student’s social and economic situation, health data, and contact details where confidentiality has been requested.

Legal Basis for Confidentiality:
Act on the Openness of Government Activities (621/1999, Section 24)

7. Sources of Personal Data

• Students’ basic data is obtained from the Studyinfo system maintained by the Finnish National Agency for Education
• Students
• Parents/guardians
• Teachers, PCDP Counsellors and Guidance Counsellors

8. Data Processors

• Other education providers (e.g. partner institutions)
• The data processors are the information system providers contracted for the systems used in managing the register.

9. Disclosures of Personal Data

• Disclosures Required by Law: to the Finnish National Agency for Education (e.g. KOSKI data repository and for the use of the eHOKS service), Statistics Finland and Kela
• to partner institutions for the purposes of extended apprenticeship training.
• to other authorities, where necessary, provided that the requesting authority has the legal right to process the data in question.
• data on participants in first aid training is disclosed to the Finnish Red Cross First Aid for inclusion in a national competence register.
• certain data may, with the explicit consent of the student, be published (e.g. on the institution’s website). Individuals also have the right to prohibit the disclosure and publication of their personal data.

10. Transfer of Personal Data Outside the EU or the European Economic Area (EEA)

The institution uses the Microsoft Office 365 (M365) environment as an electronic working platform for staff and students. The M365 service includes electronic tools as well as user-generated content.

The use of Microsoft solutions may result in the transfer of personal data outside the EU or the European Economic Area (EEA).  You can find more detailed information on Microsoft’s data protection practices on the Microsoft website: https://www.microsoft.com/en-us/privacy/privacystatement

11. Retention Period of Personal Data

Retention periods for student data vary. The data contained in the register is retained in accordance with the document management plan of the municipal education and training consortium.

The retention period is based on:
guidelines issued by the National Archives of Finland
recommendations by the Association of Finnish Local and Regional Authorities
the Act on Vocational Education and Training (531/2017)

12. Information Systems Used for Maintaining the Register and Data Protection Principles

A. Electronic Register Systems and Their Security

The Visma InSchool system suite is used as the main system for maintaining the register, including:
• multiPrimus school administration system (student information system)
• Kurre timetable planning software
• Wilma

In addition, several web-based digital environments are used in teaching, including the Moodle Pinja online learning environment and the Microsoft 365 (M365) environment.

From the student administration system (multiPrimus), personal competence development plan (PCDP) data is transferred via a technical interface to the KOSKI data repository maintained by the Finnish National Agency for Education.

Browser-based information systems use cookies for the processing of personal data.
A cookie is a small text file stored on the user’s device by the browser.
Cookies are used to provide services, facilitate login, and enable the collection of usage statistics.
Users may disable cookies in their browser settings; however, this may affect the proper functioning of the system.

The protection of the register is ensured by restricting access rights to information systems to administrative and teaching staff of the vocational college. In addition, students and parents have access rights to the Wilma application. Security is further supported by appropriate system updates as well as technical safeguards related to network infrastructure and the physical placement of equipment.

An agreement has been concluded between the data controller and the system providers regarding data protection and technical requirements related to the environment. The system providers ensure the retention of the register and the data contained in it in accordance with good data processing practices, so that the register remains technically intact and reliable.

B. Paper-Based Records and Their Protection

No paper-based records are maintained.

EU General Data Protection Regulation (679/2016/EU)
The Finnish Data Protection Act (1050/2018)

Privacy Notice
Data Controller’s Information Notice
19 June 2025

1. Name of the Register

Electronic Service for Study Records and Certificates

2. Data Controller

Samiedu Municipal Education and Training Consortium
(Business ID 0207390-8)
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna

3. Person Responsible for the Register

Senior Student Administration Specialist
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna
Tel. +358 44 550 6440

4. Contact Person for Data Protection Matters

Data Protection Officer of Samiedu Municipal Education and Training Consortium
tietosuojavastaava@savonlinna.fi

5. Purpose and Legal Basis for the Processing of Personal Data

An electronic service solution that enables the delivery of documents required by students (such as transcripts of records, certificates of study and qualification certificates) electronically to students who have completed the relevant studies.

The legal basis for the processing of personal data is compliance with a statutory obligation.

Key Legislation:
Act on Vocational Education and Training (531/2017)
Government decree on Vocational Education and Training, VET (673/2017)

6. Contents of the Register

• Employees of Samiedu (first name and surname, email address, username; in employment service (TEM) or municipal trial forms: additionally the employee’s telephone number)
• Students (first name and surname, username, personal identity code, date of birth, study right ID and study right identifier, email address. For students participating in employment service (TEM) or municipal trial funding: additionally home address, postal address and telephone number
• Application users (name, username, personal identity code)

7. Sources of Personal Data

The data in the service is updated from the Primus system, in which the data is regularly maintained and updated.

8. Data Processors

The information system providers contracted for the systems used in managing the register.

9. Disclosures of Personal Data

No personal data is disclosed from the service to external parties.

10. Transfer of Personal Data Outside the EU or the European Economic Area (EEA)

Personal data may be transferred outside the EU or the European Economic Area (EEA) as part of subcontracted services provided by the service provider (e.g. Twilio, Google). Google processes personal data in accordance with a data processing agreement and the EU standard contractual clauses (SCCs), and seeks to ensure a high level of data protection through additional technical and organisational measures. The agreement between Studyo and Twilio also includes the EU standard contractual clauses (SCCs).

11. Retention Period of Personal Data

Qualification certificates are retained permanently, and archiving is carried out in the institution’s electronic archive. Data is regularly deleted from the electronic service by the data controller.

12. Information Systems Used for Maintaining the Register and Data Protection Principles

A. Electronic Register Systems and Their Security

Register data is maintained in the institution’s education administration register and provided to students through the electronic service.

The protection of the register is ensured by restricting access rights, implementing appropriate updates, and applying technical safeguards related to network infrastructure and the physical placement of equipment.

B. Paper-Based Records and Their Protection

No paper-based records are maintained.

EU General Data Protection Regulation (679/2016/EU)
The Finnish Data Protection Act (1050/2018)

Privacy Notice
Data Controller’s Information Notice
23 June 2025

1. Name of the Register

Quality Management

2. Data Protection Officer

Samiedu Municipal Education and Training Consortium
(Business ID 0207390-8)
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna

3. Person Responsible for the Register

Director of Development
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna
Tel. +358 44 550 6341

4. Contact Person for Data Protection Matters

Data Protection Officer of Samiedu Municipal Education and Training Consortium
tietosuojavastaava@savonlinna.fi

5. Purpose and Legal Basis for the Processing of Personal Data

The register is used for real-time evaluation, development and quality assurance of the activities of the education provider.

The legal basis for the processing of personal data is Article 6(1)(c) of the General Data Protection Regulation (GDPR), i.e. processing necessary for compliance with a legal obligation to which the data controller is subject.

Key Legislation:
Act on Vocational Education and Training (531/2017)
Government decree on Vocational Education and Training, VET (673/2017)

6. Contents of the Register

• Staff and customer feedback, as well as the education provider’s self-evaluation.
• The data content of the data cube consists of data from the various information management systems used by the Samiedu Municipal Education and Training Consortium, including systems for education, finance and personnel administration, as well as data from student and customer feedback.

7. Sources of Personal Data

• The student administration system serves as the data source for the data cube.
• Data collected through survey software is obtained directly from the individual.

8. Data Processors

The data processor is the information system provider contracted for the system entity used in managing the register.

9. Disclosures of Personal Data

No regular disclosure of personal data.

10.

10. Tietojen siirto EU:n tai Euroopan talousalueen (ETA) ulkopuolelle

Personal data is not transferred outside the EU or the EEA.

11. Retention Period of Personal Data

Data is retained for different periods depending on the type of data. The data contained in the register are retained in accordance with the document management plan of Samiedu Municipal Education and Training Consortium.

The retention periods are based on guidelines issued by the National Archives of Finland, recommendations by the Association of Finnish Local and Regional Authorities, as well as the Act on Vocational Education and the Local Government Act.

12. Information Systems Used for Maintaining the Register and Data Protection Principles

A. Electronic Register Systems and Their Security

• TCD-Survey and TCD-Analytics (survey, analytics and reporting tools)
• The data cube is compiled from data produced by the institution’s information management systems, including MultiPrimus, Intime Web reporting and Aditro ESS7

Users of the register have a personal username and password. Access rights are defined based on job responsibilities.

In addition, security is supported by appropriate system updates as well as technical safeguards related to network infrastructure and the physical placement of equipment.

An agreement has been concluded between the data controller and the system provider regarding data protection and technical requirements related to the environment. The system provider ensures the retention of the register and the data contained in it in accordance with good data processing practices, so that the register remains technically intact and reliable.

B. Paper-Based Records and Their Protection

No paper-based records are maintained.

EU General Data Protection Regulation (679/2016/EU)
The Finnish Data Protection Act (1050/2018)

Privacy Notice
Data Controller’s Information Notice
23 June 2025

<h2>1. Name of the Register</h2>
Samiedu Development Project Portfolio (Thinking Portfolio)
<h2>2. Data Controller</h2>
Samiedu Municipal Education and Training Consortium
(Business ID 0207390-8)
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna
<h2>3. Person Responsible for the Register</h2>
Director of Development
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna
Tel. +358 44 550 6341
<h2>4. Contact Person for Data Protection Matters</h2>
Data Protection Officer of Samiedu Municipal Education and Training Consortium
tietosuojavastaava@savonlinna.fi
<h2>5. Purpose and Legal Basis for the Processing of Personal Data</h2>
The purpose of processing personal data is to manage communication, information sharing and coordination related to the implementation of projects at the Samiedu Municipal Education and Training Consortium. The development project portfolio contains the names of individuals participating in the projects, in accordance with the requirements set by the funding bodies.

<strong>The legal basis for the processing of personal data </strong>is public interest and exercise of official authority as well as legal obligation of the controller.

<strong>Key Legislation:</strong>
Common Provisions Regulation (EU) No 1303/2013

<h2>6. Contents of the Register</h2>
The register contains data required by funding bodies related to Samiedu’s project activities, project staff and partners (organisations and contact persons), as well as cost and funding information related to the projects.

<strong>The register includes the following data, which may vary depending on the specific project:  </strong>
<ul>
<li>Project staff: name</li>
<li>Potential partners: first name and surname of the contact person, email address</li>
</ul>
<h2>7. Sources of Personal Data</h2>
Personal data is obtained via an interface from Active Directory (AD). Contact details of representatives of other organisations are entered into the system by the person responsible for the project.
<h2>8. Data Processors</h2>
The data processors are the information system providers contracted for the systems used in managing the register.
<h2>9. Disclosures of Personal Data</h2>
No regular disclosure of personal data.
<h2>10. Transfer of Personal Data Outside the EU or the European Economic Area (EEA)</h2>
Personal data is not transferred outside the EU or the EEA.
<h2>11. Retention Period of Personal Data</h2>
Personal data is retained in accordance with the document management plan of the municipal education and training consortium and the guidelines provided by the funding bodies.
<h2>12. Information Systems Used for Maintaining the Register and Data Protection Principles</h2>
<strong>A. Electronic Register Systems and Their Security</strong>

Access to electronic systems is protected by usernames and passwords.

The protection of the register is ensured by restricting access rights to information systems to administrative and teaching staff of the vocational college. Security is further supported by appropriate system updates as well as technical safeguards related to network infrastructure and the physical placement of equipment.

An agreement has been concluded between the data controller and the system providers regarding data protection and technical requirements related to the environment. The system providers ensure the retention of the register and the data contained in it in accordance with good data processing practices, so that the register remains technically intact and reliable.

<strong>B. Paper-Based Records and Their Protection</strong>

No paper-based records are maintained.

&nbsp;

&nbsp;

<span data-teams=”true”>EU General Data Protection Regulation (679/2016/EU)
The Finnish Data Protection Act (1050/2018)</span>

Privacy Notice
Data Controller’s Information Notice
20 December 2024
<h2>1. Name of the Register</h2>
Student and Customer Register of Samiedu Summer University
h2>2. Data Controller</h2>
Samiedu Municipal Education and Training Consortium
(Business ID 0207390-8)
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna
<h2>3. Person Responsible for the Register</h2>
Training Coordinator
Puistokatu 5
57100 Savonlinna
Tel. +358 44 7730997
<h2>4. Contact Person for Data Protection Matters</h2>
Data Protection Officer of Samiedu Municipal Education and Training Consortium
tietosuojavastaava@savonlinna.fi
<h2>5. Purpose and Legal Basis for the Processing of Personal Data</h2>
The purpose of processing personal data is to organise Summer University teaching (planning, implementation and monitoring), provide customer service, carry out marketing activities, and compile statistics.

The legal basis for the processing of personal data is Article 6(1)(c) of the General Data Protection Regulation (GDPR), i.e. processing necessary for compliance with a legal obligation to which the data controller is subject (Act on Liberal Adult Education 632/1998). The processing of personal data for marketing purposes and the collection of feedback is based on Article 6(1)(a) of the GDPR, i.e. the data subject’s consent.

<h2>6. Contents of the Register</h2>
Personal data includes: surname and first names, date of birth, personal identity code, street address, postal code and city, email address, telephone number, professional title, mother tongue, gender, municipality of residence at the beginning of the year.  Employer/educational institution information. Statistical data: education, purpose of studies, main activity. Marketing consent: consent given by the individual to receive information about Summer University offerings.

Feedback forms: name and email address.
<h2>7. Regular Sources of Personal Data</h2>
Data is obtained directly from the data subject via electronic or paper registration forms.
<h2>8. Data Processors</h2>
The data processor is the information system provider contracted for the system used in managing the register.
<h2>9. Regular disclosures of personal data</h2>
No regular disclosure of personal data.
<h2>10. Transfer of Personal Data Outside the EU or the European Economic Area (EEA)</h2>
Personal data is not transferred outside the EU or the EEA.
<h2>11. Retention Period</h2>
Data collected through the feedback form is retained only until the feedback has been processed.

For all other data, [to be completed / specify retention policy].
<h2>12. Information Systems Used for Maintaining the Register and Data Protection Principles</h2>
A. Paper-Based Records

Paper registration forms are stored in locked premises until the data has been processed, after which they are securely destroyed. Registration data is stored in an electronic system.

B. Paper-Based Records and Their Protection

The register is maintained in the Kongressi system. Access to the register database is restricted through the use of usernames and passwords. Access rights to the database are granted only to those employees whose duties require such access.

EU General Data Protection Regulation (679/2016/EU)
The Finnish Data Protection Act (1050/2018)

Privacy Notice
Data Controller’s Information Notice
9 June 2025
<h2>1. Name of the Register</h2>
Conflicts of Interest Register
<h2>2. Data Controller</h2>
Samiedu Municipal Education and Training Consortium
(Business ID 0207390-8)
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna
<h2>3. Person Responsible for the Register</h2>
Secretary of the Audit Committee of the Municipal Education and Training Consortium, Senior Student Administration Specialist
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna
Tel. +358 44 550 6440
<h2>4. Contact Person for Data Protection Matters</h2>
Data Protection Officer of Samiedu Municipal Education and Training Consortium
tietosuojavastaava@savonlinna.fi
<h2>5. Purpose and Legal Basis for the Processing of Personal Data</h2>
The purpose of processing personal data is to maintain declarations of interests submitted by municipal elected officials and public office holders. These declarations concern management positions and positions of trust in companies and other entities engaged in business activities, significant assets, and other affiliations or interests that may be relevant to the performance of their official or elected duties.

Declarations of interests are submitted to the Audit Committee, which supervises compliance with the obligation to submit declarations and submits the declarations to the Council for information.

The legal basis for the processing of personal data is compliance with a legal obligation to which the controller is subject.

<strong>Key Legislation:</strong>
Local Government Act (410/2015)
<h2>6. Local Government Act</h2>
Personal data collected through the declaration of interests:

The name of the elected official or public office holder referred to in Section 84 of the Local Government Act, details of any interests and affiliations relevant to the performance of their elected or official duties, and information concerning the municipal joint authority body in which the individual serves, including their role in that body or their official position within the organisation.
<h2>7. Sources of Personal Data</h2>
The personal data is obtained directly from the data subjects themselves through the Declaration of Interests submitted by individuals who are subject to the disclosure obligation.
<h2>8. Disclosures of Personal Data</h2>
According to the Local Government Act, declarations of interests are submitted to the Audit Committee, which supervises compliance with the obligation to submit declarations and submits the declarations to the Council for information.

Under the Local Government Act, a municipality is required to maintain a register of declarations of interests in a public information network, unless otherwise provided by provisions concerning confidentiality.

Personal data is not disclosed for direct marketing, telemarketing, address services, or market and opinion surveys.
<h2>9. Transfer of Personal Data Outside the EU or the European Economic Area (EEA)</h2>
Personal data is not transferred outside the EU or the EEA.
<h2>10. Retention Period of Personal Data</h2>
Data contained in the Register of Declarations of Interests is retained permanently.

<strong>Basis for the retention period:</strong>
Decision of the National Archives of Finland AL/10361/07.01.01.03.01/2017
<h2>11. Information Systems Used for Maintaining the Register and Data Protection Principles</h2>
<strong>A. Electronic Register Systems and Their Security</strong>

The register data is maintained in an Excel file.

The protection of the register is ensured by restricting access rights to the register. In addition, security is supported by appropriate software updates as well as technical safeguards related to network infrastructure and the physical placement of equipment.

<strong>B. Paper-Based Records and Their Protection</strong>

The records are stored in locked premises, and access to the records is restricted to persons who are authorised to process the data as part of their duties.

&nbsp;

EU General Data Protection Regulation (679/2016/EU)
The Finnish Data Protection Act (1050/2018)

Privacy Notice
Data Controller’s Information Notice
9 June 2025
<h2>1. Name of the Register</h2>
Financial Management Services
<h2>2. Data Controller</h2>
Samiedu Municipal Education and Training Consortium
(Business ID 0207390-8)
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna
<h2>3. Person Responsible for the Register</h2>
Director of Administration
Samiedu Vocational College
Pohjolankatu 6, 57200 Savonlinna
Tel. +358 44 550 6363
<h2>4. Contact Person for Data Protection Matters</h2>
Data Protection Officer of Samiedu Municipal Education and Training Consortium
tietosuojavastaava@savonlinna.fi
<h2>5. Purpose and Legal Basis for the Processing of Personal Data</h2>
The purpose of the processing of personal data is to manage the payment transactions of the Samiedu Municipal Education and Training Consortium, including the processing of purchase invoices, payments based on expenditure vouchers, salary payments, cash deposits, invoicing of accounts receivable, and the recording and reporting of accounting transactions.

<strong>Key Legislation:</strong>
Local Government Act (410/2015)
Accounting Act (1336/1997)
Act on Amendments to the Accounting Act (1620/2015)
Recommendations issued by the Accounting Board and the organisation’s internal policies and guidelines.
<h2>6. Contents of the Register</h2>
<ul>
<li>Suppliers of goods and services: supplier name, contractor contact details (name and telephone number), supplier number, address details, Business ID, bank account details, invoice amounts, due dates, and invoice status.</li>
<li>Customer data related to accounts receivable, service cash transactions, and payment processing: customer name, personal identity code or Business ID, address details, invoiced services, invoice amounts, due dates, and invoice status.</li>
<li>Payroll payment information of employees.</li>
</ul>
Some of the data contained in the register is confidential.

<strong>Legal Basis for Confidentiality:</strong>
Act on the Openness of Government Activities (621/1999, Section 24)
Applicable data protection legislation.
<h2>7. Sources of Personal Data</h2>
The data contained in the register is obtained from payment and invoicing authorisations processed by the respective business units (with contracts, customers, and suppliers serving as the original sources of the data), the Primus student administration system, the Prepayment Register, and the Population Information System.
<h2>8. Data Processors</h2>
<ul>
<li>Employees of the Samiedu Municipal Education and Training Consortium who have access rights to the financial services registers based on their job duties and/or customer relationship responsibilities.</li>
<li>The contractually appointed auditor.</li>
</ul>
The Financial Services unit processes supplier-specific payments and payment transactions related to purchase invoices and expenditure vouchers after they have been verified and approved by the relevant operational units. Completed financial transactions are recorded in the accounting system, and reports on these transactions are prepared when necessary.

Customer-specific sales invoices are issued by the relevant operational units. Payment monitoring, payment reminders, and any amendments to payment plans are managed by the financial administration.

Representatives of the financial management information system providers, acting in accordance with contractual agreements, also serve as processors of personal data
<h2>9. Disclosures of Personal Data</h2>
Personal data processed by the Financial Administration may be disclosed to the external auditor, debt collection agencies, and banks for payment processing purposes. In addition, project payment applications are disclosed to project administrators and funding bodies as required for the administration and financing of projects.
<h2>10. Transfer of Personal Data Outside the EU or the European Economic Area (EEA)</h2>
Personal data is not transferred outside the EU or the EEA.
<h2>11. Retention Period of Personal Data</h2>
The data contained in the register are retained in accordance with the document management plan of the municipal education and training consortium.

<strong>Säilytysperuste</strong>:
Guidelines issued by the National Archives of Finland
Recommendations by the Association of Finnish Local and Regional Authorities
Accounting Act
<h2>12. Information Systems Used for Maintaining the Register and Data Protection Principles</h2>
<strong>A. Electronic Register Systems and Their Security</strong>
<ul>
<li>Accounting, accounts payable and receivable, financial planning and archiving of records: Intime</li>
<li>Electronic invoicing: Laskuhotelli invoicing portal</li>
<li>Internal electronic invoice approval workflow for purchase invoices: WorkFlow</li>
<li>Payment Management System: Analyste</li>
<li>Cash Register System: CEEPOS Computer Program Unit</li>
</ul>
In addition, interfaces are used with several systems that support financial administration processes.

The protection of the register is ensured by restricting access rights to the information systems based on job responsibilities, implementing appropriate updates, and applying technical safeguards related to network infrastructure and the physical placement of equipment.

Agreements have been concluded between the data controller and the system providers regarding data protection and technical requirements related to the environment. The system providers ensure the retention of the register and the data contained in it in accordance with good data processing practices, so that the register remains technically intact and reliable.

<strong>B. Paper-Based Records and Their Protection</strong>

The records are stored in locked premises, and access to the records is restricted to persons who are authorised to process the data as part of their duties.

&nbsp;

EU General Data Protection Regulation (679/2016/EU)
The Finnish Data Protection Act (1050/2018)

Privacy Notice
Data Controller’s Information Notice
19 June 2025
<h2>1. Name of the Register</h2>
Information Service Requests
<h2>2. Data Controller</h2>
Samiedu Municipal Education and Training Consortium
(Business ID 0207390-8)
Samiedu Vocational College
Pohjolankatu 4, 57200 Savonlinna
<h2>3. Person Responsible for the Register</h2>
tietopalvelupyynto@samiedu.fi
P.O. Box 12, 57201 Savonlinna
Street address: Pohjolankatu 4, 57200 Savonlinna
<h2>4. Contact Person for Data Protection Matters</h2>
Data Protection Officer of Samiedu Municipal Education and Training Consortium
tietosuojavastaava@savonlinna.fi
<h2>5. Purpose and Legal Basis for the Processing of Personal Data</h2>
To manage and fulfil information requests concerning records and documents held in the archives of the Samiedu Municipal Education and Training Consortium through its website www.samiedu.fi

The legal basis for the processing of personal data is compliance with a statutory obligation.

<strong>Key Legislation:</strong>
Act on Vocational Education (531/2017)
Act on the Openness of Government Activities (621/1999)
Archives Act (831/1994)
<h2>6. Contents of the Register</h2>
Personal data collected through the information service request:
<ul>
<li>the subject of the request (e.g. certificate, certificate of resignation/completion, or other document)</li>
<li>information regarding the preferred method of document delivery</li>
<li>the individual’s contact details and date of birth</li>
<li>qualification-related information, including name of the qualification, year of commencement of studies, year of completion of studies, year the qualification was awarded, and other specifying details (free-text field).</li>
</ul>
Some of the data contained in the register is confidential.

<strong>Legal Basis for Confidentiality:</strong>

Act on the Openness of Government Activities (621/1999, Section 24)
Applicable data protection legislation.
<h2>7. Sources of Personal Data</h2>
Tiedot saadaan asianosaiselta itseltään, hänen valtuuttamansa taholta tai viranomaiselta.
<h2>8. Henkilötietojen käsittelijät</h2>
Käsittelijöinä toimivat sopimuksen mukaisen tietojärjestelmätoimittajan edustajat.
<h2>9. Henkilötietojen luovutukset</h2>
Henkilötietoja luovutetaan salassapitosäännökset huomioiden yksilöidyn pyynnön perusteella suullisesti tai tulosteena vain rekisteröidyn suostumuksella tai lain säännösten perusteella.

Tietoja ei luovuteta suoramainontaan, puhelinmyyntiin, osoitepalveluun eikä markkina- ja mielipidetutkimuksiin.
<h2>10. Tietojen siirto EU:n tai Euroopan talousalueen (ETA) ulkopuolelle</h2>
Tietoja ei siirretä EU:n tai ETA:n ulkopuolelle.
<h2>11. Henkilötietojen säilytysaika</h2>
Rekisteriin sisältyvät tiedot säilytetään koulutuskuntayhtymän arkistonmuodostussuunnitelman mukaisesti.

<strong>Säilytysperuste</strong>:
Kansallisarkiston määräykset
Kuntaliiton suositukset
<h2>12. Rekisterin ylläpitojärjestelmät ja suojauksen periaatteet</h2>
<strong>A. Sähköiset ylläpitojärjestelmät ja niiden suojaus</strong>

Tietopalvelupyyntö täytetään verkkopalvelussa www.samiedu.fi, josta se välittyy sähköpostijärjestelmän kautta asian käsittelijälle.

Rekisterin suojaus toteutetaan rajoittamalla tietojärjestelmän käyttöoikeuksia, toteuttamalla asianmukaiset päivitykset sekä toteuttamalla verkkoteknisiä ja laitesijoitteluun liittyviä teknisiä suojaustoimia.

Rekisterinpitäjän ja järjestelmäntoimittajien kesken on tehty sopimus tietosuojasta ja tekniseen ympäristöön liittyvistä vaatimuksista. Järjestelmäntoimittaja hoitaa rekisterin ja siihen sisältyvien tietojen säilytyksen hyvän tietojenkäsittelytavan mukaisesti niin, että rekisteri säilyy teknisesti eheänä ja luotettavana.

&nbsp;

<strong>B. Manuaalinen aineisto ja sen suojaus</strong>

Aineisto sijaitsee lukituissa tiloissa ja aineistoa saa käsitellä vain henkilöt, joilla työtehtävien mukainen oikeutus tiedonkäsittelyyn.