The student register of the enrollment, application, and administration system of School of Business Summer School – Privacy Statement

GDPR (2016/679)

Updated: 22.2.2022

1 Name of the register

The student register of the enrollment, application, and administration system of School of Business Summer School – Privacy Statement

2 Controller

Jamk University of Applied Sciences
P.O. Box 207
FI-40101 Jyväskylä, Finland

3 Contact person in matters concerning the register, contact information during office hours

Register and process manager: Director, School of Business, Minna-Maaria Hiekkataipale

Register and process owner: Head of Department Global Competence, Matti Hirsilä

Content Main User: Education Coordinator, Olga Afanaseva

Technical Main User: System Specialist, Ulla Tiainen-Sallinen (Peppi) or Coordinator, Elina Kirjalainen (Webropol)

 4 Purpose of the processing of personal data

Administration and verification of identity, collection of required documents, transferring information into the student management system Peppi

5 Data contents of the register

Mandatory information for all

Information concerning students

Student’s personal data:

  • First name
  • Last name
  • Date of birth (ddmmyy)
  • Nationality
  • Gender
  • Mother tongue
  • Mobile phone with country code
  • Email
  • Street address
  • Zip code
  • City
  • Country

Next of kin

  • Name and relationship to student
  • Their contact information

 Home institution

  • Name of institution in English
  • Address of the institution
  • Name of department coordinator
  • Email of university contact person
  • Post code town
  • Telephone

Questions concerning arrival

Questions concerning course choices

Questions concerning Insurance coverage during the exchange period

Questions about study tours

Questions about accommodation

Application documents:

  • Copy of your passport

6 Legal bases for processing personal data

The statutory task/obligation and controller’s legitimate interests

7 Regular information sources

Information sources for periods abroad are

  • Applicants/data subject themselves
  • Jamk student register/study information system
  • Receiving and sending institution/organisation liaison

8 Regular information disclose and information transfer outside the EU or the European Economic Area

Information is disclosed to Jamk University of Applied Sciences student register/study information system, and finance services.

The following regular information transfers to third parties are done:

  • To the receiving and sending institution/organisation liaison for organising and implementing the period abroad.
  • In case of incoming students with the consent of the data subject also to the operator in charge of tutoring, student housing foundation or other agreed apartment broker, library
  • National and international authoritative transfers, such as Immigration Services, and Embassies, etc.

Personal information may be transferred outside the EU or the European Economic Area and/or international organisation , if receiving institution/organisation of the period abroad is located outside the EU or the European Economic Area and/or is international organisation.

Handling the personal data is not contracted out.

9 Register protection principles

Information is collected via Webropol survey and the data is transferred to the student management system Peppi.

The use of the Peppi system requires a personal user name and password. Rights to see and make changes/update the data is dictated by the user name and the role attached to the user. Staff is entitled to see/update only such information which is needed and included in their duties. The right to use the system is taken out from the staff moving into other duties.

Personal data is protected according to Survey tool – Privacy Statement , Peppi – Privacy Statement (described below) and M-drive is accessible only to limited amount of employees who process this data)

Peppi – Register protection principles:

Personal information is processed and maintained according to the Act on the Protection of Privacy.


  • is stored and protected so that it is not available to any outside source, it cannot be accidentally deleted, changed, given or transferred to outsiders or handled in any illegal manner.
  • Access to the system is limited at Jamk to specific persons and is determined by their working duties. The use of the system requires a user ID and a password.
  • Jamk personnel is bound by a non-disclosure agreement.
  • Information containing personal details will be destroyed by shredding or as data security waste.
  • All servers are located in a locked location and access is monitored. Servers are only allowed for administrators.

10 Retention period or criteria for determining

Personal data is stored 5 years on M-drive in accordance with the Jamk information management plan, taken into account also the rules and regulations of the possible sponsors of the period abroad (e.g. European Commission) pertaining the retention period. Determining information from the system is done with timing/manually.

To enable studying the personal data is transferred to Jamk student register/study information system Peppi, where data is stored in accordance with the Jamk information management plan. In the national database of higher education institutions Virta the data is stored permanently. Jamk also stores permanently the electronic information in the  student register (Decision of the National Archives of Finland AL/20757/ )

11 Automatic decision-making/profiling

Automatic decision making/ profiling related to personal data is not conducted.

12 Rights of the Data Subject

Read more information about the Jamk’s Privacy Policy, Data Protection Officer and the rights of the data subject and their implementation.