PRIVACY STATEMENT
General Data Protection Regulation of the European Union (679/2016) as of 25th May 2018, Data Protection Act (1050/2018)
Compiled on 25th April 2018
Customer Relationship Management (CRM) system of Karelia University of Applied Sciences
1. Register controller
Karelia Ammattikorkeakoulu Oy / Karelia University of Applied Sciences Ltd.
Address: Tikkarinne 9, 80200 Joensuu, Finland
Tel. +358 13 260 600, Email: info(at)karelia.fi
2. Person in charge of the register
CEO / President of Karelia UAS
3. Person in charge of customer relationship management
Head of Service Business, Mr Harri Mikkonen, tel. +358 50 502 0402
4. Contact person in matters related to customer relationship management
Service Business Coordinator, Ms Anne Prepula, tel. +358 50 311 9168, Tikkarinne 9, 80200 Joensuu, Finland
5. Person in charge of data protection
Karelia Ammattikorkeakoulu Oy, Tietosuojavastaava, Tikkarinne 9, 80200 Joensuu, Finland
Tel. +358 50 525 0623, email: tietosuoja(at)karelia.fi
6. Purpose of processing personal data
According to the Universities of Applied Sciences Act, the mission of universities of applied sciences is to provide higher education for professional expert jobs based on the requirements of working life and its development and on the premises of academic research and academic and artistic education and to support the professional growth of students. They shall also carry out applied research, development and innovation activities and artistic activities that serve education in universities of applied sciences, promote industry, business and regional development and regenerate the industrial structure of the region. In carrying out their mission, universities of applied sciences shall promote lifelong learning. These are statutory tasks.
The term service business at Karelia University of Applied Sciences refers to services provided to customers outside the university of applied sciences. The business idea in service business is to produce high quality, productised, or customised expert services and supplementary education for companies, communities and private people both locally, nationally and internationally.
Karelia University of Applied Sciences uses its CRM customer relationship management system to maintain its working life-related contacts and operations. The system is a centralised and structured place for maintaining information on customers, partners and interest groups and on business processes. These are called partnership activities.
The use of the customer relationship management system is based on a customer-oriented way of thinking and acting. The CRM system at Karelia University of Applied Sciences is a tool for the entire staff to maintain working life-related contacts and operations. Information gathered in the system helps to plan and monitor working life activities, select the ways of working with customers and partners, and strengthen the relationships. It enables the identification of customers and partners’ needs and sales management.
The CRM system helps to manage business processes. The system enables the creation of offers, sales orders, and invoices. The system provides statistics on the submitted offers and orders and on customer assignments. The contact information for working life partners is located in one place in the CRM system and it can be utilised in marketing communication and in information distribution. Immediate feedback is also collected in the system and it can be compiled for the purpose of evaluation and development of operations.
7. Content of the register
The CRM system includes personal data for the following categories of people: UAS alumni, various interest groups such as strategic partners, key partners, operational partners and international partners, and service business customers (companies, associations, public organisations, private people), including information on the staff, as well as Karelia UAS CRM system users in their different roles. The categories of personal data processed in the system are as follows: name, address, email, telephone number, employer, and person’s role or duties in the organisation.
8. Legal basis for processing personal data
The management of statutory duties is the legal basis for processing personal data in applied research, development and innovation activities and in artistic activities in promoting business and regional development and the local industrial structure. Partnership activities are based on agreements and the legal basis is contractual. As regards the service business of Karelia UAS, the basis for processing personal data is a legitimate advantage. Alumni information is obtained from data subjects by their own consent, so the legal basis for the processing of personal data is the consent of the data subject him/herself.
9. Grounds for providing personal data
Agreement-based partnership activities require having information on contact persons. Personal data in service business and in alumni activities is needed for providing the services.
10. Legitimate advantages of the register controller
Managing service business operations. Employment-related issues of the staff of Karelia UAS.
11. Security of processing personal data
The CRM system of Karelia UAS, including the contents of the system, is located in a server facility monitored with an access control system. The use of the CRM system is based on access rights that depend on the person’s role and duties at Karelia UAS. Appropriate protection technologies are used for the transfer of data. Secure email is available to be used for confidential messaging.
12. Recipients or recipient groups of personal data
Mailing lists in Excel format are downloaded from the CRM system into a service by Koodiviidakko Oy for the purpose of communication and information distribution by Karelia UAS president’s office. The CRM system has a box that can be ticked to prohibit marketing communication. The Meerkado system (see www.meerkado.fi for Privacy Policy) by Solenovo Oy provides an Excel-format report that can be exported into the CRM system (name, telephone number, email address, company name), if needed. Karelia UAS uses the Reportronic working time and project management system by Sebitti Oy that has a two-way connection for transferring project staff data. The Microsoft O365 service used by Karelia UAS is interlinked with the CRM system of Karelia UAS, which means, for example, that activities can be viewed using an Outlook plugin.
13. Transfer of personal data outside the European Union or the European Economic Area
Personal data will not be transferred outside the EU or EEA.
14. Retention of personal data
Karelia University of Applied Sciences has a partnership programme in which the partners’ contact information is actively updated. Specific persons have been appointed in charge of the strategic and key partners of Karelia UAS and they are responsible for maintaining the data on respective partners and contact persons. It is not necessary in the CRM system to completely delete data, but e.g. a contact persons’ data can be removed (passivated/activated). When the activation of a contact person is removed, it cannot be edited or used with other records. Deactivated user accounts may be reactivated, if necessary. An alumnus can submit a data removal request via a web form. Customer relationship management documents (partnership agreements, partnership information) are stored according to the Karelia UAS archiving plan.
15. Rights of the registered person
The rights of the registered person are determined according to the purpose of processing personal data. The registered person has the right to inspect the data concerning him/herself stored in the register. The request for the inspection has to be made to the controller of the register. The registered person has the right to request correction or removal of data, set limitations for the handling of his/her personal data, object the handling of the data, and s/he has the right to transfer data from one system to another. The registered person has the right to withdraw his/her consent to the handling of his/her personal data at any time. In addition, the registered person has the right to file a complaint with the supervisory authority. The contact person concerning the rights of the registered person is the person in charge of data protection, whose contact details are in section 5 of this statement.
16. Automatic decision-making and profiling
Not in use.