Privacy notice for researchers, professionals and visiting scholars

1.4.2023. Aalto University updates this notice as needed. Updated versions of this notice will show the date of the new version at the beginning of the document. If we make changes to content of this notice, we will take appropriate measures to keep you informed in a manner consistent with the significance of the change. We encourage you to check this notice often to be aware of how Aalto University protects your data. 

Processing the personal data of academic visitors

Aalto University processes academic visitors' personal data in order to organise academic visits and to support the mobility of the visitors. Please note, that when participating our research activities, also privacy information for researchers and academic professionals further on this page is relevant.

Purpose of processing personal data

The visitor's personal data is processed:

• to review the purpose and prerequisites of the visit
• to enable the use of the services, premises and equipment offered to the visitor
• to draw up a visitor agreement
• to get access to information needed to manage the costs that may be related to the visit
• to collect the follow up and reporting data on academic visits

Legal basis to process personal data

The legal basis for processing personal data are

• article 6(1)(e) of EU General Data Protection Regulation: processing of data is necessary for carrying out tasks of general benefit and
• article 6(1)(c): processing is necessary for compliance with a legal obligation to which the controller is subject.
• article 6(1) (b): processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

Aalto University processes visitors' personal data to prepare and execute visitor contracts, expert appointment agreements and employment contracts.

The university is bound by statutory obligations to ensure compliance with export control and dual-use regulations and rules and regulations regarding sanctions when organizing visits, cooperation, and support for research activities.

What personal data does Aalto University collect?

Regarding visitors, we process the following groups of personal data:

• name and contact information at the place of departure and during the visit, as well as other identification information
• information of the visitor’s home organisation as well as other affiliations
• the visitor's home country and citizenship
• information about the visitor's financiers and sponsors
• information about the visitor's research field and career (e.g. academic resume)
• information about the duration and purpose of the visit and other cooperation
• information about the visitor's host
• information about the possible grants, fees and salary that may be paid to the visitor, as well as the costs of the visit
• information about possible sanctions concerning the person, the university of origin or other affiliations, as well as information about the connection of the visitor's activity or visit to controlled products or sanctions
• information about the equipment, services and technologies needed by the visitor

Sources of personal data

The visitor provides the necessary information to organize the visit themselves. We may verify the information reported by a visitor from public information sources, the visitor's previous organizations, and other reported sources.

Handling of personal data

Visitors' personal data is processed by Aalto University employees participating in the organization of the visit. The information about the visits is stored in the ACRIS information system within the host's information, where it is publicly available.

How long are personal data stored?

Personal data is stored for as long as is necessary in relation to the purposes for which it was collected and processed, or for as long as is required by law or regulation. The retention periods for Aalto University's documents are specified in the information management plan (TOS).

Transfer of personal data to third countries

A data protection policy of the university is that particular care is to be taken when transferring personal data outside the EU and the EEA to countries that do not offer the data protection required by the European General Data Protection Regulation (GDPR). Transfers of personal data outside the EU and EEA are done in accordance with the requirements of the GDPR, using as a basis e.g. its reference to decisions made on the adequacy of the level of protection provided (Article 45), utilising standard agreement clauses and following other data protection measures in accordance with the GDPR.

Rights of the data subject concerning personal data 

Under the GDPR, you have the right to review your information and rectify any inaccurate or erroneous personal data. In addition, with certain exceptions, you have the right to erase your data. If he processing of personal data is based on your consent, you also have the right to withdraw your consent. You find more information on your rights here.

Processing personal data of researchers and academic professionals

Please find the current privacy notice for ACRIS, the research information system of Aalto University in here.