The Learning Centre customer register - Privacy notice

Name of the register:

The Aalto University Learning Centre register of customers

Date:

3 October 2023

Controller, contact person and person in charge of the register

Aalto University Foundation
Postal address: P.O. Box 11000, Fl-00076 AALTO
Street address: Otakaari 24, 02150 Espoo
Tel.: (exchange) +358 9 47001

Contact person and person in charge of the register:
Service manager; Learning Services team leader. Phone: +358 50 373 2233

Data protection officer and contact details

Aalto University data protection officer

Postal address: P.O. Box 11000, Fl-00076 AALTO
Street address: Otakaari 24, 02150 Espoo
Tel.: (exchange) +358 9 47 001
Email: [email protected]

Purpose of the register, legal basis for processing personal data

The purpose of processing personal data in the register is to maintain information on the customers of Aalto University Learning Centre and on their borrowed library material.

The email addresses in the register are used to invite customers to participate in customer satisfaction surveys. The surveys are conducted at two-year, or greater than two-year intervals.

The right of Aalto University to process information on the data subject (i.e. the person in the register to whom the personal data pertains) is based

• on its public-interest duty to provide Learning Centre services to Aalto University students
• on making or performing an agreement on behalf of all customers in using the services
• on its legitimate interest in certain cases where a customer fails to meet his or her obligations.

A: ls personal data collected directly from the data subject?

Yes.

B: ls personal data collected from a source other than the data subject?

Yes.

Aalto University student register. Aalto University employee register.

lnformation contained in the register (description of data subject categories and personal data categories)

The following persona! data is necessary and processed in the register:

Data on Aalto University students transferred from the student register:

• personal identification number
• last name
• first names
• street address
• postal code
• mobile phone
• email address

Data on customers who use Learning Centre lending services:

• customer name
• personal identification number
• postal address
• telephone number
• email address
• customer category (e.g. staff customer, student customer)
• entry on statistical category (e.g. Aalto University student, external student).
• library card number
• data on the customer's current loans
• data on accrued late fees
• data on the customer's reserved items
• data on debt collection (if necessary)

Data on students who started studying prior to 1 August 2019 is transferred from the student register  after the student gives consent. Starting from the beginning of the academic year which began on 1 August 2019, this data has been directly transferred from the student register. Starting from the beginning of 2021, a student's data is transferred from the student register to the Learning Centre customer register after the student registers as a customer in the Aalto-Primo portal.

Otherwise, customer data is obtained when reported by the customers themselves.

Starting from the beginning of 2021, the data of Aalto University staff members who are Learning Centre customers is transferred from the HR system after each staff member registers as a customer in the Aalto-Primo portal.

Recipients or
categories of
recipients of
the personal
data (i.e.
disclosure of
personal data)

Personal data is processed only by those Aalto employees or those contracted
individuals working on behalf of Aalto who have a right to process the data.

Aalto University may also use outside parties to process personal data for Aalto on
the basis of a commission contract.

Recipients of the personal data (according to activity):

• Ex Libris (the developer of the library system that contains the customer register, system support and server maintenance)
• online payment service (if a customer pays late fees online)
• collection agency (if a debt is turned over to it)
• National Repository Library (NRL) (if a customer requests materials from NRL collection)

Transfer of
personal data
to third
countries

The data protection policy of the university is to exercise particular care if
transferring personal data outside the EU and EEA to countries that do not offer
the level of data protection required by the European General Data Protection
Regulation (GDPR). Transfers of personal data outside the EU and EEA are done in
accordance with the requirements of the GDPR.

Period for
which personal
data is stored /
Criteria used to
determine this
period

The periods for which personal data saved in systems and manual material may
be stored are based on law and on the records management plan of Aalto
University. The storage periods for this personal data file are as follows:

• Customer data is stored for as long as the customer uses Learning Centre services, or for as long as the customer has outstanding obligations, such as unreturned loans, unpaid late fees or debts that have been turned over to a collection agency for handling.
• In other cases, the data is erased three (3) calendar years after the customer’s last transaction.

Rights of the
data subject

Right to review data

You have the opportunity to review data on yourself by going to the Aalto-Primo portal (https://primo.aalto.fi). To correct the data on yourself, use the Aalto-Primo change-of-address form or write to the Learning Centre’s email address: [email protected].

You have a right to know what personal data is being processed on you and what data on you has been stored. The university will provide you with your data upon request without undue delay. To make a data request, go to https://datarequest.aalto.fi/en-US/. The requested information or the additional information related to the request must be provided no later than one month after receiving the request. If the information request is complex and comprehensive, the deadline may be extended by two months.

Right to rectification of data

You have a right to have any inaccurate or incomplete personal data concerning yourself rectified or supplemented without undue delay. In addition, you have the right to request that any unnecessary personal data on yourself be erased.

Right to object to processing of personal data

In certain situations, you have the right to object to the processing of your personal data, i.e. to request that it not be processed at all. When the data processing involves the performance of a task in the public interest, the exercise of the official authority vested in the controller, or the realisation of a legitimate interest of the controller or of a third party, you may object to the processing on grounds relating to your particular situation.

Right to be forgotten

You may have the right to have your personal data erased from a university register, depending on the legal basis for the data processing. This right shall not apply to cases where data processing is necessary for compliance with a legal obligation or for a task carried out in the exercise of official authority vested in the university. The storage and erasure of data shall comply with the records
management plan of the university and the data storage periods required by legislation.

Right to data portability

You shall have the right to receive the personal data you provide to the university, and receive it in a structured, commonly used and machine-readable format, as well as the right to transmit the data to another controller without hindrance from the university. This right shall apply only to situations where the processing is carried out by automated means and is based on consent or contract.

You can exercise your right by contacting the Aalto data protection officer ([email protected]).

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data relating to you infringes the General Data Protection Regulation (EU) 2016/679. In addition, you have the right to use other administrative or judicial remedies.

You have the right to bring court proceedings against the controller or the organisation processing your personal data if you consider that the processing of your personal data infringes the General Data Protection Regulation.