Skip to content
Home Privacy policy Privacy notice: Processing of personnel data

Privacy notice: Processing of personnel data

Privacy notice: Processing of personnel data: joint informative document for data subjects (Articles 13 and 14 of the General Data Protection Regulation [2016/679]).

Purposes of processing personal data

Personal data and pay information are processed for employment contract and salary payment purposes.

Data is transmitted to stakeholders (Keva, tax authorities, trade unions) according to regulations.

Legal basis for processing

The basis for processing personal data is our legitimate interest (employment relationship). Main legal instruments include the Finnish Employment Contracts Act, Accounting Act, Working Hours Act and Annual Holidays Act.

In some cases also consent or explicit consent can be basis for processing personal data.

Personal data content and retention periods of the register

Data category nameRetention period
Name75 years from the person’s date of birth
Personal identity code75 years from the person’s date of birth
E-mail address10 years from the end of the last service period
Address10 years from the end of the last service period
Person’s basic information75 years from the person’s date of birth
Person’s service period data75 years from the person’s date of birth
Employee pay data75 years from the person’s date of birth
Person’s absence information10 years from the end of the last service period
Employee sickness absence information10 years from the end of the last service period
Person’s annual leave information10 years from the end of the last service period
Person’s office location information10 years from the end of the last service period
Person’s working time information10 years from the end of the payment year
Person’s working time information (Repo)10 years from the end of the payment year
Presents, rewards etc. given to the persons10 years from the end of the last service period
Person’s work history information10 years from the end of the last service period
Person’s degree information10 years from the end of the last service period
Person’s personal objectives10 years from the end of the last service period
Person’s job description10 years from the end of the last service period
Person’s development discussion information10 years from the end of the last service period
Person’s competence information10 years from the end of the last service period
Person’s working plans10 years from the end of the payment year
Person’s roles10 years from the end of the last service period
Person’s international mobility informationRetained permanently
Person’s distraintUntil the end of the year the distraint takes place
Person’s tax informationUntil the entry into force of the following tax card
Person’s parking space information3 years from the end of the employment relationship
Space reservations made by the person10 years from the reservations
Service requests made by the person5 years from the service request
Sanctions1 year from the end of the employment relationship
Working tools used by the personRetained as long as the person holds these working tools
Person’s trade union details10 years from the end of the last payment year
Publication InformationRetained permanently
Personal files: Microsoft 365 (e-mails and OneDrive), P-drive and Google services6 months from the end of the employment relationship
Personal data received through the Whistleblower channel5 years, unless the law requires a longer storage period

Data subjects

Personnel of Häme University of Applied Sciences, Häme Vocational Institute and HAMK Academy

Regular sources of data

From data subjects themselves.

Data is also obtained from the tax authorities and the enforcement authorities.

Regular disclosures of data

Data is disclosed to banks (salary payment and account balance), tax authorities, Kela, Keva, occupational health care services, trade unions, enforcement authorities. Data may be disclosed from the register for research purposes through research permit procedure.

Statistical data is disclosed to Sivistystyönantajat ry, the Finnish Ministry of Education and Culture and Statistics Finland.

Principles of data protection of the register

A Manual material

Data is archived in paper form in accordance with the archiving plan of the HR services for the period required by law after the employment relationship has ended.

B Data processed through automated data processing

Data is stored in an information system. Users have personal user IDs. Access is granted only to those persons who are entitled to access and use the data in the system in order to perform their duties.

The lawful processing of personal data is ensured by categorisation of data and with operating methods that are in compliance with the data handling rules concerning data set.

Automated decision-making

No automated decision-making is performed on the recorded data.

Transfer of data outside the EU or EEA

If it is necessary to transfer personal data outside EU or ETA area to the countries EU does not have determined adequate level of data protection, the transfer is done by using EU Standard Contractual Clauses. These contractual clauses are available from the data protection officer.

Rights of the data subject

The EU General Data Protection Regulation (2016/679) provides the data subject with the following rights:

The data subject shall have the right to withdraw his or her consent at any time. (Article 7)

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed. The data subject shall have the right to access to the personal data concerning him or her. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the data controller may charge a fee or refuse to act on the request. (Article 12 and Article 15)

The data subject shall have the right to obtain from the data controller the rectification of inaccurate personal data concerning him or her contained in the register (Article 16). A request for rectification shall be submitted in writing. Persons in an employment relationship (with HAMK or HAMI) are able to do rectification suggestions concerning their recorded working hours, which are then approved by their supervisor or salary administration personnel.

The data subject shall have the right to request the erasure of personal data concerning him or her where one of the following grounds applies (Article 17):

  • the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
  • the data subject withdraws consent on which the processing is based and there is no other legal ground for the processing;
  • the data subject objects to the processing, and there are no overriding legitimate grounds for the processing (Article 21);
  • the personal data have been unlawfully processed;
  • the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.

The data subject shall have the right to obtain restriction of processing where one of the following applies (Article 18):

  • the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
  • the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
  • the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
  • the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.

Where the processing is based on consent and carried out by automated means, the data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a data controller, in a machine-readable format. (Article 20)

Requests to exercise these rights are to be submitted:

Häme University of Applied Sciences Ltd
Data protection officer
P.O. Box 230 (Visamäentie 35A)
FI-13101 Hämeenlinna, Finland

email: [email protected]. You can also send the message via secured e-mail https://www.securedmail.eu/ .

The data subject shall have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Data controller

Häme University of Applied Sciences Ltd, Häme Vocational Institute Ltd and HAMK Academy Ltd
P.O. Box 230 (Visamäentie 35A), FI-13101 Hämeenlinna
13101 Hämeenlinna

Telephone: +358 3 6461, e-mail address: [email protected]

Contact person of the register

[email protected]

Data protection officer

[email protected]

Häme University of Applied Sciences Ltd
data protection officer
P.O. Box 230
FI-13101 Hämeenlinna