Version: April 4, 2018
Through our digital service, we also operate from time to time as a data processor for our customers (e.g. educational organization or institution), which means that we process personal data based on contracts on behalf of our customers in accordance with their instructions. Regarding this personal data collection and use, we advise you to read our customers’ privacy policies as well.
The data controller relating to processing of personal data is:
Business ID: 2867321-5
For what purposes is personal data collected and used and what is the legal basis for processing personal data?
We collect, store and process personal data only for predefined purposes. We also always make sure that there is at least one legal basis for processing personal data. The main purposes and the applicable legal basis for processing personal data are:
Provision of service. Personal data is collected and used for managing the entire customer relationship and providing our digital service. This may include for instance user authentication and invoicing. The legal basis for this processing is a contract between Eduten and the customer. The legal basis for some processing may also be consent (children) or express consent (health data).
Marketing. We also collect and use personal data for marketing purposes, including direct marketing and contacting potential customers. We may also use personal data to target or retarget advertising in digital media platforms, such as social media and search engines. The legal basis for this processing is our legitimate interest. A person can however at any point prohibit direct marketing by sending email to firstname.lastname@example.org. We do not sell or rent personal data to third parties for marketing purposes.
Customer communications. We also collect and use personal data for customer communication purposes, including handling of support requests and customer feedback as well as notifying users about the service. The legal basis for this processing is fulfilling contractual obligations as well as our legitimate interest.
Analytics and business development. We also use anonymized data for statistical and research purposes. This is mainly data that is generated during the use of our service. This anonymized data may be transferred to third parties, such as educational organizations and institutions for the purpose of educational analysis and development. This may be done in the form of reports provided to our customers. We also use the personal data as well as the anonymized data generated from the use of our service to develop our own digital service. The legal basis for this processing is mainly our legitimate interest.
Human resources management. Personal data relating to employees and job applicants are mainly collected and used for human resources management purposes, payment of salaries, fulfilling other rights and obligations relating to employment contracts, meeting legal requirements relating to employment as well as evaluating and selecting candidates for open positions. The legal basis for this processing may be fulfilling a contract between Eduten and the employee, consent (job applicants) as well as fulfilling legal obligations relating to employment.
What personal data is collected and from which sources?
The personal data we collect and use is mainly provided by the person herself. Another important source is the data created and generated during the use of our digital service. Regarding potential organizational customers, we could also get information from public sources, such as LinkedIn. We also collect website use and visitor information with Google Analytics and HubSpot for analyzing our website use, develop it further and for targeting relevant marketing content for our customers and website visitors.
Data we collect and process relating to our customers: Name of the organization, person’s name, business contact details and similar data.
Data we collect and process relating to teachers: Name, school or educational institution, email address and similar data.
Data we collect and process relating to students: Data is divided into personal data and research data. Personal data is data that teachers need to generate reports. It contains for instance user login, name of the person and date of birth. Research data contains data that is generated when the student uses the service (e.g. what assignments the student did as well as the results) and classification data relating to the student. Research data contains for instance age in months, gender and country. Research data alone is anonymous data.
Data we collect and store relating to potential customers: Name, email, employer, job title and similar data.
Data we collect and store relating to employees: Name and contact details, social security number, email and details required for payment of salaries and withholding taxes.
With consent we may also process: Personal data of users under 16 years with consent from parents, and health data relating to user’s learning process and performance.
Note that our customers may use the service for storing and processing their and their users' personal data, so in those situations we operate as their data processor based on contracts. In such situation we process personal data only on behalf of the specific customer based on their instructions and only as long as we have a valid contract.
Information regarding children
A contract regarding the use of our service can also be made with an educational institution and its representative, who is authorized to make contracts on behalf of the specific organization. This person must be at least 18 years old and in a relevant position in the organization. However, users of our service may also be students who are under 16 years old.
If Eduten offers its digital service directly to children under 16 years (or a lower age limit, if so provided by national local law) and processes personal data relating to children based on consent, it will make sure that the consent is given or authorized by a person with parental responsibility for the child. We may also process personal data relating to children who are users or students based on our legitimate interest, which is the provision of our digital service to users.
If Eduten’s customer has users or otherwise enters personal data relating to children in the digital service and the customer is considered as data controller for this personal data, it is customer’s responsibility to ensure that there is lawful basis for processing the personal data.
Who processes personal data and is it transferred to anyone?
Personal data is mainly stored in electronic format and people within our organization have access to personal data.
We may also use third party services providers for data storage (e.g. cloud storage), digital marketing and processing of personal data. In these situations, we make sure we have a written contract with the services provider with minimum data processing provisions and also otherwise that the confidentiality of personal data is secured and data is otherwise processed and transferred lawfully.
We may also disclose or transfer personal data to fulfill legal obligations or when a legal authority requires a disclosure. We may also disclose personal data if we are a party of a business sale, such as a merger or an acquisition.
If any of our services providers or data transferees are located outside the EU, we make sure that the transfer of data fulfills all legal requirements.
Is personal data transferred outside the EU?
By default, personal data is not transferred outside the EU. In certain limited situations, data may be transferred outside the EU if our services provider is located there.
If personal data is transferred outside the EU, we make sure that the transferee is located in a country with adequate safeguards (as decided by the EU commission from time to time), the transferee is Privacy Shield certified (if a US-based company) or the transfer occurs by using model clauses published by the EU commission.
How long is data stored?
We will not store personal data for a longer period than is necessary for its purpose or required by contract or law. The storage times for personal data may vary based on its purpose and the situation. Data may also be deleted after a contract ends with the customer.
How is data stored and kept secure?
Personal data is stored and secured in accordance with general industry standards and practices. We consider and keep personal data confidential. Subcontractors that we use for processing personal data are selected also based on their data security measures. For our own systems and data storage, we use only well established services providers and robust software tools. Access to personal data is also protected with user-specific logins, passwords and user rights. Our premises are also safe and secure.
Is it mandatory to provide personal data? What happens if you don’t provide it?
If you as a customer, user or employee do not provide us some of your personal data or allow processing of it, it is very likely that we cannot serve and fulfil the purpose of our business. At least entirely. At minimum, we need to process personal data relating to employment and for provision of our service to customers with whom we have a contract.
What rights does a person have relating to her personal data?
Withdraw your consent
If we process personal data based on your consent, you can at anytime withdraw your consent by notifying us by sending email to email@example.com.
Access to data
You have the right to have confirmed if we are processing your personal data and also to know what data we have about you. In addition, you have right to some supplemental information described in the law about the processing activities. For access requests, please contact us as instructed in the next section.
Right to have errors corrected
You have the right to request that we correct any inaccurate or outdated personal data we have about you.
Right to prohibit direct marketing
You have the right to request that your personal data is not processed for direct marketing purposes by sending us email to firstname.lastname@example.org.
Right to object processing
If we process your personal data based on public interest or our legitimate interest, you have the right to object processing of your data, to the extent that there is no such significant other reason that would override your rights or the processing is not necessary for handling legal claims. Please notice that in this situation we may not be able to serve you anymore.
Right to restrict processing
In certain situations you have the right to require that we restrict processing of your personal data.
Right to data portability
If we process your personal data based on your consent or fulfilling of a contract, you have the right to require transfer of the data you have provided to us to another services provider in a commonly used electronic format.
How can a person use her rights?
You can execute and use your rights by contacting us by sending email to email@example.com. In such case, we ask you to provide us your name, contact details, phone number as well as something that we can use to verify your identity, such as written and signed (and scanned) request. If you consider that the processing of your personal data is not lawful, you can always also make a notification to a supervisory authority (in Finland tietosuojavaltuutetun toimisto).
Who can you contact in privacy matters?
Contact details in privacy matters:
Business ID: 2867321-5
Our contact person in privacy matters is Henri Muurimaa. You can reach him by sending email to the address provided above or calling to the number provided above.