Data protection

Centria’s Data Protection Practices

This page explains how Centria University of Applied Sciences Ltd processes your personal data and what rights you have in relation to your personal data.

Centria processes your personal data in order to perform its statutory duties under the Universities of Applied Sciences Act and in connection with its other activities where there is a lawful basis for the processing of personal data.

The personal data processed varies depending on the processing activity. Personal data processed may include, for example, contact details, identification data, information relating to studies, employment or customer relationships, and data generated through the use of services. Your personal data may be processed in different situations and in different roles, for example, as a student, applicant, employee, job applicant, customer, cooperation partner or other user of our services.

More detailed information about the personal data processed is provided in the privacy notices relating to specific processing activities.

When processing personal data, we comply with the EU General Data Protection Regulation (GDPR), the Finnish Data Protection Act (1050/2018), and other applicable legislation.

1. Why do we process your personal data and what personal data do we process?

We process your personal data only for specified and lawful purposes. Your personal data may be processed in the following situations:

Students and applicants

• you apply to study with us or enrol in studies
• you study or have studied with us
• you communicate or interact with us or use our services

Job applicants and employees

• you apply for a job with us
• you work or have worked with us

Users of services, cooperation partners and stakeholders

• you interact with us or use our services or systems
• you visit our premises or campus areas
• you are our cooperation partner, contractual partner or customer, or a potential partner or customer
• you register for or participate in our events or training, projects, research or surveys
• you subscribe to our newsletter or respond to our customer surveys
• you visit our website
• you participate in our alumni activities
• you hold a position of trust, are a member of a governing body, or are otherwise appointed to a specific role

We also process your personal data for the purposes of ensuring safety and security, information security, case and records management, compliance with our legal obligations, and the establishment, exercise or defence of our rights and interests.

2. What is the lawful basis for processing your personal data?

There must always be a lawful basis for the processing of your personal data. The lawful basis depends on what personal data we process and the purpose for which it is processed. The applicable lawful basis is specified in more detail in the privacy notice concerning the relevant processing activity.

The lawful basis varies depending on the processing activity. Most of our processing of personal data is based on the performance of statutory duties assigned to a university of applied sciences, compliance with legal obligations, and the performance of tasks carried out in the public interest. For some services, processing may be based on legitimate interests, a contract, or the consent of the data subject.

3. Where do we obtain your personal data?

We usually obtain your personal data directly from you, for example when you apply to study or for a job with us, register for an event, use our services, or otherwise interact with us.

In some situations, we may also obtain personal data from public authorities, other organisations, or publicly available sources where there is a lawful basis for doing so.

Personal data may also be generated when you use our systems and services, for example for the purposes of information security, access control, or ensuring the proper functioning of services.

If we obtain your personal data from a source other than you, further information will be provided in the privacy notice concerning the relevant processing activity.

4. Are you required to provide us with your personal data?

If the provision of personal data is mandatory, we will inform you of this in connection with the relevant service or interaction. If you do not provide the necessary information, we may not be able to process your matter, provide the service, or perform the relevant task.

Where the provision of personal data is based on voluntary consent, you can generally choose not to provide the data.

5. To whom may your personal data be disclosed?

Your personal data may be disclosed, for example, to public authorities, national data repositories, partner higher education institutions, education providers, research organisations and funding bodies, and other recipients where there is a lawful basis for the disclosure or where the data subject has given consent.

Your personal data may also be processed in systems provided by service providers used by Centria. In such situations, the service providers process personal data on behalf of Centria and are not permitted to use the personal data for their own purposes.

6. Does Centria use external service providers?

We may use, for example, information system providers, cloud services, learning environments, communication services, financial administration services, event and registration services, and other services necessary for the operations of the University of Applied Sciences.

Where a service provider processes personal data on behalf of the University of Applied Sciences, we agree on the applicable data protection obligations in accordance with the requirements of data protection legislation.

7. Is your personal data transferred outside Europe?

We aim to arrange the processing of personal data so that personal data is not transferred outside the European Economic Area (EEA) without an applicable lawful basis for such a transfer.

If your personal data is transferred outside the EEA, the transfer will be carried out in accordance with the requirements of Chapter V of the GDPR. The transfer may be based, for example, on an adequacy decision adopted by the European Commission or on appropriate safeguards as referred to in the GDPR.

Where applicable, more detailed information about international transfers is provided in the privacy notice concerning the relevant processing activity.

8. How do we use cookies?

Our website uses cookies and similar technologies to ensure that the website functions properly, to analyse its use, and to improve the user experience.

Strictly necessary cookies do not require your consent. For other cookies, such as analytics and marketing cookies, we ask for your consent through the cookie settings when you first visit the website.

You can change your preferences and withdraw your consent at any time via the Cookie Settings link at the bottom of the page.

9. How long do we retain your personal data?

We do not retain your personal data for longer than is necessary for the purposes for which the data is processed, unless a longer retention period is required by law.

The retention period depends, for example, on the purpose of processing, applicable legislation, archiving obligations, the University’s rules concerning information management and document retention, a contract, your consent, or the establishment, exercise or defence of legal claims.

More detailed retention periods, or the criteria used to determine them, are provided in the privacy notices concerning specific processing activities.

10. Is your personal data used for automated decision-making?

We do not use your personal data for automated decision-making that produces legal effects concerning you or similarly significantly affects you.

11. Is your personal data used for profiling?

Profiling means automated processing of personal data in which personal data is used, for example, to evaluate or predict certain personal aspects relating to an individual.

If profiling is used in a manner that may have significant effects on you, we will inform you separately and provide the additional information required under the GDPR.

12. How do we protect your personal data?

We take appropriate measures to protect your personal data.

To protect personal data, we use measures such as access rights management, user authentication, secure information systems, log management, technical and organisational security measures, data protection and information security guidelines for staff, and agreements governing the processing of personal data.

Your personal data may only be processed by persons who are authorised and have a need to process the data based on their duties.

We continuously assess and develop information security and data protection as part of our operations.

13. What rights do you have?

You have rights relating to your personal data under the GDPR. The applicability of these rights depends on the purpose for which your personal data is processed and the lawful basis for the processing.

Right of access

You can ask whether we process personal data concerning you and obtain a copy of the personal data we process.

If you are our student or employee, you can also access some of your personal data through the systems available to you.

Right to rectification

If your personal data is inaccurate or incomplete, you can request that it be corrected or completed.

Right to erasure

In certain circumstances, you can request the erasure of your personal data. This may be possible, for example, where the data is no longer necessary for the purposes for which it was collected or where the processing is based on your consent and you withdraw that consent.

However, we cannot erase personal data where its retention or processing is required by law or another binding obligation.

Right to restriction of processing

In certain circumstances, you can request that the processing of your personal data be restricted. This may apply, for example, where you contest the accuracy of the data, oppose the erasure of the data, or need the data for the establishment, exercise or defence of legal claims.

Right to object to processing

In certain circumstances, you have the right to object, on grounds relating to your particular situation, to the processing of your personal data.

Where processing is based on the performance of a task carried out in the public interest or on legitimate interests, we will assess your objection on a case-by-case basis.

Right to data portability

In certain circumstances, you may have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and to transmit that data to another controller.

Right to withdraw consent

Where the processing of your personal data is based on your consent, you can withdraw your consent at any time.

The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Restrictions on your rights

Not all of the rights described above apply to all processing of personal data. Your rights may be restricted, for example, where the processing of personal data is required by law or where the retention of the data is prescribed by law.

14. How can you exercise your rights?

If you wish to exercise your rights, you can submit a request by email to: tietosuojavastaava@centria.fi

Where possible, please specify in your request which personal data or processing activity your request concerns.

We have the right to verify your identity where this is necessary to protect your personal data.

We will respond to your request without undue delay and generally within one month of receiving the request. In certain circumstances, this period may be extended by up to two further months. If the period is extended, we will inform you of the extension and the reasons for it.

Exercising your rights is generally free of charge. If a data subject requests further copies, the controller may charge a reasonable fee based on administrative costs in accordance with Article 15(3) of the GDPR.

A request made by a data subject may also be refused on the grounds provided for in the GDPR. If a request is refused, the controller will provide the data subject with a reasoned response explaining why the request has been refused.

15. What can you do if you are dissatisfied with the processing of your personal data?

If you believe that we are processing your personal data unlawfully or have otherwise failed to comply with data protection legislation, you can first contact us.

You also have the right to lodge a complaint with the competent supervisory authority.

In Finland, the supervisory authority is:

Office of the Data Protection Ombudsman
Postal address: PO Box 800
FI-00521 Helsinki
Finland
Telephone (switchboard): +358 29 566 6700
Email: tietosuoja@om.fi

16. We update this data protection information

This data protection information may be updated if our processing of personal data, the systems we use, our operations, or the applicable legislation changes.

We publish the current version on our website.

This data protection information was last updated on 15 September 2026.

17. Questions about data protection?

If anything in this data protection information is unclear or you would like to know how your personal data is processed in your particular situation, you can contact:

tietosuojavastaava@centria.fi

We want you to know how your personal data is used and what rights you have. You can always ask us about the processing of your personal data.

18. Contact details of the controller

Centria University of Applied Sciences Ltd
Talonpojankatu 2
FI-67100 Kokkola
Finland
Telephone: +358 (0)6 868 0200

System-specific Data Protection Reports

All of Centria UAS’ English language registers and data protection reports (as well as information system reports) will be centrally published on this site. All Finnish language registers and reports are located on this page.