Privacy statement

Updated 28.2.2025

1 Introduction

This Privacy statement describes how personal data are processed in Opin.fi service. It also explains what rights you have as a data subject and how you can use them. Data subjects are learners who have created a profile in Opin.fi and universities’ teaching staff included in the information on offered studies. All Finnish universities and universities of applied sciences participate in Opin.fi service, which is part of their joint Digivision 2030 project.

This Privacy statement will be updated regularly. You can also find the most recent version at: privacy statement(Opens in a new tab).

2 Controller’s and Data Protection Officer’s contact details

Finnish higher education institutions are joint controllers of the Opin.fi service. For a list of the joint controllers and their contact details visit https://wiki.eduuni.fi/x/G6OhH(Opens in a new tab).

HigherEd Hub Finland Oy is the centralised contact point of Opin.fi service in data protection matters. You can reach it at tietosuoja@opin.fi.

3 Purposes of processing, data types, applicable legal bases and storage periods

Purpose of data processingData typesApplicable legalStorage period
Publication of study options
  • Name
  • Title
  • Email
Public interestUntil further notice
User identification and management of user rights
  • Name
  • Student number
  • Email
  • Phone number
  • Personal identity code (not retained)
  • IP address
  • Language selection
Agreement1 year from last login
Import and storage of a learner's study attainments
  • Information on completed studies
  • Information on degrees
  • Rights to study
  • Attendance information (present/absent during the current semester)
Consent1 year from last login while consent remains valid
Site development and ensuring its availability
  • IP address
  • Device information
  • Browser information
  • Transaction data
Consent2 years after collection
Site maintenance
  • Name
  • Student number
  • Email
  • Phone number
  • Personal identity code (not retained)
  • IP address
  • Language selection
Public interest2 years
Granting and management of user rights in Opin.fi
  • User’s organisation (university)
  • User’s name and business email
  • Access level
  • User's network
AgreementWhile performing the job role
Consent management
  • On/off information
  • Time stamp
Agreement
Ensuring the technical security of the site and investigating abuses
  • IP address
  • Log data
Public interest2 years
Email messages to the data subject about topical matters of the service
  • Name
  • Email
Consent1 year from last login while consent remains valid
User support for processing data subjects’ service messages or problem reports
  • Name
  • Message content
  • Contact details (email, phone number)
Agreement1 year from last login
Service development based on customer feedback
  • Name
  • Contact details (email, phone number)
  • Communication language
  • Feedback content
Consent

4 Source of information

As a rule, profile information is collected directly from the learner. In connection with identification, the learner's personal data are obtained from Suomi.fi and HAKA user identification and from the learner number register of the Finnish National Agency for Education: learner number register(Opens in a new tab). Information on completed studies is obtained from Virta higher education achievement register. Information on the offered studies is obtained from universities’ information systems. Technical information on site use is collected by using cookies.

5 Disclosure of personal data to third parties and international data transfers

User data can be disclosed to higher education institutions in connection with course registrations. Statistical data on course participation are also disclosed to higher education institutions. To implement the service, external service providers are used for the following purposes:

  • Service provision and profile management
  • Analytics

The service providers we use have a contractual obligation to ensure a high level of data protection when processing the data.

Opin.fi service discloses no data to non-EU/EEA countries.

6 Data subjects’ rights

Using your rights

As a data subject you have many rights by which you can influence the way your personal data are processed. You can use the rights listed below directly through your profile or by emailing a request to: tietosuoja@opin.fi.

Right to be informed

Data subjects have the right to be informed about personal data processing we carry out in a transparent and easily understandable form. This Privacy statement provides basic information about the processing of personal data. If you have any questions about data protection, please contact: tietosuoja@opin.fi for more information.

Access to data

Data subjects have the right to be informed of which personal data concerning them we process and to receive a copy of the processed data if they wish.

Rectification of data

Data subjects have the right to request rectification or correction of their data, in which case we will supplement inaccurate or incorrect data.

Restricting the processing of data

Data subjects have the right to demand that the processing of their personal data is restricted. This means that the data are retained but, in other respects, they are only processed based on consent, to meet a legal requirement, to protect the rights of another person or for an important reason of public interest of the European Union or one of its Member States. The restriction of processing can be used if, for example, the lawfulness of data processing has been disputed. In this case, the processing of the data will be restricted until its lawfulness has been verified.

Objecting to the processing of data

Data subjects have the right to object to the processing of personal data for a personal reason if the processing is based on a legitimate interest, public interest or the exercise of official authority. The processing of the data will be discontinued unless it is necessary for some other justified reason.

Transferring information

Data subjects have the right to request that their personal data are transferred from one system to another (‘right to data portability’). This right may be used when the personal data have been obtained directly from the data subject and their processing has been based on an agreement or consent.

Erasure of data

Data subjects have the right to have all of their personal data erased (‘right to be forgotten’). This right may be used if, for example, the data subject withdraws their consent on which the processing was based and no other legal basis is applicable to the processing.

Lodging a complaint

Data subjects have the right to lodge a complaint with the competent supervisory authority concerning the processing of personal data. The data protection authority in Finland is the Office of the Data Protection Ombudsman.