Privacy statement of the student admissions register at Fintraffic Air Navigation Services Ltd

1. Introduction

Protecting your privacy and the transparency of the processing of your personal data are important to the Fintraffic Group. The purpose of this privacy statement is to inform you of the processing of your personal data in Avia College student admissions.

We process your personal data will in accordance with the EU General Data Protection Regulation (EU) 2016/679 and national data protection legislation.

2. Controller

Fintraffic Air Navigation Services Ltd                          

business ID 2767840– 1 

Street address:
Lentäjäntie 1 B, 01530 Vantaa

Postal address:
PO Box 157, 01531 Vantaa

Switchboard:
+358 (0)20 4284 000

Controller's representative: 
Training assistant Tommi Sundqvist 
ans(at)fintraffic.fi
+358 20 4284 000

Group Data Protection Officer 
privacy(at)fintraffic.fi
+358 29 450 7000

3. Categories of data subjects and personal data we process

Categories of data subjects

The system collects and stores data on the applications and entrance examination results of Avia College applicants to facilitate the completion of student admissions.

Personal data we process

Personal data to be processed on each applicant

• Name, personal identity code, gender, mother tongue and nationality
• Contact information: postal address, telephone number and email
• Study data: previous studies and completed degrees
• Work experience
• The application includes a free-form column in which the applicant can write a description of himself/herself
• Result of an online pre-selection test by Fintraffic Navigation Services Ltd
• The results of the Eurocontrol Feast tests, which test skills and aptitude tests and include a personality survey completed on computers
• Numerical suitability assessment of the admissions psychologist
• Numerical interview assessments by Fintraffic Navigation Services Ltd
• Information on the outcome of the medical examinations by aeromedical examiners (approved/rejected)
• Information on the result of the personnel security clearance (approved/rejected)

4. Data sources

The data in the register is obtained from the applicant, the results of the entrance examination, the Aeromedical Centre and the Finnish Security and Intelligence Service

5. Purpose and legal basis for processing

The purpose of processing personal data is to complete student admissions to Avia College training.

The personal data referred to in this privacy statement are processed in accordance with the EU General Data Protection Regulation’s Article 6(1)

• (a) with the consent of the data subject
• (c) in order to comply with the legal obligation of the controller

6. Disclosure of data and data recipients

The controller uses instructions and written data processing agreements to ensure that each recipient complies with the regulations related to the processing of personal data.

Other companies belonging to the controller's group may process your personal data on the basis of the legitimate interest of the controller. However, your data is disclosed and processed within the group only to the extent necessary to implement the purposes described in this privacy statement.

Your data can be disclosed to the following parties:

Disclosure of personal data to processors

The processor of personal data may only process data in accordance with instructions issued by the controller.

Personal data is disclosed to the service providers participating in student admissions, which include:

• Company used in the processing of applications (Lyyti Oy)
• Company responsible for the admissions process' online pre-selection test (Mediamaisteri Oy)
• The company responsible for the psychological test sections of the entrance examination (Pilot Select Oy)

Disclosure to third parties

• FEAST tests (Eurocontrol)
• Aeromedical Centre (AMC)
• Finnish Security and Intelligence Service (SUPO)

The results of the FEAST tests may be disclosed to other organisations that use that test system with the written consent of the applicant. No other data in the register will be disclosed.

Transfers of personal data outside the EU or EEA countries

Personal data will not be disclosed to countries outside the EU or EEA

7. Data storage

Personal data is stored for five (5) years from the date of the student admission decision (Act on the National Register of Education, Qualifications and Degrees 884/2017, section 22).

Your personal data will only be processed for the period and to the extent necessary for the purposes listed in this privacy statement. When the legal basis for processing no longer exists or personal data is no longer needed, the data will be properly destroyed.

8. Protection of personal data

The controller has access to appropriate technical and organisational personal data protection measures. With these measures, the controller ensures that the data subject’s personal data are not accidentally or unlawfully destroyed, lost or altered. The controller also ensures that the data are not disclosed without authorisation and cannot be accessed by anyone who does not have the right to process the data.

Data is stored in electronic systems protected by firewalls, passwords and other appropriate technical solutions. The right to access to the register is limited to certain persons employed by Fintraffic Navigation Services Ltd and other specified persons who need information in their tasks. Everyone who has access to the register data is bound by a duty of non-disclosure.

9. Data subject’s rights

Right to receive information on the processing of their own data, right of access to their data and right to request rectification of their data

You have the right to be informed by the controller of whether your personal data is being processed. If your personal data is being processed, you have the right to receive a copy of your personal data and information on the purposes of the processing and other matters related to the nature of the processing.

If your personal data is incomplete or otherwise incorrect, you can demand that the controller rectify your data.

Right to request the erasure or restriction of processing of data

You may require that the controller delete your personal data, for example, when the controller no longer needs your personal data for the original purpose, your personal data is being unlawfully processed in your opinion, or you withdraw your consent as the legal basis for the processing of your data. However, if the retention of your personal data is necessary to establish, present or defend a legal claim, the controller is not under any obligation to delete your data.

You may require that the controller restrict the processing of your personal data to only include its storage, for example when it is unclear whether your personal data is accurate or being lawfully processed.

When the legal basis for the processing of your data is the legitimate interest of the controller, the public interest or the exercise of public authority, you have the right to object to the processing of your data on the basis of your personal, special situation. However, if there is a significant and justified reason for processing that overrides your rights, the processing of your data can continue.

Right to withdraw consent

If the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. After your consent has been withdrawn, the controller may no longer process your personal data for which your consent was the only grounds for processing.

Withdrawal of consent shall not affect the lawfulness of processing carried out before the withdrawal of consent.

Right to require the technical transfer of their data from one controller to another

If the processing is based on your consent or the implementation of an agreement and it is carried out automatically, you have the right to require the transfer of your data technically directly from one controller to another.

Exercise of the data subject's rights

As a rule, the actions the controller takes due to your request are free of charge for you. However, you must be able to identify yourself reliably for your request to be approved. Therefore, if necessary, the controller may require you to prove your identity at the time of your request.

The controller will respond to your request without undue delay and, as a rule, within one month of receiving the request.

10. Referral to the Data Protection Ombudsman

If you feel that your personal data has been processed in a manner that does not comply with data protection legislation, you may lodge a complaint with the supervisory authority. The Office of the Data Protection Ombudsman acts as the competent supervisory authority in Finland:

Street address: Lintulahdenkuja 4, 00530 Helsinki, Finland
Postal address: PO Box 800, 00531 Helsinki, Finland
Switchboard: +358 29 566 6700Registry: +358 29 566 6768
Email (registry): tietosuoja(at)om.fi

However, the controller would appreciate if you could first notify the controller of the matter. For further information on the data subject's rights please see https://tietosuoja.fi/yksityishenkilot