Privacy Notice

Privacy notice for users of A+ Learning management system

1. Description of this notice

Name: A+ user data

A+ is the online learning environment developed and maintained at the department of Computer Science at Aalto University. This notice describes processing of personal data on A+ users in order to comply with university’s statutory educational duties and open MOOC education. The users are employees and students. The student users can be a) students with study right at Aalto University (degree students, exchange students, non-degree students who have a right to pursue single course(s), and Open University students), and b) students with no study right at Aalto University (participants in open MOOC courses). Personal data are collected directly from data subject and elsewhere than from the data subject.

This notice supplements the general privacy notices at Aalto:

Privacy notice for students, available at https://into.aalto.fi/display/contact/Privacy+notice
Privacy notice for employees, available at https://www.aalto.fi/en/aalto-university/privacy-notice-for-employees (requires login).

The general privacy notices are referred to below when they are directly applicable also for this notice.

In this notice, we tell you how your personal data are handled in A+ and what rights you have to your personal data. Additionally, we describe the joint rules of the game on the purposes of processing the data, which are organizing teaching and scientific research in order to develop teaching.

This privacy notice covers the A+ core and the services it provides for the automatic assessment (MOOC-Grader) and originality evaluation (Radar, Watermarks) of student submissions, temporary storage of student code snippets for getting instructor feedback (Koodisäilö), interactive assignments (Acos), user feedback and assessment (MOOC-Jutut, Rubyric), and student queuing for advising (Neuvontajono). Additionally, this notice covers the MyCourses addon Astra, which handles the automatic assessment in MOOC-Grader of student submissions in MyCourses.

The office of the data protection ombudsman has defined automated decision-making and profiling at https://tietosuoja.fi/en/automated-decision-making-and-profiling. The Aalto University data protection policy at https://www.aalto.fi/en/services/aalto-university-data-protection-policy defines that at Aalto, no automated decision-making is allowed. The personal data collected in A+ is used for profiling which helps teachers in giving support and guide students in studies and development of their skills. The results of the profiling are always used by persons, and profiling is not used as part of automated decision-making. Users can themselves print an informal notice on passed course assignments in A+. In all Aalto degree courses, the teacher responsible for the course registers the official course grades for Aalto students in Sisu.

A+ is maintained at the Department of Computer Science and it runs on Aalto servers in Aalto premises.

Version history:

Original: June 2022

2. Controller and unit in charge

Aalto University, Department of Computer Science
Visiting address: Konemiehentie 2, 02150 Espoo
Telephone (exchange): 09 47001
Unit in charge: Department of Computer Science, head of department Lauri Savioja
Contact person: Anni Rytkönen
Contact details for the unit in charge: aplusguru@cs.aalto.fi

3. The data protection officer

As in Privacy notice for students, chapter 2

4. Purpose and legal grounds for the processing of personal data

The purposes of processing the data are organizing teaching and scientific research in order to develop teaching.

students with study right: As in Privacy notice for students, chapter 3
employees: As in Privacy notice for employees
students with no study right: As in Privacy notice for students, chapter 3, where applicable

5. Purposes of legitimate interest pursued by the controller or by a third party (applies only to Case A; processing is based on point f of Article 6(1))

As in Privacy notice for students, chapter 4

6. Categories and origin of personal data

Personal data collected from other systems as part of the login process
- Aalto users (identifying authentication; origin of data: other Aalto systems)
  - individual-specific identifier data: first name, last name, username, student number
  - background information: organization, language preference
  - contact details: email address
- HAKA users (identifying authentication; origin of data: user's home organization)
  - individual-specific identifier data: first name, last name, username, student number
  - background information: organization, language preference
  - contact details: email address
- Google accounts (separates, does not identify; origin of data: Google)
  - individual-specific identifier data: name, username
  - contact details: email address
Personal data collected in the system from users themselves
- Study attainments, incl. examination responses and other completed assignments used to assess study attainments, and their evaluation and feedback, as well as feedback given by students
- Information on participation in teaching, such as background information on whether the student participates in the course as degree student or MOOC participant
- Information regarding user actions in the system
- Additionally, other needed background information, such as research permits for scientific research in order to develop teaching, may be collected
- Information may be observed, inferred or derived from the use of the IT services or systems provided for student use by the university or collected by the security and monitoring services used by the university
Origin of data collected in the system, if not the users themselves:
- course personnel (given assessment and feedback)
- other course participants (given peer assessment and feedback)
- system data (e.g., automatic assessment or similarity checking)
Not collected: Special categories of data (sensitive data) concerning studies

7. The recipients or categories of recipients of the personal data

The data in A+ is processed only by Aalto employees who need the data for their work duties. The information is protected from unauthorised handling. Access rights are in place to restrict unauthorised access.
Aalto University may also use outside processors, such as system service providers that process personal data on behalf of Aalto on the basis of a commission contract.
Aalto University discloses personal data to parties outside the university or processes data for purposes other than the original only in situations where such disclosure or processing is permitted by law. Personal data may be disclosed from A+ as follows:
- for scientific research
- to comply with the Act on the Openness of Government Activities (621/1999) or with other legal obligations.

8. Planned transfers of personal data to third countries or international organisations

As in Privacy notice for students, chapter 7.

9. Period for which personal data are stored / Criteria used to determine the period for which data are stored

The periods for which personal data saved in A+ are stored are based on the law and the records management plan of Aalto University (https://www.aalto.fi/en/services/records-management-plan-tos). Personal data are not stored permanently in A+. Personal data are stored in A+ as follows:

Personal data collected directly from the data subject (information related to studies, participating and passing courses): stored for the ongoing and two coming academic years
Identifying data (user accounts): until the user is not a member of any course instance (storage period see above), and thereafter until the last login timestamp is >12 months past
Logs: handled according to Aalto log rules (available in Finnish at https://www.aalto.fi/fi/tietoturva/lokisaanto)

10. Right of access by the data subject, right to rectification, right to erasure, right to restrict processing and right to data portability (Articles 15, 16, 17, 18 and 20 of the General Data Protection Regulation)

Students: if you want to access or rectify your information stored in A+, primarily contact the teacher responsible for your course.
All users: if you want that your personal data stored in A+ is erased (taking into account storage rules), please send a message to aplusguru@cs.aalto.fi .
All users: To make any information requests related to your rights as a data subject, you may also use the personal data portal https://datarequest.aalto.fi/en-US/

11. Right of the data subject to object to processing of personal data (General Data Protection Regulation, Article 21)

As in Privacy notice for students, chapter 10

12. The right of the data subject to withdraw consent

As in Privacy notice for students, chapter 11

13. The right of the data subject to lodge a complaint with a supervisory authority

As in Privacy notice for students, chapter 12

14. Is the provision of personal data a statutory or contractual requirement, or a requirement necessary to enter into a contract, and is the data subject obliged to provide the personal data? / What are the possible consequences of failure to provide such data

As in Privacy notice for students, chapter 13