1.1. This data protection policy explains the procedure of processing personal data and the data concerning the private life of individuals at the University of Tartu (“university”; registry code 74001073, address Ülikooli 18, 50090 Tartu, email info [ät] ut.ee). Personal data are any data concerning an identified or identifiable natural person, revealing the person’s physical, mental, physiological, economic, cultural or social identity, relationships and affiliation or origin. Processing of personal data is any operation performed with personal data, including the collection, recording, organisation, storage, alteration, disclosure, granting access to personal data, consultation and retrieval, use and communication of personal data.
1.2. The university processes personal data only if there is a legal basis for it and only as long as necessary to achieve the objective of processing or to comply with legal obligations. The university applies all relevant organisational, physical and technical security measures to protect the personal data that are at the university’s disposal from unauthorised and non-compliant use, disclosure or damage.
1.3. The processing of electronic and paper documents (including the terms of storage) and the rights of access are governed at the university by the following bylaws:
1.3.1. Documentary Procedure Rules,
1.3.2. Regulations for ensuring security in the buildings of the University of Tartu,
1.3.3. List of Documents of the University of Tartu,
1.3.4. Accounting Policies and Procedures.
1.4. Electronic personal data are stored in the university’s central servers, which are located in the university’s server rooms in the territory of the Republic of Estonia. The central servers comply with the Information Technology Standard established at the university.
1.5. The university processes personal data only in full compliance with legislation governing personal data protection, including upon communication of personal data to processors located in non-European Union countries. The university may use processors located in third countries, for example, in mailing list management.
1.6. The data protection policy does not deal with the way the university processes data of legal persons or how other persons process personal data. Nor does the policy cover the processing of personal data on external websites to which there are links on the university’s web pages.
2.1. As controller, the university processes the data of persons who apply for studies at the level of professional higher education, bachelor’s or master’s, integrated bachelor’s and master’s study or doctoral study (degree study). The university processes the personal data of student candidates on the basis of the consent given via the admissions information system (SAIS for curricula taught in Estonian) or the international student application management system DreamApply. The scope and principles of processing of personal data submitted via SAIS can be found here. The same principles for DreamApply are available here.
2.2. SAIS receives the student candidate’s personal data from other national registers (for example, Population Register, Estonian Education Information System (EHIS)). If it is impossible to request data for a student candidate via SAIS from such registers (for example, the student candidate submits the admission application before graduating from the previous level of study or if the student’s name is changed during the admissions period), or if upon applying for degree study the student candidate submits the application on paper, the university will make an independent request for data. The university makes a request for the personal data of an international student candidate, including requests for educational data, on the basis of the student candidate’s consent, from Estonian ENIC/NARIC Centre (Academic Recognition Information Centre), a unit of Archimedes Foundation.
2.3. After making the admission decision, the university enters the student’s personal data in the Study Information System (SIS) and processes them based on the principles described in chapter 3.
3.1. As controller of personal data, the university processes the following personal data of degree students through SIS and other information systems that support teaching and studies:
3.1.1. name and surname, personal identification number, date and place of birth, country of origin, citizenship and contact details. The processing of these personal data results from the University of Tartu Act and Universities Act and is necessary for the purpose of identifying the student, organising teaching and studies, creating a user account for the student in the university’s computer system, and issuing academic documents. The university uses contact details also to send invitations to participate in surveys conducted by the university and important information about activities of the university’s organisations (for example, Student Council) and at the university (for example, events, alumni activities, mentorship programme);
3.1.2. educational data required for organising teaching and studies, for example, data on previous education, data on currently acquired education (curriculum and electives, form of study and workload, date of start and end of studies, study results) and work experience;
3.1.3. data required to apply for and verify grants, stipends, exemption from tuition fee, and academic leave, including financial data, for example, the bank account number, data regarding family members, and data on service in the Defence Forces;
3.1.4. special categories of personal data contained, for example, in medical certificates submitted to apply for exemption from tuition fee and to give reasons for failure to appear for an exam, and applications to request an academic leave, applications for the right to take part in studies during academic leave, and applications for stipends.
3.2. The legal basis for processing student data is the university’s legal obligation and/or task carried out in the public interest (organisation of study). The legal basis arises from national legislation (for example, Universities Act, University of Tartu Act, Study Allowances and Study Loans Act, Professions Act, Aliens Act), the performance of which is governed by government regulations (for example, Regulation on Student Scholarships, Regulation on the Format and Statute of Diplomas and Diploma Supplements, Regulation on the Statute of the Estonian Education Information System), and the university bylaws (for example, Admission Rules, Study Regulations, Procedure for Recognition of Prior Learning and Professional Experience, Conditions of Reimbursement of Study Costs, Procedure for Applying for, Granting and Payment of Stipends and Study Allowances, Regulation of Study Information System, Procedure for Awarding Professions, Rules of Residency).
3.3. The university processes the personal data of students in several information systems: SIS, document management information system, and e-learning environments Moodle and Mahara. To use Moodle and Mahara, students do not have to submit additional data, because the data is automatically transferred from the SIS. Users of e-learning environments may complete their user profile with voluntary information (for example, a photo, city, interests), which helps to improve the user convenience of the e-learning environment. The legal basis for processing these data is the user’s consent. The user has the right to edit or delete these data at any time.
3.4. If a student applies for a grant from non-university persons or organisations (for example, cooperation partners, grant providers) or participates in projects funded and controlled by non-university persons, the university will forward the student’s data to such persons. In such cases, the basis for processing personal data is the student’s consent given by submitting the application.
3.5. After the student has graduated from degree study, the university publishes the student’s name in the alumni list. In the case of legitimate interest, the university may use the university graduates’ contact details to introduce opportunities of further study and alumni activities to them.