The processing of personal data, GDPR
As a student at Luleå University of Technology, here you will find information about how we handle your personal data and what it is used for. We follow the General Data Protection Regulation (GDPR).
Personal data controller
Luleå University of Technology is the data controller for the processing of your personal data. You can reach our Data Protection Officer at dataskydd@ltu.se or 0920-49 10 00.
Purpose of processing
We process your personal data in order to
- ensure that information about applicants for education, completed studies, grades on courses and degrees is preserved
- carry out examination and plagiarism control
- record grades, attendance and other information on completed studies.
- you should be able to work with teachers and other students within a course or program
- display correct course information on the student website
- allocate relevant resources, facilities and materials to you as a student
- provide study and career guidance
- create a basis for follow-up and evaluation of our education
- decide on the admission of students
- be able to communicate with you as a student
- decide on registration fees and tuition fees
- create and report official statistics
- manage the suspension of students liable for tuition fees
- investigate and manage disciplinary cases
- allocate relevant support measures
- managing exchanges with foreign institutions and travel grants
- managing requests for examinations elsewhere; and
- enabling research.
We will also process your personal data in the ways necessary to comply with the rules on public documents and government archives.
Categories of personal data and their source
We primarily receive personal data about you from antagning.se, which is managed by the Swedish Council for Higher Education. In some cases, we receive personal data from other higher education institutions if you have studied there previously.
In addition, we have the personal data that we receive from you or that is created about you because of your education with us. The fact that you as a student must provide certain information in order to study is regulated, among other things, in the Ordinance (1993:1153) on the reporting of studies etc. at universities and colleges. We update your information against the population register to ensure that your information is current and relevant.
Legal basis
When we process your personal data, we do so in order to fulfill our official duties or to comply with laws and regulations. We thus process your personal data to fulfill a task of public interest, as part of our exercise of public authority or due to a legal obligation. In some cases, we ask for your consent to do so, such as the transfer of your personal data to universities outside the EU for the purpose of exchange studies.
Disclosure
In many cases, your personal data is contained in what are known as public documents. The public is always entitled to request access to public documents, unless the document is covered by confidentiality and must be kept secret. If the document is not to be kept secret, we will disclose it to anyone who requests access to the document. This may mean that your personal data will be included in the disclosure.
Transfer of personal data
We transfer your personal data to other organizations in some cases, for example to
- other higher education institutions, in Sweden or within the EU, for example when you want to transfer credits or when we check your eligibility.
- CSN, when they need the data to grant or pay out student grants.
- The Swedish Council for Higher Education through antagning.se.
- SCB to create official statistics
- other authorities in Sweden or the EU, to handle matters concerning professional qualifications and licenses.
- partner universities
- the student unions at Luleå University of Technology
- The Swedish Research Council, the Swedish Agency for Innovation Systems
- Swedish Institute and
- University Chancellor's Office.
International transfer
If you apply for exchange studies, apply for an exam elsewhere or collaborate with an organization outside the EU/EEA, we transfer personal data to that organization. We also transfer your personal data to service providers such as Canvas. If their servers are located outside the EU/EEA, we make sure to take all relevant security measures to ensure that your data is handled correctly and securely.
Storage
In the vast majority of cases, there are rules regarding public documents that govern how long we process your personal data, known as thinning regulations. These rules may say that we should keep your personal data for two (2) years, (for example your answers to an exam), that the information should be kept forever (such as your diploma) or a period of time in between. It depends on the public document in question.
For the personal data we have that are not in public documents, we delete them when they are no longer needed for the purpose for which we collected them.
Your rights
You have the right, under certain circumstances, to have your data erased, rectified, restricted and to have access to the personal data being processed. You also have the right to object to the processing. To exercise your rights, please contact the Data Protection Officer using the contact details below.
Withdrawal of consent
If our processing of your personal data is based on consent, you have a right to withdraw your consent. If you wish to withdraw your consent, please contact your contact person at the university or email dataskydd@ltu.se.
Who is responsible for the students' processing of personal data?
Luleå University of Technology is the data controller for the processing of personal data that takes place within the university's activities. This applies not only to the processing carried out by teachers and administrative staff, but as a general rule the university is also responsible for the processing of personal data carried out by students within the framework of their education. If, for example, a student processes personal data in their thesis work, the processing is therefore covered by the rules of the Data Protection Regulation and it is Luleå University of Technology's responsibility to ensure compliance with the rules.
However, there are some exceptional situations. For example, if a student carries out an internship (VFU), as a general rule, it is instead the internship site that is responsible for personal data when the student performs various tasks in, for example, school or health care (in the same way as the internship site is responsible for personal data when its employees process personal data).
Contact and comments
If you want to contact the data controller or have comments on our processing of personal data, you can contact the data protection officer at dataskydd@ltu.se, 0920-49 10 00.
If you are not satisfied with our response, you can contact the Swedish Data Protection Authority with complaints about our processing of your personal data, imy@imy.se or 08-657 61 00.
Updated: