Safe and Secure Handling of Personal Data for Students at Luleå University of Technology

Data Controller

Luleå University of Technology is the data controller for the processing of your personal data. O data protection officer at Luleå University of Technology can be reached at dataskydd@ltu.se or by phone at 0920-49 10 00.

Purpose

We process your personal data in order to:

• ensure that data about applicants, completed studies, grades and qualifications are preserved;
• carry out examinations and plagiarism checks;
• register grades, presence and other data on completed studies;
• enable you to work with teachers and other students on a course or programme;
• display correct course information on the student web;
• assign relevant resources, premises and material to students;
• provide study and career guidance;
• create material for follow-ups and evaluations of our courses and programmes;
• make decisions on admission of students;
• enable communication with students;
• make decisions on application fees and tuition fees;
• compile official statistics and report them;
• manage suspension of students required to pay tuition fees;
• investigate and manage disciplinary cases;
• provide relevant support measures;
• manage travel grants and exchanges with foreign universities;
• manage applications regarding examinations in other locations;
• enable research.

Luleå University of Technology will also process your personal data as required for Luleå University of Technology to comply with regulations on public documents and the archives of public authorities.

Categories of Personal Data and Sources

Our primary source of personal data is antagning.se/universityadmissions.se, which is managed by the Swedish Council for Higher Education. In some cases, we collect personal data from other higher education institutions where you have studied earlier.

In addition to this, we collect personal data either received from you, or created about you, as part of your studies at Luleå University of Technology. We check your data against the population register and update them if necessary.

Legal Basis

When we process your personal data, we do it in order to fulfil our obligations as a public authority, or to comply with laws and regulations. This means that we process your personal data in order to carry out a task in the public interest, as part of exercising public authority or due to a legal obligation. In some cases we will ask for your consent, for example when we need to transfer your personal data outside the EU when you go on exchange.

Disclosure

In many cases, your personal data will be recorded in public documents. Anyone has the right to request to see a public document, and it must then be verified that the document does not contain any data that is not to be disclosed. If the document does not contain any data covered by non-disclosure rules, the document must be disclosed. This may mean that your personal data is also disclosed.

Transfer of Personal Data

In some cases, Luleå University of Technology will transfer your personal data to other organisations such as:

• other higher education institutions, in Sweden or the EU, for example when you want to transfer credits from courses, or when Luleå University of Technology needs to verify that you fulfil the entry requirements.
• the Swedish Board of Student Finance, when they need the data to grant or pay student finance;
• the Swedish Council for Higher Education through antagning.se/universityadmissions.se;
• Statistics Sweden, to supply data for official statistics;
• other authorities in Sweden or the EU, to process cases concerning professional recognition and professional status qualifications;
• partner universities;
• the Luleå University of Technology students' unions;
• the Swedish Research Council, the Swedish Governmental Agency for Innovation Systems;
• the Swedish Institute;
• the Swedish Higher Education Authority.

International Transfer of Personal Data

If you apply for exchange studies, apply for examination in other locations or cooperate with an organisation outside the EU/EEA, we will transfer your personal data to that organisation. We will also transfer some of your data to suppliers of services for e.g. Canvas. If their servers are located outside the EU/EEA, we will take all relevant precautions to ensure that your data is handled correctly and safely.

Storing Data

In most cases, there are rules on the appraisal and disposal of public documents and how long we will store your data. Such rules may state that personal data should be stored for two (2) years, e.g. in the case of examination answers, indefinitely, e.g. in the case of degree certificates, or any period of time in-between. How long data is stored depends on what kind of public document it is.

For personal data not stored in public documents, we will erase it as soon as it is no longer needed for the purpose for which it was collected. The files in the file area linked to your student account will for example be erased one year after your graduation.

Your Rights

You have the right, under certain circumstances, to have your personal data erased, corrected or limited. You also have the right of access to the personal data being processed. You also have the right to object to the processing. To exert your rights, contact the data protection officer (contact details below).

Withdrawing Consent

If Luleå University of Technology’s processing of your personal data is based on consent, you have the right to withdraw this consent. You will always be given more information on how to do this in each case where you have consented to your data being processed. If you have not received that information, contact Luleå University of Technology’s data protection officer - you will find contact details below.

Obligation to Provide Personal Data

In order to study at Luleå University of Technology, you must provide us with certain personal data. This is regulated in the Swedish ordinance regarding reporting of studies, etc., at higher education institutions.

Who is responsible for students’ personal data processing?

Luleå University of Technology is the data controller for the processing of personal data as part of university activities. This does not only include the data processing done by teachers and administrative staff, but, as a rule, the university is also responsible for personal data processed by students as part of their courses and programmes. If students for example process personal data as part of their independent projects, this is regulated by the GDPR and Luleå University of Technology is responsible for ensuring that the regulations are followed.

There are some exceptions, however. If students are on practical placements (VFU), the organisation where students are placed is the data controller when students complete different duties in for example healthcare or schools (in the same way that the organisation is the personal data controller when its employees process personal data).

Contact and Comments

If you would like to contact our data controller or have any comments on the processing of personal data at Luleå University of Technology, contact the data protection officer at dataskydd@ltu.se, 0920-49 10 00.

If you are not happy with the answer provided by us, you can take your complaint to the Swedish Data Protection Authority, datainspektionen@datainspektionen.se or 08-657 61 00.