Effective as of December 8 2023
Last modified: 2023 - 12 - 22
CSC - IT Center for Science Ltd
P.O. Box 405 (Keilaranta 14)
02101 Espoo
+358 9 457 2821 (operator)
www.csc.fi
servicedesk@csc.fi (later "we" or "CSC")
CSC Service Desk
tel. 09 457 2821 (operator)
servicedesk@csc.fi
Data protection officer, privacy@csc.fi
Data asset owner: noppe@csc.fi
Noppe service users
We process your personal data in order to:
Provide and improve our service https://noppe.csc.fi,
For the purposes of ensuring network and information security
For statistics given to Ministry of Education and Culture. Statistics are aggregated so that individual user can not be recognized.
The lawful basis for processing your data is the contract between CSC and Ministry of Education and Culture
We process the following information:
Data subject's basic data such as email, user ID and university affiliation
Technical verification data: IP address
Personal data is provided by the data subject. User email is provided by oauth API. User affiliation is recognized based on email.
We do not transfer data to third parties. We do not transfer personal data outside the EU/EEA.
The only persons authorised to use the systems containing personal data are those CSC employees who have the right to process customer data on the basis of the work they carry out. Each admin has their own user ID and password for the systems.
The data is collected into databases that are protected by firewalls, passwords and other technical measures. The databases and backups of these databases are located in locked facilities and only designated individuals have access to this data.
Email and sso identity is collected to services' internal database. We currently do not have a process for deleting or anonymising users. Aim is to anonymise this data in the active database after 1 year.
Reason to keep user information: statistics to be produced for Ministry of Education and Culture.
User ID is collected to service backend logs when user logs in. User's IP addresses are collected in logs in K8s clusters, and in service backend logs.
We currently do not have a process for deleting old backend logs. In cluster logs data is kept for 2-3 years, depending on K8s cluster lifetime.
Reason to keep information in logs: possible security violations. User's course data which can contain, for example, a cloned git repo with users own ID.
This is archived when the K8s cluster is removed. In this case, the user's data is stored with us for at least 1 year after the last use,
but it may take 2-3 years before deletion, depending on the service life of the cluster.
Course request form: username and email are stored in course request form. Reason for this is capacity planning and reporting to OKM.
As a data subject, you have the right to inspect the data about yourself, object the processing of your data, to review your data, and to demand rectification or erasure of inaccurate or false information, provided that there is a legal justification for its removal. As a data subject, you have the right under the General Data Protection Regulation to oppose the collection of your data or to request that it be restricted and to make a complaint about the processing of personal data to the supervisory authority:
Visiting address: Lintulahdenkuja 4, 00530 Helsinki
Postal address: P.O. Box 800, 00531 Helsinki, Finland
E-mail: tietosuoja(at)om.fi
Switchboard: +358 (0)29 566 6700
Registry: +358 (0)29 566 6768
You have the right to check which personal data concerning you CSC processes as a controller. To get access to your data, send us an email to servicedesk@csc.fi. In your request, please indicate:
Which data you wish to check
If you wish to check all of your data, or data concerning a certain period of time
The format in which you would like to have access to the data
Your name
Your contact details (for example, your email address or phone number)
All enquiries and requests regarding this privacy notices should be made in writing or in person to privacy@csc.fi
If we make changes to our privacy policy, we will make these accessible by updating this privacy notice document. If the changes are significant, we may inform people about these changes in some other way, such as by email or by publishing a notification on our webpage. We recommend that you visit our webpage regularly and pay attention to any changes to this privacy notice.