NB: This document is a translation from the original document. This translation is not binding; its purpose is only to explain the contents of the original document in English. In case there are any obscurities in the translation, please check the original document for correct and binding expressions. The original document can be found on the Finnish website of SYKETTÄ.
EU’s General Data Protection Regulation, Articles 12, 13 and 14
Updated: 26.3.2026
1. Controller of the register
The Student Union of the University of Eastern Finland (Itä-Suomen yliopiston ylioppilaskunta, [ISYY])
2. Representative of the controller
Head of Sports Heli Aalto, tel. +358 44 576 8445,
email: heli.aalto@isyy.fi
3. Contact persons of the controller
Service Planner Niklas Leinonen, tel. +358 44 576 8418,
email: niklas.leinonen@isyy.fi
4. Contact information of the Data Protection Officer
Data Protection Officer Helena Eronen, tel. +358 50 576 0282,
email: tietosuojavastaava@isyy.fi
5. Purpose of processing personal data
Personal data are processed in SYKETTÄ physical activity test for the following purposes:
- Evaluation of applicability to physical activity test
- Tracking performance at the physical activity test
- Keeping statistics and possible use of data in research without personal data
6. Legal basis of processing personal data
Processing of personal data is based on Article 6 or 9 of the General Data Protection Regulation:
☒ consent of the data subject
These can be found from EU’s General Data Protection Regulation, Article 6, paragraph 1, points a-f.
7. Categories of personal data and the data retention period
Personal data on the SYKETTÄ physical activity test
When registering to SYKETTÄ physical activity test, the following personal data is asked from the user:
Name and contact information
During the physical activity test at “active exerciser tests”, the following personal data is asked from the user:
- Name and contact information
- Age
- Sex
- Test results
During the physical activity test at “low intensity tests”, the following personal data is asked from the user:
- Name
- Age
- Sex
- Height
In addition body composition, condition and hand compression force are measured. From these measures the app compiles body condition grading.
Personal data shall be deleted after two (2) years. Test statistics are used afterwards in anonymous form.
8. Information systems that are used in processing
Personal data, that is collected in the SYKETTÄ system, are used in the following information systems:
- Webropol or Google Forms
- Kehonkuntoindeksi-app
- InBody-device
9. Where is the personal data required in processing received from?
Personal data is acquired from the data subject themselves or from the measurements during tests.
10. Use of cookies
Cookies are used in the browser-based information systems of data processing. A cookie is a small text file, which is stored on the user’s device by the browser. Cookies are used for carrying out services, making it easier to log into services and making it possible to compile statistics of the service usage. A user may restrain the use of cookies in the browser system, but this may prevent the system from operating properly.
Cookies are used in the following browser-based data processing systems: Webropol, Google Forms
11. Regular transfers and disclosures
Personal data are disclosed regularly for the following parties:
Student Union of the Karelia University of Applied Sciences, POKA
Student Union of the Karelia University of Applied Sciences, POKA, operates as a processor of the SYKETTÄ user register’s personal data. One SYKETTÄ staff member is on the payroll of POKA.
Karelia-ammattikorkeakoulun opiskelijakunta POKA
Tikkarinne 9
80200 Joensuu
https://www.pokapoka.fi/english/become-a-member/privacy-statement.php
Itä-Suomen liikuntaopisto (ISLO) and Pohjois-Karjalan Liikunta ry (POKALI) are processors of personal data during the physical activity tests. Itä-Suomen liikuntaopisto and Pohjois-Karjalan Liikunta ry has signed Data Processing Agreement with the controller.
12. Data transfer or disclosure to outside EU or EEA and the legitimate grounds for such actions
Personal data on the SYKETTÄ website and mobile app shall not be transferred to outside EU or EEA. Personal data located in Google Drive are transferred to outside EU. Google obeys the standard contractual clauses of the European Commission in guaranteeing the required level of data protection, when personal data are transferred to outside EU. ISYY has agreed to EU’s standard contractual clause in the legal clauses of its contract’s data protection with Google.
13. Principles of protecting personal data
Protecting personal data on Physical Activity Tests
Access to personal data has been restricted to only selected staff members of the controller and processors. Personal data is deleted within 2 years after the physical activity test. During the personal data processing, ISYY data protection records and regulations are followed. Technical databases and their user interfaces are defended for example by firewalls. System data is backupped regularly.
Access to personal data has been given for the staff members in accordance with their tasks and responsibilities.
14. Automated decision-making
Automated decisions shall not be made.
15. Rights of a data subject
As a data subject you have the right to:
- Inspect your data
- Claim for rectification of your data
- Claim for erasure of your data
- Claim for restriction of processing
- Object processing
- Request for transferring your personal data from the controller to another controller
- Withdraw your consent, if the processing of the personal data is based on the consent given by you
As a data subject you may use the above-mentioned rights by contacting the Data Protection Officer of the Student Union.
A data subject has the right to make a complaint to the Office of the Data Protection Ombudsman, in case the data subject deems that the valid data protection legislation has been violated in processing the personal data concerning the data subject.
Advice and instructions in matters related to the rights of data subject are given by the Data Protection Officer, contact information in section 4.