Privacy and data protection

hands on laptop
Here you can find information about how Hanken School of Economics processes personal data.

You can find information about Hanken's Steering Group for Data Protection here and Data Protection Officer here

Processing of personal data at Hanken School of Economics

At Hanken, the protection of your personal data and privacy, as well as the responsible handling of your data, is of utmost priority. 

This page describes Hanken’s general data protection practices regarding the collection and processing of personal data. The processing of personal data is further clarified through separate privacy notices, which explain the purpose of data handling in specific areas where personal data is processed. 

Hanken processes your personal data in accordance with applicable legislation. The relevant legislation on data protection includes the Finnish Data Protection Act (1050/2018), which complements the EU General Data Protection Regulation (2016/679) (“GDPR”). 

Why does Hanken process your personal data? 

There are several reasons why Hanken processes your personal data. The primary reason is to carry out Hanken’s role as a public authority (university). Hanken provides high-quality education and research and works daily to promote the values of equity, openness, and integrity. 

The most common reason for processing your personal data is that you are a student, researcher, or employee at Hanken, an applicant for a job or study position at Hanken, or you are otherwise in contact or collaborating with the university. 

What personal data is collected and processed at Hanken? 

Hanken only processes personal data that is directly necessary for the specific purpose for which it is collected. The collected personal data includes, for example: 

  • Identifying information (e.g. name, date of birth, personal identity code, gender, nationality, mother tongue, username, student number) 

  • Contact information (e.g. address, phone number, email address) 

  • Employment-related data, employee number 

  • Admission-related data, national student number 

  • Study rights and academic records 

  • Banking and financial information for invoicing purposes 

  • Technical data related to website visits (e.g. IP address, session information, and cookies). 

Your personal data is only processed by individuals employed by Hanken or working on its behalf, who have the right to process the data. Only those for whom the processing is necessary for their work responsibilities will handle the data. 

What is the legal basis for Hanken's processing of your personal data? 

The processing of your personal data at Hanken is primarily based on Articles 6.1(c) (legal obligation) and 6.1(e) (public interest and exercise of official authority) of the GDPR. In some cases, processing may also be based on consent or contract. Hanken is also entitled to process special categories of personal data if the processing is necessary for reasons of substantial public interest (Article 9.2(g) GDPR). 

How does Hanken collect your personal data? 

Hanken primarily collects your personal data directly from you when you register or personally contact Hanken. In some cases, Hanken may also obtain your data from other authorities or universities. 

To whom may Hanken disclose your personal data? 

Hanken may disclose your personal data to relevant authorities and other parties when required by law or when necessary to fulfill contractual obligations. 

Transfer of your personal data to third countries 

In some cases, Hanken may need to transfer your personal data to third countries outside the EU/EEA, e.g. because of agreements or projects Hanken is involved in. In such cases, Hanken, as the data controller, exercises particular care and caution when transferring personal data. Transfers outside the EU/EEA are always carried out in accordance with the GDPR. 

How long is your personal data stored? 

The retention period for your personal data is determined according to applicable legislation and Hanken’s information management plan. Data is only retained as long as necessary for the purpose it was collected or as required by national laws concerning publicity, information management, access to information, and archiving. 

Your rights under the GDPR 

Right of access and right to rectification of personal data 

In accordance with the GDPR, you have the right to know what personal data Hanken processes about you. You also have the right to have inaccurate personal data rectified, without undue delay. If your personal data is incomplete, you have the right to have data completed, with regards to the purpose of the processing. 

Right to erasure and withdrawal of consent 

You have the right to request the erasure of your personal data if it is no longer needed for the purpose for which it was collected or processed. However, this right does not apply if the processing is necessary for: 

  • Compliance with a legal obligation, 

  • The performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, 

  • The establishment, exercise, or defence of legal claims, or 

  • Exercising the right of freedom of expression and information. 

If the processing of your personal data is based on consent, you have the right to withdraw your consent. If there is no longer a legal basis for processing after withdrawal, your personal data will be deleted. 

Right to restriction of processing 

You have the right to request the restriction of the processing of your personal data in certain situations. This applies if: 

  • You contest the accuracy of the personal data – during the period required to verify the data, 

  • The processing is unlawful, and you oppose the erasure of the personal data and instead request the restriction of its use, or 

  • Hanken no longer needs the personal data for the original purpose, but you need them to establish, exercise, or defend legal claims. 

Right to data portability 

You have the right to receive your personal data that you have provided to Hanken or to have your personal data transmitted to another controller in certain cases.  

Right to object to processing 

You have the right to object to the processing of your personal data if the processing is based on a public or legitimate interest. 

Right not to be subject to automated decision-making 

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.  

Exercising your rights 

To exercise your rights under the GDPR, you may contact Hanken’s Data Protection Officer by email at: dpo@hanken.fi Opens in new window . More information about Hanken's process for handling requests can be found here:


If you believe that the processing of your personal data violates the provisions of the GDPR, you have the right to file a complaint with the Office of the Data Protection Ombudsman Opens in new window

Right to be informed of a personal data breach 

If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, Hanken, as the data controller, is obliged to inform you of the incident without undue delay. 

Questions and contact information 

If you have questions regarding data protection, you can contact the Data Controller of Hanken or Hanken’s Data Protection Officer. 

Contact details for the Data Protection Officer: dpo@hanken.fi Opens in new window  
Contact details for the Data Controller: P.O. Box 479, 00101 Helsinki, +358 (0)29 431 331.


Privacy Notices


Privacy notices of studies and research at Hanken