PRIVACY STATEMENT
PURPOSE OF PROCESSING
KiVa Antibullying Program® is a whole school intervention program developed at the University of Turku. In the countries where KiVa Program is currently available, schools offering compulsory education may register for the program. User data gathered from the participant schools and their users form a user register at the University of Turku, Finland.
GROUNDS FOR PROCESSING
The processing of personal data is based on the data controller’s legitimate interest.
DATA CONTROLLER AND CONTACT DETAILS
This privacy statement includes the register maintained by the University of Turku.
KiVa Antibullying Program, INVEST Research Flagship Centre, 20014 University of Turku, Finland. Email address: kiva@kivaprogram.net
The KiVa Program offers its users various online services. The use of these services may create a person register to another data controller (such as the education provider or school in question). The data protection of these services is explained in detail below.
CUSTOMER REGISTER
Users of the KiVa program form a customer register. The phone numbers and email addresses of the school principals and coordinators/contact persons are saved in the register and processed for communication purposes.
WEBSITE AND INTRANET
The website www.kivaprogram.net does not save personal data of its users and no cookies are applied. Different user groups of the KiVa Program are granted access to a restricted area called the KiVa intranet https://intra.kivaprogram.net/login/. The IP address and time of visit are saved of those users who sign in to the KiVa intranet.
COOKIES
The KiVa intranet only applies strictly necessary cookies. The log data of the KiVa intranet are stored for 24 months, after which they are removed automatically.
USER GROUPS OF THE KIVA INTRANET AND DATA PROCESSING
USER GROUPS IN REGISTERED KIVA SCHOOLS
Staff members in registered KiVa schools log in to the KiVa intranet with school-specific login credentials. The IP address and time of visit are saved from these users.
COORDINATOR LEVEL USERS
School principals and KiVa coordinators/contact persons access the KiVa intranet with a personal user ID. This user-specific coordinator ID enables principals and coordinators to view and update their school’s contact information and user accounts. The data saved from these users include: IP address, email address, school, time of visit, and log data regarding the changes they have made into the school information and/or user accounts. To remove a coordinator ID, please contact kiva@kivaprogram.net. Coordinator level IDs that have been detached from their school (and therefore are not linked to any school) are automatically removed from the database after 24 hours.
Coordinator level accounts that have been inactive for more than 18 months will be automatically removed from the system.
DELETION OF NON-ACTIVATED COORDINATOR ACCOUNTS
Coordinator level users receive an activation link after their email address has been added into the system for the first time. If the account has not been activated by the owner in 30 days, the account will be removed automatically from the user database.
School principals’ and/or coordinators’ contact details are also visible in the school profile to which schools’ coordinators have access and editing rights. To delete the contact details of former employees, schools may either update the information themselves, or contact kiva@kivaprogram.net
DELETION OF USER ACCOUNTS OF DEACTIVATED SCHOOLS
When schools no longer wish to use the program, their user accounts and contact information are erased from the system. The anonymous student and staff survey data, however, are stored in the system for future reference.
CERTIFIED KIVA TRAINERS & LICENSED PARTNERS
The data saved from certified KiVa trainer and licensed partner users includes IP address, time of visit, organization name and email address. Personal data is deleted when the grounds for stakeholder collaboration has ended or the person asks for the deletion of their personal data.
CONTACT FORM & PARTNER FORM
The information on the website’s contact form (name information and e-mail address of the sender) and partner form (name information of the sender, e-mail address, name information of the organization/company) are also stored in the system. The licensing partners of the KiVa Antibullying Program use the site to collect the contact details of those interested in the program (name and e-mail of the sender and name information of the school). The contact form data as well as personal contact details gathered through the partner form are stored for one (1) year.
KIVA TRAINING
When participants register for KiVa training, their name, contact and billing information are stored primarily using the contact and event management system of the University of Turku, Konsta. https://www.utu.fi/en/privacy/notice/konsta-contact-and-event-management-system
Using the service generates log entries with the purpose of ensuring the information security and technical development of the service, as well as detecting, preventing and investigating faults (Information Society Code (917/2014), Sections 138, 141 and 144). The logs are stored for the time needed for these purposes and will not be used for any other purpose.
KIVA GAMES
When students log in as users of KiVa Game 1, KiVa Game 2 or Pulmikas game, their personal data is not processed at the University of Turku. However, in KiVa game 2, the users’ name information, player progress and IP address are stored in the service. The KiVa Game 2 user management (only accessible by the school staff) includes a space for one or more email addresses of the school’s KiVa team or its members. This way students can report bullying and reach the school’s KiVa team directly from the games 1 and 2. The addresses can be added and removed by the school staff. The University of Turku is the data controller of this information. KiVa Game 2 also forms a register of players’ names and usernames, and the data controller of the aforementioned is the school. The University of Turku is, therefore, the data processor. In KiVa Game 1 and KiVa Game 2 the log data is stored for following the number of players.
School-specific data related to the games (list of users and log data) can be accessed by the staff of the school in question, the licensed partner organization in the country, the service provider (A1 Media Oy) and the selected members of the KiVa Antibullying Program at the University of Turku to resolve problem situations.
STUDENT AND STAFF SURVEYS
The students and staff members of schools that are registered in the KiVa Program are offered anonymous online surveys. Answering the annual KiVa surveys does not require any collection of personal data. The answers to the surveys are stored into the University of Turku server alongside with the respondents’ date and time of the completion of the survey, and language in which the survey was taken. Selected members of the survey service provider (Anders Innovation), IT services and the KiVa Program at the University of Turku have access to the survey data. The survey data will be stored for future research purposes. Schools are responsible for informing parents about the KiVa surveys in advance, and asking permission to conduct the surveys in class as required by local laws and regulations.
RECEIVER GROUPS OF PERSONAL DATA
The KiVa Antibullying Program collaborates with third parties which provide assistance and/or services. Anders Innovations Oy is the technical administrator of the server of the University of Turku, in which the KiVa student and staff survey answers are stored. The survey answer register can be accessed by selected staff members of the KiVa Program in Finland, the IT services of the University of Turku, and Anders Innovations Oy. These groups process the survey data to maintain and guarantee adequate service.
The KiVa Program customer register, which includes the data from school principals and coordinators/contact persons, their contact information as well as all user IDs in the intranet are situated in the server of the University of Turku. The data processor in the role of technical administration of these data is Sofokus Oy. The administration of data comprises the management, editing, usability, and removal of data upon request.
The log data of KiVa games (KiVa Game 1 and KiVa Game 2) will not be transferred or disclosed to parties outside the EU or European Economic region.
Registered data will not be used for automatic decision-making or profiling.
CATEGORIES OF PERSONAL DATA
Using the service generates log entries with the purpose of ensuring the information security and technical development of the service, as well as detecting, preventing and investigating faults (Information Society Code (917/2014), Sections 138, 141 and 144). The logs are stored for the time needed for these purposes and will not be used for any other purpose.
RIGHT OF ACCESS, RIGHT OF RECTIFICATION, RIGHT OF ERASURE, RIGHT OF RESTRICTION, RIGHT TO OBJECT
Registered users have the right to request from the controller access to and rectification or erasure of their personal data or restriction of processing the data and to object to processing. To delete any user accounts or contact details, please contact kiva@kivaprogram.net.
RIGHT OF APPEAL TO A SUPERVISORY AUTHORITY
A registered user has the right to lodge a complaint with a supervisory authority.
DATA PROTECTION OFFICER
Contact details of the data protection officer of the University of Turku via e-mail: dpo@utu.fi
The Data Security description of the University of Turku is available in the following address: https://www.utu.fi/en/privacy/data-security-description