Privacy notice for users of the EXAM electronic examination service
Effective as of 13 May 2026
Updated 28 May 2026
This privacy notice explains how your personal data is processed when you use the electronic examination service EXAM.
1. Why and on what basis does Aalto University process your personal data?
The purpose of processing your personal data is to enable the electronic examination and assessment of students using the electronic examination service EXAM (hereafter referred to as EXAM or EXAM service). EXAM is used for creating examinations and other assessments of students, as well as for exam time bookings, exam sittings and exam result assessments. The EXAM examination room is monitored with video surveillance and audio recording.
The legal grounds for the processing of the personal data are compliance with a legal obligation and the performance of a task conducted in the public interest or the exercise of official authority vested in the controller. It is based on Aalto University’s statutory obligation under the Universities Act (558/2009) to provide education and assess learning, which includes the following: creating exams in the EXAM service for students; the booking of exam times by students; the monitoring of exam sittings; the exam responses entered by students; and the teachers’ assessments of the completed exams.
More information on the grounds for processing the personal data of examiners or other staff members is given on the Data Protection, personal data page: /en/services/data-protection-personal-data-eu-general-data-protection-regulation#7-personnel
2. What personal data does Aalto University collect and process?
The groups of data subjects and the data stored in the student information system
- Given name and family name
- Student number
- Employee ID
- User roles
- User permissions
- Email address
- Exam booking details, date of exam sitting, information on whether student attendance
- Exam performance, feedback, grade
- Visual and audio recording taken of the student during the exam
- Last login information
- Information on acceptance of the system’s terms of use
- Information on consent for processing the audiovisual data from the video surveillance and audio recording
The data subject enters their Aalto user ID and password when logging into the EXAM system. The given and family name, student number, and email address are retrieved from the student information system (Sisu).
- Given name and family name
- Employee ID
- Student number
- User roles
- User permissions
- Email address
- Name of exam author
- Name of person performing the assessment
- Assessment date
- Grade given
- Last login information
- User rights relating to the maturity essay
The data subject enters their Aalto user ID and password when logging into the EXAM system. The given and family names, employee ID, email address, exam author’s name and exam marker’s (i.e. grader’s) name come from the HR system. The student number comes from the student information system Sisu.
- Given name and family name
- Employee ID
- Student number
- User role
- Email address
- Last login information
- User rights relating to the maturity essay
The data subject enters their Aalto user ID and password when logging into the EXAM system. The given and family names, employee ID, email address, exam author’s name and exam marker’s (grader’s) name come from the HR system. The student number comes from the student information system (Sisu).
The EXAM examination rooms are monitored with recording audiovisual equipment. Outside the examination rooms, the data subjects are informed of this surveillance. Information from the audiovisual recording and from the EXAM system may be combined to verify the identity of the person sitting the exam as well as to investigate any disturbances, harassment or suspicions of misconduct in studying. The recording audiovisual surveillance ensures that students follow the rules of electronic examinations, such as not bringing prohibited items, e.g. mobile phones, into the examination site. Access to the audiovisual recordings is restricted to specifically designated members of the Aalto University staff.
3. To whom Aalto University may disclose your personal data
Recipients who process your personal data: System administrators and examiners process the personal data related to the examination. The service provider (CSC – IT Center for Science) has access to personal data when necessary in order to fix technical issues, for example. A subcontractor of the service provider performs development and maintenance work for the shared service. The subcontractor processes personal data to support universities in use of the service and to investigate malfunctions.
4. Transfer of personal data to third countries
The data protection policy of the university specifies that particular care is to be exercised if personal data is transferred outside the EU or EEA to countries that lack the same level of data protection as is required by the European General Data Protection Regulation (GDPR). Transfers of personal data outside the EU and EEA are performed in accordance with GDPR requirements using standard agreement clauses and other GDPR-compliant protective measures.
5. Personal data and principles of privacy protection
Protecting personal data is important É«É«À² University. Aalto University has implemented the appropriate technical, organisational and administrative security measures to protect all personal data against loss, misuse, unauthorised use, disclosure, alteration or destruction. Access to personal data is restricted to specific members of the Aalto University staff (system administrators and examiners).
6. Period for which personal data is retained
Students’ exam responses and the exam assessments are retained in the examination system for six (6) months after the results have been published.
The audiovisual surveillance recordings are retained for 45 days. Recordings related to suspected misconduct in studying or other exceptional incidents are retained for the duration of the investigation.
Determination of the length of the retention period takes into account the following regulations:
- Aalto University Records Management Plan (TOS)
- Aalto University General Regulations on Teaching and Studying
- Aalto University Examination Guidelines
- General Privacy notice, digital camera surveillance
7. Rights of the data subject concerning personal data
You have rights relating to the processing of personal data at Aalto. The extent of the rights depends on the legal grounds for the processing and the current data protection legislation.
A) Right of access by the data subject
You have the right to review the personal data on yourself that is in the possession of Aalto University.
B) Right to rectification
You have the right to rectify inaccurate or incomplete data.
C) Right to erasure
You have the right to request the erasure of your data (‘the right to be forgotten’), for example, in the following cases:
- You withdraw your consent to the processing of your data and there is no other legitimate ground for the processing.
- You object to the processing of your data for direct marketing purposes. This right does not apply to the processing of personal data described in this privacy notice, as personal data is not processed for direct marketing purposes.
In many cases, Aalto University has a responsibility to retain personal data, for example, due to obligations based on law
D) Right to restrict the processing
If you contest the accuracy of the personal data we have recorded concerning you or the lawfulness of the processing, or if you have exercised your right to object to the processing, you may request that we restrict the processing of your personal data to storage only. The processing of the data is then restricted to storage only until the accuracy of the data has been verified or it has been ascertained whether our legitimate interests override your interests. If you do not have the right to request the erasure of data from our records, you may instead request that we restrict the processing of such data to storage only.
E) Right to object to the data processing when the processing is based on legitimate interest
You are always entitled to refuse any processing of your personal data that is done for direct marketing purposes.
F) Right to data portability
You have the right to receive in machine-readable form any personal data that you give to us. This applies to personal data processed only by automated means when the processing is based on consent or necessary for the performance of a contract.
The requests of data subjects who wish to exercise their abovementioned rights shall be assessed situationally and on a case-by-case basis. Please be aware that we may also retain and use your personal data when necessary for compliance with legislative obligations, the resolution of disputes or the performance of contracts.
8. How to use your rights
Aalto University is the controller. With the above description of our data protection procedures, our aim has been to provide a clear account of our personal data processing. We have not succeeded in that endeavour if any part of the document remains unclear about how we conduct the processing. In that case, you may send us a request concerning the processing or ask for further details about it, as described below.
You may exercise your rights, as described in section 7, by submitting a GDPR-compliant request via the university’s personal data portal:
If you have questions about the service or would request routine changes, such as to your contact details, you may contact the system administrator:
Specialist Katriina Korhonen
Tel. (exchange): +358 9 47001
Email: exam@aalto.fi
You may also contact Aalto University’s data protection officer if you have questions about requirements or other matters involving the processing of personal data.
Data protection officer: Sirpa Syrjälä
Tel. (exchange): +358 9 47001
Email: dpo@aalto.fi
9. Updates to the privacy notice
As Aalto University’s operations evolve, updates may be made to the privacy notice. The latest version of the privacy notice can be found on this page.
Right to complain
If you regard the processing of your personal data as an infringement of privacy protection laws, you have the right to lodge a complaint with the supervisory authority, the Office of the Data Protection Ombudsman (See ).