PRIVACY NOTICE – Viipuri Lab

The purpose of this section is to describe the processing of personal data in scientific research, in compliance with the regulations outlined in Articles 13 and 14 of the EU General Data Protection Regulation (2016/679).

1. Data controller:

Lappeenranta-Lahti University of Technology LUT (hereinafter “LUT University”)

Business ID: 0245904-2
Address: Yliopistonkatu 34, 53850 Lappeenranta, Finland
Phone: +358 294 462 111
E-mail: info(at)lut.fi

2. Data controller’s representative and contacts:

• Lab Manager, Mahinda Mailagaha Kumbure, mahinda.mailagaha.kumbure(at)lut.fi and lut.viipurilab(at)lut.fi. Address: LUT University, Business School, Yliopistonkatu 34, 53850 Lappeenranta, Finland.
• Head of the Lab, Päivi Maijanen-Kyläheiko, paivi.maijanen-kylaheiko(at)lut.fi and lut.viipurilab(at)lut.fi. Address: LUT University, Business School, Yliopistonkatu 34, 53850 Lappeenranta, Finland.

3. Data protection officer:

Anne Himanka, Legal Counsel
Address: LUT University, Yliopistonkatu 34, 53850 Lappeenranta, Finland
Phone: +358 50 564 4623
E-mail: dataprotection(at)lut.fi

4. Purpose of data processing:

Viipuri Lab (LUT) is a platform for experimental research on decision-making studies using human subjects. Research conducted at Viipuri Lab can be used for scientifical research projects.
At the Viipuri Lab, personal data are collected from participants who voluntary register to the platform to participate to behavioral and decision-making experiments organized by LUT University. Specifically, these data are used only for the following purposes:

• To inform and send invitations to potential participants about upcoming experiments (either in presence or online) when they are scheduled.
• To achieve a scientifically motivated selection of participants for certain participants’ requirements (e.g., for scientific purposes it might be needed to recruit only subjects with a given background).
• To observe and track the participants experiment session history within Viipuri Lab laboratory.
• To provide payments- a monetary reward for the experiment.

For the purpose of paying the monetary reward to the participants, the personal data is processed in accordance with LUT University’s Privacy Notice for Fee-paid Employees: https://www.lut.fi/sites/default/files/media/documents/LUT-privacy_notice_fee-paid-employees.pdf

5. Legal basis of data processing:

Personal data is collected so that the Viipuri Lab can get in touch with the signed-up volunteers regarding scientific research studies conducted by the lab. The legal basis for processing personal data on the research platform stands with EU General Data Protection Regulation (2016/679) article 6 1e, conducting scientific research in the public interest, in line with the Finnish Data Protection Act (Section 4.1 item 3).

6. Content of data filing system and storage period:

Viipuri Lab collects the following personal data about subjects who voluntary register to Viipuri Lab platform: first name, last name, gender (male female, non-binary), mother tongue, language skills (Finnish, English), email address and phone number. The database also contains background information on education and includes university, education level (bachelor, master, PhD), field of study and the specific LUT School where studies are carried out (Business School, School of Energy System, School of Engineering Science). Moreover, other data collected include registration, acceptance of Viipuri Lab’s rules and data protection policy, previous signups, participations to the experiments, no-shows, and a pseudonymized participant id. For the purpose of paying the monetary reward to the participants, also the categories of personal data mentioned in the LUT University’s Privacy Notice for Fee-paid Employees (https://www.lut.fi/sites/default/files/media/documents/LUT-privacy_notice_fee-paid-employees.pdf) will be processed. The administrator will delete subjects’ information from the register if they haven't taken part in an experiment within five years. Moreover, the administrator will delete the registration information after 5 years from the registration. Data collected in the research experimental studies (that is, decision and choices subjects make during the experiments) will not be combined with the individual personal data (see section 8).

7. Information systems employed:

The information system used for subjects’ recruitment is ORSEE.

8. Data sources:

All personal information is collected from the volunteers themselves.

The researchers of a particular project conducted using the Viipuri Lab platform have the rights to use Experimental Data collected in that project. The Experimental Dataset is generated by the choices and decisions that the participants make at any given experimental session.

• At the end of the experiment, subjects are typically asked to fill out a brief demographic questionnaire (e.g., age, gender, field of study, etc.). The data set might also include such demographic information.
• These data are evaluated scientifically. At no time will the researcher link the decisions made in an experiment to a specific person. The data will be used in such a way that it is NOT possible to attribute any data to any specific participant. That is, the choices a participant makes in the experiment cannot be combined with his/her name. Therefore, the information generated and archived from the experiment is anonymous.
• The anonymous data is used for scientific research (publications) and lectures.

9. Use of cookies:

No cookies are used in the processing of personal data.

10. Data transfer and disclosure:

Viipuri Lab's research-ethics responsibilities include the proper safeguarding of personal data. In the Recruitment System of the Viipuri Lab, information about registered persons will not be passed on to a third party.

11. Data transfer and disclosure beyond the EU or EEA:

Personal data will not be transferred outside the EU/EEA.

12. Safeguards for data processing:

All subjects’ forms containing personally-identifying information (e.g., informed consent) are stored in secure locations. All personal data collected during the research studies is confidential. The databases and the information they contain are kept protected with passwords and firewalls and by storing them on a separate server with restricted access.

13. Automated decision-making:

Personal data will not be utilized for profiling or automated decision-making.

14. Rights of the data subject:

• Data subjects have the right to withdraw their consent if the data processing is based on consent.

• Data subjects have the right to lodge a complaint with the Data Protection Ombudsman if the subjects consider that the data processing regarding them is in breach of data processing legislation in force.

• Data subjects have the following rights under the EU’s General Data Protection Regulation:
  • Right of access to data concerning the data subject (article 15)
  • Right to rectification of data (article 16)
  • Right to erasure of data (article 17). The right to erasure shall not apply if the processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes if the right to erasure prevents or significantly hinders the data processing
  • Right to restriction of processing (article 18)
  • Right to data portability to another data controller (article 20).
  • Right to object (article 21).
• Data subject’s rights under the EU’s General Data Protection Regulation do not automatically apply to all data processing.

The liaison in matters related to the data subject's rights is the data protection officer; contact details in section 3.