GraphoLearn – Privacy notice

GraphoLearn (Service) is an evidence-based learning game for supporting reading development. In other words, GraphoLearn is digital assessment and training environment for those who are learning to read. With our international partners, we develop and validate new GraphoLearn language versions in several countries.

Published

24.10.2023

What should you know about the processing of your personal data?

The University of Jyväskylä collects personal data about you to carry out its duties. You have rights to this data, such as the right to access the data and the right to be sure that it is stored securely and only for the necessary time. Above all, you have the right to know the following:

what information we collect about youand why,
for how long, and where we keep this information, and
to whom we share this information.

All of these points are explained in this privacy notice.

How to find the information you are looking for?

We have created this privacy notice to be as easy as possible to use and understand. That is why you will find the key points summarised under each section. If you are interested in knowing more, please follow the links in the sections or contact the data protection officer of the University of Jyväskylä.

Contact the data protection officer

Why we process your personal data?

Here we describe how we collect, use and handle your and children’s personal data when using our websites, software and services.

The game log information GraphoLearn collects is used for improving the service and for scientific research purposes. Typically, this means that we researchers look at the data to see for example how long it takes to learn specific reading skills, what things seem to be easy and more challenging,
and any other questions to help us understand better how to support reading skill development and improve GraphoLearn (Service).

By accepting this privacy policy

You as a legal guardian of a child give us a consent to process the child’s personal data for the purposes defined under this Privacy Policy.
You also give us an explicit consent to process the data at the United States or outside EU/EEA area when the Data Controller is from the United States/or outside the EU/EEA area. Such processing may have possible risks due to the absence of an adequate level of data
protection. The General Data Protection Regulation is a regulation in EU and it does not apply to data processing at the United States/outside the EU/EEA area.
If you are not the guardian of the child, you must have explicit permission from the legal guardians of any minors that use GraphoLearn under your supervision.

What data we process and how long?

The time we store your personal data is at most three years. To get more information about what personal data we collect and how long we keep certain information, check the sections below.

In order to use GraphoLearn, the user (an adult, usually a researcher, teacher or guardian) needs to register in the game and accept the user terms before starting to use the game. For registration, the user needs to provide his/her email address. This means that when an adult who wants to be a GraphoLearn user registers in the game by giving his/her email address, the server will send back to this email address an activation link which must be clicked in order to activate the user account.

After the activation is completed, the account can be used to log into the game. The email address is not used for anything else. GraphoLearn collects also game log data that do not include direct identifiers. For the person to be identified from the log data additional information is needed. However, these data are considered personal data as long as the data controller is able to identify the players

The user data (email address) can be removed from the GraphoLearn servers upon user’s written removal request. The way to contact us is either to send an email to the following address: grapholearn@nmi.fi or by using the feedback function in GraphoLearn. Also, once three years has passed since the last time the user has used the game and has not replied to an email request
whether s/he wants to continue to use the game, the user information (email address used for the
registration) will be removed.

The players log data are anonymized when the data controller stops processing direct identifiers.

What rights you have and how to exercise them?

You have the following rights:

Right to access your data.
Right to have any incorrect information corrected.
Right to have your data erased (right to be forgotten), in certain situations.
Right to restrict processing.
Right to have the responsible unit inform the party to which your data is disclosed of your data being corrected, erased, or the processing being restricted.
Right to object processing, e.g. direct marketing.
Right to have your data transferred from one system to another, when processing is based on an agreement or your consent.
Right to be notified of any information security breaches resulting in a high risk.
Right to file a complaint with the supervisory authority.
Right to withdraw consent

You can exercise your rights by sending a request to the university's Registry Office. You can use the form on the Registry Office's website or send your request informally. Keep in mind that withdrawing your consent doesn’t change the processing that happened before the withdrawal.

Get to know your rights

Use the form of the Registry Office

Send an informal request to the Registry Office

Who can access your personal data?

The data gathered by using GraphoLearn can be disclosed to researchers within a specified research team for purely scientific purposes. The team is specified in GraphoLearn Research or in GraphoLearn Research and Development Licenses. Typically, researchers are from established
universities and research institutes.

GraphoLearn uses GraphoLearn servers on Google Cloud Platform. These are located both within and outside the European Union or the European Economic Area. The servers are used for GraphoLearn registration (registration requires an email address from a user), for creating player
names, and for game log data which can be used by the GraphoLearn game and researchers. Google Cloud Platform terms of service (a copy of which is at https://cloud.google.com/terms/) and which the Controller has read and accepts with respect to the hosting of the personal data collected and processed by the Controller within the use of Service.

Learn more about data processors

To whom we transfer your data?

The University of Jyväskylä shall be entitled to transfer Personal Data freely within the European Union or the European Economic Area in order to provide the Service. The Processor is also entitled to transfer Personal Data outside the European Union or the European Economic Area in compliance with the Data Protection Laws.

On what basis we process your personal data?

We process your personal data based on legal grounds, agreements, or your consent. If you want to dive deeper into our legal bases, such as the relevant legal provisions, you can find more information through the menu below.

The EU General Data Protection Regulations (which is known as GDPR) apply to us when we process personal data. The regulations say that information should only be processed in one or morevspecified circumstances, which are known as ‘lawful bases’. The lawful bases on which we may process your personal information include:

The legal guardian has given consent to the processing of child’s personal data for one or more specific purposes (Article 6.1(a).

Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (Article6.1(b).(E.g., where an order has been placed for our services).
Processing is necessary for scientific or historical research purposes or statistical purposes (section 4.1(3) of the Finnish data protection act).
Fulfilment of the legitimate interests of the controller or a third party (Article 6.1(f), GDPR) [E.g. improving the GraphoLearn service, to communicate with you, and to investigate and respond to your queries].
Processing that is necessary for compliance with a legal obligation to which the controller is
subject (Article 6.1(c), GDPR).

How to contact us?

If you want more information about the processing of your personal data, do not hesitate to contact our data protection officer via email or phone (+358 40 805 3297).

Contact our data protection officer

Contact information of units

Below you find the contact information of the responsible unit. If you wish, you can directly contact the unit instead of the data protection officer.

If you want to exercise your rights (withdraw your consent for example) you can contact the Registry Office by email:

Send a request to the Registry Office

GraphoLearn-Privacy-Policy_2020-1.pdf