Privacy Notice for BeLLE Research

This privacy notice explains how research participants’ personal data will be processed.

BeLLE Consortium consists of organisers of the Bebras Challenge from many countries in and outside of Europe. The consortium starts in 2021 and will go on as long as the members want to work together. The consortium is coordinated and data collected from the ViLLE learning environment is owned by the Turku Research Institute for Learning Analytics (TRILA) at the University of Turku, Finland.

Bebras Challenge is an annual challenge for primary and secondary education students on informatics and computational thinking.

Note that in this privacy notice you are informed about how personal data will be processed. Pseudonymised research data can be shared with TRILA Consortium researchers.

Pseudonymisation means that personal data, for example the name and school of the participant, in the research data are changed into a form from which they are not recognisable anymore. However, the personal data is stored in another file, and with the key stored by the person responsible of information, the research data is possible to combine with the personal data.

1. Data Controller

University of Turku

Contact person for research-related matters:
Name: Heidi Kaarto
Email: heidi.kaarto@utu.fi

Responsible researcher:
Name: Mikko-Jussi Laakso
Phone: +358 29 450 2407
Email: milaak@utu.fi

2. Data Protection Officer’s Contact Information

The data protection officer of the University of Turku can be reached by email at dpo@utu.fi and by phone +358294503009.

3. Description of Research and Personal Data Processing

The goal of BeLLE research is to investigate informatics and computational thinking skills and skill development of primary and secondary education and similarities and differences of different subgroups (for example, students from different countries or different genders). Research results are used in the development of the Bebras Challenge so that it would suit better for assessing students’ informatics and computational thinking skills without losing the promotive effect for informatics and computational thinking.

Research data is collected as part of the Bebras Challenge from 2021. Data is collected annually from the countries that are participating in the BeLLE Consortium that year and using the ViLLE learning environment. Research data includes background information, such as the country and language of the challenge, information about the participants, such as school, age, and gender, and answer data (answer, date and time of the answer, and time on task). Personal data is processed by the people responsible for information processing at TRILA and the organiser in the country where the research data is collected. Research results based on statistical methods are published in peer-reviewed scientific publications as group phenomena.

4. Persons involved in Personal Data Processing

Personal data is processed by the people responsible for information processing at TRILA and the organiser in the country where the Bebras Challenge is organised. The organisers of the Bebras Challenges are listed in bebras.org/structure-of-the-bebras-community.

5. Duration of Personal Data Processing

Research is active for the time being. Bebras Challenge is organised annually and so research data is collected annually. Research data is stored in the information system of the University of Turku, Finland. Pseudonymised research data may be used in research years after it has been collected.

6. Lawful Basis for Personal Data Processing

The processing of personal data is based on Article 6(1) of the GDPR:

  • task carried out in the public interest:
    • scientific or historical research or statistical purposes

7. Personal Data Included in the Research

Personal data is collected from what partcipants and their teachers report. These include ViLLE username (which may be email address), name, country, language of the challenge, city, school, age, and gender. Additionally the data includes answer data (including answer, date and time of the answer, and time on task).

8. Special Categories of Personal Data (Sensitive Personal Data)

No personal data of special categories is processed in the research.

9. Sources of Personal Data

Personal data is collected in the ViLLE learning environment from surveys and answer data reported by participants and their teachers.

10. Personal Data Protection Measures

To organise the Bebras Challenge, personal data is stored in ViLLE. The general privacy notice of ViLLE can be found in trila.fi/en/statements/villes-privacy-policy-statement/.

For research purposes the research data is processed as is (including personal data) or pseudonymised. Personal data is processed only by the people responsible for information processing at TRILA and the organiser of the Bebras Challenge in the country where the research data is collected. For other researchers the data is shared pseudonymised: only people responsible for information processing at TRILA have access to the key to undo the pseudonymisation, so only they can identify individuals from the research data.

Research data is stored in the information system of the University of Turku, Finland. Personal data processed in information systems is protected in the following ways:

  • user ID and password
  • encryption

11. Transferring and Sharing of Personal Data with Third Parties.

Personal data will be transferred to the following recipients outside the data controller: the organiser of the Bebras Challenge in the country where the research data is collected. The organisers of the Bebras Challenges are listed in bebras.org/structure-of-the-bebras-community.

12. Transfer of Personal Data Outside of the EU or EEA

Personal data will be transferred outside of the European Union or the European Economic Area if the data is collected from a country outside the European Union or the European Economic Area, but only to the country where the data is collected.

Pseudonymised research data may be transferred to other countries than where it was collected including countries in and outside of the European Union and the European Economic Area.

13. Processing of Personal Data After the Study Ends

The research data will be retained for compatible scientific research in the future in accordance with the requirements of the GDPR without direct identifiers.

Research data is stored in the information system of the University of Turku, Finland, for ten (10) years after the BeLLE Consortium has ended.

The retention of the research data is based on Article 5(1)(b) and (e) of the GDPR. A new privacy notice will be sent to participants for the new use of the research data, unless the data controller can no longer identify the participants from the research data.

14. Rights of the Data Subject and Exceptions to These Rights

For more information about your rights under the GDPR, contact the person mentioned in section 1.

Rights of the Data Subject

According to the Data Protection Regulation, the data subject has the right to:

  • Access their data (Article 15)
  • Rectify their data (Article 16)
  • Erase their data and be forgotten (Article 17)
  • Restrict the processing of their data (Article 18)
  • Transfer their data from one controller to another (Article 20)
  • Object to the processing of their data (Article 21)
  • Not be subject to automated decision-making (Article 22)

However, the data subject cannot exercise all rights in all situations, depending on the legal basis for the processing of personal data.

Exceptions to Data Subject Rights

Data protection legislation allows for exceptions to data subject rights when personal data is pro-cessed for scientific research and exercising the rights would prevent or significantly hinder the achievement of the research purposes. The need to make exceptions to data subject rights is al-ways assessed on a case-by-case basis.

If the processing of personal data in research does not require the identification of the data subject and the controller cannot identify the data subject, the rights to access, rectify, erase, restrict pro-cessing, notify, and transfer data do not apply unless the data subject provides additional infor-mation enabling reliable identification (Article 11).

Right to Complain 

You have the right to lodge a complaint with the Data Protection Ombudsman if you believe that your personal data has been processed in breach of applicable data protection legislation.

Contact Information for the Data Protection Ombudsman:

Data Protection Ombudsman’s Office
Visiting address: Lintulahdenkuja 4, 00530 Helsinki
Postal address: PO Box 800, 00531 Helsinki
Switchboard: +358 29 566 6700
Email: tietosuoja(at)om.fi