Last modified: March 2026
In brief
The Aalto OpenCS online learning platform (the Platform) processes personal data to provide digital learning activities, support teaching, improve courses and digital tools, and, where applicable, support scientific research on learning and teaching.
This page is the platform-specific privacy notice for users of the Platform. For degree students, exchange students, non-degree students with a right to pursue single courses, and Open University students, it complements Aalto University’s general Privacy Notice for Students. Other learner groups, such as lifelong learners and other non-degree participants, may also be covered by other Aalto University privacy information applicable to the educational offering in question.
The Platform may include automatic assessment, learning analytics, recommendations, dashboards, and AI-assisted support features. These are intended to support teaching and learning. They do not by themselves make binding decisions on final grading or course completion.
Controller
The controller for the processing described in this notice is:
Aalto University Foundation sr Otakaari 24, 02150 Espoo, Finland
The Platform is developed and operated at Aalto University.
For questions about this notice or the Platform, please contact: arto.hellas@aalto.fi
For information about Aalto University’s Data Protection Officer and general privacy practices, please see Aalto University’s general Privacy Notice for Students.
Who this notice applies to
This notice applies to users of the Platform, including:
- degree students;
- lifelong learners and other non-degree course participants;
- teachers and course staff;
- teaching assistants and other authorised users.
This notice focuses especially on the processing of learner personal data in the Platform.
What the Platform is used for
The Platform is an online learning service used to create, provide, manage, and improve courses and digital learning activities.
Depending on the course and the features in use, the Platform may support:
- interactive course materials;
- exercises, assignments, quizzes, and assessments;
- automatic assessment of certain tasks according to rules defined by course staff;
- teacher and peer feedback;
- learning analytics and progress views;
- recommendations, hints, or tailored learning support;
- dashboards and other tools that help teachers understand how current courses are progressing;
- AI-assisted support features, such as formative feedback or other learning support tools.
What personal data we process
Depending on the course and the features in use, the Platform may process the following categories of personal data.
Basic account and participation data
- name;
- username or other identifier;
- email address;
- role in the Platform;
- course enrolment or participation information;
- identity-provider attributes received through institutional single sign-on (for example HAKA), such as institutional identifier, name, and email address, where applicable;
- consent choices where optional features are used.
Exercise, submission, and assessment data
- answers and submissions to exercises, assignments, quizzes, questionnaires, and similar tasks;
- timestamps relating to submissions and learning activities;
- process data relating to how a task, solution, or submission was created, such as intermediate versions, snapshots, or similar task-completion data where this is collected by the Platform;
- scores, grades, or other assessment outcomes where applicable;
- teacher comments, rubric information, and other feedback;
- peer-assessment information where peer review is part of the course;
- data needed for checking academic integrity, where applicable.
Learning activity and usage data
- information about how course materials and activities are used;
- browsing and navigation data within the Platform;
- information about interaction with the Platform, including limited activity, inactivity, and return-to-activity signals;
- progress data, such as completed tasks or viewed materials;
- logs of actions taken in the Platform.
Data used for support, recommendations, and feedback
- messages exchanged in learner support chats (for example with course staff, teaching assistants, or AI-assisted support tools), and related timestamps and status information where such tools are used;
- information about previous task completion and performance;
- data used to offer additional exercises, hints, recommended materials, or similar support;
- prompts, inputs, and outputs where AI-assisted support tools are used;
- information about whether optional support features have been enabled or disabled.
Technical and security data
- login data;
- IP address and browser or device-related technical information;
- session data and technical cookies necessary for the functioning of the Platform;
- audit and security logs.
Where the personal data comes from
Personal data processed in the Platform may come from:
- the user directly, for example when using course tools, making submissions, or providing information;
- Aalto University systems that provide account, identity, enrolment, or course-related information;
- federated identity providers used for institutional login, where applicable;
- teachers, teaching assistants, or course staff;
- the operation of the Platform itself, including automatically generated logs and progress information;
- derived information, such as progress indicators, recommendation signals, or summaries of learning activity.
Why we process personal data
We process personal data in the Platform for the following purposes.
Delivering teaching and learning activities
We process personal data to provide and manage digital courses and learning activities. This includes authentication, access control, course participation, submissions, assessment, feedback, and the administration of teaching. Where applicable, this may also include the use of submission and process data to support the review of originality, authorship, and academic integrity.
Developing teaching and supporting teachers’ work
We process personal data to develop teaching practices and support course staff in their work. This may include improving exercises, assessments, feedback processes, grading-related tools, teacher-facing dashboards, and other features that help course staff manage and improve teaching.
Supporting learners and improving learning support
We process personal data to support learners and improve learner-facing support. This may include improving hints, feedback, recommendations, sequencing of learning activities, and other features intended to help learners progress.
Operating, securing, and improving the Platform
We process personal data to operate, maintain, secure, test, and improve the Platform as a digital service. This includes technical maintenance, performance monitoring, troubleshooting, usability improvements, accessibility improvements, and development of new features.
Understanding learning and teaching in current courses
We process personal data to help understand how learning materials, exercises, and course features are used in current courses. This may include aggregated or individual-level views that help teachers identify bottlenecks, misconceptions, participation patterns, or parts of a course that may need improvement.
Scientific research on learning and teaching
Where applicable, personal data from the Platform may also be used for scientific research on learning and teaching in higher education. This may include retrospective analysis of existing course and platform data, including submissions, process data, and interaction with learning materials and support tools, as well as other research projects carried out under Aalto University’s research governance.
Not all development or analysis activities are scientific research. Many changes to exercises, feedback, materials, or Platform features are made as part of ordinary teaching or service development. Where an activity is carried out as scientific research, that purpose is treated separately and additional project-specific information may be provided where needed.
Legal bases for processing
The legal basis for processing personal data in the Platform depends in part on the user’s relationship with Aalto University and the educational offering in question.
For users covered by Aalto University’s general Privacy Notice for Students, the main legal bases are generally aligned with that notice.
Public task / official authority
For many uses of the Platform, the main legal basis is that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Aalto University.
This includes, for example:
- organising and delivering teaching;
- developing teaching;
- supporting studies and learning;
- providing and developing digital teaching services;
- understanding and managing current courses;
- carrying out scientific research within the university’s mission, where applicable.
Legal obligation
Some processing may also be necessary to comply with legal obligations that apply to Aalto University, including obligations relating to study records, information security, record retention, academic integrity, or disclosures required by law.
Contract
For some learner groups or educational offerings, processing may also be necessary for the performance of a contract or for steps taken before entering into a contract, for example where participation is based on a separate continuing education or other service arrangement.
Consent
Consent may be used where a feature or activity is genuinely optional. This may include, for example:
- optional third-party services or embedded content;
- certain optional personalization or AI-assisted support features, where Aalto University chooses to rely on consent;
- specific research projects where consent is used.
Where processing is based on consent, you are explicitly asked for consent, and you may withdraw your consent at any time. Withdrawal does not affect processing that took place before consent was withdrawn.
Development, analytics, and research
The Platform is used both to support teaching and to improve the Platform and related teaching practices.
Ordinary teaching and service development
The Platform and its course materials may be updated to create new exercises, assessments, feedback, and teaching materials, and to improve existing ones based on course needs, teaching experience, and analysis of how learning materials and activities are used.
This may include comparing acceptable alternative ways of presenting tasks, hints, feedback, materials, or other support features in order to improve the Platform and teaching practices.
Scientific research
Some analyses may also be carried out as scientific research on learning and teaching. This may include, for example, analysis of submissions, process data, errors, misconceptions, engagement with learning materials, or the use of feedback and support tools.
Where such activities are conducted as scientific research, they are governed separately as research. Additional project-specific information may be provided where appropriate.
Automatic assessment, recommendations, analytics, and AI-assisted support
Automatic assessment
Some tasks in the Platform may be checked or evaluated automatically according to rules or assessment logic defined by teachers or course staff. In some cases, this may include the use of AI-assisted tools to evaluate task outputs against teacher-defined criteria. These rules may be updated during the course where needed.
Recommendations and tailored support
The Platform may use information about learning progress, prior task completion, or similar information to offer additional exercises, hints, or recommended materials intended to support learning.
Learning analytics and dashboards
The Platform may provide analytics, summaries, or dashboard views that help learners follow their own progress and help course staff understand how current courses are progressing.
AI-assisted support
The Platform may include AI-assisted tools that help generate formative feedback, hints, or other learning support, or that support teachers in preparing feedback or teaching materials.
No solely automated decisions with legal or similarly significant effects
The features described above are intended to support teaching and assessment. They do not by themselves make binding decisions on final course completion or final grading.
AI-assisted feedback, recommendations, and similar support features are advisory or supportive tools.
Who can access personal data
Access to personal data is limited according to role and need.
Depending on the situation, personal data processed in the Platform may be accessed by:
- the learner or other user concerned;
- teachers, course staff, and teaching assistants involved in the course;
- designated technical or administrative personnel who maintain or support the Platform;
- researchers, where data is used for scientific research and access is authorised appropriately;
- service providers acting on behalf of Aalto University.
Access is limited to what is necessary for the relevant task.
Disclosure of data and processors
Personal data may be processed by service providers acting on behalf of Aalto University for hosting, maintenance, analytics, technical support, embedded content, or similar purposes.
Where optional third-party services are used, personal data may also be processed by those providers in accordance with the feature in question.
Personal data may also be disclosed where required by law or where this follows from Aalto University’s general privacy framework.
Where personal data is used for scientific research, data may be shared with authorised research collaborators where permitted by law and subject to appropriate safeguards.
International transfers
If personal data is processed outside the European Economic Area, Aalto University will ensure that an appropriate legal basis and safeguards for the transfer are in place, in accordance with applicable data protection law and Aalto University’s general privacy framework.
Retention of personal data
Retention of personal data in the Platform follows Aalto University’s general retention practices for student, learner, teaching-related, and service-related data where applicable.
In addition, different categories of Platform data are retained for different periods depending on their purpose. The main retention periods currently applied in the Platform are described below. Official study records are retained in central university systems where applicable.
| Category of personal data | Retention period / criterion |
|---|---|
| User account and basic data | Retained for as long as the account remains active. An account may be treated as inactive and removed in accordance with Platform retention practices after 60 months without login. |
| Submissions and submission-related data, including grading, feedback, points, and progress data | Retained for up to 60 months after the end of the course instance. |
| Activity logs | Retained for up to 24 months after the end of the course instance. |
| Official study records | Stored in Sisu and retained according to Aalto University’s central rules for official study records. |
Official study records and other centrally governed data
Where Platform data forms part of official study records or other university records, retention follows Aalto University’s central retention rules for such data.
Course-operation data
Data used to run courses and support teaching, such as submissions, activity data, progress information, and similar course-operation data, is retained in line with the periods described above, unless longer retention is required by law or by Aalto University’s retention rules.
Technical and security logs
Technical, audit, and security logs are generally retained in line with the activity log retention period described above, unless longer retention is necessary for security, troubleshooting, maintenance, or service integrity.
Optional-feature data
If optional third-party services, non-essential analytics, or optional support features are used, retention may also depend on the feature in question and the choices made by the user.
Research datasets
Where Platform data is used for scientific research, research data is retained in accordance with the relevant research plan, applicable university procedures, and legal requirements. Where possible, research data may be pseudonymised or later anonymised.
Additional course-specific or project-specific information may be provided where needed.
Cookies and similar technologies
The Platform uses cookies and similar technologies that are necessary for providing the service, such as maintaining login sessions, authentication, and saving settings needed for course participation.
If optional third-party services or other non-essential technologies are used in the Platform, we will provide any required information and request consent where required.
Your rights
As a data subject, you have the rights provided under applicable data protection law.
Depending on the situation, these may include the right to:
- access your personal data;
- request correction of inaccurate data;
- request erasure, where the legal conditions are met;
- request restriction of processing;
- object to processing in certain situations;
- withdraw consent, where processing is based on consent;
- lodge a complaint with the data protection supervisory authority.
For users covered by Aalto University’s general Privacy Notice for Students, more information is available in that notice.
You may also contact the Platform or course staff if you have questions about automatic assessment, analytics, feedback, or other Platform features.
Changes to this notice
This notice may be updated from time to time, for example when Platform features or data processing practices change. The latest version will be made available through the Platform.