Last modified: December 2025

Privacy at a glance

We collect your basic details, course progress, and usage activity to deliver courses, carry out teaching-related tasks, and support scientific research on learning and teaching. This processing is necessary for providing the learning services you signed up for, for improving teaching quality, and for carrying out tasks in the public interest in line with Aalto University’s mission.

Some additional features — such as certain types of personalized content, AI-assisted feedback, and selected third-party services — are optional and only used with your consent.

All data is stored securely at Aalto University, and research data is anonymized or pseudonymized whenever possible.

Privacy notice

Aalto OpenCS, referred to as the platform, is an online learning service designed and developed for offering courses. The platform supports the creation and modification of courses, the creation and modification of automatically assessed, peer-assessed, and teacher-assessed course assignments, as well as the typical online learning platform-related functionality such as grading and book-keeping.

The platform is hosted and developed at the Department of Computer Science at Aalto University. For information about the platform and the courses, contact Arto Hellas (firstname.lastname@aalto.fi) or individual course teachers.

In the following, the term we refers to Aalto University and its employees responsible for the development of the platform and the courses offered on the platform. In Computer Science education, Aalto University is among the highest ranked Universities in Europe and the topmost one in Finland.

The terms course participant and student refer to any user who uses the course materials offered by the platform.

Aalto University privacy notice

As this platform is developed, maintained, and hosted at the Aalto University, the Aalto University privacy notice concerns this platform too.

The following is an addendum to the Aalto University privacy notice, detailing information on the data collected by the platform and on the purpose of the data collection. For specific details not addressed here such as data retention policies, see the Aalto University privacy notice.

Addendum

Purpose for processing of personal data

Creating and improving online courses and carrying out teaching-related administrative tasks requires that we process personal data about course participants.

We process personal data for the following purposes:

• Based on contractual necessity (GDPR Article 6(1)(b)) and/or legitimate interest (GDPR Article 6(1)(f))

  These activities are necessary for delivering the learning services you have signed up for and for operating and securing the platform. This includes authentication, course participation, grading (automatic, peer, and teacher assessment), plagiarism detection, and course administration, as well as platform maintenance, statistics, and follow-up necessary for teaching.

• Based on a task carried out in the public interest (GDPR Article 6(1)(e))

  We use course and platform data, in identifiable, pseudonymized, or aggregated form, for scientific research on learning and teaching in higher education. This includes, for example, evaluating courses and teaching methods and developing new educational approaches. Such research is conducted in line with Aalto University’s public-interest mission and research ethics and is described in the Aalto University privacy notice and, where applicable, in project-specific information sheets.

• Based on consent (GDPR Article 6(1)(a))

  Certain optional features require your consent before we process your personal data for them. These include, for example:

  • showing certain types of personalized content and AI-assisted feedback that go beyond what is strictly necessary for course delivery,
  • using course data for specific research projects that go beyond the core educational and public-interest purposes described above (for example, participation in a voluntary study with additional questionnaires),
  • sharing pseudonymized research data with trusted research partners for particular research projects,
  • enabling third-party analytics and performance monitoring (e.g. YouTube videos, optional analytics tools).

  You can give or withdraw consent for these uses in your user profile or via the consent pop-up shown on first page load. For some research projects, additional study-specific consent forms or information sheets may also be used.

For further information about legal bases for processing personal data at Aalto University, see Aalto University privacy notice.

Personal data

The personal data stored and collected by the platform are as follows.

• Basic data: Name, email address, background information provided through forms, including consent information.
• Course progress data: Time-stamped data on course-specific tasks (e.g. assignments, questionnaires, peer-assessments), including correct and incorrect submissions as well as process data detailing the construction of entered solutions.
• Course material usage data: Time-stamped data on course material usage including browsing activity, video activity, and interaction and/or activity with other course components.

Security

All collected data is stored on Aalto maintained servers in Finland and processed according to the rules of fairness and confidentiality. Access to the data is limited to a select group of Aalto employees, and technical and organizational safeguards are in place to ensure the security of the personal data.

Providing data for third parties

We do not share personal data with third parties without your consent, unless required by law.

When you give consent in your settings or in a study-specific consent form, data may be shared in the following ways:

• Research use (external): Pseudonymized data may be shared with trusted research partners for scientific studies on learning and teaching. Only the data necessary for the research purpose is shared. Agreements are in place to ensure secure processing, appropriate retention, and deletion or further anonymization after the research has been completed.

• Third-party services: Some optional services (e.g. video hosting via YouTube or selected analytics and performance tools) may process personal data when enabled. You can allow or deny the use of these services in your consent settings.

In addition, we may share anonymized and aggregated statistics that do not identify individual students with collaborators or in publications. As anonymized data is not personal data, it is not subject to the GDPR.

Processing of personal data for automated decision-making

The platform supports automatically assessed tasks in courses. For example, the platform can automatically decide whether a submitted task (such as a questionnaire answer or a programming problem) is correct, based on rules defined by the course teacher(s). These rules may be updated or improved by the course teacher(s) over time.

The platform also supports offering additional assignments or materials — personalized content — based on course participants’ performance. This personalization may be based on rules defined by the course teacher(s) and/or on AI-assisted tools developed and hosted internally at Aalto University or operated under data processing agreements with trusted partners. These tools may generate tailored content or feedback to support learning, but they do not make binding decisions about grading or course completion.

You may opt out of personalized content, including AI-assisted feedback, in your user profile or in the consent pop-up shown on first page load.

Some course material may differ between participants even if personalized content is disabled. In such cases, variation is random (e.g. random order of questions, randomized variable names, or different versions of content from a pool) and not based on personal data.

Data retention and rights

Personal data on this platform is stored only for as long as necessary to provide the service, support teaching, and conduct research in line with Aalto University’s policies. This platform does not store official degree or study attainment records, which are managed in Aalto University’s central systems.

• Course-related data such as registrations, submissions, progress data, and activity logs are normally retained for the duration of the course and a limited period thereafter (typically between 6 months and 5 years, depending on the type of data). Submissions and progress data may sometimes be kept longer if needed for plagiarism detection or academic integrity reviews.

• Sensitive data, if collected, is stored only as long as necessary and for no more than 4 years.

• Data used for research is typically pseudonymized and, where possible, later anonymized. Pseudonymized research data is retained only for as long as necessary for the research project and any follow-up analyses, in line with Aalto University’s research data management and retention policies. As a general criterion, this means a defined period after the last publication or report in which the data is used, after which the data is either further anonymized or securely deleted. Once data has been irreversibly anonymized, it is no longer personal data and may be stored for a longer period.

You may request the removal of your platform account through the user profile. Please note that removing your account does not delete data already anonymized or data already included in ongoing or completed research datasets, and does not affect official degree or study attainment records stored in Aalto University’s central systems.

For details on your data protection rights (e.g. access, correction, erasure, restriction, portability, and objection) and the full retention rules, see Aalto University privacy notice.

Cookies and tracking

Cookies are small text files stored on your device when you use the platform.

The platform uses two types of cookies:

• Strictly necessary cookies (always active):

  These are required for the core functions of the platform, such as login, security, and keeping track of course progress. They do not require consent.

• Non-essential cookies (consent-based):

  These are only used if you give consent. They may be used for features such as showing personalized content, enabling research-related analysis, or allowing selected third-party services (e.g. YouTube videos, analytics tools). You can change your consent choices at any time in your user profile or through the consent pop-up.

Cookies from the platform

The platform uses strictly necessary cookies for authentication and authorization. When you log in, a cookie is placed on your device so that the platform can recognize your session, attribute submissions to you, and award course points correctly.

Third-party cookies

Some optional third-party services used by the platform, such as YouTube for instructional videos, may set their own cookies. These cookies are only active if you consent to third-party services in your settings. We use YouTube’s privacy-enhanced mode, which means cookies are set only when you play a video.

Browsers typically offer the opportunity to block third party cookies. For example, in Google Chrome, this can be done through Settings -> Site settings -> Cookies and data -> Block third-party cookies. Note that blocking third party cookies may influence the performance of some of the websites that you use.