Last modified: September 2025

Privacy at a glance

We collect your basic details, course progress, and usage activity to deliver courses and carry out teaching-related tasks. This processing is necessary for providing the learning services you signed up for and for improving teaching quality.

Some additional features — such as personalized content, AI-assisted feedback, external research, and third-party services — are optional and only used with your consent.

All data is stored securely at Aalto University, and research data is anonymized or pseudonymized whenever possible.

Privacy notice

Aalto OpenCS, referred to as the platform, is an online learning service designed and developed for offering courses. The platform supports the creation and modification of courses, the creation and modification of automatically assessed, peer-assessed, and teacher-assessed course assignments, as well as the typical online learning platform -related functionality such as grading and book-keeping.

The platform is hosted and developed at the Department of Computer Science at Aalto University. For information about the platform and the courses, contact Arto Hellas (firstname.lastname@aalto.fi) or individual course teachers.

In the following, the term we refers to Aalto University and its employees responsible for the development of the platform and the courses offered on the platform. In Computer Science education, Aalto University is among the highest ranked Universities in Europe and the topmost one in Finland.

The terms course participant and student refer to any user who uses the course materials offered by the platform.

Aalto University privacy notice

As this platform is developed, maintained, and hosted at the Aalto University, the Aalto University privacy notice concerns this platform too.

The following is an addendum to the Aalto University privacy notice, detailing information on the data collected by the platform and on the purpose of the data collection. For specific details not addressed here such as data retention policies, see the Aalto University privacy notice.

Addendum

Purpose for processing of personal data

Creating and improving online courses and carrying out teaching-related administrative tasks requires that we process personal data about course participants.

We process personal data for the following purposes:

• Based on contractual necessity (GDPR Article 6(1)(b)) and/or legitimate interest (GDPR Article 6(1)(f))

  These activities are necessary for delivering the learning services you have signed up for, and are based on contractual necessity and/or our legitimate interest. This includes authentication, course participation, grading (automatic, peer, and teacher assessment), plagiarism detection, and course administration.

  Research strictly necessary for evaluating courses and improving teaching methods is also based on contractual necessity or legitimate interest.

• Based on consent (GDPR Article 6(1)(a))

  Certain optional features require your consent before we process your personal data for them. These include:

  • showing personalized content and AI-assisted feedback,

  • using course data for research beyond what is necessary for course delivery,

  • sharing pseudonymized or anonymized research data with trusted research partners,

  • enabling third-party analytics and performance monitoring (e.g. YouTube videos, optional analytics tools).

For further information about legal bases for processing personal data at Aalto University, see Aalto University privacy notice.

Personal data

The personal data stored and collected by the platform are as follows.

• Basic data: Name, email address, background information provided through forms, including consent information.
• Course progress data: Time-stamped data on course-specific tasks (e.g. assignments, questionnaires, peer-assessments), including correct and incorrect submissions as well as process data detailing the construction of entered solutions.
• Course material usage data: Time-stamped data on course material usage including browsing activity, video activity, and interaction and/or activity with other course components.

Security

All collected data is stored on Aalto maintained servers in Finland and processed according to the rules of fairness and confidentiality. Access to the data is limited to a select group of Aalto employees, and technical and organizational safeguards are in place to ensure the security of the personal data.

Providing data for third parties

We do not share personal data with third parties without your consent.

When you give consent, data may be shared in the following ways:

• Research use (external): Anonymized or pseudonymized data may be shared with trusted research partners for scientific studies on learning and teaching. Only the data necessary for the research purpose is shared. In the case of pseudonymized data, agreements are in place to ensure secure processing and deletion after the research has been completed.

• Third-party services: Some optional services (e.g. video hosting via YouTube or selected analytics and performance tools) may process personal data when enabled. You can allow or deny the use of these services in your consent settings.

Processing of personal data for automated decision-making

The platform supports automatically assessed tasks in courses. For example, the platform can automatically decide whether a submitted task (such as a questionnaire answer or a programming problem) is correct, based on rules defined by the course teacher(s). These rules may be updated or improved by the course teacher(s) over time.

The platform also supports offering additional assignments or materials — personalized content — based on course participants’ performance. This personalization may be based on rules defined by the course teacher(s) and/or on AI-assisted tools developed and hosted internally at Aalto University or operated under data processing agreements with trusted partners. These tools may generate tailored content or feedback to support learning, but they do not make binding decisions about grading or course completion.

You may opt out of personalized content, including AI-assisted feedback, in your user profile or in the consent pop-up shown on first page load.

Some course material may differ between participants even if personalized content is disabled. In such cases, variation is random (e.g. random order of questions, randomized variable names, or different versions of content from a pool) and not based on personal data.

Data retention and rights

Personal data on this platform is stored only for as long as necessary to provide the service, support teaching, and conduct research in line with Aalto University’s policies. This platform does not store official degree or study attainment records, which are managed in Aalto University’s central systems.

• Course-related data such as registrations, submissions, progress data, and activity logs are normally retained for the duration of the course and a limited period thereafter (typically between 6 months and 5 years, depending on the type of data). Submissions and progress data may sometimes be kept longer if needed for plagiarism detection or academic integrity reviews.

• Sensitive data, if collected, is stored only as long as necessary and for no more than 4 years.

• Data used for research may be anonymized or pseudonymized. Anonymized data may be stored indefinitely, as it is no longer personal data.

You may request the removal of your platform account through the user profile. Please note that removing your account does not delete data already anonymized or used in research, and does not affect official degree or study attainment records stored in Aalto University’s central systems.

For details on your data protection rights (e.g. access, correction, erasure, restriction, portability, and objection) and the full retention rules, see Aalto University privacy notice.

Cookies and tracking

Cookies are small text files stored on your device when you use the platform.

The platform uses two types of cookies:

• Strictly necessary cookies (always active):

  These are required for the core functions of the platform, such as login, security, and keeping track of course progress. They do not require consent.

• Non-essential cookies (consent-based):

  These are only used if you give consent. They may be used for features such as showing personalized content, enabling research-related analysis, or allowing selected third-party services (e.g. YouTube videos, analytics tools). You can change your consent choices at any time in your user profile or through the consent pop-up.

Cookies from the platform

The platform uses strictly necessary cookies for authentication and authorization. When you log in, a cookie is placed on your device so that the platform can recognize your session, attribute submissions to you, and award course points correctly.

Third-party cookies

Some optional third-party services used by the platform, such as YouTube for instructional videos, may set their own cookies. These cookies are only active if you consent to third-party services in your settings. We use YouTube’s privacy-enhanced mode, which means cookies are set only when you play a video.

Browsers typically offer the opportunity to block third party cookies. For example, in Google Chrome, this can be done through Settings -> Site settings -> Cookies and data -> Block third-party cookies. Note that blocking third party cookies may influence the performance of some of the websites that you use.