Cursor Oy Privacy Policy

Front page
Cursor Oy Privacy Policy

1. GENERAL

Cursor Oy is committed to protecting individuals’ rights and keeping the data it processes secure.

This privacy notice describes how Cursor collects, uses, stores and protects personal data.

At Cursor, personal data is processed for several different reasons. In this notice, “you” refers to customers, potential customers, employees of our customers and other relevant parties. “Cursor” refers to Cursor Oy and all of its subsidiaries.

2. CONTROLLER

The controller for all personal data referred to in this notice is Cursor Oy, unless otherwise stated. Cursor Oy acts as the controller when it determines the purposes and means of processing personal data in its own operations. In some services, Cursor Oy acts as a processor on behalf of its owner municipalities, project funders or other principals.

Contact details of Cursor Oy:

Cursor Oy, Business ID: 0727178-6
Kyminlinnantie 6
48600 Kotka

Cursor Oy is a non-profit development company that belongs to the City of Kotka Group.

3. DATA PROTECTION OFFICER

Cursor Oy belongs to the City of Kotka Group and is covered by the City of Kotka’s Data Protection Officer. The contact details of the Data Protection Officer are available at https://www.kotka.fi/kotkan-kaupunki/tietosuoja/

At Cursor Oy, the contact person for data protection matters is IT Manager Toni Jaakkola, toni.jaakkola@cursor.fi, tel. +358 40 190 2526.

4. RIGHTS OF THE DATA SUBJECT

Under the GDPR, you have the right to receive information about the processing of your personal data and to influence the processing of your personal data. This notice serves as an information document. In addition, you may request further information from the controller. You also have the following rights concerning the personal data we process, unless obligations imposed on the controller or applicable legislation provide otherwise:

Right of access to your personal data
Right to rectify or complete your data
Right to erase your data
Right to restrict the processing of your data
Right to data portability
Right to object to the processing of your data
Right not to be subject to automated decision-making

If you wish to exercise the rights listed above, requests will be assessed on a case-by-case basis. As a rule, we will respond to your requests within 30 days of receiving the request. To exercise your rights and to ensure the rights of other data subjects, we ask you to prove your identity in connection with the processing of the request.

Requests to exercise the rights listed above must be submitted in writing either to tietosuoja@cursor.fi or by post to:

Cursor Oy
Tietosuoja-asiat
Kyminlinnantie 6
48600 KOTKA

Right to lodge a complaint

You may also lodge a complaint with or contact the data protection authority. The contact details of the Finnish data protection authority are available at www.tietosuoja.fi.

5. PERSONAL DATA ROLES

Cursor Oy processes your personal data on different grounds depending on the services you use. You may belong to one or more personal data roles, depending on how extensively you use our services. The following sections describe the matters related to the processing of personal data separately for each personal data role. The personal data roles are described in more detail in the subsections of section 5.

The personal data roles are:

5.1 Users of websites
5.2 Starting entrepreneurs
5.3 Existing entrepreneurs and company personnel
5.4 Project customers
5.5 Newsletter subscribers
5.6 Participants in events/webinars
5.7 Rental customers and camera and access control of properties
5.8 Political decision-makers and influencers in the region’s municipalities
5.9 Members of Cursor’s Board of Directors
5.10 Designated users of online services, i.e. users for whom a user account has been created
5.11 South-Eastern Finland Film Commission extras egister
5.12 Registry of potential service providers for industrial projects (StarBrix)

5.1 Users of Websites

We use several different services within our websites to provide you with better services and to analyse website functionality, ease of use and technical performance. The processing of cookie-based tracking analytics is based on the user’s consent to the use of cookies. The purpose of technical tracking is to ensure the technical functionality of our website.

We use this information to develop the technical, functional and logical features of the website, to ensure and monitor website security and to prevent possible online vandalism. In addition, separately entered data is processed to provide customer service, for example in the premises register; in such cases, the data is processed under the role of existing entrepreneurs or named users of online services.

Your data is also used for remarketing, which means that based on your visit you may see our marketing messages on platforms you use, such as Facebook or Google Ads.

We also create various statistics and analyses on the operation of our online services.

Most of the data is collected on the basis of your acceptance of our cookie policy. The cookie policy is available in the bar at the bottom of our websites, where you can also select the cookies you accept.

The websites administered by Cursor Oy are:

In addition, services provided by external service providers have been embedded in our websites:

Premises and plot register: https://cursor.toimitilapalvelut.fi, service provider Hakosalo Oy
Event calendar: https://tapahtumat.cursor.fi/, service provider Eventilla Oy
Company directory: https://cursor.yrityshakemistot.fi, service provider Hakosalo Oy
Media bank: https://platform.crowdriff.com/m/visitkotkahamina, service provider CrowdRiff
Booking calendar for business advisors, service provider Teonos Oy

For these services as well, Cursor is the controller of the data content and user accounts. Your consent to cookie practices is requested separately for each site in these services.

Our service offering also includes the tourism online store https://kauppa.visitkotkahamina.fi, supplied by Aptual Commerce Oy. The site has its own privacy notice.

The personal data we collect:
We collect information from you about the characteristics and location of your computer, such as IP address, identifier cookies, pages visited, your behaviour on our pages, where you came to our pages from, time, operating system, devices and browser. In addition, we naturally store all information you enter on the pages or in their services.

Data collected from website users is not used to identify an individual person. Most of the collected data is converted through automated processing into a form from which we can identify only larger aggregates. However, in order to investigate vandalism and possible crimes, we may, in cooperation with the authorities, process visitor data from online services also for the purpose of identifying you.

Where do we get the personal data we collect?
The personal data we collect consists of technical and usage data provided by your terminal device, data generated by your activity on websites and data you have entered yourself.

Which parties do we disclose information to?
We do not disclose website usage data to external parties, except for possible partners involved in carrying out our communications. However, our service providers have access to the data in question for maintenance purposes.

Is data transferred outside the EU?
The Google Analytics service we use stores personal information on servers located outside the EU.

The GDPR compatibility of Google Analytics is specified in the additional terms for data processing by Google Analytics.

How long do we store the data?
Google Analytics user-level analytics data are retained for a maximum of 14 months. Statistical data from which individual users cannot be identified may be retained for longer.

The retention period for Facebook advertising cookies is 90 days.

Purpose of and legal basis for processing of personal data
One of our services is providing advice to entrepreneurs before starting a business. If you come to us for advice to start-up entrepreneurs, you belong to this group.

Will the data be used for personal profiling purposes?
The data we collect may be used for the purposes of targeted website marketing.

5.2 Starting entrepreneurs

With regard to the data of starting entrepreneurs, we act as a processor on behalf of the contracting municipalities. The contracting municipalities are the controllers.

Purpose and legal basis of processing personal data
One of our services is advisory support for entrepreneurs before establishing a business. If you come to us for starting entrepreneur advisory services, you belong to this group.

We use the data to provide customer service, create statistics/analyses, conduct customer satisfaction surveys and, with your separate consent, also for electronic marketing. We also use this data if you want us to provide a statement to a funder, such as Finnvera, Vitality Centres or Employment Areas.

We collect and process data concerning starting entrepreneurs on a contractual basis on behalf of our owner municipalities. The owners of the personal data register are the commissioning municipalities, and we act as the processor of personal data.

The personal data we collect:
We collect your name and contact details (telephone number, email address, address, etc.), gender, municipality of residence, date of birth, language of communication and data related to providing the service. This data includes, among other things, education category, education description, occupation, employment status category, employment status description, work experience description, emails exchanged with us, profitability calculations, business plans and other similar documentation that is necessary for providing the service.

For established companies, we collect sensitive data on whether the contact person has an immigrant background. This information is used solely for statistical purposes.

Where do we get the personal data we collect?
We receive personal data from the following sources:

Information on immigrant background is obtained from the company register of the Finnish Patent and Registration Office or through the Finnish Enterprise Agencies.

From the customer themselves
From the marketing system of the Finnish Enterprise Agencies (SUK ry), from which we receive your name, email address, postal code and employment status. Based on this information, we contact you to provide the service. You have given your consent to the disclosure of this information to us when completing the form.
Information on immigrant background is obtained from the company register of the Finnish Patent And Registration Office or through the Finnish Enterprise Agencies.

Which parties do we disclose information to?
At the customer’s request, data may be disclosed, for example, to members of our expert network or to cooperation partners, such as the Kotka-Hamina Regional Vocational Education Group Ekami or South Kymenlaakso Employment Services – EKTE. In such cases, the person’s contact details and a brief description of the business idea or the company’s service need are disclosed.

Statistical material produced from this personal data is widely disclosed for use by Cursor’s stakeholders and the media. However, individual persons cannot be identified from this material.

How long do we store the data?
If we have not been in contact with you in the form of meetings, phone calls or messages for 10 years, we will delete your data from our systems.

If you establish a company, you will move in our personal data role classification under the role “Existing entrepreneurs and company personnel”, and we will use the data to provide services from then on in your new role; see section 5.3.

Will the data be used for personal profiling purposes?
No.

5.3 Existing entrepreneurs and company personnel

With regard to personal data related to companies, we act as a processor on behalf of the contracting municipalities. The contracting municipalities are the controllers.

Purpose of and legal basis for processing of personal data:
We collect data on companies, entrepreneurs and personnel operating in our region, on our cooperation partners and on potential investment customers.

This data is used to provide services to customers, assess customer satisfaction, carry out marketing and target it, and produce various statistical analyses. Discussions with companies and actions taken are processed by us as confidential or secret. However, please note that if you are also a project customer, some information may fall partly or entirely within the scope of the Act on the Openness of Government Activities.

Cursor’s task is to increase the vitality of companies in the Kotka-Hamina region and Loviisa and to attract new companies to the region. Therefore, the processing of your data is our legitimate interest.

We collect and process data concerning entrepreneurs and company personnel on a contractual basis on behalf of our owner municipalities. The owners of the personal data register are the commissioning municipalities, and we act as the processor of personal data.

Our duties assigned by the owner municipalities include maintaining a register of companies in the region, in connection with which we publish a company directory on our website.

The personal data we collect:
We collect your name and contact details (telephone number, email address, address, etc.), date of birth (for entrepreneurs in the region), gender, municipality of residence, language of communication and data related to providing the service. This data includes, among other things, emails, notes from telephone conversations, meeting notes and any other documentation necessary for providing the service. If you have been our “starting entrepreneur” customer, we also use all data collected under that role. In addition, if you are part of our expert network, we process information about your expertise and the services you provide.

For established companies, we collect sensitive data on whether the contact person has an immigrant background. This information is used solely for statistical purposes.

Where do we get the personal data we collect?
Data is primarily obtained from the data subjects themselves, Cursor’s cooperation partners and companies, communities and private individuals covered by the services. In addition, data is collected from companies’ own websites and other public sources, such as the Finnish Patent and Registration Office and the Business Information System YTJ.

The data is stored in cloud-based systems provided by external system suppliers, in which the maintenance personnel of the systems may be able to view data in connection with maintenance tasks. Confidentiality with system suppliers has been agreed contractually.

Is data transferred outside the EU?
Visit Kotka-Hamina customer data is stored in a cloud-based CRM system located outside the EU. The system provider has provided a statement on the system’s GDPR compliance. Other customer data is stored only within the EU.

How long do we store the data?
We collect data on companies in the region throughout their entire lifecycle. We also store data on entrepreneurs throughout the company’s lifecycle. We process data on companies’ key persons while providing services, and this data is retained for 10 years from the most recent contact.

We retain the basic data of active companies throughout the company’s lifecycle because we maintain a company directory of companies operating in the region on our website. When a company ceases operations, the company and its basic data are transferred to a background register of closed companies, which is for our internal use only. Companies that have been in the background register for 5 years are deleted.

Data related to invoicing, contracts and accounting is retained in accordance with applicable national legislation.

Will the data be used for personal profiling purposes?
Data may be used for targeted service provision and marketing communications. No other profiling is carried out.

5.4 Project customers

With regard to personal data related to companies, we act as a processor on behalf of the contracting municipalities. The contracting municipalities are the controllers.

Purpose of and legal basis for processing of personal data
When you participate in an action, training or event of an EU-funded project, you are a project customer.

Data is used to implement communications, marketing and customer service carried out in projects. In addition, for EU project reporting, we disclose some personal data to the funder, the project lead partner and the project supervisor. In ESR projects, we collect various statistical data for the register of the Ministry of Finance, but in this case we act as a processor on their behalf. In ENI-CBC projects, the processing of personal data has been agreed in the partnership agreement in accordance not only with EU legislation but also with national legislation.

This obligation is based on EU legislation concerning regional and structural policy and national implementation, including:

Act on Regional Development and Implementation of the European Union’s Regional and Structural Policy (756/2021)
Act on the Financing of Regional Development and European Union Regional and Structural Policy Projects (757/2021)
Government Decree on the Financing of Regional Development and EU Regional and Structural Policy Projects (867/2021)
Common Provisions Regulation (EU) 2021/1060 concerning the ERDF, ESF+, JTF and other funds
ERDF Regulation (EU) 2021/1058
ESF+ Regulation (EU) 2021/1057
JTF Regulation (EU) 2021/1056

Under these provisions, the processing of personal data is necessary for managing projects, carrying out reporting and enabling the granting and supervision of funding.

We carry out project activities on a contractual basis on behalf of our owner municipalities. The owners of the personal data register are the commissioning municipalities, and we act as the processor of personal data.

The personal data we collect:
We collect the same data as in the personal data roles “Existing companies and their personnel” and “Starting entrepreneurs”.

Where do we get the personal data we collect?
Data is primarily obtained from the data subjects themselves, Cursor’s cooperation partners and companies, communities and private individuals covered by the services. In addition, data is collected from companies’ own websites and other public sources, such as the Finnish Patent and Registration Office and the Business Information System YTJ

Which parties do we disclose information to?
For EU project reporting, we disclose some personal data to the funder, the project lead partner and the project supervisor. In ESR projects, we collect various statistical data for the register of the Ministry of Finance, but in this case we act as a processor on their behalf.

Data is stored in cloud-based systems provided by external system suppliers, in which the maintenance personnel of the systems may be able to view data in connection with maintenance tasks. Confidentiality with system suppliers has been agreed contractually.

Is data transferred outside the EU?
In ENI-CBC projects, the processing of personal data is agreed on in the partnership agreement not only in accordance with EU legislation, but also as required by national law.

How long do we store the data?
The retention periods for project data are considerably long. Personal data is retained for at least 10 years after the end of the project. The retention period is determined taking into account European Council regulations and national retention obligations.

Will the data be used for personal profiling purposes?
No.

5.5 Newsletter Subscribers

Purpose and legal basis of processing personal data
We offer you the opportunity to receive interesting additional information about our services and our region. If you subscribe to a newsletter, you belong to this role.

We use this data to carry out communications and to monitor and analyse them. We also use the data we collect to implement marketing automation.

When subscribing to a newsletter, you give separate consent to the processing of your personal data and to email marketing.

We may send relevant newsletters to business contacts (B2B) without separate consent. However, you have the option to prohibit communications via the link in the newsletter or by contacting us, after which we will no longer send you our marketing communications.

What personal data we collect
We collect contact details from you, such as email address and name. This data is combined with data collected in other roles. In addition, we collect information on whether you read our newsletters and which links you use in them, and when you use the links, we see which of our websites you view.

Where we obtain the personal data we collect
The personal data we collect comes from the newsletter subscriber themselves, public company registers, Cursor Oy’s customer register and publicly available information on municipal officials and decision-makers.

To whom we disclose data
We do not disclose data to external parties.

Are data transferred outside the EU
Some of the data is stored in a cloud-based system located outside the EU. The system provider has provided a statement on the system’s GDPR compliance.

How long data are retained
If you are only in the newsletter role, we delete your personal data when you withdraw your consent to receiving email. If you belong to other roles and withdraw your consent to receiving email, we retain your data on the basis of the other roles.

Are data used for profiling individuals
No.

5.6 Participants in events/webinars

Purpose and legal basis of processing personal data
We collect registration data on participants in events/webinars using electronic forms.

Data is used to organise events and to compile statistics on participant numbers. Data is also used to inform participants about possible changes and upcoming events and for customer feedback surveys. Based on consent, data may also be used for marketing communications.

The storage of data is based on the consent of the person providing the data.

What personal data we collect
We collect your name, contact details, the organisation you represent and any other information relevant to organising the event that is requested on the questionnaire.

For events/webinars organised in connection with projects, we collect the personal data required for project activities, depending on the funding body of the project in question (ESF/ERDF, etc.). See section “5.4 Project customers”.

Where we obtain the personal data we collect
We collect personal data from the data subjects themselves and from the person registering or reporting the event participant.

To whom we disclose data
For events organised in connection with projects, we store or provide to the project funder the personal data of event/webinar participants that the funder requires to be available in connection with project audits; see section “Project customers”. In addition, we may provide participants’ names and contact details to cooperation partners involved in organising the events.

Are data transferred outside the EU
Some of the data is stored in a cloud-based system located outside the EU. The system provider has provided a statement on the system’s GDPR compliance.

How long data are retained
Participation data is retained for 10 years from the event/webinar, unless permission has been given for marketing communications. If permission has been given to use the data for marketing communications, the data is retained for as long as it is relevant for carrying out marketing communications. Data found to be outdated is deleted without delay. Data is also deleted without delay at the person’s own request.

Data collected from project events is retained in accordance with the funder’s instructions; see section “Project customers”.

Are data used for profiling individuals
No. However, targeted marketing communications may be sent on the basis of the data if consent has been obtained.

5.7 Rental customers and camera and access control of properties

Purpose and legal basis of processing personal data
As part of our operations, we provide rental of meeting rooms, business premises and similar facilities. If your company or you rent premises from us, you are a rental customer.

Your data is used to provide customer service and related communication and information, invoicing and customer satisfaction assessment. Contact details are also used to handle possible maintenance requests.

We use data generated from the use of identifiers in access control and intrusion alarm systems only for managing access rights and for preventing and investigating crimes, and, where necessary, identifying persons who have moved in the premises in possible cases of vandalism and crime.

We disclose access control and intrusion alarm system identifier data, the related name information and access data to the tenant of the premises so that they can verify the correctness of access lists. Data generated from the use of identifiers is not disclosed to the tenant.

Our camera surveillance records live footage of the monitored area and of any persons and vehicles that may be moving within the range of each surveillance camera. The primary purpose of camera surveillance is to prevent crime, and the data generated from surveillance is used only to investigate criminal and damage incidents and, where necessary, to identify persons who have moved in the premises. Data generated from camera surveillance is not disclosed to the tenant.

Separate privacy notices for access control, intrusion alarm systems and camera surveillance are available from Cursor Oy on request.

If you rent our premises as a private individual, we process your data on a contractual basis. If the company you represent rents premises from us, we process your data on the basis of legitimate interest, because otherwise we cannot provide good customer service or serve our customers to the extent required by the rental relationship.

What personal data we collect
We collect the data necessary for invoicing, accounts receivable and possible debt collection, and link you to the premises rented by you or by the company you represent. In addition, for rental operations, we collect your contact details from maintenance requests you have made and from other material you have provided to us.

In addition, we collect data on the access control and intrusion alarm system identifiers you use and their use, and we store camera surveillance footage.

Where we obtain the personal data we collect
We obtain the personal data we collect from the data subject themselves or from the company they represent. Where necessary, the personal data we collect is supplemented from generally available sources.

To whom we disclose data
The collected data is stored in information systems to which system suppliers also have access for maintenance and support tasks. There are no actual disclosures of data.

Camera surveillance recordings are stored locally in systems located on our own premises. Suppliers of the camera system may be able to view recordings in connection with technical maintenance work.

Are data transferred outside the EU
The data we collect is not transferred outside the European Union or the European Economic Area.

How long data are retained
We process data concerning persons in companies while providing services, and we retain this data until the end of the customer and rental relationship, with the following exceptions:

Data related to invoicing, accounting and contracts is retained in accordance with applicable national legislation.

Data possibly stored in maintenance requests is retained indefinitely. This data mainly consists of the person’s name, location or contact details.

We retain data generated from the use of identifiers in access control and intrusion alarm systems for 30 days, and data generated from camera surveillance for a maximum of 14 days depending on recorder capacity, unless there is a special reason to retain the data for longer, for example in suspected criminal cases.

Are data used for profiling individuals
No.

5.8 Political decision-makers and influencers in the region’s municipalities

Purpose and legal basis of processing personal data
As part of regional cooperation organised by our municipal owners, we process your data under this role.

This data is used for communications related to regional cooperation events and news. Information on your participation in events and data for paying meeting fees and travel reimbursements is disclosed to Sarastia Oy and to the municipalities in our operating area.

The municipalities in our region purchase regional cooperation from us as a service, so processing your data is our legitimate interest. Without processing the data, we cannot provide the service.

What personal data we collect
At the beginning of the council term, your municipality asks you for consent to disclose data to us. This data consists of your name, email address and other contact details.

We collect data on your participation in regional meetings and events, such as regional forums and seminars, and data for paying any travel reimbursements.

Where we obtain the personal data we collect
The data we collect comes from the persons themselves and from public municipal data sources.

To whom we disclose data
We do not disclose data to external parties.

Are data transferred outside the EU
No.

How long data are retained
Data is retained for a maximum of two years after the person is no longer in a relevant position from the perspective of regional decision-maker cooperation.

Are data used for profiling individuals
No.Purpose and legal basis of processing personal data
As part of board work in accordance with Cursor’s Articles of Association, we process your data under this role.

This data is used for filing notifications with the Trade Register, communication between the Board and Cursor, maintaining the related-party register and paying meeting fees.

In accordance with Cursor’s shareholders’ agreement and Articles of Association, our operations include a Board of Directors, so processing your data is our legitimate interest. Without processing the data, we cannot file notifications with the Trade Register, carry out cooperation between the Board and the Supervisory Board or pay meeting fees.

What personal data we collect
At the beginning of the Board term, you are asked for consent to disclose data to us. This data consists of your name, email address, other contact details and data required for paying meeting fees. We collect data on your participation in Board meetings for the purpose of paying meeting fees.

For the related-party register, we collect information on holdings of more than 50% held by Board members and their spouses, Board memberships and other controlling positions in organisations.

Where we obtain the personal data we collect
Data is primarily obtained from the Board members themselves.

To whom we disclose data
Data may be disclosed, where necessary, to the tax authority and to the company’s auditor.

Are data transferred outside the EU
No.

How long data are retained
Data is retained after the end of your Board work in accordance with laws concerning payroll administration.

Are data used for profiling individuals
No.

5.9 Members of Cursor’s Board of Directors

Purpose and legal basis of processing personal data
As part of board work in accordance with Cursor’s Articles of Association, we process your data under this role.

This data is used for filing notifications with the Trade Register, communication between the Board and Cursor, maintaining the related-party register and paying meeting fees.

For the related-party register, we collect information on holdings of more than 50% held by Board members and their spouses, Board memberships and other controlling positions in organisations.

Where we obtain the personal data we collect
Data is primarily obtained from the Board members themselves.

To whom we disclose data
Data may be disclosed, where necessary, to the tax authority and to the company’s auditor.

Are data transferred outside the EU
No.

How long data are retained
Data is retained after the end of your Board work in accordance with laws concerning payroll administration.

Are data used for profiling individuals
No.

5.10 Designated users of online services, i.e. users for whom a user account has been created

Purpose and legal basis of processing personal data
In some of our online services, a user account is created for you, or you use our online service with an account created by a third party. In such cases, you are a named user of online services.

Data is used to ensure the technical functioning of the service, to organise access management and for the purpose for which the online service we provide is intended. In addition, we store various logs concerning the use and editing of files.

The legal basis for processing data varies case by case. An online service may be used to fulfil a statutory obligation, or processing may be based on so-called legitimate interest when we cooperate using online services.

What personal data we collect
We collect from you the data required to create a user account, which varies depending on the service. As a rule, this data consists of the following: name, contact details and information on the organisation you represent.

In addition, we collect information on how you use the service and all information you enter into the service.

Where we obtain the personal data we collect
The personal data we collect comes from the users themselves and from their activity on the websites.

To whom we disclose data
We do not disclose data to external parties.

Data is stored in systems provided by external system suppliers, in which the maintenance personnel of the systems may be able to view data in connection with maintenance tasks. Confidentiality with system suppliers has been agreed contractually.

Are data transferred outside the EU
No.

How long data are retained
Usage data is retained by our hosting service providers for the period required for technical maintenance. Document editing and commenting data is used for the lifecycle of the document.

Are data used for profiling individuals
No.

5.11 South-Eastern Finland Film Commission (seffc.fi) Extras Register

Purpose and legal basis of processing personal data
We collect data in the South-Eastern Finland Film Commission assistant register on persons who have registered as volunteer film assistants (hereinafter “Assistant”).

The storage of data is based on the consent of the person providing the data. In the case of a child, the parent completes the information on their behalf.

What personal data we collect
The register contains only the information provided by the Assistant themselves. The person registering as an Assistant decides themselves how they wish to describe themselves. The Assistant can at any time view, edit or delete the data concerning themselves in the assistant register, or ask the register administrator to perform these actions on their behalf. However, for assistant data entered before June 2024, deletion requests must for the time being be made manually to johanna.kunttu@cursor.fi and toni.jaakkola@cursor.fi.

Where we obtain the personal data we collect
We collect personal data from the data subjects themselves.

To whom we disclose data
Register data is stored on the server of an external service provider. We have concluded an agreement with the service provider to ensure compliance with GDPR requirements. Register data can be accessed, processed and maintained by Cursor Oy/South-Eastern Finland Film Commission personnel, representatives of production companies acting as our cooperation partners and the IT service provider for technical maintenance purposes. Disclosure of data to production companies is based on the Assistant’s own consent. We store all personal data in a password-protected environment. The data is also stored as part of Cursor Oy’s customer register.

Are data transferred outside the EU
No.

How long data are retained
Personal data is retained for as long as the assistant register exists, unless the Assistant deletes their data or requests its deletion.

Are data used for profiling individuals
The data in the personal data register is not used for automated decision-making by profiling. However, assistants suitable for each film project are searched for manually from the register on the basis of the personal characteristics they have provided.

5.12 Registry of potential service providers for industrial projects (StarBrix)

Purpose and legal basis of processing personal data
Personal data is processed to make potential suppliers of services and those needing services aware of each other in industrial projects in the Kotka-Hamina-Loviisa region. Supplier data is collected for publication on our website. The legal basis for processing is legitimate interest, which arises when the data subject becomes a user of the service.

What personal data we collect
The personal data collected consists of the contact persons of potential suppliers and their contact details, as well as user accounts created for the service. Contact details are collected for the needs of industrial project companies and to be disclosed to them.

Where we obtain the personal data we collect
Individuals enter the supplier register data into the online service themselves voluntarily. Telecommunication identification data may be generated automatically from visits to the site.

To whom we disclose data
Data is processed by Cursor Oy personnel and by the technical supplier of the service. In addition, supplier data, including contact persons and their contact details, is published on our publicly accessible website. Data concerning suppliers’ contact persons is disclosed by Cursor Oy employees to industrial project companies and other potential service users. Direct access to the system may be granted to limited representatives of these parties. In addition, data may be disclosed to these parties as separate lists, for example in Excel format. Telecommunication identification data may be viewed by the technical implementer of the service. It is used only for technical purposes and for detecting and preventing possible information security threats.

Are data transferred outside the EU
The system is located in Finland, but the industrial project companies and other service users to whom data is disclosed may be global actors outside the EEA.

How long data are retained
Data is retained in the system until the data subject submits a deletion request. In addition, personal data will be destroyed when the lifecycle of the online service ends.

Are data used for profiling individuals?
No.