Privacy Policy

Controller Islenord, private trader (Finnish yksityinen elinkeinonharjoittaja), Business ID 3650802-5, Mariabergintie 3 F 28, 02820 Espoo, Finland. Registry record: https://tietopalvelu.ytj.fi/yritys/3650802-5 Privacy contact: contact@culturestate.fi.

What data we process Account data of customer organization contacts (name, work email, role, organization). Assessment responses, stored without any identifier of the respondent. Optional follow-up contact details: an email address a respondent gives so they can be told about a future follow-up assessment. It is stored in a separate register and is never linked to responses. Billing reference data for paid subscriptions: business name, billing email, billing country, subscription state and payment provider identifiers. Technical log data used to keep the service secure and operational.

Payment data Culture State does not store or process full payment card details. Checkout, payment processing and billing information are handled by Stripe (including Link), acting as merchant of record for supported transactions. Culture State stores only minimized billing references: plan, currency, billing interval, subscription state and provider identifiers needed to match a subscription to the right organization. No assessment responses, participant information, OCHI or OCCI values, report findings, organization structure, Alignment data or Monitoring data is shared with Stripe or Link at any time.

Anonymity in assessments Survey links are group-specific, not personal. Responses cannot be joined back to an invitation or a person. Results are reported at group level only, and a group is reported only once the minimum response threshold is met.

Legal basis Account data and billing references are processed to perform the agreement with the customer organization. Retaining accounting records is a legal obligation. Security and service improvement processing relies on legitimate interest. Follow-up contact details are processed on the respondent's consent.

Retention and location Data is processed and stored inside the EU. Organizational data is retained for the agreed retention period (24 months by default) after the agreement ends, and is then permanently and automatically deleted. Billing and accounting records are subject to different retention requirements from assessment data: they are kept for the period required by accounting law even where assessment data has already been deleted.

Processors We use cloud hosting, database, email delivery and payment providers as sub-processors. Current sub-processors (service and assessment data): Lovable Labs Incorporated (application hosting, database, authentication and email delivery, data held in the EU) and Cloudflare, Inc. (content delivery and security). Separate payment service: Stripe, Inc. and its group companies, including Link, provide Managed Payments (checkout, payment processing, billing, supported indirect taxes, fraud prevention and disputes) and act as merchant of record for supported transactions. Stripe processes billing and payment data as its own independent controller, not as our sub-processor, and does not receive assessment data. The up-to-date list is also published in our Data Processing Agreement: contact@culturestate.fi.

Cookies The service uses strictly necessary cookies only. See the cookie policy for details.

Your rights You have the right to access, rectify, erase, object to, restrict and port your personal data. Because assessment responses are anonymous, they cannot be linked to an individual respondent and therefore cannot be retrieved or deleted individually. Consent can be withdrawn at any time.

Contact Privacy requests: contact@culturestate.fi. You also have the right to lodge a complaint with your data protection authority.