Privacy policy

1 Data controller

This website and the personal data collected through it are the responsibility of:

• Curious Crew Oy
• Business ID: FI35950217
• Address: Kosselikatu 2, 33870 Tampere, Finland
• Email: info@curious.fi
• Phone: +358 50 530 7938

2 Privacy contact

For any privacy matter, including the data subject rights described below, contact info@curious.fi. We respond within one month at the latest.

We have not appointed a data protection officer, as our activities do not meet the criteria in Article 37 of the GDPR.

3 What data we process

Contact form

When you send us a message through the contact form, we process:

• your email address
• the topic you selected (sales, recruitment, training or other)
• the content of your message (up to 5,000 characters)
• the site language you were using (Finnish or English)
• the page you came to the form from

The message is delivered by email to the Curious inbox matching the topic. Form data is not stored in the website database, and the form does not ask for your name or phone number. If you include other personal data in the message field, we process that as part of your enquiry as well.

Spam prevention

The form includes technical checks against automated submissions: a hidden field, a signed form token and a minimum delay before sending. These checks run on our own server, collect no additional data and send nothing to outside services. We do not use an external spam filter.

Server logs

The web server records standard technical log data such as IP address, timestamp, requested address and browser identifier. Logs are used for security, troubleshooting and keeping the service available, not for tracking visitors.

Customers and partners

For contact persons at customer and partner companies we process name, job title or role, work email and phone number, the organisation they represent, and the correspondence and notes relating to our dealings and assignments. This supports proposals, contracts, delivery and managing the relationship. These are work-related contact details; we do not collect information about people's private lives.

Customer and project data is handled in our own internal business system, deployed in the EU region of the Render platform, and in email and files in Google Workspace.

Sales and marketing

We do business-to-business sales, so we may collect names, job titles and work contact details of contact persons at prospective client companies from public sources in order to get in touch. Sources include company websites, LinkedIn and the Finnish Trade Register. We do not buy marketing lists.

When we first make contact, we tell you where we got your details. You can opt out of direct marketing at any time, and we will then remove your data from marketing use. Electronic direct marketing to representatives of companies is based on section 200 of the Finnish Act on Electronic Communications Services.

Invoicing and accounting

When invoicing assignments we process the details recorded on invoices and vouchers, such as the contact person's name and contact details along with billing and payment information. This is based on obligations in the Finnish Accounting Act and tax legislation, so we cannot delete this data on request before the statutory retention period ends.

Staff and subcontractors

We process data about our employees and subcontractors in order to manage the employment relationship and assignments: name and contact details, terms of employment or contract, working time and project entries, and the information needed for payroll and invoicing. This data is handled in our internal business system and in our accounting and payroll systems.

This processing is based on the employment or assignment contract and on the statutory obligations of an employer. Staff are given more detailed information about it when their employment begins.

Recruitment

If you apply for a job with us by email or through the contact form, we process the information in your application and its attachments, such as name, contact details, work history and education, together with notes made during interviews. We do not run aptitude assessments or contact referees without your consent.

Applications are currently received and handled by email. Access to them is limited to the people at Curious taking part in the recruitment.

4 Purpose and legal basis

Responding to enquiries

Legitimate interest (GDPR Article 6(1)(f)) and pre-contractual steps taken at your request (Article 6(1)(b)).

Managing customer and partner relationships

Performance of a contract (Article 6(1)(b)), and legitimate interest where the contact person represents a contracting party rather than being a party themselves.

Sales, prospecting and direct marketing

Legitimate interest: business-to-business sales and communication with existing and prospective customers. Electronic direct marketing is additionally governed by section 200 of the Finnish Act on Electronic Communications Services. You can opt out at any time.

Invoicing, accounting and taxation

Compliance with a legal obligation (Article 6(1)(c)), in particular the Finnish Accounting Act and tax legislation.

Managing employment and subcontracting

Performance of a contract (Article 6(1)(b)) and the statutory obligations of an employer (Article 6(1)(c)).

Preventing spam and abuse

Legitimate interest: protecting the site and our inboxes from automated submissions, using the form's own technical checks.

Security and service availability

Legitimate interest: troubleshooting the site and detecting misuse.

Recruitment

Pre-contractual steps at the request of the data subject, and legitimate interest in finding suitable people.

Where processing is based on legitimate interest, we have assessed that it is necessary for the stated purpose and does not override your rights and freedoms. You can request more detail about that assessment from the address above.

We do not carry out automated decision-making or profiling, and we do not use contact form data for targeted marketing.

5 Where the data comes from

For the most part we receive data from you: when you submit the form, contact us by email or phone, apply for a job, or act as a contact person in an assignment. Server log data is generated technically as you use the site.

For sales purposes we may also collect work contact details of company representatives from public sources such as company websites, LinkedIn and the Finnish Trade Register. In those cases we tell you the source of the data no later than when we first contact you. We do not buy marketing lists and we do not gather data from non-public sources.

6 Retention periods

• Contact form messages: 12 months from receipt, unless the enquiry leads to a customer relationship.
• Customer and partner contact details: for the duration of the relationship and 24 months after it ends.
• Sales and marketing contact details: 24 months from the last contact, or immediately once you opt out of direct marketing. After that we retain only the record of your opt-out, so that we do not contact you again.
• Invoices, vouchers and other accounting material: six years from the end of the calendar year in which the financial period ended, as required by the Finnish Accounting Act. Financial statement material for ten years.
• Staff and subcontractor data: for the duration of the employment or contract and afterwards for as long as employment, tax and accounting legislation requires, for example payroll vouchers for the six years set by the Finnish Accounting Act.
• Job applications: for the duration of the recruitment process and no more than 12 months after it ends. We ask for your separate consent if we want to keep your application longer for future roles.
• Server logs: no more than 12 months.

We delete data once the retention period ends or when it is no longer needed for the purpose it was collected for.

7 Who receives the data

We do not sell or rent personal data. The following service providers process data on our behalf:

• Google Ireland Limited (Google Workspace): processing and storage of email, calendar and files.
• Hostaan Oy: website hosting and technical maintenance.
• Maventa (e-invoicing operator): delivery of invoices.
• Kirjanpito Kaleva Oy: processing of invoicing and accounting material.
• Piilo Accounting Oy (Finland): accounting and invoicing software.
• Render (render.com): hosting environment for our internal business system. The system holds customer, project and employee data, and is deployed in the provider's EU region.

We have a data processing agreement under Article 28 of the GDPR with each processor, obliging them to process data only on our instructions. We may also disclose data to authorities where the law requires it.

8 Transfers outside the EU and EEA

Our email service is provided by Google Ireland Limited, established in the EU. Because of how the service is built technically, the data may also be accessible from the United States. In those cases the transfer relies on the standard contractual clauses approved by the European Commission and on the adequacy decision underpinning the EU, US Data Privacy Framework.

Our internal business system is deployed in the EU region of the Render platform, so customer, project and employee data is stored in the EU. The provider is nonetheless US-based and may have technical access to the data in the course of maintenance. This transfer likewise relies on the standard contractual clauses and the Data Privacy Framework.

The provider running the website and our accounting software are both Finnish, and using them requires no transfer of personal data outside the EU or EEA.

You can request further information about the safeguards in place from the address above.

9 Cookies

This site uses no analytics, advertising or tracking cookies. We run no visitor analytics, no ad pixels and no embedded third-party content that would set cookies. That is why there is no cookie banner: there are no cookies that require consent.

WordPress sets technical cookies only for site administrators when they log in. The site language is passed as a URL parameter, not stored in a cookie.

10 How we protect the data

• The site runs over an encrypted HTTPS connection.
• Enquiries are kept in the provider's secured email environment, which requires a personal account and multi-factor authentication.
• Access is limited to the people at Curious who need it to do their job.
• The contact form has technical protection against automated submissions.
• No personal data is stored in the website database.

11 Your rights

Under the GDPR you have the right to:

• know whether we process personal data about you, and receive a copy of it
• have incorrect or incomplete data corrected
• request erasure of your data
• request restriction of processing
• object to processing that is based on legitimate interest
• opt out of direct marketing at any time and without giving a reason, in which case we stop immediately
• receive the data you gave us in a machine-readable format and transfer it to another controller

Send your request to info@curious.fi. We may ask you to clarify the request or verify your identity before we act on it. Exercising your rights is free of charge.

Not every right applies in every situation. For example, we cannot delete invoicing and accounting material before the retention period under the Finnish Accounting Act has passed. If we cannot act on a request, we always say so and explain why.

12 Right to lodge a complaint

If you believe we process your personal data unlawfully, you can lodge a complaint with the Finnish Data Protection Ombudsman. We would appreciate the chance to sort it out with you first.

• Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
• Visiting address: Lintulahdenkuja 4, 00530 Helsinki, Finland
• Postal address: PL 800, 00531 Helsinki, Finland
• Switchboard: +358 29 566 6700
• Email: tietosuoja@om.fi

13 Changes to this policy

We update this policy when the site's features or the way we process personal data change. We will note significant changes on the site.