PR / LEGAL / privacy
Privacy notice
Updated:
1. Controller and contact
The controller is Punasaari Research, Business ID 3580452-7, Vantaa, Finland. The responsible contact is Kai Punasaari. Contact info@punasaariresearch.fi or kaipunasaari@punasaariresearch.fi; telephone +358 40 815 9174.
2. Scope and sources
This notice covers this corporate website, enquiries and career applications. You provide information through forms, uploaded CVs or email. Necessary technical information is generated when using the site. Somemind AI and other products have their own service-specific notices; their account, social-media or health-data processing is not described as part of this website. Do not submit patient records or other sensitive information through these forms.
3. Data categories
Enquiries: name, email address, message and submission time. Applications: those details plus the role applied for, cover letter, CV and its original filename. Security and operation: a pseudonymised IP hash used for request limits, browser user-agent information, session identifiers and server access/error logs. An IP hash is not treated as anonymous data. Administration uses staff usernames, password hashes and session activity; visitors do not create an account on this corporate site. Administration additionally uses private authenticator enrollment secrets, replay-prevention counters and minimal audit events. Audit records are kept for 30 days. CV files remain quarantined until a successful malware scan and are not sent to external AI services.
4. Purposes and legal bases
General enquiries and partnership correspondence are handled on legitimate interest grounds (GDPR Article 6(1)(f)): responding to people who contact the business. Requests concerning a possible contract and job applications are handled to take steps at your request before a contract (Article 6(1)(b)), where applicable. Abuse prevention, site security and administration rely on legitimate interests (Article 6(1)(f)). Legal obligations, if applicable, use Article 6(1)(c). We do not reuse these submissions for unsolicited marketing or AI training.
5. Providing information
Submitting an enquiry or application is voluntary. Name, email and a message are needed to handle the form. A CV is required only when applying through an advertised career form. Without the necessary information we may be unable to respond or assess an application. No automated hiring decision is made on this site.
6. Recipients and service providers
Access is limited to authorised company personnel and service providers needed to operate the service. Tietokettu supplies website hosting and email. Providers may process necessary data for hosting, delivery, security and support under the applicable service arrangement. We do not sell personal information. External project and reference links lead to separately operated sites; clicking a link is subject to that site’s privacy practices.
7. Retention and deletion
Enquiry messages and CV/application data are retained for 30 days from receipt and then deleted. The website’s automatic cleanup removes expired form records and attached CV files. Request-limit records are also cleared when older than 30 days. Email copies, server logs and backups are part of the hosting/email arrangement and must follow the controller’s retention instructions; erasure requests also cover those copies. This website does not maintain a separate recruitment talent pool.
8. Cookies, security and AI
The site uses an essential PUNASAARI_SESSION cookie for form security and administration. It lasts for the browser session; admin access expires after 30 minutes of inactivity. Language selection uses explicit page URLs. Fonts and visual assets are hosted locally. This website has no advertising cookies, embedded third-party analytics or AI processing of form submissions. Access controls, request limits and restricted file downloads help protect submitted data.
9. International transfers
The site does not send enquiry or CV content to external AI providers. Tietokettu’s storage, support and backup locations depend on the hosting/email service arrangement. Ask the controller for current processing-location and transfer information. Any transfer outside the EEA must have a GDPR-compliant basis and safeguards. No unverified claim of EU-only hosting is made in this notice.
10. Your rights and complaints
Depending on the legal basis, you may request access, correction, erasure, restriction, portability or object to processing based on legitimate interests. If consent is used for a separate purpose, you may withdraw it without affecting earlier lawful processing. Contact either company email above. We respond normally within one month; where GDPR permits an extension, we explain it. Only proportionate identity verification is requested. You may complain to the Finnish Office of the Data Protection Ombudsman at tietosuoja.fi.
11. Changes to this notice
We update this notice when purposes, providers or site functions change. The date below identifies the current website notice. Contact Kai Punasaari for questions about the operation of the 30-day policy, provider copies or your rights.