4. FOR WHAT PURPOSES AND UNDER WHICH LEGAL BASES MAY WE PROCESS PERSONAL DATA OF USERS

Purposes of Processing

To process your application to the ‘Deep Dive’ event and to provide and manage the ‘Deep Dive’ event (legal ground: legitimate interest and performance of contract).

Our processing of your personal data is primarily based on the reviewing of your application and, for those Users chosen as participants, the organizing and managing of the ‘Deep Dive’ event.

We may process personal data to be able to provide essential functionalities or enhance the quality of the ‘Deep Dive’ event. In some cases, personal data may be processed for the purpose of carrying out contractual obligations towards the User as the organizer of the program. Further, if you reach out to our contact service, we may use the provided information for answering questions and solving possible issues.

To fulfill our legal obligations (legal ground: compliance with a legal obligation).

We may need to process personal data to fulfill our legal obligations, such as our bookkeeping obligations or to provide information to competent authorities (e.g. tax authorities).

For claims handling and legal processes (legal ground: legitimate interest).

Mimir may process personal data in relation to claims handling and legal processes, where necessary. We may also process data for the prevention of fraud, misuse of our ‘Deep Dive’ event and for data, system and network security.

For sharing information with our relevant stakeholders (legal ground: consent).

We may process personal data for the purpose of sharing it with the relevant representatives of the academia and industry to aid your dialogue with these stakeholders provided you have given us your consent to do so.

Explaining the legal bases for processing

To the extent personal data is processed based on a contract between us and the User, the legal basis shall be performance of contractual obligations. We may also process personal data based on our legal obligations or other legitimate interests, for example in connection with organizing relevant trips included in the ‘Deep Dive’ event. Whenever using your data based on our legitimate interest, we shall carefully weigh our interest against your right to privacy.

In certain cases, you may be requested to grant your consent for the processing of your personal data. In this event, the legal ground for such processing is your consent. You may withdraw your consent at any time.

We do not under any circumstances process Users’ personal data for the purposes of automated individual decision-making, including profiling.

5. INTERNATIONAL TRANSFERS

We strive to keep all personal data subject to this Privacy Policy within the European Economic Area. However, we do have service providers engaged in the operation of the Platform in several geographic locations, such as in the United States. As such, we and our service providers may transfer personal data to, or access it in, jurisdictions outside the European Economic Area or outside of your domicile.

In these situations, we shall ensure that your personal data is subject to adequate level of protection regardless of the jurisdiction. This happens by concluding a series of agreements with our service providers based on the Standard Contractual Clauses or through other appropriate safeguards under chapter V of the EU General Data Protection Regulation (2016/679).

6. PERSONAL DATA RECIPIENTS

We shall not share your personal data within our organization, unless strictly necessary to perform our Services. We shall further not share personal data with any external third party, unless one of the following circumstances apply:

It is necessary for the purposes set out in this Privacy Policy

To the extent that third parties need access to personal data to ensure the performance of the ‘Deep Dive’ event, we have taken appropriate contractual and organizational measures to ensure that personal data is being processed exclusively for the purposes specified in this Privacy Policy and in accordance with all applicable laws and regulations.

For legal reasons

We may share personal data with third parties outside of our organization if we have a good- faith belief that access to and use of the personal data is reasonably necessary to: (i) meet any applicable law, regulation, and/or court order; (ii) detect, prevent, or otherwise address fraud, security or technical issues; and/or (iii) protect the interests, properties or safety of Mimir, our Users or the public in accordance with the law. When possible, we will inform you about such transfer and processing.

To authorized service providers

We may share personal data to authorized service providers who perform services for us (including data storage support services). Our agreements with our service providers include commitments that the service providers agree to limit their use of personal data and to comply with privacy and security standards at least as stringent as the terms of this Privacy Policy.

For other legitimate reasons

To the extent Mimir is involved in a merger, acquisition or asset sale, we may transfer personal data to the third party involved. However, we will continue to ensure the confidentiality of all personal data. We will give notice to those concerned when the personal data are transferred or become subject to a different privacy policy as soon as reasonably possible.

With explicit consent

We may share personal data with third parties outside of our organization for other reasons than the ones mentioned above, when we have your explicit consent to do so. You have the right to withdraw your consent at any time.

7. STORAGE PERIOD

Your personal data shall not be stored by us any longer than necessary for the purposes of providing the ‘Deep Dive’ event or parts thereof, or for another individual purpose for which your data is being processed hereunder. The exact storage period depends on the nature of the information and the purposes of processing. Hence, the maximum storage period may vary per use case.

Generally, personal data of Users is deleted within a reasonable time after the User is no longer enrolled in our ‘Deep Dive’ event or when the User requests the deletion of such personal data, unless we are obligated to store the data for longer periods due to applicable law.

The personal data of those Users’ who have applied to ‘Deep Dive’ event but were ultimately not chosen as participants shall be deleted within thirty (30) days’ following the commencement of the ‘Deep Dive’ event, unless we are obligated to store the data for longer periods due to applicable law.

Notwithstanding the above, we may have to store Users’ personal data a bit longer to the extent such data is included in our automatic encrypted back-up processes. However, your data shall not be accessed or used for any purposes while such data is included in the back-ups, which shall be permanently deleted in every thirty (30) days’.

8. YOUR RIGHTS

You have the right to access your personal data processed by us. You may contact us, and we shall inform what kind of personal data we have collected and processed regarding you.

Right to withdraw consent

In case the processing is based on a consent you have granted us, you may withdraw the consent at any time. Withdrawing your consent may lead to fewer possibilities to enjoy the benefits of our ‘Deep Dive’ event. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Right to rectify

You have the right to have incorrect or incomplete personal data we have stored about you corrected or completed by contacting us.

Right to erasure

You may also ask us to erase your personal data from our systems. We will comply with such request unless we have a legitimate ground to not delete the data.

Right to object

You have the right to object to certain use of your personal data if such data is processed for other purposes than necessary for the performance of our contractual obligations towards you or for compliance with a legal obligation. If you object to the further processing of your personal data, this may lead to fewer possibilities to enjoy the benefits of our ‘Deep Dive’ event.

Right to restriction of processing

You may request us to restrict processing of personal data for example when your data erasure, rectification or objection requests are pending and/or when we do not have legitimate grounds to process your data. This may however lead to fewer possibilities to enjoy the benefits of our ‘Deep Dive’ event.

Right to data portability

You have the right to receive your personal data from us in a structured and commonly used format and to independently transmit that data to a third party.

How do you use your rights hereunder

The abovementioned rights may be used by sending a letter or an e-mail to us on the addresses set out above, including the following information: full name, address, e-mail address and a phone number. We may request the provision of additional information necessary to confirm your identity.

We reserve the right to reject requests that are unreasonably repetitive, excessive, or manifestly unfounded.

9. INFORMATION SECURITY

We use administrative, organizational, technical, and physical safeguards to protect the personal data we collect and process. Our security controls are designed to maintain an appropriate level of data confidentiality, integrity, availability, resilience, and ability to restore the data. We shall also test our systems, and other assets for security vulnerabilities at appropriate intervals.

Should despite of the security measures, a security breach occur that is likely to have negative effects on your privacy, we will inform you and other affected parties, as well as relevant authorities when required by applicable data protection laws, about the breach as soon as reasonably possible.

10. LODGING A COMPLAINT

In case you consider our processing of personal data to be inconsistent with the applicable data protection laws, a complaint may be lodged with the local supervisory authority for data protection.

In Finland, the local supervisory authority is the Data Protection Ombudsman (https://www.tietosuoja.fi).