GDPR / Data Protection

The Global AI Capability & Transformation Initiative is committed to protecting personal data and complying with the EU General Data Protection Regulation (Regulation (EU) 2016/679) and applicable national data protection law. Trusted measurement depends on trusted data handling — this commitment is core to the initiative's independence and credibility.

Start North ry (business ID 2799788-3), Otakaari 5 A, 02150 Espoo, Finland, is the controller for personal data processed through this site and the associated research, except where a partner institution acts as a joint or independent controller for its part of the processing. Contact: lauri@laituri.ai.

We process personal data lawfully, fairly, and transparently; for specified, explicit, and legitimate purposes; limited to what is necessary; kept accurate; retained no longer than necessary; and processed securely. We are able to demonstrate our compliance (accountability).

We rely on consent, performance of a contract, legitimate interests, and/or legal obligation, as set out in Section 5 of the Privacy Policy. Where we rely on consent, you can withdraw it at any time.

Much of our processing is for scientific research. In that context we apply the safeguards required by Article 89: data minimisation, pseudonymisation or anonymisation wherever possible, strict access controls, and publication of results only in aggregated or anonymised form. Participation in research is voluntary, and withdrawal is possible in line with the information provided at the point of participation.

You have the right to:

• Access — obtain confirmation of, and a copy of, your personal data (Art. 15).
• Rectification — have inaccurate or incomplete data corrected (Art. 16).
• Erasure — request deletion in certain circumstances ("right to be forgotten") (Art. 17).
• Restriction — request that we limit processing in certain circumstances (Art. 18).
• Data portability — receive your data in a structured, commonly used, machine-readable format (Art. 20).
• Object — object to processing based on legitimate interests, and to direct marketing at any time (Art. 21).
• Not be subject to solely automated decisions producing legal or similarly significant effects, except as permitted by law (Art. 22).
• Withdraw consent at any time where processing is based on consent (Art. 7(3)).

To exercise any of these rights, contact lauri@laituri.ai. We will respond within one month, as required by the GDPR. There is normally no charge; we may ask you to verify your identity.

We use carefully selected processors — including Laituri.ai (technology platform), Start North (research coordination), and hosting/email/analytics providers — who process personal data only on our documented instructions under data processing agreements. Research partners collaborate under appropriate agreements.

Where personal data is transferred outside the EEA, we rely on an adequacy decision or the European Commission's Standard Contractual Clauses, together with any additional measures required, to ensure an equivalent level of protection.

We maintain procedures to detect, report, and investigate personal data breaches, and will notify the relevant supervisory authority and affected individuals where required by the GDPR.

If you have concerns about how we handle your personal data, please contact us first at lauri@laituri.ai so we can help. You also have the right to lodge a complaint with a data protection supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) — tietosuoja.fi. If you are in another EU/EEA country, you may contact your local supervisory authority.

Data Protection contact: lauri@laituri.ai
Start North ry, Otakaari 5 A, 02150 Espoo, Finland · 2799788-3