Privacy Policy

BusinessOulu (City of Oulu Public Enterprise) acts as the Data Controller for personal data processed within the Polar-Spot platform.

To deliver event hosting, team presentation management, and jury scoring workflows, Polar-Spot collects and processes the following categories of data:

• Identity & Account Information: Name, email address, and role identifiers (Admin, Judge, Team Member, or Visitor) managed securely via Supabase Auth.
• Team & Event Content: Team names, project descriptions, pitch deck links, presentation recordings, and member contact affiliations.
• Evaluation & Scoring Records: Criteria ratings, evaluation notes, and computed scores submitted by designated judges during live or scheduled events.
• Technical & Operational Logs: Session tokens, temporary authentication headers, and standard server diagnostic access logs maintained strictly for security monitoring and audit integrity.

Data is processed strictly to coordinate BusinessOulu events, manage team presentations, facilitate evaluation workflows, and keep event and team data visible for visitors and organizers.

Data Visibility, Feedback & Score Confidentiality:

Participating team profiles, project summaries, presentation materials, and constructive qualitative feedback from judges may be made visible to visitors and participants to foster community learning. In contrast, all numerical evaluation scores, criteria grades, individual judge ratings, and computed scoring results are strictly confidential, restricted exclusively to authorized judges and event administrators, and will not be published publicly.

Personal data is never sold, leased, or distributed to third-party commercial advertisers.

Under the EU General Data Protection Regulation (GDPR), we process personal data based on the following legal grounds:

• Consent (Art. 6(1)(a) GDPR): Given explicitly by users upon account creation, team registration, or submission of presentation content.
• Legitimate Interest (Art. 6(1)(f) GDPR): For system administration, user authentication, service reliability, and security log maintenance.

Polar-Spot uses an independently self-hosted backend infrastructure deployed on a cloud service within the European Union, rather than using managed Supabase Cloud. This architecture ensures that BusinessOulu maintains complete sovereignty, full ownership, and direct operational control over all platform data without third-party vendor intervention:

• Self-Hosted Cloud Infrastructure: Database and backend services are self-hosted on a cloud service within the European Union (EU), providing full data sovereignty with no third-party database vendor dependence.
• Row Level Security (RLS): PostgreSQL Row Level Security policies enforce strict isolation within the self-hosted database, preventing unauthorized cross-user data access.
• Encrypted Communication: All data transmission between clients, web servers, and the self-hosted database utilizes end-to-end Transport Layer Security (TLS/SSL) encryption.

As a data subject under GDPR, you are entitled to exercise the following statutory rights: