Pole Star Advisory Oy

Last updated: February 2nd, 2026.

1. Data Controller

The data controller is:

Pole Star Advisory Oy, Helsinki, Finland

Email: juho-petteri.huhtala@aalto.fi

2. Purpose of Data Processing

Personal data is processed for the following purposes:

• Conducting scientific and applied research based on survey responses

• Producing anonymised and aggregated research results, reports, and publications

• Where applicable, administering voluntary prize draws or follow-up contact related to a survey

Participation in surveys and participation in any prize draw or follow-up contact are voluntary and independent.

3. Legal Basis for Processing

Personal data is processed in accordance with Article 6 of the General Data Protection Regulation (GDPR) on the following legal bases:

• Legitimate interest (Article 6(1)(f)) for conducting scientific and applied research

• Consent (Article 6(1)(a)) for optional processing activities, such as participation in prize draws or follow-up contact

Consent for optional processing may be withdrawn at any time without affecting participation in the survey itself.

4. Categories of Personal Data

Depending on the survey, the following categories of data may be processed:

• Survey responses

• Contact details (such as email address), if voluntarily provided

• Free-text responses, which may contain personal data if participants choose to include identifying information

Participants are advised not to include names or other identifying information in open-ended responses unless they wish to do so.

5. Separation and Anonymisation of Data

Directly identifying data (such as name, email address, or phone number) is stored separately from survey responses.

Identifying data will be removed or anonymised without undue delay after the survey has closed and before analysis of the results begins. The exact timing of anonymisation may vary depending on the survey and operational requirements.

Once anonymisation has taken place, survey data can no longer be linked to individual participants and is no longer considered personal data under the GDPR.

6. Retention Periods

• Identifiable contact data is retained only for as long as necessary for the stated purpose (e.g. administering a prize draw or delivering prizes) and is deleted thereafter

• Anonymised research data is stored for up to ten (10) years for scientific and applied research purposes

Anonymised data may be included in research reports, scientific publications, or shared with other researchers for research purposes.

7. Data Subject Rights

Until personal data has been anonymised and can no longer be linked to an individual, participants have the right to:

• Access their personal data

• Request rectification or deletion

• Restrict or object to processing

• Withdraw consent for optional processing activities

Once data has been anonymised, these rights no longer apply, as the data is no longer personal data under the GDPR.

Participants also have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of their habitual residence.

8. Data Transfers

Personal data is processed within the European Union.

Personal data is not transferred outside the EU/EEA.

9. Contact

If you have questions about this privacy notice or the processing of your personal data, please contact:

juho-petteri.huhtala@aalto.fi