Your privacy is important for us

Demola Global takes your data protection seriously and will keep your personal data safe by all means necessary. We are proud to provide you control of your personal data and we respect your decisions in that matter.

Please read this document thoroughly and in case you don’t agree with Demola Global’s privacy policy, we suggest you not to apply or provide your data to Demola.

What information are we collecting

Demola is gathering applicants’ personal data from the users themselves while applying at Demola online application system at https://portal.demola.net and while signing contracts, and consists of following data:

• First and last name
• Email address
• Phone number
• Address (Street and number, postal code, city and country)
• Birth date
• Preferred Demola challenge-selections
• User preferred challenges between those available in a Demola batch
• User description about their motivation to join Demola
• User description about their motivation to join specific challenges
• User description about competence and skills
• Uploaded CV file
• Place of study
• Own, short description about their studies
• Years studied
• Approximate graduation date
• Student type
• Employment / jobseeker status (for example, whether you are an unemployed jobseeker) — collected only where you take part in a Demola program run together with public employment services
• Degree level
• Personal social network profile links

Cookies

Demola Global uses cookies from Google Analytics to analyze trends, administer the website, track users’ movements around the website, and to gather demographic information about our user base as a whole. This data is used to deliver customised content and promotions to users whose behaviour indicates that they are interested in a particular subject area.

Why are we handling your information

Your personal data will be utilized for one or more purposes mentioned below:

1. Team building

The data given when applying to Demola is used to form the best possible multidisciplinary co-creation teams to work with business project partners. The more in-depth data is given when applying, the better we can provide you our service with suitable project opportunities. You approve the use of your personal data in team building based on your consent by applying to Demola.

2. Agreement signature

As Demola project progresses, new intellectual property is generated along the way. Thus, it is important to ensure the rights of all participants in various possible situations. Demola signs agreement with the project partner and also with the project group. Your personal data will be used as identifier in Demola project group agreement in case you are selected in to a Demola project. Note: your personal data (name, address, phone number, email address and birth date) will be also visible to rest of your project group. Your personal data will be stored in the agreement for the duration of the agreement, which is five (5) years. Demola is entitled to use your data in agreement by legitimate interest.

3. Project work & facilitation

Demola projects are professionally facilitated and require intensive participation from all parties. You may be contacted via telephone, email and possibly other means by Demola personnel and project partners to ensure service experience for all participating actors. You approve the use of your personal data for facilitation and project work purposes before and during the project by legitimate interest.

4. Study coordination

In order to receive credit from university partners, such as credit points, information regarding your participation may be delivered to appropriate university staff members. University staff may reach out to you via email or phone in study-related matters. You approve sharing of your personal data to relevant staff members of appropriate Demola member universities based on legitimate interest.

5. Revenue

In case your Demola project generates financial benefits for the project group, your data will be utilized for the payment. In case other data, such as social security number or banking information, is required, Demola will request for the information separately and that information is handled according to this document based on contract and legitimate interest.

6. Recognition

Demola will use your personal details to show recognition in different forms. The most used case is your personal Demola certification. Other means of recognition might include publications of different sorts, mentions in social media etc., but they will always be done in good spirit and with positive expected value for you. You approve the use of your personal data for recognition activities based on legitimate interest.

7. Recruitment

Demola may approach you with possible job offers in Demola Summer or other paid job opportunity fulfilled by Demola in case you have given your consent for the purpose. You can approve the use of your personal data for recruitment purposes via giving your consent when asked.

8. Internship

In case you show your interest towards internships offered by Demola, you give your consent to Demola Global to share your personal information with potential internship providers and Demola staff members in your desired target country or countries. Demola may also share your information to receiving university’s personnel in case your internship requires collaboration with them and your personal data is necessary for practical arrangements.

9. Analytics & reporting

We analyse platform usage and outcomes to understand how our services are used, to measure and report on the impact of Demola activities, and to improve and develop our services. Where possible this analysis and reporting is carried out on aggregated or anonymised data. Demola handles your personal data for analytics and reporting purposes based on legitimate interest.

How are we storing, combining and automatically analyzing your information

Demola might collect data regarding your use of Demola services to enhance its provided service. Any data collected of user’s behavior is stored separately from Demola innovation platform user register and will be anonymized at all times. No behavioral data will be linked directly to you. Your data can also be sorted via algorithm for team building, but the decision of accepting or declining your application is always done by a natural person. If your data is analyzed automatically, only professionally necessary data will be used and it will be anonymized in all possible stages.

To support our staff, Demola uses artificial intelligence (AI) tools to help process and organise information internally — for example to suggest titles and tags, to transcribe audio, and to summarise internal notes our staff write while running Demola activities. Where AI produces feedback that may be shared with you (for example suggestions to improve an application), that feedback is AI-generated and advisory only. AI does not make selection decisions: the decision to accept or decline your application, and any selection into a project or team, is always made by a natural person. The AI service providers we use for these purposes are listed under “Do we share your data with others?” below.

Meeting recording in the Demola Companion app. If you use the Demola Companion app, you and your team can choose to record your team meetings as audio. Before a recording starts, the team member making the recording will tell everyone present and ask for their consent; you can decline, and you can ask to stop or delete a recording at any time, without any disadvantage to you. Recordings are linked to your team, not to you personally. When a meeting is recorded, we use AI to transcribe and summarise it and to give your team developmental feedback on your project work — for example, feedback on how you defined your project stakeholders. The AI may also try to identify who said what (for example when someone states their name or is addressed by name); any such identification is AI-generated and may be inaccurate. The feedback is AI-generated and advisory only: it is meant to help your team improve, it is never used to assess, grade, rank or select individuals, and it draws only on aggregated and anonymised knowledge from past Demola projects — not on other teams’ identifiable data. The original audio is sent only to our transcription provider and is deleted after it has been transcribed; the resulting transcript and summary may be kept as part of Demola’s knowledge base. The AI service providers we use are listed under “Do we share your data with others?” below.

Do we share your data with others?

Demola will share your data only to following parties:

1. Local universities in Demola alliance and their dedicated Demola personnel. Your data will be shared only with the necessary personnel operating Demola activities in the Demola location you have applied to.
2. Relevant staff members of appropriate Demola member universities. Your data will be shared only with the necessary personnel in Demola member universities, that have real intention to provide you credit points, mentoring or other benefits and help with your studies, Demola project or internship.
3. Project partners. Parts of your personal data may be shared with the project partners in your Demola project, and with project partners to whose project you are potentially selected to. The purpose of sharing your personal data with project partners is to create the best possible team for the project in hand and to ensure smooth communication between project partners & project group members. In case you have given your consent, your personal data might also be shared with Demola project partners for recruitment purposes.
4. Internship providers. Parts of your personal data might be shared with parties that offer internship positions through Demola to ensure suitability of position to both ways, in case you have shown your interest towards Demola internship positions.
5. Public employment services. In some municipalities we run a Demola program together with the local public employment services, and the participants are also clients of that authority. In those programs only — not in regular Demola projects — we share the participation data necessary for the collaboration, which may include your employment / jobseeker status (for example, that you are an unemployed jobseeker), with the relevant local public employment authority. That authority then processes the data as an independent controller under its own statutory duties.

Demola Global takes care through agreements and other necessary means that your personal data is processed in a legal way and with respect to this privacy policy documentation.

Service providers / sub-processors

To run our services we rely on a number of trusted service providers who process personal data on our behalf. We list them below, with the purpose, location and the safeguard that applies to any transfer outside the EU/EEA:

• Amazon Web Services (AWS) — hosting, file storage, transactional email and user authentication for our platform. Location: EU region (eu-west-1, Ireland).
• Anthropic (Claude) — AI assistant used by Demola staff to analyse platform data. Location: USA. Safeguard: Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework.
• OpenAI — AI titling, tagging, transcription and summarisation of internal notes. Location: USA. Safeguard: Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework.
• Deepgram — audio transcription of recorded sessions, where used. Location: USA. Safeguard: Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework.
• eSignatures (esignatures.com) — electronic signing of project contracts and agreements (signer name, email address and phone number). Location: outside the EU/EEA. Safeguard: Standard Contractual Clauses.
• Microsoft — online meeting links (Microsoft Teams) for project sessions. Location: EU (Microsoft 365). Safeguard: Microsoft Data Protection Addendum / Standard Contractual Clauses.
• GitHub — private code repositories for project teams (collaborator email address). Location: USA. Safeguard: Standard Contractual Clauses.
• Google Analytics — website usage and traffic analytics (see “Cookies” above). Location: USA. Safeguard: Standard Contractual Clauses and the EU-US Data Privacy Framework.
• Google reCAPTCHA — protection of our application and contact forms against automated abuse and spam. Location: USA. Only minimal data (visitor IP address and interaction signals) is processed for this purpose; the same transfer safeguards as the other Google services listed above apply.

We might share your personal data with entities outside the EU/EEA regarding the aforementioned use cases — including our service providers (such as the US-based AI providers Anthropic and OpenAI) and, where relevant, project partner companies or other recipients located outside the EU/EEA. When personal data are transferred outside the EU/EEA, the transfer is made under appropriate safeguards: an adequacy decision, the European Commission’s Standard Contractual Clauses (SCCs), or — for certified US recipients — the EU-US Data Privacy Framework.

How is the information kept up-to-date

You are responsible of keeping your personal data updated in Demola services. You are able to edit your data in case of errors or changes to personal data through your application at portal.demola.net.

What measures are we taking to protect your data

Demola is utilizing privacy by design and is minimizing the need of storing your data anywhere else than systems designed specifically for the use. Only the people with exact need to handle your data will be granted with the access to your data and they are given training on the topic. Personal data privacy and data security are maintained by a separate team inside Demola.

We continuously monitor our services and underlying infrastructure to protect them from threats, including spam, malware, viruses, and other forms of malicious code. We have security measures designed to protect against the loss, misuse and/or alteration of the information under our control. These include:

• Encryption of your information whilst it travels between your device and our servers, including leading encryption technology like HTTPS and Transport Layer Security.
• All data is backed up daily. Files that you upload (such as your CV) are stored on servers that use modern techniques of encryption.
• Firewalls. We prevent others from accessing confidential data or accessing internal networks that store your data.
• The servers on which the data is maintained are properly protected from outsiders. They can be accessed only by predefined personnel who are obligated to maintain secrecy.

How long we will store your data

Your data will be stored no longer than necessary. We will delete the identifying data of you within one year after your estimated graduation date mentioned in Demola profile, unless you give consent to store your data beyond that. Demola project participants’ name, date of birth, address, email address and phone number will be stored in the Demola project group agreement for 5 years after the end of the project. However, that data is strictly used only for fulfilling the agreement.

Your consent of storing your personal data for longer than stated in this document may be asked, as there might be need to utilize your data for possible recognition activities or to contact with relevant job opportunities after your Demola project.

What are your rights

Based on our values and governing GDPR, you have always the right to be in control of your personal data. All personal data requests will be processed without unreasonable delay, but always within 30 days. Demola can require you to prove your identity in case of any data request.

Right to know what is stored of you

You may always request to see what data is stored of you by contacting us through Demola’s web pages or by contacting Demola via contact details found in the end of this document.

Right to be forgotten

You have the right to be forgotten and your data to be removed during all times. You can get your data removed through your application at portal.demola.net, through Demola web page’s contact form or by contacting Demola via contact details found in the end of this document.

However, your data is very important for the duration of Demola project, so we are kindly asking you not to remove your personal data during a Demola project you are participating in. In case you still remove your personal data from Demola during your Demola project, you waive your right to receive any recognition, awards, certificate or financial benefits from Demola. Your personal data will also be stored in the Demola project group agreement for 5 years after signing it. However, that data is used strictly for fulfilling the agreement.

Right to transfer your data

You have the right to transfer your data to another service at any time. You can request data transfer through Demola web page’s contact form or by contacting Demola via contact details found in the end of this document.

Right to correct your data

You have the right to have correct data stored of you at all times. You can correct your personal data through your application at portal.demola.net, ask it to be corrected through Demola web page’s contact form, or by contacting Demola via contact details found in the end of this document.

Right to withdraw consent

If the processing of your personal data is based on consent, you have the right to withdraw consent at any time. The withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.You can always withdraw any consent by contacting Demola Global using the contact information provided in the end of this document.

How to exercise the rights of the data subjects

After receiving all the required information of your request (including confirmation of identity), we will start the processing of your request. We will do our best effort to process your request within a period of one (1) month.

We may reject requests that are unreasonably repetitive, excessive or manifestly unfounded.

Right to contact supervisory authority

You have the right to contact and lodge a complaint with a supervisory authority, if you consider that the processing of personal data relating to you infringes this documentation or legislation, including General Data Protection Regulation (GDPR) in Europe.

We are kindly asking you to contact Demola Global, whose contact details can be found at the end of this document, to investigate the case with you before reaching out to the supervisory authorities.

We may change this Privacy Policy from time to time, whenever necessary. All changes hereto will be made available on our website: www.demola.net.