Privacy

Who we are

Curatum is run by Diogo Diogo Oy, a company registered in Finland (Business ID 3654172-2), which is the controller of the personal data described here.

To ask about your data or exercise your rights, write to us through the contact form and mention privacy in your message.

What we collect, why and for how long

• Joining the list. Name, email, organisation and role, to send you the report and occasional research notes. Legal basis: your consent, which you can withdraw at any time. Kept until you ask to be removed, and reviewed at least every two years.
• Booking a conversation. Name, email, organisation, role and your message, to reply and set up the conversation. Legal basis: steps you asked for before a possible contract, and our legitimate interest in answering. Kept for up to 24 months after our last contact, unless it becomes a client relationship.
• Website measurement. Pages viewed, buttons clicked, language, type of device and browser, and the site you came from. No cookies, nothing stored on your device, and IP addresses are discarded before the data is stored. Legal basis: our legitimate interest in knowing which parts of the site are useful. Kept for up to 12 months.
• Google Analytics (only if you accept). The same kind of information, measured with cookies on your device. Legal basis: your consent, which you can withdraw at any time at the end of this page. Cookies last up to 13 months; Google keeps the data for up to 14 months.
• Platform accounts (clients). Email address, a password stored only as a secure hash by our sign-in provider (or a personal access link, of which we keep only a fingerprint), your organisation, role and the venues you can see, and how the platform is used (pages and periods opened, under a short pseudonymous code, never the figures on screen). Legal basis: the contract with your organisation and our legitimate interest in improving the service. Kept while the account is active and up to 12 months after it is closed.
• Data clients bring to the platform (ticketing, survey answers, reviews). We process it on behalf of each institution, which remains its controller, under an agreement with that institution. This notice does not cover it: please ask the institution.

Who processes data for us

• Cloudflare: hosting and delivery of the site (global network).
• Supabase: database and sign-in (servers in Frankfurt, Germany).
• PostHog: website and product measurement (EU servers in Frankfurt, Germany).
• Google (Google Ireland Ltd.): Google Tag Manager and Google Analytics, only with your consent (Google may process data in the United States).
• Google Cloud BigQuery: data warehouse for client data (Madrid, Spain).
• Anthropic: writes the readings in the platform, reads institutions' public websites and describes the columns of imported files. It receives aggregated figures, public web pages and column summaries with personal data removed, never visitors' personal data (United States).

We do not sell personal data or use it for advertising.

Transfers outside the EU

Cloudflare may handle technical data such as your IP address on its global network, under the EU-US Data Privacy Framework and standard contractual clauses. If you accept Google Analytics, Google may do the same, under the same framework. Anthropic receives no personal data of visitors from us.

Cookies and browser storage

The website sets cookies only if you accept Google Analytics (_ga and _ga_…, up to 13 months), and never for advertising. The rest of the measurement uses no cookies.

The platform uses your browser's storage to keep you signed in and to remember preferences such as the selected venue or period, and the site remembers your answer about Google Analytics; this is needed for the service to work.

Your rights

You can ask for access to your data, its correction or deletion, to restrict or object to its use, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time.

You can also complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or to the authority in your country (in Portugal, the CNPD at cnpd.pt).

Changes

We update this page when what we do changes. The date above shows the current version.