Privacy Policy

Privacy Notice for cumulusassociation.org and the member register of Cumulus Association

The website cumulusassociation.org (the “Website” or the “Service”) is maintained and hosted by the International Association of Universities and Colleges of Art, Design and Media (“Cumulus Association”, “Cumulus”, “we” or “us”). The member register of Cumulus Association is also maintained on the Website. This privacy notice explains about the means and purposes of processing of personal data of the visitors of the Website and of the members of Cumulus Association.

Protecting your privacy and your personal data is of the utmost importance to Cumulus Association. Cumulus Association is committed to complying with the requirements that the European Data Protection Regulation (the GDPR) places upon us in the processing of your personal data.
This privacy notice is subject to change. This privacy notice will be updated when changes are implemented. You will always find the up-to-date version of this privacy notice on this website.

1. Why does Cumulus Association process personal data?

Cumulus Association collects and processes certain personal data in order to:

• enable you to use the Website
• maintain and develop the Website
• enhance or improve your experience of the Website by collecting details of your visit
• keep a register of our members and their contact persons (who are hereinafter jointly referred to as “Members”)
• enable communication and marketing

In addition, Cumulus Association will also process personal data for the purposes of data security and to prevent and resolve possible misconduct.

2. Whose data is being collected?

We collect information of Cumulus full and associate members in our member register. We also collect information of the users visiting the Website. Further, we collect information of the subscribers and readers of our newsletter, and of persons sending us information for publication on the Website or participating in our events or competitions.

3. What personal data does Cumulus Association process?

Cumulus Association will only process personal data that is necessary for the processing purposes defined in this privacy notice. The personal data that we collect can be grouped into the following categories:

• Information collected through observing the use of the Website
• The user’s Internet Protocol address (IP address) along with metadata of the hardware they are using while visiting the Website; e.g. time of visit to our service; the page from which the system accessed our website; pages visited during the session; browser type, browser version, device type, operating system and similar technical information. No cookies are used to collect this data.
• Member register of full and associate members of Cumulus

The register may include following information of member institutions and its representatives:

• Identification information: such as title, forename, surname
• Contact information: such as name of staff, telephone number, email, postal addresses
• Social media information
• Details to Zoom, Skype and other equivalent platforms
• Other institutional information
• News and notices of events of our Members and partners. Information of persons submitting entries in competitions, events and/or conferences, and their entries such as designs, presentations, articles and other publications.

4. Sources of information

The information and data that are collected in the Cumulus member register are provided to the Cumulus Association by the members themselves.
Personal data is collected from the users themselves when they visit the Website, or when they otherwise interact with Cumulus Association.

5. What information and data are published on the Website?

Information submitted by the Members to the Cumulus member register will be published on the Website, except for data entries marked as “not visible” in the member register.
News and events are published on the Website with the authorization and approval of the organizers and holders of the events.
The rights of publications, designs and equivalent are defined and secured separately within the context of competitions, events and/or conferences that they emerge from or in cooperation with.

6. Lawful Basis for Processing

Our legal basis for processing personal data is a legitimate interest to maintain and develop the Website and our member register, and to communicate and to market Cumulus Association:

• Personal data processed for communication and marketing purposes
• Information collected through observing use of the Website
• Member information
• Newsletter user profile data
• The processing of personal data for the purposes of data security and to prevent and resolve possible misconduct

7. Processing of information by third parties

Cumulus Association discloses personal data to third parties only to the extent necessary for the purposes personal data is processed:

I) Service providers

In the maintenance of its Website, Cumulus Association uses partners to process data for the purposes detailed in this privacy notice. Cumulus Association transfers your personal data to such partners only to the extent that the partners need to be able to access the personal data that we process in order to be able provide Cumulus Association with services for the purposes specified in this data protection policy.
Our website makes use of the plug-in “WordPress statistics”, which enable the compilation of statistics and analysis on the use of the website.

II) Research use

In some situations, Cumulus Association may disclose your personal data for the purposes of research. In these cases, all personal data is processed in accordance with the General Data Protection Regulation and national data protection legislation.

III) Statutory reasons

Cumulus Association may disclose your personal data to third parties if access to personal data or other processing of personal data is required to i) fulfill statutory responsibilities or a court order; ii) detecting, preventing or handling misuses, security risks or technical issues.

8. International transfers of personal data

The server on which the Website is operated is in the European Union (EU). We strive to carry out all services related to the Website using operators and services located within the EU or the European Economic Area (EEA). In some cases, however, services related to the use of our Website may also be carried out by operators and on servers located in third countries. In such cases, your personal data may also be transferred outside the EU or EEA in accordance with applicable legislation. Regarding transfers of personal data to countries where local data protection legislation does not provide an adequate level of data protection, transfers are protected utilizing appropriate safeguards, such as standard contractual clauses approved by the European Commission or binding corporate rules. To learn more about the appropriate safeguards we use, please contact us by using the contact information provided below.

9. Retention period

Personal data will be retained for the period of validity of the legal basis for processing and for as long as necessary for the processing purposes mentioned in this privacy notice.

The information of the users is retained for as long as Cumulus Association´s legitimate interests can reasonably be deemed valid. We determine the validity of our legitimate interest by, for example, your use of our online services as well as the communication between us.

10. Your rights

The General Data Protection Regulation grants the data subject a number of rights with which the data subject can govern the processing of their personal data. The data subject may use the following rights in relation to Cumulus when Cumulus acts as the controller for the data subject’s personal data:

Right of access and right to rectification

You have the right to receive confirmation on whether we process personal data relating to you and the right to access any such personal data. Cumulus may ask you to specify your request where necessary.

In addition, you have the right to request the rectification of incorrect personal data relating to you, or to supplement incomplete personal data that Cumulus is processing.

Right to data erasure

You have the right to request erasure of your personal data from our data systems. Cumulus will comply with your request, provided that there is no legitimate reason to retain the data, such as a statutory obligation to continue processing the personal data. Personal data may not be deleted instantly from backup copies and other such data systems, but will be deleted through regular database retention practices.

Right to object

You also have the right to object to the processing of your personal data if your personal data is processed for other purposes than the fulfillment of legal responsibilities or the provision of services. You may object to the processing of your personal data for purposes of direct marketing, even if the basis for such processing is consent given by you in the past. Objecting to the processing of your personal data may lead to limitation of the usage of the Cumulus website. You have the right to prohibit direct marketing by following the instructions contained in all of our marketing messages.

Right to restriction of processing

If you contest the correctness of the data which we have registered about you or the lawfulness of processing, or if you have objected to the processing of the data in accordance with your right to object, you may request us to restrict the processing of these data to only storage. The processing will only be restricted to storage, until the correctness of the data can be established, or until it is assured that our legitimate interests override your interests.

If you are not entitled to erasure of the data which we have registered about you, you may instead request that we restrict the processing of these data to only storage. If the processing of the data which we have registered about you is solely necessary to assert a legal claim, you may also demand that other processing of these data be restricted to storage. We may process your data for other purposes if this is necessary to assert a legal claim or if you have granted your consent to this.

Right to data portability

You have the right to receive your personal data from us in a structured, commonly used format so that you may transfer your personal data to another controller, provided that the processing of your personal data is based on consent or a contract between you and Cumulus.

11. Who is the controller and who can I contact?

The controller of your personal data is The International Association of Universities and Colleges of Art, Design and Media (Cumulus Association), which is legally represented by Aalto University Foundation sr (Aalto University).

The contact person in matters related to the Website and the Cumulus member register is:

Anna Lindberg
E-mail: [email protected]

Mailing address: Cumulus Association, P.O. Box 11000, 00076 AALTO, FINLAND
Visiting address: Otakaari 1, 02150 Espoo
Service Address: www.cumulusassociation.org

Data protection officer:

You can use your rights by contacting Aalto University’s data protection officer. The extent of your rights is subject to the legal basis for processing, and exercising your rights requires identification.

Anni Tuomela

Contact information: [email protected], tel. (switchboard) +358 (9) 47001

Right to lodge a complaint:

If the processing of your personal data is in breach of applicable legislation, you have the right to lodge a complaint with the national supervisory authority. You can lodge the complaint with a competent supervisory authority. In Finland, this is the Data Protection Ombudsman, and the complaint must be lodged in accordance with instructions provided by the Office of the Data Protection Ombudsman. Please see https://tietosuoja.fi/en/home for more information.