GDPR Compliance

Introduction

AuroraSpinn Entertainment Oy is committed to protecting your personal data and complying with the EU General Data Protection Regulation (GDPR) 2016/679. This page provides detailed information about how we comply with GDPR requirements and your rights as a data subject.

Data Controller

Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent: For cookies and similar technologies (Article 6(1)(a) GDPR)
• Legitimate Interests: For website analytics and security (Article 6(1)(f) GDPR)
• Legal Obligation: For compliance with legal requirements (Article 6(1)(c) GDPR)

Your Rights Under GDPR

1. Right of Access (Article 15)

You have the right to obtain confirmation as to whether we are processing your personal data and, if so, to access that data and receive information about:

• The purposes of processing
• The categories of personal data
• The recipients or categories of recipients
• The retention period
• Your other GDPR rights

2. Right to Rectification (Article 16)

You have the right to have inaccurate personal data corrected and incomplete personal data completed.

3. Right to Erasure / "Right to be Forgotten" (Article 17)

You have the right to request deletion of your personal data when:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• Erasure is necessary for compliance with a legal obligation

4. Right to Restriction of Processing (Article 18)

You have the right to restrict processing of your personal data when:

• You contest the accuracy of the data
• Processing is unlawful but you prefer restriction to erasure
• We no longer need the data but you need it for legal claims
• You have objected to processing pending verification

5. Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller where technically feasible.

6. Right to Object (Article 21)

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.

7. Right to Withdraw Consent (Article 7(3))

Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

8. Right Not to be Subject to Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us:

We will respond to your request within one month. In complex cases, we may extend this by two additional months, and we will inform you of any such extension.

Data We Collect

We collect the following categories of personal data:

• Automatically collected data: IP address, browser type, device information, pages visited, timestamps
• Cookies: See our cookie policy for details

How We Use Your Data

We use your personal data for the following purposes:

• To provide and maintain our Service
• To analyze website usage and improve user experience
• To detect and prevent security threats
• To comply with legal obligations

Data Sharing

We do not sell your personal data. We may share your data with:

• Service providers: Who process data on our behalf under strict contractual obligations
• Legal authorities: When required by law or to protect our rights

International Data Transfers

If we transfer your data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as:

• EU Commission approved Standard Contractual Clauses
• Transfer to countries with an adequacy decision
• Other legally approved mechanisms

Data Retention

We retain your personal data only as long as necessary for the purposes for which it was collected or as required by law. Our retention periods are:

• Website analytics data: 26 months
• Cookie consent records: 12 months
• Security logs: 90 days

Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• HTTPS encryption for data transmission
• Access controls and authentication
• Regular security assessments
• Staff training on data protection
• Incident response procedures

Data Breach Notification

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay as required by Article 34 GDPR.

Children's Privacy

Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it immediately.

Cookies and Tracking

We use cookies in accordance with EU Directive 2002/58/EC (ePrivacy Directive). You can manage your cookie preferences through our cookie consent banner or your browser settings.

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated.

Finnish Supervisory Authority:

Updates to This Policy

We may update this GDPR compliance page to reflect changes in our practices or legal requirements. We will notify you of significant changes by posting a notice on our website.

Contact Us

For any questions about GDPR compliance or to exercise your rights, please contact our Data Protection Officer:

Last Updated: October 14, 2025