Privacy notice

Data controller

Oiketos Oy · Business ID 2393286-3
info@oiketos.com

This notice concerns the leadership school provided by Oiketos Oy at praxis.kalliopolku.fi. Kalliopolku Leadership School is its marketing name. Oiketos Oy is the formal service provider and data controller.

What data is processed?

• Account data: name, email address, technical user identifier and sign-in method, and an optional profile picture. Google sign-in links an identity-provider user identifier to your account.
• Learning data: course enrolments, task answers and revisions, progress, and saved reading and listening preferences.
• Support features you use: Sophia conversations, responses and feedback, and any mentor invitations, mentoring relationships and shared reports.
• Technical data: sign-in and event logs, including event times and IP addresses, session data, and language and appearance preferences.

Data comes from you, your chosen sign-in provider and your use of the leadership school service. Course instructors and mentors may add information about tasks and support within their permissions.

Signing in with Google

When you choose Google sign-in, Google verifies your identity and provides the leadership school with basic identity and profile data: your name, email address and an optional profile picture. This is used to create and identify your account and sign you in. The leadership school does not receive your Google password. Google processes data in its own sign-in service under its own terms. Google Privacy Policy

Purposes and legal bases

The leadership school uses personal data to maintain accounts and courses, provide learning and guidance, save progress, send service messages, and operate and secure the service.

You provide the information yourself when registering and using the service. Processing the personal data needed for your account and the education and guidance you request is based on performance of a contract (GDPR Article 6(1)(b)). Processing is limited to what is needed to provide the requested service.

Access and service providers

The leadership school stores data in its learning-service database and file storage. Permissions restrict access. Course instructors, accepted mentors and administrators have access according to their responsibilities and assigned service permissions.

Telia delivers service emails. Delivery involves processing the recipient's name and email address, the message content and technical delivery information.

Sophia and other AI features

AI-Sophia uses an OpenAI model. Sending a message to Sophia involves sharing your own message, relevant earlier conversation content, any related task answer, and the course and source material needed to produce a response with OpenAI.

OpenAI's guidance states that stored model responses are retained for at least 30 days by default. Abuse-monitoring logs are normally retained for up to 30 days; legal or safety requirements can extend this period.

OpenAI does not use API data to train models by default. The leadership school does not opt its material into voluntary training use. OpenAI data processing and retention guidance

OpenAI processing may take place outside the EEA. Transfers are technically protected.

Share only what is needed for an exercise. Avoid unnecessary health, religious or other sensitive details and identifiable information about other people, particularly in AI conversations.

Your rights

You can ask about the processing of your personal data, request access to it, and request correction or deletion. Where applicable, you can request restriction of processing or data portability, and object to processing. If processing is based on consent, you can withdraw it. Send your request to the controller using the contact address below. Your identity may need to be verified before fulfilling the request. You can also lodge a complaint with the Finnish Data Protection Ombudsman.

Data Protection Ombudsman: lodging a complaint

Cookies

The leadership school learning service uses a session cookie to maintain sign-in, your session across pages and preferences stored in that session. The cookie does not contain your password.

The service does not use analytics or marketing cookies. No such cookies or additional tracking features are being added at this stage.

Language and appearance choices are stored in the session for anonymous visitors and in user preferences for signed-in users. They do not need a separate tracking cookie.

Moodle also uses localStorage and sessionStorage in your browser for interface strings, templates, version information and cache management data. These browser stores are distinct from cookies and the learning data saved to your account.

If you proceed to Google sign-in, Google may use cookies on its own page. Their information and controls belong to Google's service.

You can delete cookies in your browser settings. Blocking the session cookie prevents normal sign-in operation. This information page does not request consent to other cookies.

Privacy enquiries

Send privacy questions and personal data requests to Oiketos Oy at info@oiketos.com.