1. INTRODUCTION

Aichologist Oy (later “We, “Us or “Ours”) is committed to ensure compliance with applicable data protection laws and regulations of the European Union. This Privacy Notice (“Notice”) is based on the principles and requirements of the EU General Data Protection Regulation (“GDPR), and all other applicable national data protection laws. By means of this Notice we would like to inform you, the data subject, about how and why we collect, process and use personal data, and about your rights as a data subject in regard to the processing of your personal data.

2. SCOPE AND SUPPLEMENT

This Notice covers all forms of processing of personal data by Aichologist Oy. It describes how Aichologist Oy collects, uses, and shares personal data obtained directly from the user, customer, supplier, business partner, or other, or obtained indirectly from other sources. It applies to the processing of personal data obtained through any channel of communication or by any means, including but not limited to email, file transfer, feeding personal data into applications and tools, websites or mobile apps, social media pages and platforms. This Notice may be supplemented by specific data protection and privacy notices and statements that relate to specific forms or purposes of data processing.

3. APPLICATION OF NATIONAL LAWS

While the GDPR is applicable to processing of data of EU residents, there may be laws and regulations in some countries which specify further data protection requirements, in particular conditions for lawful data processing. If so, it has to be verified on a case-to-case basis whether these laws can prevail.

4. PERSONAL DATA WE PROCESS, PURPOSES AND BASIS

This section of our Notice describes what personal data we collect and process, for what purposes and on what legal basis. The amount of personal data we process depends on the context and circumstances of your interaction with us and we strive to minimize it.

4.1. HANDLING ORDERS AND CONTRACTUAL OBLIGATIONS

When you place orders to purchase goods or services from Us, or if you request information about products and services prior to placing an order, or if you request support regarding the product or services you have ordered, We will process personal data that is necessary to negotiate and execute a contract and to fulfill any contractual obligations, and to exercise our rights under the contract. This also includes advisory services under the contract if this is related to the contractual purpose. Prior to the conclusion of a contract personal data can be processed to prepare bids or tenders or to fulfill other requests of the prospect that relate to contract conclusion. For this purpose We process personal data (including, but not limited to, name, title, email, telephone, postal address, shipping and billing address), order and customer information (including goods and services ordered and provided, instructions regarding the order, customer business activities and interests and order history), financial information (including invoice data, preferred payment options, term of payment, bank account and credit card information). The legal basis for processing personal data for the purpose of handling orders and fulfilling contractual obligations and exercising contractual rights is Article 6 (1) b) GDPR (contractual necessity). The legal basis for processing personal data for the purposes of understanding customer business activities and interests and order history is Article 6 (1) f) GDPR (legitimate interests). The legal basis for processing and keeping personal data for the purpose of complying with record keeping obligations (including commercial accounting standards and tax and fiscal retention obligations) is Article 6 (1) c) GDPR (legal obligation).

4.2. BROWSING OR REGISTERING ON OUR WEBSITES, SERVICES OR SOCIAL MEDIA

When You browse Our websites, social media pages or platforms, We may use cookies and other tracking technologies to capture and understand how you use our websites, social media pages and platforms. Depending on the cookies and tracking technologies in use, We collect information about your online browsing behavior on Our websites, social media page or services, including information on how you react to adverts and offers. We may also collect information about the device You have used to access Our websites, social media pages or services, (including device model and operating system, browser type, IP-address, mobile device identifiers). Cookies are collected using these third-party tools: Provider: Auth0 Purpose Authentication provider for our web-based application. https://auth0.com/privacy https://auth0.com/docs/manage-users/cookies/authentication-api-cookies Cookiebot Purpose GDPR compliant cookies collection https://www.cookiebot.com/en/privacy-policy/ Last updated: 22th Sep 2024 You can disable cookies at any time by accessing the pop-up menu in the visited website or by blocking them on your browser. Some of the cookies are required for the service to work properly, for instance those cookies that are needed for secured authentication. When You register on one of our websites, social media pages or services We will additionally process personal details (including name, title, email, telephone), and account details (including username, password, login-/logoff data), except where registration under an alias or pseudonym is permitted. The legal basis for processing information about online browsing behavior, if it contains personal data, is Article 6 (1) a) GDPR (consent), if we ask you to provide consent and to agree to the processing of your personal data. Specific other provisions in laws relating to data processing in an online context may require your consent as well. Under some circumstances e.g. when we process a limited amount of personal data which, by type and nature does not significantly affect your rights and freedoms, the legal basis for processing your personal data in the context of your browsing or registering on our websites, social media pages or platforms is Article 6 (1) f) GDPR (legitimate interests).

4.3. COMMUNICATION, MARKETING, TAKING PART IN PROMOTIONS, EVENTS AND FEEDBACK

When You contact us for any sort of inquiry or request, We will process Your personal details (including name, title, company or organization you work for, email, telephone, other contact information), as far as this is necessary to deal with your inquiry or request and to respond to. When You have purchased goods or services from Us, or if You have indicated to us that You are interested in certain goods or services, We may process your personal details (including name, title, company or organization you work for, email, telephone, other contact information) to contact You and to send You information about Our or Our business partners’ goods and services, new technological developments, special offers and business opportunities. When You take part in promotions or events hosted or sponsored by Us, we will process Your personal details (including name, title, company or organization you work for, email, telephone, other contact information) to manage Your participation in the promotion or event, to provide You with information about Our or Our business partners’ goods and services, new technological developments, special offers and business opportunities. We will also process Your personal details to ask for Your feedback regarding the promotion or event, your satisfaction with Our or Our business partners’ goods or services and performance. We may also ask You for contributions to improve and enhance Our goods and services and collaboration with Our business partners. The legal basis for processing personal data for the purpose of communicating with you and to respond to any sort of inquiry or request is Article 6 (1) b) GDPR (contractual necessity), as far as it occurs in the context of preparing or facilitating the conclusion of a contract or to answer to inquiries and requests in connection with a contract. As far as personal data is processed for communicating with you on other matters the legal basis is Article 6 (1) f) GDPR (legitimate interests).

4.4. LEGAL OBLIGATIONS AND COMPLIANCE

Our business is subject to various laws and regulations that impose legal obligations on Us. Some of these laws and regulations may require the collection and processing of personal data (e.g. tax laws, commercial laws, trade and export compliance regulations etc.). Where such legal obligations are based on EU or EU Member State laws and regulations, the legal basis for processing personal data is Article 6 (1) c) GDPR. Where such legal obligations are based on laws and regulations of third countries (non-EU), compliance with these legal obligations may represent a legitimate interest. If so, the legal basis for processing personal data is Article 6 (1) f) GDPR. The latter applies also to the processing of personal data for the purpose of ensuring compliance with Our policies, codes of conduct and regulations.

4.5. USE OF AICHOLOGIST SERVICES LIKE AI-PSYCHOLOGIST AND AI-PERFORMANCE COACH

Aichologist Services like AI-Psychologist and AI-Performance Coach are run by Aichologist Oy. By using the Services, you consent to the things you tell the bot being collected and used for generating the bot’s responses as well as for additional purposes as explained below. You also consent to us gathering any other information that you explicitly provide us and that is necessary for us to offer You access to the bot. You do not need to share any personal information that you are not comfortable sharing. Aichologist encrypts user conversation logs by default and depending on the settings they are visible either only to the User or also the development team. Content development and some technical personnel may have access to logs of conversations with the bot, but in such cases the identities of the users are not included in the corresponding log entry. This information is used for improving the bot, better understanding the needs of various users, and troubleshooting any problems that may occur. Users can opt-in to personalized mode, where logs are also used for personalizing bot behavior according to the user and improving the user experience. Users can also share their conversation logs or conversation summaries with Aichologist personnel such as psychologist at their will. Additionally, information is collected from the logs in anonymized form for preparing summary reports of issues. In Business use issues could be such as employee satisfaction and commonly occurring problems for the company’s management. These reports are thoroughly anonymized and no personally identifying information is included as a part of such reports. The bot uses artificial intelligence and natural language processing technology for purposes such as selecting or generating a response to what you have said. Similar methods may also be applied to analyzing your conversation history with the bot in order to develop a profile of you, so that the bot may offer you more personally relevant content. All information about you is treated as confidential. With the exception of anonymized information used for compiling summary reports, no information about you will be shared with any external organizations except for authorities where required by law. We will never sell your information for marketing purposes or anything sleazy like that. NOTE THAT AS FOR NOW, INTERNATIONAL AND NON-EUROPEAN ORGANIZATIONS SUCH AS OPENAI MIGHT BE INVOLVED IN PROCESSING SOME OF THE DATA YOU PROVIDE IN MESSAGES. DO NOT SHARE ANY INFORMATION WHICH YOU ARE NOT COMFORTABLE SHARING OR WHICH CAN BE CONNECTED TO YOU. SUCH INFORMATION COULD INCLUDE BUSINESS CRITICAL DATA, CONFIDENTIAL OR SENSITIVE INFORMATION REGARDING IDENTIFIABLE DATA ABOUT YOU OR OTHER PEOPLE SUCH AS NAMES, ADDRESSES ETC. The content of some of your messages is processed by external Large Language Model API providers such as OpenAI, whose artificial intelligence technology is used for generating responses to your messages. WE DO NOT INCLUDE ANY IDENTIFIABLE INFORMATION ABOUT YOU TO SUCH 3RD PARTIES, BUT WE CANNOT CONTROL WHAT YOU CHOOSE TO SHARE IN YOUR WRITTEN MESSAGES WITH THE BOT. All of these services execute the EU’s Standard Contractual Clauses for transfer and processing of information in third countries, ensuring appropriate safeguards for your information. We may also make use of other international and non-European services that execute the Standard Contractual Clauses.

5. SHARING PERSONAL DATA WITH SERVICE PROVIDERS AND THIRD PARTIES

Not all processing of Your personal data will be carried out by Aichologist Oy itself. Sometimes We will make use of service providers and vendors (“processors”) who will process personal data for Us, on our behalf and under our instructions. Any such outsourcing of data processing will follow a service provider / vendor due diligence and monitoring protocol, and will be governed by a Data Processing Agreement.

6. STORING PERIODS FOR PERSONAL DATA

Generally we keep personal data for no longer than is necessary for pursuing or achieving the purposes for which the personal data is processed. If We process personal data for the purpose of handling orders and fulfilling contractual obligations We will keep your personal data for as long as You have a customer or business relation with Us. Personal data that is included in documents or files that are subject to tax laws will be kept for 10 years (unless statutory provisions or pending lawsuits or tax proceedings require longer retention), personal data that is included in documents or files that are subject to commercial laws will be kept for 6 years (unless statutory provisions or pending lawsuits require longer retention). If We process personal data for the purpose of understanding your online browsing behavior We will keep personal data only for as long as necessary to create user statistics and analytics reports that use aggregate data (non-personal data). If We process personal data for the purpose of communication, marketing, promotion, event and feedback purposes, We will keep the data for a maximum of 6 months, or for as long as We have a legitimate interest to provide you with business, product and service information, or marketing, event and promotion materials, except where you have objected to the processing of your personal data for such purposes. If We process personal data for the purpose of compliance with laws and regulations that impose legal obligations on Aichologist Oy, We keep personal data for as long as such laws and regulations require. If We process personal data for the purpose of recruitment and carrying out the application process, We keep personal data for as long as necessary to review and assess the applications, to select applicants, to negotiate and execute an employment contract, and to exercise rights or defend against claims in the context of the applications process. If an application is successful, Your personal data – as far as necessary for carrying out the employment contract – will be kept for as long as you are employed with Aichologist Oy and after termination of your employment, for as long as necessary to comply with retention requirements, or for as long as forthcoming or pending lawsuits require longer retention. If Your application is not successful, We will keep your personal data for up to six months for the purpose of defending us against potential claims and lawsuits. If your application was not successful, but you have agreed that We keep your personal data on file for future opportunities, We will keep your personal data for up to two years, unless specified otherwise on Our careers websites, recruitment platforms or job portals, or in a job advertisement.

7. TRANSFERS OF PERSONAL DATA TO THIRD COUNTRIES

We do not transfer personal data outside the EEA for the time being. The Azure data center is owned by the Microsoft corporation. We do not authorize the Microsoft corporation to access, or otherwise transfer any personal data. Any processing of personal data made by Microsoft is subject to the Microsoft data protection policy applicable to the Azure data center referred above in section 4.2.

8. SECURITY OF PERSONAL DATA

We have implemented technical and organizational security measures to protect personal data we process against accidental or unlawful manipulation, destruction or loss, alteration, and against unauthorized disclosure or access by third parties. Such security measures include authentication tools, firewalls, monitoring of IT systems and networks, pseudonymization and encryption of personal data. The technical and organizational security measures are reviewed and adjusted on a regular basis, taking into account the state of the art of technology, the nature, scope, context and purposes of processing and the risks and probability of occurrence. However, given the dynamic context of security measures, state of the art of technology, vulnerabilities, threats and risks, absolute security cannot be guaranteed. If you have a particular concern about the security of your personal data, you may make an inquiry at info@aichologist.io

9. MARKETING PREFERENCES

We may have a legitimate interest to process Your personal details (including name, title, company or organization you work for, email, telephone, other contact information) to manage Your participation in a promotion or event, or to provide You with information about Our or Our business partners’ goods and services, new technological developments, special offers and business opportunities. For these purposes may use Your personal details, in accordance with any preferences, if expressed, to send You product and service information and marketing messages by email, post, phone and social media, unless You have asked us not to. Unless consent is required as a legal basis, which would also require an opt-in, You will always have the opportunity to opt-out of receiving product and service information and marketing messages by simply ticking a box or clicking on a button or link, or by changing your preferences in your account settings, as applicable. You can of course instruct us in the same way to stop sending you product and service information and marketing messages at any time afterwards. If You instruct us to stop sending you product and service information and marketing messages it might take some time for all our systems and applications to be updated, so you might still get messages from Us while we fully process Your instruction. Please note that instructing Us to stop sending marketing messages will not stop Our other communication with You, such as order conformations, order updates, shipping notices or payment requests.

10. YOUR RIGHTS OVER YOUR PERSONAL DATA

You have many rights over your personal data and how it is used. These rights are summarized below. In order to assert any of these rights you may contact info@aichologist.io.

10.1. RIGHT TO ACCESS YOUR PERSONAL DATA

You have the right to request a confirmation as to whether or not We process personal data concerning you. If We process personal data about you, You have the right to request access to the personal data and to obtain information regarding the purpose of the processing; the categories of personal data concerned; who else outside Aichologist Oy might have received the data; any available information what the source of the data was, if you did not provide it directly to us; the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period. You may also request a copy of the personal data undergoing processing.

10.2. RIGHT TO RECTIFY YOUR PERSONAL DATA

You have a right to rectify or request a correction of the record of Your personal data processed by Us, if it is inaccurate or incorrect.

10.3. RIGHT TO ERASE YOUR PERSONAL DATA

You have the right to request erasure of Your personal data. However, there may be reasons and legal grounds for keeping your personal data despite your request, e.g. if We need the data to fulfill orders or other contractual obligations, or if record keeping obligations prevent the erasure, or when We handle an ongoing complaint. If We need to continue to process your personal data We will tell You why We need to do this when We respond to your request.

10.4. RIGHT TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA

You have the right to object to the processing of Your personal data on grounds relating to Your particular situation and circumstances. However, there may be reasons and legal grounds for processing your personal data despite Your objection. If We refuse your request We will provide you with information explaining why We have refused Your request. As far as We use Your personal data for direct marketing purposes, You have the right to object at any time. This includes any profiling of Your personal data that is related to direct marketing.

10.5. RIGHT TO RESTRICT THE PROCESSING OF YOUR PERSONAL DATA

You have the right to restrict the processing of Your personal data. This means that under certain conditions You can limit the way we process and use Your personal data. The right to restrict the processing may in particular be exercised if You have issues with the content of the personal data We hold or how it is processed.

10.6. RIGHT TO WITHDRAW CONSENT TO PROCESS YOUR PERSONAL DATA

Where consent is the legal basis for the processing of Your personal data, You have the right to withdraw Your consent at any time. However, withdrawal of consent takes effect for the future only.

10.7. RIGHT TO PORTABILITY OF YOUR PERSONAL DATA

You have the right to request Us to move, transfer or copy personal data You have provided to Us so that You can use the personal data in a different service or with a different provider. You can request to receive a copy of the personal data in a commonly used and machine-readable format, so You can store it for further personal use. You can also request that We transmit it directly to another organization. However, the right to data portability may be subject to limitations due to the technical feasibility of a transmission. The right to data portability does not create an obligation for Us to adopt or maintain processing systems which are technically compatible with those of other organizations.

10.8. RIGHT TO LODGE A COMPLAINT WITH THE DATA PROTECTION AUTHORITY

You have the right to lodge a complaint with the relevant Data Protection Authority if You believe that We have not handled your personal data correctly and lawfully or if You believe that We have not dealt appropriately with Your requests. If you are unhappy with the handling of your data, You can lodge a complaint with the Finnish Data Protection Ombudsman’s Office (https://tietosuoja.fi/en/home).

11. HOW TO CONTACT US ON DATA PROTECTION

If you have any questions or concerns about this Privacy Notice or about the protection of your personal data, please feel free to contact our Data Protection Team at info@aichologist.io.

12. DATA CONTROLLER AND DATA PROCESSOR

If we determine the purpose and means of the personal data processing, We are the data controller and will operate in compliance with this Notice. If the purpose and means of the personal data processing are determined by another entity or company, We will process the data in accordance with the instructions of such entity or company and We will only be a data processor under the applicable regulations. In this case, this data protection Notice will not apply directly to You but unless otherwise agreed with the entity or company controlling the processing, it will serve as basis for processing on behalf of such company.

13. AMENDMENTS TO THIS NOTICE

We reserve the right to amend this Notice at any time.