top of page

Privacy Policy

1. Controller and scope

This policy explains how Aines processes personal data on its website aines.ai, in customer and marketing contacts, and in recruitment. We comply with the EU General Data Protection Regulation (2016/679, “GDPR”), the Finnish Data Protection Act (1050/2018), the Act on the Protection of Privacy in Working Life (759/2004) and the Act on Electronic Communications Services (917/2014).

This policy covers:

  • visitors to our website

  • people who contact us, book a demo or subscribe to our newsletter

  • contact persons of customers, prospects, partners and suppliers

  • job applicants, people who send an open application and others taking part in recruitment

 

What this policy does not cover. When Aines AI Assistants process our customers’ data – such as orders, RFQs or service requests – we act as a processor on the customer’s behalf. In that case the customer is the controller, and the processing is governed by the customer’s own privacy policy and our data processing agreement (DPA).

 

2. What data we process and why

We process only the data we need for the purposes below. Most of it comes from you directly, for example through a form or by email. Some technical data is created when you use the website.

  • Website operation and security – Data: IP address, browser and device data, essential cookies, log data; Legal basis (GDPR Art. 6): Legitimate interest: a working, secure website (f)

  • Website analytics – Data: Page views, visit duration, referring page, approximate location (country/city); Legal basis (GDPR Art. 6): Consent (a)

  • Contact requests and demo bookings – Data: Name, email, phone, company, job title, message; Legal basis (GDPR Art. 6): Legitimate interest: replying and preparing a contract (f, b)

  • Customer and partner relationships – Data: Contact person’s name, contact details, role, company, contract and billing data, correspondence; Legal basis (GDPR Art. 6): Contract (b), legal obligation: accounting (c)

  • B2B marketing – Data: Name, work email, company, role, areas of interest; Legal basis (GDPR Art. 6): Legitimate interest (f); you can opt out at any time

  • Newsletter – Data: Email, name, time of subscription, opens and clicks; Legal basis (GDPR Art. 6): Consent (a)

  • Recruitment – Data: See section 3; Legal basis (GDPR Art. 6): See section 3

  • Handling legal claims – Data: Data related to the matter; Legal basis (GDPR Art. 6): Legitimate interest (f)

Where we rely on legitimate interest, we have assessed that our interest does not override your rights. You can object to such processing (section 8).

We do not sell personal data, and we do not make decisions about you based solely on automated processing within the meaning of GDPR Article 22.

 

3. Recruitment

We receive applications at careers@aines.ai and store recruitment data in Aines’ Microsoft 365 environment. Only the people involved in the recruitment can access the data.

 

What data we process

  • basic and contact details: name, email, phone, place of residence

  • application, CV, portfolio and any other attachments you send

  • education, work experience, skills and language skills

  • salary expectation, start date and other preferences you share

  • interview notes, pre-assignments or home assignments, and assessments

  • information from your referees, if you allow us to contact them

  • correspondence with you during the recruitment

We collect data primarily from you. We may look at your public professional profile (e.g. LinkedIn) if you refer to it in your application. We collect data from other sources – such as referees – only with your consent. We do not look into applicants’ private lives, for example on social media.

 

Legal bases

  • Handling your application and selection: steps taken before entering into an employment contract (GDPR Art. 6(1)(b)) and our legitimate interest in choosing the best candidate (6(1)(f))

  • Referee checks, aptitude or personality tests, and keeping your data for future roles: consent (6(1)(a))

  • Any credit check or security clearance: a statutory basis, only for roles where the law allows it. We tell you in advance.

  • Keeping data after the recruitment: legitimate interest in defending against possible discrimination claims (6(1)(f))

 

What we don’t ask for. Please don’t include your personal identity code, health information, a copy of an ID document or other special categories of data in your application. If we receive them anyway, we delete them unless they are needed for the selection.

 

Security in recruitment

  • the careers@ mailbox and recruitment folders are limited to named people; access is reviewed at the start and end of each recruitment

  • signing in to M365 requires multi-factor authentication (MFA)

  • data is encrypted in transit and at rest

  • applications are not saved on personal devices or shared outside the organisation

  • applications are not used to train AI models

 

AI and automated decision-making. A person always makes the hiring decision. We may use AI tools within our M365 environment to help, for example to summarise applications or schedule interviews. We do not use AI to score, filter or rank applicants.

 

Retention in recruitment

  • The selected candidate’s data is transferred to HR records for managing the employment.

  • Other applicants’ data is deleted 2 years after the recruitment ends. This matches the period in which claims under the Finnish Non-Discrimination Act or Equality Act can be brought.

  • Open applications are kept for 12 months.

  • With your consent, we keep your data for future roles for up to 24 months. You can withdraw consent at any time at careers@aines.ai.

 

4. Cookies and analytics

Our website runs on the Wix platform. Essential cookies are always set, because the site cannot run securely without them. Other cookies are set only if you accept them in the cookie banner.

  • Essential – Examples: XSRF-TOKEN, svSession, hs, TS*, consent-policy; Purpose: Security, session management, storing your cookie choices; Consent: Not required

  • Analytics – Examples: Wix Analytics; Google Analytics (_ga, _ga_*, up to 2 years); Purpose: Measuring and improving how the site is used; Consent: Required

An up-to-date list of Wix cookies and their durations is in the Wix cookie table.

You can change or withdraw your consent at any time from the cookie settings in the website footer. You can also block or delete cookies in your browser settings.

 

5. Recipients and transfers outside the EU

We use trusted service providers that process data on our behalf and only on our instructions. We have a data processing agreement with each of them.

  • Wix.com Ltd – Use: Website hosting, forms, analytics; Location and transfer basis: Israel (European Commission adequacy decision); some Wix sub-processors in the United States (EU Standard Contractual Clauses or the EU–US Data Privacy Framework)

  • Google Ireland Ltd – Use: Google Analytics: website usage statistics, only with consent; Location and transfer basis: EU; Google’s processing in the United States under the EU–US Data Privacy Framework and Standard Contractual Clauses

  • HubSpot Ireland Ltd – Use: Customer relationship management (CRM): contact persons of customers, prospects and partners, contact requests and marketing communications; Location and transfer basis: EU (HubSpot EU data centre); any transfers, e.g. for support, under the EU–US Data Privacy Framework and Standard Contractual Clauses

  • Microsoft Ireland Operations Ltd – Use: Email, files, Teams interviews, recruitment material (M365); Location and transfer basis: Primarily the EU (EU Data Boundary); any transfers under the Data Privacy Framework or Standard Contractual Clauses

  • Visma Netvisor Oy – Use: Accounting and invoicing; Location and transfer basis: Finland / EU

We may also disclose data to authorities when the law requires it, and to advisers for handling legal claims. In a business transfer, data may pass to the buyer.

 

Social media. Aines has a page on LinkedIn. When you visit it, LinkedIn collects data under its own terms, and we are joint controllers with LinkedIn for the page’s visitor statistics. See LinkedIn’s privacy policy for details.

 

6. Retention

We keep data only as long as it is needed for its purpose or the law requires it. After that, it is deleted or anonymised.

  • Contact requests and demo bookings that do not lead to a customer relationship – Retention period: 3 years from the last contact

  • Customer and partner contact persons – Retention period: For the duration of the relationship and 3 years after it ends

  • Accounting records (invoices, contracts) – Retention period: 6–10 years under the Finnish Accounting Act

  • Newsletter subscribers – Retention period: Until you unsubscribe

  • Analytics and marketing cookies – Retention period: Per cookie, up to 24 months

  • Recruitment – Retention period: See section 3

 

7. Security

We protect data with technical and organisational measures:

  • access only for people who need the data for their work

  • multi-factor authentication in all tools

  • encrypted connections (HTTPS/TLS) and encrypted storage

  • staff confidentiality obligations and data protection training

  • a personal data breach process: we notify the Data Protection Ombudsman within 72 hours and you without undue delay when the law requires it

 

8. Your rights

You have the right to:

  • access your data and get a copy of it

  • have inaccurate data corrected

  • have your data erased or its processing restricted

  • object to processing based on legitimate interest – and to direct marketing at any time

  • receive the data you provided in a portable format

  • withdraw your consent at any time; this does not affect the lawfulness of earlier processing

Send your request to privacy@aines.ai. We reply within one month. We may ask you to verify your identity before disclosing any data.

 

9. Right to lodge a complaint

If you believe we process your data unlawfully, you can lodge a complaint with the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi/en) or with the supervisory authority in your country of residence. We hope you contact us first so we can put things right.

 

10. Changes

We update this policy when our operations or the law change. We announce material changes on the website.

Last updated: 12 November 2026

bottom of page