Privacy policy

This Privacy Policy explains how AliceAI Learning Oy processes personal data in connection with the aliceai.io website. It applies to website visitors, people who contact us, recipients of newsletters and other marketing communications, and users and contact persons associated with user accounts and licences connected to the website.

The processing of personal data relating to learning activities in the AliceAI mobile application, including audio, speech, exercise and learning data processed in the application, is described in a separate privacy policy for the application.

1. Data controller and contact details

AliceAI Learning Oy
Finnish Business ID: 3452208-5
Website: https://www.aliceai.io
Email for privacy matters: annemari@aliceai.io

You can use the email address above for any questions about the processing of personal data or to exercise your data protection rights.

2. Whose personal data do we process?

We may process personal data relating to the following groups:

• website visitors;
• people who contact us through the contact form, by email or by other means;
• newsletter subscribers and recipients of marketing communications;
• contact persons at current and prospective customers, partners and other stakeholders;
• holders of user accounts connected to the website, and licence users, purchasers and administrators.

3. What personal data do we process?

The data we process depends on how you use the website. We may process the following types of data, for example:

Contact and customer relationship data

• first and last name;
• email address, telephone number and other contact details you provide;
• organisation, job title or role;
• the subject of your enquiry, the content of your message and any other information you provide;
• information relating to communications, meetings, quotations, contracts and the customer relationship.

User account and licence data

• name, email address, organisation and user identifier;
• information relating to account creation, sign-in and access rights;
• information about organisations, licences, licence codes, validity periods and access rights;
• account and licence status, and the dates and times when they were created or modified;
• technical event logs necessary for service maintenance and information security.

Passwords are not stored in plain text. The authentication service processes passwords in a protected form.

Marketing data

• newsletter and other marketing communication subscriptions and consent records;
• communication preferences, interests and marketing opt-outs;
• technical information relating to sent messages, such as delivery, open and link click data, where such tracking is used and consent has been obtained where required.

Website usage data

• IP address;
• device, browser and operating system information;
• information about website visits, page usage, visit times and traffic sources;
• cookie and consent preferences;
• server, error, security and other technical logs;
• identifiers generated through cookies and similar technologies, if you have allowed their use.

Please do not submit health information or other sensitive personal data through the contact form unless it is necessary for handling your enquiry and its submission has been agreed in advance.

4. Purposes and legal bases for processing

Purpose of processing	Legal basis
Responding to enquiries and requests for quotations, and arranging requested meetings and demonstrations	Steps taken at your request prior to entering into a contract, or our legitimate interest in managing communications and business relationships
Managing customer, contractual and partner relationships	Entering into and performing a contract, or our legitimate interest in managing business customer and stakeholder relationships
Creating, managing and providing user accounts, access rights and licences	Entering into and performing a contract, or our legitimate interest in providing and administering the service ordered by a customer organisation
Sending newsletters and other electronic direct marketing	Consent; in circumstances permitted by law that relate to an existing customer relationship or the recipient's professional duties, legitimate interests
Non-essential website analytics and marketing technologies	Consent
Ensuring website functionality and information security, and preventing misuse	Our legitimate interest in maintaining a secure and functioning service and, where applicable, compliance with a legal obligation
Complying with accounting, regulatory and other legal obligations, and establishing, exercising or defending legal claims	Compliance with a legal obligation, or our legitimate interest in protecting our rights

Where processing is based on legitimate interests, we assess whether the processing is necessary and balance our interests against the rights and freedoms of the data subject. Our legitimate interests relate in particular to handling enquiries, managing business customer relationships, maintaining the service, ensuring information security and conducting appropriate business communications.

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew your consent.

5. Where do we obtain personal data?

We obtain personal data primarily from:

• you, when you complete a form, subscribe to a newsletter, create a user account, activate a licence or contact us;
• the organisation you represent, for example when your employer or a customer organisation's administrator provides user or licence information;
• the technical operation and use of the website and related systems;
• analytics and marketing services used with your consent;
• public sources and company websites, to the extent necessary and lawful for business-to-business communications.

If an organisation provides us with another person's data, we require the organisation to have the right to disclose the data and to have ensured that the person has received the necessary information about the processing of their personal data.

6. Recipients of personal data and service providers

Within AliceAI Learning Oy, personal data is processed only by people who need it to carry out their duties.

We may use service providers that process personal data on our behalf, such as:

• website maintenance, hosting, backup and information security providers;
• contact form, email and customer relationship management providers;
• newsletter and marketing service providers;
• analytics and cookie management providers;
• providers of user authentication, databases, access rights management and licence management, such as Google Cloud and Firebase;
• providers of legal, accounting and other professional services.

A customer organisation may receive information about users, access rights and licence status that is necessary to administer the service it has ordered, to the extent agreed with the customer.

We may disclose data to authorities or other parties where required by law, and in connection with a corporate transaction to the extent necessary and lawful.

We do not sell personal data.

7. Transfers of personal data outside the European Economic Area

We aim to use services and processing locations where personal data is processed within the European Union or the European Economic Area. However, some of our service providers may also process data or provide technical support from outside the European Economic Area.

If personal data is transferred outside the European Economic Area, we ensure that the transfer is lawful by relying on an applicable European Commission adequacy decision, the EU–US Data Privacy Framework for certified US recipients, or standard contractual clauses approved by the European Commission, together with supplementary safeguards where necessary.

You can request further information about the transfer mechanisms used and a copy of the applicable safeguards by contacting the email address provided in Section 1.

8. How long do we retain personal data?

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy or as required by law. As a general rule, we apply the following retention periods:

• information received through the contact form or other enquiries: up to 24 months after the most recent contact, unless longer retention is necessary for a customer or contractual relationship, a legal claim or compliance with a legal obligation;
• information about prospective customers and business contacts: up to 24 months after the most recent relevant communication, unless the data is needed to manage an ongoing business relationship;
• user account and licence data: for the duration of the access rights, licence or customer relationship, and for up to 24 months after it ends, unless longer retention is necessary to comply with a legal obligation or in connection with a legal claim;
• newsletter subscription data: until you unsubscribe or object to marketing; after this, we may retain the minimum information needed to record your marketing opt-out for as long as necessary to respect it;
• analytics data and cookie identifiers: for the period stated in the cookie settings, and no longer than necessary for their intended purpose;
• security and technical logs: generally up to 12 months, unless longer retention is necessary to investigate a security incident, prevent misuse or address a legal claim;
• records subject to statutory accounting requirements: for the period required by accounting legislation, typically 6 or 10 years depending on the type of record.

Data held in backups is phased out through the normal backup rotation cycle. Once the retention period ends, the data is deleted or anonymised so that the individual can no longer be identified.

9. Cookies and website analytics

The website may use cookies and similar technologies. Cookies can be divided into the following categories:

• strictly necessary cookies, which are needed for website functionality, forms, sign-in, information security and cookie preferences;
• analytics cookies, which help us understand how the website is used and improve the service;
• marketing cookies, which may be used to target marketing and measure its effectiveness.

The use of strictly necessary cookies is based on the need to provide the online service requested by the user and on our legitimate interest in maintaining a secure and functioning website. Analytics and marketing cookies, and other non-essential tracking technologies, are used only with your consent.

You can accept or reject non-essential cookies in the cookie banner and change or withdraw your choices at any time using the website's Manage cookies function. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. The names, providers, purposes and lifetimes of the cookies in use are listed in the website's cookie settings.

10. Electronic direct marketing

We may send newsletters and other electronic marketing based on your consent. Where permitted by law, we may also send business marketing relating to an existing customer relationship or the recipient's professional duties on the basis of our legitimate interests.

You can unsubscribe from the newsletter or object to direct marketing at any time by using the unsubscribe link in a message or by contacting the email address provided in Section 1. Opting out of marketing is free of charge.

11. Is providing personal data mandatory?

The information marked as mandatory in the contact form is needed to handle and respond to your enquiry. If you do not provide the required information, we may be unable to respond or fulfil your request.

The information marked as mandatory for user account and licence management is needed to create access rights and provide the service under the contract. Subscribing to the newsletter and accepting analytics and marketing cookies are voluntary. Declining them does not prevent you from using the website's basic functions.

12. How do we protect personal data?

We protect personal data through appropriate technical and organisational measures. Depending on the data processed and the risks involved, these may include access restrictions, user authentication, encrypted connections, logging, backups, security updates, contractual requirements for service providers and staff guidance.

Access to personal data is granted only to people who need it to carry out their duties.

13. Your data protection rights

Subject to the conditions set out in data protection legislation, you have the right to:

• obtain confirmation of whether we process your personal data and access that data;
• request the rectification of inaccurate or incomplete data;
• request the erasure of your personal data;
• request the restriction of processing;
• object to processing based on legitimate interests on grounds relating to your particular situation;
• object to direct marketing at any time;
• receive the data you have provided in a structured, commonly used and machine-readable format and transmit it to another controller, where the processing is based on consent or a contract and is carried out by automated means;
• withdraw your consent at any time;
• lodge a complaint with a competent supervisory authority.

In Finland, the supervisory authority is the Office of the Data Protection Ombudsman. Further information and instructions for lodging a complaint are available at https://tietosuoja.fi.

You can exercise your rights by sending a request to the email address provided in Section 1. We may ask you to provide additional information necessary to handle the request and to verify your identity. We will respond without undue delay and, as a general rule, within one month.

14. Automated decision-making

The processing of personal data through the website, as described in this Privacy Policy, does not involve decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

15. Changes to this Privacy Policy

We may update this Privacy Policy if our personal data processing, the services we use or applicable legislation changes. The current version will be published on this page. The effective date of the version is stated at the beginning of this Privacy Policy.