1. Controller
Controller: AitoHR Oy
Service: Kirjado
Business ID: 2959860-8
Postal address: Rautatienpuistokatu 7, 28130 Pori, Finland
Privacy contact: tietosuoja@aitohr.fi.
2. Who this notice covers
This notice covers visitors to the Kirjado website, people who contact us or subscribe to the newsletter, and reader, author, publisher and organisational customers of the service.
3. Personal data processed
We may process:
- name, email address, phone number, organisation and role
- enquiries, consents and customer relationship information
- account, login, access, subscription and payment-related information
- information about books and materials supplied to the service and related instructions
- questions, conversations, feedback and other content created in the service
- technical data such as IP address, browser and device data, cookie data, and security and event logs.
4. Purposes and legal bases
We process data to provide Kirjado, manage access and customer relationships, respond to enquiries, administer payments and agreements, protect the service and improve it.
- Contract: delivering the service and managing the customer relationship.
- Legitimate interests: security, fraud prevention, operational analysis and service development.
- Consent: newsletters, optional analytics and other processing specifically based on consent.
- Legal obligation: for example accounting and lawful authority requests.
5. Sources of data
We obtain data mainly from you, your customer organisation, technical events generated through use of the service, and providers involved in payments or service delivery.
6. Recipients and processors
Data is processed only by authorised AitoHR Oy personnel and providers needed to deliver the service. These may include hosting, database, authentication, analytics, automation, email, newsletter, payment and AI service providers. Processing is governed by agreements and applicable law.
Data may be disclosed to authorities when required by law. We do not disclose personal data for third parties’ own marketing.
7. Transfers outside the EU and EEA
We seek to process data within the EU or EEA. If a provider processes data elsewhere, the transfer relies on a European Commission adequacy decision or another lawful safeguard, such as standard contractual clauses and supplementary measures where needed.
8. Retention
We retain data only as long as needed for the purposes described here. Customer and account data is retained during the customer relationship and afterwards as required for legal obligations and claims. Enquiry data is deleted after the matter and necessary follow-up are complete. Newsletter data is retained until consent is withdrawn. Security and event logs are retained for a necessary, predefined period.
9. Your rights
Subject to applicable law, you may have the right to:
- access your personal data
- request correction of inaccurate or incomplete data
- request deletion of your data
- request restriction of or object to processing
- receive data you provided in a portable format where applicable
- withdraw consent at any time.
To exercise your rights, contact tietosuoja@aitohr.fi. We may ask for additional information to verify your identity. You may also lodge a complaint with the Finnish Office of the Data Protection Ombudsman: tietosuoja.fi.
10. Cookies and analytics
We use cookies necessary for the service to operate securely. Optional analytics or marketing cookies are used only with your consent, which you can withdraw in the cookie settings.
11. Security and logs
We protect data with appropriate technical and organisational measures. Connections are encrypted, access is role-based, and relevant security and privacy events may be recorded in an audit log.
12. AI and automated decision-making
Kirjado uses AI to create book-based conversations, summaries and other outputs requested by users. Data entered into the service may be sent to an AI provider acting under contract to process the request. Data is not used to train external AI models without a separate legal basis and notice.
We do not make automated decisions based on personal data that produce legal or similarly significant effects for users.
13. Personal data breaches
Suspected or detected breaches may be reported to tietosuoja@aitohr.fi. We assess incidents without delay and follow the notification duties of the GDPR.
14. Changes to this notice
We update this notice when the service, processing or providers change. The current version and update date are published on this page.