Privacy Notice

Who we are

Aito Science OÜ is the data controller for the personal data described in this notice.

Data Protection Officer

We have not appointed a Data Protection Officer, and we are not required to. We are not a public authority, our core activities do not require regular and systematic monitoring of individuals on a large scale, and we do not process special categories of personal data on a large scale. None of the conditions in Article 37(1) GDPR applies to us.

Data protection questions are handled directly by our founders. Write to contact@aito.science and we will answer.

What this notice covers

This notice explains how we handle personal data in two situations: when you visit aito.science, and when you contact us. It also explains our role in the user surveys we run on behalf of our clients, where we act as a processor rather than a controller.

Visiting this website

Cookies

This website does not set cookies. It does not use analytics, advertising, tracking pixels, or any similar technology, and it does not build a profile of you.

Server logs

Like any website, ours is served by a hosting provider, OVHcloud, that records technical information automatically. This typically includes your IP address, the time of the request, the page requested, and your browser type. These logs exist to deliver the site, keep it available, and protect it from abuse. We do not use them to identify individual visitors.

Legal basis: our legitimate interest in operating and securing the website (Article 6(1)(f) GDPR).

Fonts

This website loads the Montserrat and Inter typefaces from Google Fonts. When a page loads, your browser requests those font files from Google's servers, and your IP address is transmitted to Google as part of that request. Google may process that data outside the European Economic Area under the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.

Legal basis: our legitimate interest in presenting the site consistently across devices (Article 6(1)(f) GDPR).

Contacting us

If you email us, we process the content of your message together with your name, email address, and anything else you choose to include. We use it to answer you and to keep a record of our correspondence.

Legal basis: our legitimate interest in responding to enquiries, and, where the exchange concerns a possible engagement, taking steps at your request before entering into a contract (Article 6(1)(f) and Article 6(1)(b) GDPR).

We keep business correspondence for as long as the relationship is active and for a reasonable period afterwards, after which it is deleted.

User surveys we run for clients

Our service can involve surveying the users of a client's secondhand service to understand their purchasing, delivery, and packaging behaviour. Not every project includes a survey. If you have received one, the following applies.

• The client who operates the service is the data controller. Their privacy notice governs how your data is handled, and they distribute the survey to you. We never receive their user lists or contact details.
• We act as a processor on the client's instructions, under a written data processing agreement.
• We do not ask for information that identifies you. Our surveys contain no questions about your name, contact details, account, or precise location. We may ask for contextual information such as an age bracket or gender, where it helps interpret the results.
• Responses are analysed and reported in aggregate. Our results describe groups of users, never individuals.
• Surveys run on a third party survey platform. Which platform we use depends on the project and the client's requirements. The platform processes responses on our instructions under a data processing agreement.
• If you want your survey response removed, contact the operator of the service that sent it to you, or write to us and we will pass the request on.

Who we share data with

We do not sell personal data and we do not share it for advertising. We use a small number of service providers who process data on our behalf. Each is bound by a contract that limits what they may do with the data.

• Google (Google Workspace). We use Gmail for email and Google Drive for document storage, so correspondence with us and project documents are held on Google's infrastructure.
• OVHcloud, a French company, which hosts this website and keeps the technical logs described above.
• A survey platform, where a project includes a user survey. The platform varies by project.

We may also disclose data where the law requires it.

International transfers

Some of our service providers, including Google, are based outside the European Economic Area. Where that is the case, transfers are made under an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or under the European Commission's standard contractual clauses.

Your rights

Under the GDPR you have the right to:

• ask what personal data we hold about you and receive a copy
• have inaccurate data corrected
• have data erased in certain circumstances
• ask us to restrict how we use your data
• receive your data in a portable format where it was provided by you
• object to processing that relies on our legitimate interests

To exercise any of these, write to contact@aito.science. We will respond within one month.

If you are not satisfied with our response, you may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee. You may also complain to the supervisory authority in the country where you live.

Changes to this notice

We update this notice when our practices change. The date at the top shows when it was last revised.

This notice describes how we currently handle personal data. It is not legal advice and it does not form part of any contract.

Back to aito.science