Privacy Notice for Taitori Services

Privacy notice in accordance with the EU General Data Protection Regulation (EU) 2016/679.

Effective from: 14 September 2026
Version: 2.0

1. Controller and Contact Details

Taitori Oy
Business ID: 2373571-2
Address: Lars Sonckin kaari 10, 02600 Espoo, Finland
Email: privacy@taitori.fi
Customer service: support@taitori.fi

Requests and questions concerning data protection may be sent to privacy@taitori.fi.

2. Scope of This Privacy Notice

This privacy notice applies to Taitori's workplace, booking, visitor, parking, catering, display, reporting and other related services. A separate Taitori AI Assistant Privacy Notice also applies to Taitori AI Assistant and its artificial intelligence features.

3. Taitori's Role in the Processing of Personal Data

3.1 Taitori as Controller

Taitori acts as controller when Taitori determines the purposes and means of processing personal data. This may concern, for example, the management of customer and user accounts, customer service, invoicing, service communications, information security, prevention of misuse, and the development of the functionality and quality of Taitori's services.

3.2 Taitori as Processor

When a customer organisation uses Taitori's services in its own operations and determines the purposes of processing personal data, the customer organisation acts as controller and Taitori as processor. In such cases, Taitori processes personal data in accordance with the customer organisation's documented instructions and the separate data processing agreement between the parties.

When the customer organisation acts as controller, the user should primarily address a request concerning their personal data to their employer or other customer organisation that has deployed the service. Taitori assists the customer organisation in fulfilling requests as agreed.

4. Purposes of Processing Personal Data

Personal data may be processed for the following purposes:

• identifying the user, signing in and managing the user account
• managing access rights, user groups and roles
• fulfilling workstation, facility, parking, visitor, catering and other bookings or orders
• operating, maintaining, monitoring and providing technical support for the service
• customer service and communications concerning the service
• invoicing, payment processing and financial administration
• reporting, statistics and analysis of service use
• ensuring service security, preventing misuse and investigating incidents
• developing the quality, usability and functionality of the service
• fulfilling obligations based on law and official regulations.

5. Legal Bases for Processing Personal Data

When Taitori acts as controller, the processing of personal data is based, depending on the circumstances, on entering into or performing a contract, the legitimate interests of Taitori or a third party, a legal obligation, or the data subject's consent.

A legitimate interest may relate, for example, to managing the customer relationship, service security, prevention of misuse, technical maintenance, customer service, and developing the functionality and quality of the service. The necessity of processing based on legitimate interests and its effects on the rights of the data subject are assessed before processing.

If processing is based on consent, consent is requested separately for a specified purpose. Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

The privacy notice is provided to the user for information. Receiving or reviewing the privacy notice does not in itself constitute a legal basis for processing personal data.

6. Personal Data Processed

Depending on the features of the service and the functions deployed by the customer organisation, the following data may be processed:

• first and last name
• email address and telephone number
• username and technical identifiers that uniquely identify the user
• organisation, unit, team, job title and workplace location
• access rights, user groups and roles
• language, notification and other service settings
• details of workstation, facility, parking, visitor, catering and other bookings or orders
• booking times, locations, participants, organisers and necessary additional information
• special dietary requirements and other information necessary to fulfil an order
• information relating to payments, invoicing and payment transactions
• feedback submitted through the service and customer service communications
• IP address and browser, device and operating system information
• sign-in, usage, error, security and audit logs
• information transmitted to the service through integrations that is necessary to perform the function.

In some circumstances, a special dietary requirement may indirectly reveal information concerning health or beliefs. Such data is processed only to the extent necessary to fulfil the order and on an applicable legal basis.

If a user invites other persons to the service or stores information concerning them, the user and the customer organisation must ensure that there is an appropriate basis for processing the data and that only data necessary for the purpose is stored in the service.

7. Sources of Personal Data

Personal data may be obtained:

• from the data subject
• from the user's employer or another customer organisation
• from another user, for example in connection with an invitation, visit or shared booking
• from the customer organisation's Microsoft 365, Google Workspace, directory, single sign-on or other information system through an agreed integration
• from a payment, invoicing, visitor, access control, booking or other system connected to the service
• from technical and audit logs generated automatically in connection with use of the service.

8. Recipients, Disclosures and Sub-processors of Personal Data

Personal data is processed only by those Taitori employees and persons acting on assignment whose duties require it. Personal data may also be processed on Taitori's behalf by service providers used by Taitori, in accordance with Taitori's instructions.

Service providers may provide, for example, the following services:

• cloud, data centre and telecommunications services
• messaging, email and text messaging services
• customer service, analytics and monitoring services
• payment, invoicing, accounting and financial administration services
• software development, maintenance, consulting and information security services.

Personal data may be transferred to independent controllers when necessary to provide a service requested by the user. Such recipients may include, for example, a restaurant or café fulfilling a catering order, an entity managing a facility, a payment service provider, or an entity responsible for invoicing.

Personal data may also be disclosed to authorities or other parties if the disclosure is based on law, a competent order issued by an authority, or the establishment, exercise or defence of legal claims.

Taitori enters into written agreements with service providers that process personal data and requires them to maintain appropriate data protection, information security and confidentiality. Up-to-date information on material sub-processors is available from Taitori upon request or as agreed in the customer agreement.

9. Transfers of Personal Data Outside the EEA

Taitori seeks to process personal data primarily within the European Union and the European Economic Area. However, data may be transferred outside the EEA or limited access to it may be provided from outside the EEA if the service provider used or its subcontractor processes data in such a country.

Transfers are carried out in accordance with applicable data protection legislation, using, for example, a European Commission adequacy decision, standard contractual clauses approved by the European Commission, or another transfer mechanism permitted by law. Where necessary, supplementary technical and organisational safeguards are used. Further information on the applicable transfer mechanisms is available at privacy@taitori.fi.

10. Protection of Personal Data

Taitori protects personal data using technical and organisational measures appropriate to the risks of processing. These may include:

• restricting access rights based on job duties and the customer organisation's specifications
• personal user accounts and multi-factor authentication in applicable systems
• encryption of data in transit and stored data, where applicable
• logging, auditing and security monitoring
• backups, continuity management and recovery procedures
• system updates and vulnerability management
• personnel confidentiality obligations and data protection and information security guidance
• assessment of service providers and contractual oversight.

In endpoint and IoT devices connected to the service, the processing of personal data is limited to the extent necessary to perform the function. Device access rights, software and communications are protected using measures appropriate to the device type.

11. Personal Data Breaches

Personal data breaches are investigated and documented. When Taitori acts as processor, Taitori notifies the customer organisation acting as controller of a personal data breach it has detected without undue delay, as agreed.

When Taitori acts as controller, Taitori notifies the supervisory authority and data subjects of the breach when required by applicable data protection legislation.

12. Retention Periods for Personal Data

Personal data is retained only for as long as necessary to fulfil the purposes described in this notice, meet contractual obligations, or comply with statutory retention obligations.

As a general rule, personal data relating to the services is retained as follows:

• User accounts and access-right information are retained for the duration of the access right and for no more than 12 months after the access right ends. The necessity of user accounts that have been inactive for a long period may be assessed regularly. Unnecessary user accounts are deleted, or the personal data associated with them is anonymised in accordance with the service's reporting and statistical needs.
• Workstation, facility and parking bookings are retained for 24 months after the booking ends.
• Catering and service orders are retained for 24 months after the order is fulfilled.
• Visitor management data, visitor registrations and visit history are retained for 28 days after the visit ends, after which the data is anonymised.
• Contact details relating to visitor surveys are retained for 12 months after the survey is sent.
• Vehicle registration numbers and other parking-related information are retained for 24 months after the event ends.
• Usage, audit, error, security and system logs are retained for 24 months.
• Customer service requests, support requests and complaints are retained for 24 months after the matter has been resolved.
• Feedback, reporting and statistical data is retained for 24 months, after which personal data is deleted or anonymised. Anonymised data may thereafter be used for statistical purposes and purposes related to service development.
• Data relating to payments, invoicing and accounting is retained for the period required by applicable legislation.
• Personal data contained in backups is retained in accordance with the normal backup rotation for no more than 90 days.

At the end of the retention period, personal data is deleted or anonymised so that an individual can no longer be identified from the data directly or indirectly.

13. Recommendations, Profiling and Automated Decision-Making

The service may use information provided by the user and previous usage history to generate recommendations that make the user experience easier, such as suggesting suitable facilities or resources to the user.

Taitori's general services are not intended to make decisions concerning the user based solely on automated processing that would produce legal effects concerning the user or similarly significantly affect the user. If such processing is introduced, information about it will be provided separately in accordance with applicable legislation.

Taitori does not use personal data covered by this notice for direct marketing without an applicable legal basis. The data subject always has the right to object to the processing of their personal data for direct marketing purposes.

14. Rights of the Data Subject

The data subject has the following rights under applicable data protection legislation. The application of these rights depends, among other things, on the legal basis for and circumstances of the processing.

Right to Information and Access to Personal Data

The data subject has the right to obtain confirmation as to whether personal data concerning them is being processed, and the right to access the data and obtain a copy of the personal data being processed.

Right to Rectification

The data subject has the right to request the rectification of inaccurate or incorrect personal data and the completion of incomplete data.

Right to Erasure

The data subject has the right to request the erasure of their personal data in the circumstances provided by law. The right does not apply if there is a statutory or other legitimate basis for retaining the data.

Right to Restriction of Processing

The data subject has the right to request restriction of the processing of their personal data in the circumstances provided by law.

Right to Object to Processing

The data subject has the right, on grounds relating to their particular situation, to object to processing based on legitimate interests. The data subject always has the right to object to direct marketing.

Right to Data Portability

Where processing is based on consent or a contract and is carried out by automated means, the data subject may have the right to receive the personal data they have provided in a structured, commonly used and machine-readable format and to transmit the data to another controller.

Right to Withdraw Consent

If processing is based on consent, the data subject may withdraw their consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Rights Relating to Automated Decision-Making

The data subject has the right not to be subject to a decision based solely on automated processing that produces legal effects concerning them or similarly significantly affects them, unless an exception provided by law applies to the processing.

Exercising Rights

When Taitori acts as controller, a request concerning rights may be sent to privacy@taitori.fi. The identity of the person making the request may be verified where necessary. When a customer organisation acts as controller, the request should primarily be addressed to that customer organisation.

15. Right to Lodge a Complaint with a Supervisory Authority

The data subject has the right to lodge a complaint with the competent supervisory authority if they consider that the processing of their personal data infringes data protection legislation. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.

16. Requirement to Provide Data and Consequences of Failure to Provide It

Some personal data is necessary to identify the user, create access rights, perform a contract, or fulfil a booking, order or other function requested by the user. If the necessary data is not provided, the user account or requested service may not be available. As a general rule, failure to provide voluntary data does not prevent use of the service's basic functions.

17. Changes to This Privacy Notice

Taitori may update this privacy notice when the services, processing of personal data, legislation or technology changes. The current version is published in connection with the service. Customer organisations and, where necessary, users will be informed of material changes in an appropriate manner before the changes take effect.

18. Further Information

Further information on the processing of personal data and the rights of data subjects is available by email at privacy@taitori.fi.