Skip to content

Privacy Notice - Taito.ai

Last updated: October 7, 2026

Introduction

Taito.hr respects privacy and commits to protecting personal data. This notice explains how data is collected, processed, and shared, plus your privacy rights.

Taito.hr provides Taito.ai, a cloud-based human resources information system with AI assistant and AI agent features (the “Service”). Taito.hr has two roles:

  • Controller for the personal data described in this notice: data about visitors to our website, users of the Service, and contacts at our customers and prospects.
  • Processor for the HR data our customers store in the Service, such as employee records, absences and documents. The customer, usually your employer, is the controller of that data and decides how it is used. Our Data Processing Agreement governs that processing. If you are an employee whose data is in the Service, contact your employer to exercise your rights. We will forward any request we receive to them.

Content Overview

  1. Data Controller Information
  2. Data Collection
  3. Processing Purposes & Legal Basis
  4. Information Sharing
  5. Third-Country Transfers
  6. Data Retention
  7. Data Protection Rights
  8. AI Features
  9. Google API Services Disclosure
  10. Policy Updates

1. Data Controller

Taito.hr Oy (Business ID 3432713-2), Helsinki, Finland, is the data controller. Contact: legal@taito.ai

For social media interactions on Facebook, Instagram, or other platforms, refer to those platforms’ privacy notices.

2. Data Collection

Types of Personal Data Collected:

  • Personal Identification Information – Full name
  • Contact Data – Email address, and phone number and company details where you provide them
  • Account Data – Login identifiers, the organisation you belong to, and your role and permissions in the Service
  • Billing Data – Billing contact and invoicing details. Card payments are handled by our payment provider, and we do not store card numbers
  • Technical Data – IP address, login credentials, browser/app versions, timezone, operating system
  • Behaviour Data – Service and website usage and interaction patterns
  • Communication Data – Support team interactions and other correspondence with us

Data is collected directly from you when you visit our website, sign up, use the Service, or contact us, and from your organisation when it invites you to the Service.

3. Processing Purposes & Lawful Basis

  • Providing the Service and managing your account and your organisation’s subscription. Lawful basis: performance of our contract with your organisation, and our legitimate interest in providing the Service to its users.
  • Billing and accounting. Lawful basis: contract, and legal obligation under Finnish accounting law.
  • Security, fraud prevention and keeping the Service running. Lawful basis: legitimate interests.
  • Customer support and service communications, such as notices of changes to our terms. Lawful basis: contract and legitimate interests.
  • Data analytics to improve the Service and our website. Lawful basis: legitimate interests. On our website, analytics and advertising cookies are used only with your consent, which you can withdraw at any time.
  • Marketing to business contacts. Lawful basis: legitimate interests, or consent where the law requires it. You can opt out at any time.

We conduct balancing tests to ensure legitimate interests don’t override individual rights and freedoms. Contact legal@taito.ai for details.

We do not use the HR data our customers store in the Service for any of these purposes. We process that data only on our customers’ instructions, as set out in the Data Processing Agreement.

4. Information Sharing

Personal data may be disclosed to third parties when:

  • Necessary for stated purposes
  • Required by law (health, tax, law enforcement authorities)
  • Transferring to entities acquiring business assets or merging
  • Necessary to establish/defend legal rights, ensure safety, investigate fraud, or respond to government requests

Third-Party Service Providers: Data is shared with trusted vendors for hosting, databases, authentication, email delivery, payments, monitoring, analytics, customer support and customer relationship management, and with AI providers where you use the Service’s AI features. These providers cannot use data beyond contracted services. Data processing agreements are in place. The providers that process customer data in the Service are listed at trust.taito.ai/subprocessors.

We do not sell personal data.

5. Third-Country Transfers

The Service’s primary databases and their backups are located in the EU/EEA. Data isn’t transferred outside EU/EEA without GDPR Chapter V compliance.

Some service providers operate outside the EEA (including the US), among them the providers of the Service’s AI features. Adequate protections include:

  • European Commission adequacy determinations, including the EU-U.S. Data Privacy Framework, or
  • Standard Contractual Clauses (EU-approved)

Request details about processors and safety measures at legal@taito.ai.

6. Data Retention

Personal data is retained for purposes outlined in Section 3. When legitimate need ceases or service use ends, data is deleted or anonymized.

Retention Periods:

  • Account Data: While your account is active, and deleted with your organisation’s data under the terms of the Service
  • Personal Identification and Contact Data: For the duration of the customer relationship plus 12 months; for prospects, 12 months from our last contact
  • Billing Data: As long as required by the Finnish Accounting Act (1336/1997)
  • Technical & Behaviour Data: No longer than necessary for the purposes above, currently up to 12 months
  • Communication Data: 12 months

If purposes cease, deletion/anonymization occurs immediately. Longer retention applies if legally required or needed to establish, exercise, or defend legal claims.

Note: For customer-processed data, customers (as controllers) determine retention periods. Contact your data controller entity.

7. Data Protection Rights

Users may:

  • Request access to held information
  • Request correction of incomplete/inaccurate data
  • Request erasure where retention isn’t justified
  • Object to processing based on legitimate interests, and to direct marketing at any time
  • Request processing restrictions
  • Request data portability
  • Withdraw consent (when processing relies solely on consent)

Exercise Rights: Email requests to legal@taito.ai; we will respond per applicable laws, normally within one month.

Complaints: Unhappy with practices? Contact your local data protection authority. In Finland: Office of the Data Protection Ombudsman

8. AI Features

The Service includes an AI assistant and AI agents that work on HR data at the request of our customers’ users. That processing is described in the Data Processing Agreement. In short:

  • No training. Neither we nor our AI providers use data from the Service to train or improve AI models.
  • Same permissions as the user. The AI features see only the data the user who uses them is permitted to see.
  • Classified fields stay out. Your employer can classify fields, such as a national identity code or bank account, so that the AI features receive only a placeholder, or nothing at all. Common formats of national identity codes and bank account numbers are removed, on a best-effort basis, from messages typed into the assistant before they are stored or sent. Users remain responsible for what they type. These controls do not cover other data, such as absence data or documents, which the AI features can read within the user’s permissions.
  • People decide. The AI features are not designed to make decisions about you based solely on automated processing that have legal or similarly significant effects on you, and our customers are contractually prohibited from using them for such decisions. The AI features act on the instructions of people, and decisions about you stay with a person.
  • Listed providers. The AI providers are listed, with their locations, at trust.taito.ai/subprocessors. They may process data outside the EU, including in the US, under the safeguards in Section 5. Your employer chooses the provider used for AI conversations, and other listed providers may support functions such as search.

9. Google API Services Usage

9.1 Limited Use

Taito.hr uses Google APIs when a user connects Google Calendar or Gmail to the Service. Taito.ai’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

9.2 How Google data is used

Connecting Google Calendar lets the Service and its AI features read and create calendar events, for example to show availability or schedule meetings. Connecting Gmail lets them draft and send email on the user’s behalf. Google user data is processed by the Service’s AI providers only to perform the task the user requests, and is not used to train AI models.

Users must grant explicit permission for Calendar and Gmail access and can revoke it at any time. We partner exclusively with vendors meeting strict security/privacy standards and minimize third-party information sharing.

10. Policy Updates

This notice updates periodically to reflect legal, regulatory, or operational changes. Earlier versions are available in our archive. We will notify users of material changes by email or in the Service.