Legal
Privacy statement
Last updated: 5 October 2026
The short version. This website loads nothing from third-party servers, runs no advertising or analytics trackers, and sets one strictly necessary cookie plus a cookie remembering your language. We only hold the data you type into a form or give us when you pay, and only for as long as we need it to answer you or the law requires.
Data controller
AJ-Group
Business ID / VAT: FI18913457
Lohja, Finland
Email: contact@aj-group.net
Website: https://aj-group.net
Introduction
AJ-Group (“we”, “our”, or “us”) is committed to protecting your privacy and to processing your personal data in accordance with the General Data Protection Regulation (GDPR).
This privacy statement explains what personal data we collect when you use our website, why we collect it, how we use it, and your rights regarding your personal data.
What personal data we collect
Contact form
If you contact us using our contact form, we collect:
- Your name
- Your email address
- The subject line, if you fill one in
- The contents of your message
This information is used solely to respond to your enquiry or to provide the service you asked about. We do not use contact form submissions for marketing purposes, and we never add an address to our newsletter because it wrote to us.
Newsletter
If you subscribe to our newsletter we store your email address and the date on which you confirmed the subscription. We use double opt-in: nothing is added to the list until you click the confirmation link we send you. Every newsletter contains a one-click unsubscribe link, and unsubscribing deletes the address rather than flagging it.
Online payments
If you pay us through our payment page, the payment is processed by Stripe (Stripe Payments Europe, Ltd., Ireland). You enter your card or bank details on Stripe’s own page; they never reach us. From Stripe we receive:
- Your name and email address, as you give them on Stripe’s page
- The amount, the date, and the invoice number or message you typed
- The payment method, such as the card brand, its country and its last four digits
We use this to match your payment to your invoice, to refund you if something went wrong, and to keep the accounting records Finnish law requires. Stripe also uses payment data as an independent controller for its own purposes, such as fraud prevention and its legal duties as a payment institution, and may set cookies on its payment page for that. See Stripe’s privacy policy.
Website analytics
We do not run analytics on this website. There is no Google Analytics, no advertising pixel and no third-party tag of any kind. The site loads no fonts, scripts, images or styles from external servers, so your browser never contacts anyone but us (until you choose to pay us online: the payment page then sends you on to Stripe, see Online payments).
Should we introduce analytics in the future, it would be activated only after you have given consent through a cookie banner, and this statement would be updated first.
Server log files
When you visit our website, our hosting infrastructure automatically records technical information including:
- IP address
- Browser type
- Operating system
- Date and time of access
- Requested pages
- HTTP status codes
These logs are necessary for website security, troubleshooting, preventing abuse and maintaining reliable operation.
Spam protection
To keep automated submissions out of our inbox, the forms count how many submissions have come from a given visitor recently. That counter is keyed by a salted, irreversible hash of the IP address — the address itself is never written to our application storage — and the counters are deleted automatically.
Why we process your data
- To respond to enquiries submitted through our contact form.
- To send our newsletter, where you have asked for it.
- To take the payments you make to us, and to keep the accounting records the law requires.
- To operate, maintain and secure our website.
- To prevent abuse of our forms.
- To comply with applicable legal obligations.
Legal basis for processing
We process personal data under one or more of the following legal bases defined by the GDPR:
- Your consent — for the newsletter, and for answering your enquiry.
- Our legitimate interests in operating, securing and improving our website.
- Compliance with legal obligations.
- Taking steps prior to entering into a contract, where applicable.
- Performance of a contract — when you pay an invoice or an amount agreed with us.
Cookies
This website sets one strictly necessary cookie. It keeps your session while you use the site preview and the forms, and it carries the token that protects those forms against cross-site request forgery. It contains no identifying information and expires on its own.
A second, functional cookie records which language version of the site you are reading, so that you are not redirected away from a language you have chosen. It holds a two-letter code and nothing else.
We store one further item in your browser’s local storage to remember that you have seen the cookie notice, and your light/dark theme choice. Those never leave your device.
Full detail is in our cookie policy.
Sharing personal data
We do not sell or rent your personal data.
Your personal data may be shared only with trusted service providers that help us operate our website. This is our complete list:
| Sub-processor | Purpose | Location |
|---|---|---|
| Datacenter provider | Houses our servers; we run the web and mail servers ourselves | Finland (EU) |
| Stripe Payments Europe, Ltd. | Processing payments made on our payment page | Ireland (EU); see below |
| Mistral AI SAS | Answers in the “Ask AI” chat (our own AI server in Finland is the backup) and turns spoken questions into text when our own server is offline or busy; it does not keep the text | France (EU) |
These providers act as processors on our instructions, under contracts that meet Article 28 of the GDPR. All of them are inside the EU. Stripe may, however, transfer payment data to Stripe, Inc. in the United States, which is certified under the EU–U.S. Data Privacy Framework; Stripe also relies on the European Commission’s Standard Contractual Clauses. Other website data never leaves the EEA. If that ever changes, we will update this page before it happens and rely on the Standard Contractual Clauses or another Article 46 safeguard.
Services we build for clients
Some products we build — such as the interactive AI avatar kiosk — process data on behalf of the client who operates them. In those projects the client is the controller and AJ-Group acts as a processor. Where an AI model is involved we use EU-hosted providers on paid tiers that exclude customer data from model training, with encrypted logs and short retention, and the people affected are told before any recording begins. Details are provided per project in the relevant data-processing agreement.
Data retention
| Data | Retention |
|---|---|
| Contact form enquiries | Up to 24 months |
| Newsletter subscription | Until you unsubscribe |
| Unconfirmed newsletter sign-ups | Deleted automatically after 48 hours |
| Spam-protection counters | Deleted automatically, at most 30 days |
| “Ask AI” chat questions, voice and answers | Not stored; answered by Mistral AI (above) or our own AI server in Finland and dropped. Only daily counts are kept |
| Server logs | According to our hosting provider’s retention policy |
| Payment records | Six years from the end of the financial year, as the Finnish Accounting Act requires |
Where required by law, certain information may be retained for longer periods.
Your rights
Under the GDPR, you have the right to:
- Access your personal data.
- Request correction of inaccurate personal data.
- Request deletion of your personal data.
- Restrict the processing of your personal data.
- Object to processing based on legitimate interests.
- Withdraw your consent at any time.
- Request data portability where applicable.
- Lodge a complaint with the Finnish Data Protection Ombudsman if you believe your rights have been violated.
Exercise them here: use the your data & rights form — access, correction, erasure, portability, restriction, objection or withdrawal of consent, all in one place. You can also simply write to contact@aj-group.net. Either way we answer within one month, free of charge.
To opt out of the newsletter, use the unsubscribe link in any newsletter — it deletes your address straight away, without us having to act on it.
Data security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration or destruction. The site is served over HTTPS, form submissions are protected against cross-site request forgery, and stored submissions are kept outside the public web directory with restrictive file permissions.
While we take reasonable steps to protect your information, no method of transmitting data over the Internet can be guaranteed to be completely secure.
Contact
If you have any questions regarding this privacy statement or wish to exercise your rights under the GDPR, please contact us:
AJ-Group
Business ID / VAT: FI18913457
Lohja, Finland
Email: contact@aj-group.net
Changes to this privacy statement
We may update this privacy statement from time to time to reflect changes in our services, legal requirements or data protection practices. Any updates will be published on this page together with a revised “last updated” date.