Privacy Policy

Laituri.ai Oy
Otakaari 5A / Kiuas Collective, 02150, Espoo, Suomi
+358 440552199
Business ID: 3608395-2
Helsinki, Finland

1. Introduction

Laituri.ai Oy (Business ID 3608395-2) ("we", "us", "our") provides an AI-powered candidate assessment platform that helps organisations evaluate competencies, skills, and culture fit. This Privacy Policy explains how we collect, use, share, and protect personal data when you use our platform, visit our website (www.laituri.ai), or interact with us as a candidate, HR user, or website visitor.

We are committed to protecting your privacy and processing personal data in compliance with the EU General Data Protection Regulation (GDPR), the Finnish Data Protection Act (Tietosuojalaki, 1050/2018), and all other applicable data protection laws.

2. Data Controller

The data controller responsible for your personal data is Laituri.ai Oy, Business ID 3608395-2, Helsinki, Finland.

If you have any questions about this policy or how we handle your personal data, please contact our privacy team at [email protected].

3. Personal Data We Collect

We collect different categories of personal data depending on how you interact with us:

3.1 Candidate Data

When you complete an assessment on behalf of a hiring organisation, we collect:

• Full name, email address, and preferred language
• Assessment responses, including written answers and competency scores
• AI-generated evaluation results and competency profiles
• Technical metadata: browser type, IP address, assessment start/end times
• Any additional data requested by the hiring organisation (e.g., CV upload, cover letter upload)

CV and Cover Letter scanning. Where a candidate uploads a CV (curriculum vitae) and/or cover letter, the platform automatically scans these documents and uses the extracted anonymized information to tailor and customize the assessment to the role and to the candidate's background. Once the assessment has been customised, the personal information (CV and/or cover letter) is only viewed by the recruiting team and is not processed in any other way.

Access to results. Assessment results and reports are accessible only to the members of the recruitment team at the hiring organisation who are actively recruiting for the position the candidate applied to. Results are not visible to other employees of the hiring organisation, to other Laituri.ai customers, or to the public.

3.2 HR User Data (Platform Accounts)

When an HR professional or recruiter creates a platform account, we collect:

• Full name, work email address, and job title
• Company name and billing information
• Account credentials (passwords are stored as hashed values only)
• Activity logs: assessments created, candidates invited, reports viewed
• Support and communication records

3.3 Website Visitor Data

When you visit www.laituri.ai, we may collect:

• IP address, browser type, operating system, and referring URL
• Aggregated page views and referrers, collected without cookies and without any identifier stored on your device
• Contact form submissions (name, email, message)
• Information stored locally in your browser for the site to function (see Section 9)

4. How We Use Your Personal Data

We process personal data for purposes including providing and improving our assessment platform, fulfilling contractual obligations, communicating with users, ensuring platform security, and complying with legal obligations.

We do not sell personal data to third parties. We do not use candidate assessment data to train our AI models in a way that re-identifies individuals without explicit consent.

5. Data Sharing and Third-Party Processors

We share personal data only where necessary. All third-party processors are bound by data processing agreements that meet GDPR requirements.

We may also disclose personal data to competent authorities if required by law, court order, or to protect the rights, property, or safety of Laituri.ai or others.

6. International Data Transfers

We primarily store and process data within the European Economic Area (EEA). Where data is transferred outside the EEA (for example, to AI service providers with servers in the United States), we rely on the following safeguards:

• EU Standard Contractual Clauses (SCCs) adopted by the European Commission
• Adequacy decisions where applicable
• EU-US Data Privacy Framework certification where available

You may request a copy of the applicable transfer mechanisms by contacting [email protected].

7. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy, or as required by applicable law. When data is no longer needed, it is securely deleted or anonymised so that it can no longer be attributed to an individual.

CV and cover letter information. Information extracted from a candidate's CV and cover letter is used only to customise the candidate's assessment. Immediately after the assessment has been generated, the personal data extracted from the CV and cover letter is destroyed and is not retained on our systems.

Access scope. Assessment results that we do retain on behalf of the hiring organisation can be viewed only by the members of the recruitment team responsible for the position the candidate applied to. Access is governed by role-based controls and is removed when the recruitment process for the position is closed, in accordance with the hiring organisation's retention schedule.

8. Your Rights Under GDPR

Depending on your location and the legal basis for processing, you have the following rights:

• Right of access: obtain a copy of the personal data we hold about you
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure: request deletion of your data ("right to be forgotten")
• Right to restrict processing: limit how we use your data
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to processing based on legitimate interests or direct marketing
• Right to withdraw consent: where processing is based on consent, withdraw it at any time
• Right to lodge a complaint: contact the Finnish Data Protection Ombudsman (tietosuoja.fi) or your local supervisory authority

9. Cookies and Tracking Technologies

We group cookies and similar technologies into three categories: strictly necessary (always active), analytics, and marketing. Analytics and marketing are switched off until you turn them on. No non-essential technology is loaded before you give consent. You choose via the consent banner shown on your first visit.

What we currently use. We set no advertising or tracking cookies, and our website analytics is cookieless, so it stores nothing on your device and does not profile you. The strictly necessary category covers information kept in your browser's local storage so the service works: your signed-in session, your language choice, security checks (Cloudflare Turnstile), your cookie choice itself, and, during an assessment, a local backup of your in-progress answers, kept for 24 hours so a crash or refresh does not lose your work. This backup stays on your device; it is not a tracking technology.

You can change or withdraw your choice at any time via the "Cookie settings" link in the website footer, or by clearing site data in your browser. Strictly necessary items cannot be switched off, as the service cannot function without them.

10. AI-Specific Disclosures

Laituri.ai uses artificial intelligence to evaluate candidate responses and generate competency reports. We are committed to responsible AI practices:

• Automated processing: Assessment results are generated by AI. Hiring organisations are responsible for final employment decisions. AI outputs are advisory, not determinative.
• Right to human review (GDPR Art. 22): If an automated decision significantly affects you, you have the right to request human review by contacting the hiring organisation or us.
• Bias mitigation: We regularly audit AI outputs for demographic bias and update models to improve fairness and accuracy.
• Model training: We do not use individually identifiable candidate responses to train AI models. Only aggregated, anonymised data may be used for model improvement.

11. Data Security

We implement technical and organisational measures proportionate to the risk of processing, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access control (RBAC) and least-privilege principles
• Pseudonymisation of candidate data where technically feasible
• Regular penetration testing and vulnerability scanning
• Employee training on data protection and information security
• Incident response procedures aligned with GDPR Art. 33/34 breach notification requirements

In the event of a personal data breach that poses a high risk to your rights and freedoms, we will notify affected individuals and the competent supervisory authority in accordance with GDPR obligations.

12. Children's Privacy

Our platform is not directed to children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact [email protected] and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. We will notify you of material changes by:

• Posting the updated policy on our website with a revised effective date
• Sending an email notification to registered HR users
• Displaying a prominent notice on the platform for 30 days after a material change

Continued use of the platform after the effective date of a revised policy constitutes your acceptance of the changes.

14. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact: [email protected]

This document was last reviewed on 19 May 2026. Laituri.ai Oy, ID: 3608395-2, Helsinki, Finland