Legal
Privacy statement
Last updated: 13 August 2026
The short version. This website loads nothing from third-party servers, runs no advertising or analytics trackers, and sets one strictly necessary cookie plus a cookie remembering your language. We only hold the data you type into a form, and only for as long as we need it to answer you.
Data controller
AJ-Group
Business ID / VAT: FI18913457
Lohja, Finland
Email: contact@aj-group.net
Website: https://aj-group.net
Introduction
AJ-Group (“we”, “our”, or “us”) is committed to protecting your privacy and to processing your personal data in accordance with the General Data Protection Regulation (GDPR).
This privacy statement explains what personal data we collect when you use our website, why we collect it, how we use it, and your rights regarding your personal data.
What personal data we collect
Contact form
If you contact us using our contact form, we collect:
- Your name
- Your email address
- The subject line, if you fill one in
- The contents of your message
This information is used solely to respond to your enquiry or to provide the service you asked about. We do not use contact form submissions for marketing purposes, and we never add an address to our newsletter because it wrote to us.
Newsletter
If you subscribe to our newsletter we store your email address and the date on which you confirmed the subscription. We use double opt-in: nothing is added to the list until you click the confirmation link we send you. Every newsletter contains a one-click unsubscribe link, and unsubscribing deletes the address rather than flagging it.
Website analytics
We do not run analytics on this website. There is no Google Analytics, no advertising pixel and no third-party tag of any kind. The site loads no fonts, scripts, images or styles from external servers, so your browser never contacts anyone but us.
Should we introduce analytics in the future, it would be activated only after you have given consent through a cookie banner, and this statement would be updated first.
Server log files
When you visit our website, our hosting infrastructure automatically records technical information including:
- IP address
- Browser type
- Operating system
- Date and time of access
- Requested pages
- HTTP status codes
These logs are necessary for website security, troubleshooting, preventing abuse and maintaining reliable operation.
Spam protection
To keep automated submissions out of our inbox, the forms count how many submissions have come from a given visitor recently. That counter is keyed by a salted, irreversible hash of the IP address — the address itself is never written to our application storage — and the counters are deleted automatically.
Why we process your data
- To respond to enquiries submitted through our contact form.
- To send our newsletter, where you have asked for it.
- To operate, maintain and secure our website.
- To prevent abuse of our forms.
- To comply with applicable legal obligations.
Legal basis for processing
We process personal data under one or more of the following legal bases defined by the GDPR:
- Your consent — for the newsletter, and for answering your enquiry.
- Our legitimate interests in operating, securing and improving our website.
- Compliance with legal obligations.
- Taking steps prior to entering into a contract, where applicable.
Cookies
This website sets one strictly necessary cookie. It keeps your session while you use the site preview and the forms, and it carries the token that protects those forms against cross-site request forgery. It contains no identifying information and expires on its own.
A second, functional cookie records which language version of the site you are reading, so that you are not redirected away from a language you have chosen. It holds a two-letter code and nothing else.
We store one further item in your browser’s local storage to remember that you have seen the cookie notice, and your light/dark theme choice. Those never leave your device.
Full detail is in our cookie policy.
Sharing personal data
We do not sell or rent your personal data.
Your personal data may be shared only with trusted service providers that help us operate our website. This is our complete list:
| Sub-processor | Purpose | Location |
|---|---|---|
| Our hosting provider | Serving this website; server logs | Finland (EU) |
| Our email provider | Delivering the messages our forms generate | Finland (EU) |
These providers act as processors on our instructions, under contracts that meet Article 28 of the GDPR. All of them are inside the EU, so no transfer of your website data outside the EEA takes place. If that ever changes, we will update this page before it happens and rely on the European Commission’s Standard Contractual Clauses or another Article 46 safeguard.
Services we build for clients
Some products we build — such as the interactive AI avatar kiosk — process data on behalf of the client who operates them. In those projects the client is the controller and AJ-Group acts as a processor. Where an AI model is involved we use EU-hosted providers on paid tiers that exclude customer data from model training, with encrypted logs and short retention, and the people affected are told before any recording begins. Details are provided per project in the relevant data-processing agreement.
Data retention
| Data | Retention |
|---|---|
| Contact form enquiries | Up to 24 months |
| Newsletter subscription | Until you unsubscribe |
| Unconfirmed newsletter sign-ups | Deleted automatically after 48 hours |
| Spam-protection counters | Deleted automatically, at most 30 days |
| Server logs | According to our hosting provider’s retention policy |
Where required by law, certain information may be retained for longer periods.
Your rights
Under the GDPR, you have the right to:
- Access your personal data.
- Request correction of inaccurate personal data.
- Request deletion of your personal data.
- Restrict the processing of your personal data.
- Object to processing based on legitimate interests.
- Withdraw your consent at any time.
- Request data portability where applicable.
- Lodge a complaint with the Finnish Data Protection Ombudsman if you believe your rights have been violated.
Exercise them here: use the your data & rights form — access, correction, erasure, portability, restriction, objection or withdrawal of consent, all in one place. You can also simply write to contact@aj-group.net. Either way we answer within one month, free of charge.
To opt out of the newsletter, use the unsubscribe link in any newsletter — it deletes your address straight away, without us having to act on it.
Data security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration or destruction. The site is served over HTTPS, form submissions are protected against cross-site request forgery, and stored submissions are kept outside the public web directory with restrictive file permissions.
While we take reasonable steps to protect your information, no method of transmitting data over the Internet can be guaranteed to be completely secure.
Contact
If you have any questions regarding this privacy statement or wish to exercise your rights under the GDPR, please contact us:
AJ-Group
Business ID / VAT: FI18913457
Lohja, Finland
Email: contact@aj-group.net
Changes to this privacy statement
We may update this privacy statement from time to time to reflect changes in our services, legal requirements or data protection practices. Any updates will be published on this page together with a revised “last updated” date.