Privacy Policy

1. Controller

The controller of your personal data is AI Eesti OÜ (registry code 17165018), Rotermanni 14, 10111 Tallinn, Estonia. For data protection questions, write to info@aieesti.ee.

2. What data we process and why

For each kind of processing we list the data, the purpose, the legal basis under the General Data Protection Regulation (GDPR) and how long we keep it.

• Enquiries and contact forms. Name, email, phone (if you add it), company, chosen service and message. We use them to answer your enquiry, call you back and make an offer. Legal basis: steps taken at your request before entering into a contract, and our legitimate interest in answering business enquiries (GDPR Art 6(1)(b) and (f)). Kept for up to 3 years after our last contact.
• Training registration. Name, email, phone, company, chosen cohort, how you heard about us, employment type, when you accepted the cancellation terms and your newsletter choice; later also billing and attendance data. We use them to confirm your seat, organise the training, send calendar invitations and course information, invoice, and issue a certificate or statement of attendance. Legal basis: contract (GDPR Art 6(1)(b)) and obligations under the Estonian Accounting Act and Adult Education Act (Art 6(1)(c)). Invoices are kept for 7 years, other registration and attendance data for 3 years after the training ends.
• Waitlist. Name, email, phone, company, number of participants and preferred timing. We use them to tell you about new dates and contact you. Legal basis: your request (GDPR Art 6(1)(b)). Kept for up to 12 months or until you ask us to delete them.
• Newsletter. Email address. We send a weekly summary of AI news. Legal basis: your consent (GDPR Art 6(1)(a)), which you can withdraw at any time through the link at the bottom of every email. Kept for as long as you are subscribed.
• Job applications. Name, email, phone, LinkedIn profile, CV, cover letter, answers to the application questions, and video and portfolio links. We use them for recruitment only. An AI tool helps with the first review of applications, but a person always makes the decision. Legal basis: steps taken at your request before entering into a contract, and our legitimate interest in finding the right person (GDPR Art 6(1)(b) and (f)). Kept for 12 months after your last application, then deleted automatically.
• Booking a meeting. If you book a time through our Google Calendar page, we receive your name, email and the chosen time. Legal basis: your request (GDPR Art 6(1)(b)). Kept for up to 3 years after our last contact.
• Website analytics and ad measurement. Only with your consent: pages visited, clicks, device and browser data, and approximate location based on IP address. PostHog and Google Analytics show us how the website is used, and Google Ads and Meta (Facebook, Instagram) tools measure how our ads perform. We do not record sessions. Legal basis: your consent (GDPR Art 6(1)(a)). Analytics data is kept for up to 14 months.
• Website security and reliability. When you submit a form, Cloudflare Turnstile checks that you are not a bot, which processes your IP address and browser data. If an error occurs on the website, we store the error message, page address and browser type for 30 days. If a form fails to send, we store your name, email and chosen course so we can contact you ourselves, for up to 90 days. Legal basis: our legitimate interest in protecting the website and not losing your message (GDPR Art 6(1)(f)).

3. Who we share data with

The following service providers process data on our behalf (processors). They may use it only on our instructions.

• Cloudflare (USA): website hosting, database, file storage and bot protection.
• Google (USA): email and calendar (Google Workspace), Google Analytics, Google Ads and Google Tag Manager.
• Meta Platforms Ireland (Ireland): ad performance measurement.
• PostHog (data stored in the EU): website analytics.
• Resend (USA): confirmation and notification emails.
• Kit (USA): newsletter delivery.
• Slack (USA): internal team notifications about new registrations.
• Anthropic (USA): first review of job applications.
• Accounting service provider: invoicing and bookkeeping.

4. Transfers outside the European Union

Some providers are based in the USA. Data is transferred under the European Commission's adequacy decision of 10.07.2023 (EU-US Data Privacy Framework) where the provider is certified, and otherwise under the Commission's standard contractual clauses. We never sell your data.

5. Cookies and browser storage

On your first visit we ask for your consent to cookies. No analytics or advertising tool loads before you choose. You can change your choice at any time through the "Cookie settings" link in the website footer.

Always used, because the website needs them to work:

• remembering your cookie choice (browser localStorage);
• unsent form data, which we resend automatically on your next visit (localStorage, up to 24 hours);
• remembering your newsletter pop-up preference (localStorage);
• Cloudflare Turnstile bot check when you submit a form.

Only with your consent: PostHog analytics (localStorage), Google Analytics and Google Ads cookies (such as _ga and _gcl_au), and the Meta cookie (_fbp).

Video preview images load from YouTube's servers. The video itself starts only when you click it and uses privacy mode (youtube-nocookie.com).

6. Your rights

You have the right to:

• access your data and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict the processing of your data;
• object to processing based on our legitimate interest;
• receive the data you gave us in a machine-readable format;
• withdraw your consent at any time. This does not make earlier processing unlawful.

To make a request, write to info@aieesti.ee. We reply within one month.

If you believe we have breached your rights, you can contact the Estonian Data Protection Inspectorate: www.aki.ee, info@aki.ee.

7. Do you have to give us your data?

Form fields marked with an asterisk (*) are needed for us to answer your enquiry or accept your registration; without them we cannot. Consenting to analytics and subscribing to the newsletter are voluntary.

8. Automated decisions

We do not make decisions about you based solely on automated processing that have a legal or similarly significant effect on you. For job applications, AI is an aid and a person makes the decision.

9. Changes

We update this page when our processing changes. The date of the latest change is shown at the top.

10. Google user data in our applications

This section covers AI Eesti applications that connect to your Google account, not visits to the website.

When you use our service that connects to Google services (for example through Google Drive or Google Slides), we access only the files you have created with or shared with our application.

• We do not collect, process or transfer Google user data to third parties.
• We do not use Google data to train machine learning or AI models.
• We use Google APIs only to modify files you have selected or created (for example copying and editing slides).
• Our application fully complies with the Google API Services User Data Policy, including the Limited Use requirements.

All data is processed securely, with restricted access, and only for the purposes above.