Privacy Policy

Effective from 2026-07-05. This Privacy Policy describes how InnoVisual Oy processes personal data in Innohub and its related services. If anything remains unclear, please contact us: tietosuoja@innohub.fi. This English version is a translation; in the event of any conflict, the Finnish version prevails.

1. Controller and contact details

InnoVisual Oy, Business ID (Y-tunnus) 3526875-2, VAT ID FI35268752, Välikatu 6, 62900 Alajärvi, Finland. Contact point for data protection matters: tietosuoja@innohub.fi.

2. Services covered by this Privacy Policy

This Privacy Policy applies to the Innohub.fi website and the Innohub service offering: InnoRenki with its features (such as customer surveys, presentations and customer relationship management), the Innohub online shop where it is in use, calculators and other tools, newsletters, contact forms, chat widgets and any login, SSO and payment functions.

In some B2B services, InnoVisual acts as a processor of personal data on behalf of the customer. In such cases, a separate data processing agreement or an equivalent contractual schedule is required with the customer, and the customer is responsible for fulfilling its own obligation as controller to inform its own users and customers.

3. What data we process

• Account and contact data: name, email address, company, role, telephone number, billing details and service-related messages.
• Login and SSO data: user identifier, email verification status, login method and logs necessary for security purposes. We do not receive the password to your Google or Microsoft account.
• Customer relationship and contract data: subscription, contract versions, acceptances, access rights, invoicing, payment status, support requests and customer service messages.
• Service content: for example InnoRenki conversations, responses to InnoRenki customer surveys, presentations and customer relationship management data, form responses, data entered into tools and content created by the customer.
• Payment data: payments are processed through a payment service provider. We do not store full card numbers; we receive the payment status, order identifiers and the information required for accounting purposes.
• Technical data and cookies: IP address, browser, device, timestamps, logs, cookie preferences, website usage data and data needed to manage misuse and information security.
• Marketing data: newsletter subscription, consents, campaign source, opens and clicks, where such tracking is in use and lawful.

4. Purposes and legal bases of processing

• Performance of a contract: account creation, login, use of the service, orders, payments, customer support and delivery of the service.
• Legal obligations: accounting, taxation, mandatory obligations towards public authorities and giving effect to data protection rights.
• Legitimate interests: information security of the service, prevention of misuse, development of the service, management of B2B customer relationships, reasonable analytics and technical monitoring.
• Consent: non-essential cookies, newsletters and other electronic direct marketing where consent is required.
• Documented instructions of the customer: when we act as a processor on behalf of a customer, we process the data of the customer’s end users in accordance with the service and agreement concluded with the customer.

5. AI functions and transparency

Innohub’s AI features may generate answers, suggestions, summaries and analysis, for example in chat, customer service, lead handling, NPS feedback, CRM work or document processing. When a user interacts with AI, the service aims to make it clear that the function in question is AI-assisted.

Customer content is not used to train general-purpose AI models without a separate agreement or consent. AI responses may be incomplete or inaccurate and should not be regarded as legal, medical, financial or other professional advice without human review.

We do not make decisions based solely on automated processing that would produce legal effects concerning the data subject or similarly significantly affect them. Any classification, scoring or recommendation serves to support decision-making and is not an automated final decision.

6. Data location and sub-processors

Innohub’s primary data is stored on InnoVisual Oy’s own server in Helsinki, Finland (UpCloud Oy). We aim to limit AI processing to the EU regions of Google Cloud Vertex AI (the Finnish region europe-north1 and Google’s EU multi-region). Speech recognition is carried out, to the extent it is used, in Google Cloud’s Netherlands region (europe-west4) and speech synthesis in Google’s EU multi-region. Some supporting services, such as payments, SSO, email and consent management, may require data to be processed outside the EU/EEA on the basis of the service provider’s contractual terms, data processing agreements, standard contractual clauses or other lawful transfer mechanisms.

We use the following named sub-processors and technical service providers to deliver the service, to the extent that the relevant function is in use:

Supplier	Role	Typical location / note
UpCloud Oy	Technical service provider for application and database infrastructure	Helsinki, Finland
Domainhotelli / Planeetta Internet Oy	WordPress environment, domain name, DNS, email or hosting services, to the extent they are in use	Finland / EU, in accordance with the supplier’s terms of service
Google Cloud / Vertex AI	Processing of AI requests, embeddings, search, model services, speech recognition and speech synthesis	EU (Vertex AI: Finland europe-north1 and EU multi-region; speech recognition in the Netherlands, europe-west4; speech synthesis in the EU multi-region)
Stripe Payments Europe, Ltd.	Payments, subscriptions, billing and fraud prevention data	EU, as well as Stripe’s sub-processors and transfer mechanisms
Telnyx LLC	Calls and phone numbers, where the voice channel is in use	EU (call audio) and the United States (call event data), in accordance with the supplier’s transfer mechanisms
Usercentrics A/S / Cookiebot by Usercentrics	Cookie and consent management	EU/EEA, as well as the supplier’s sub-processors
Google Ireland Limited	Google SSO and any Search Console / Site Kit functions	EU, as well as transfers in accordance with Google’s terms of service
Microsoft Ireland Operations Limited	Microsoft SSO, where in use	EU, as well as transfers in accordance with Microsoft’s terms of service
Burst Statistics or Matomo	Website usage statistics, if in use	Primarily in Innohub’s own environment

We do not sell personal data to third parties or disclose it for advertising purposes.

7. Data retention

• Customer account and service content: retained for the duration of the customer relationship and for a reasonable period thereafter, unless erasure is requested or longer retention is necessary by reason of law, contract, a dispute or information security.
• Account deletion: when an account is deleted, the service content is deleted. The customer may export its data before deletion. Basic information on the end of the customer relationship (such as industry, company size category and reason for ending) is retained for two years, after which it is anonymised.
• Invoicing and accounting records: retained as required by the Accounting Act and tax legislation, typically for 6–10 years depending on the type of record.
• Technical logs: as a rule, retained for a short period for the purposes of information security, troubleshooting and the prevention of misuse, unless a particular incident requires a longer investigation.
• Consent and contract log: retained for as long as necessary to demonstrate acceptances, the contract version and the legal basis.
• Marketing data: retained for as long as the subscription, consent or communications based on the customer relationship remain in effect, after which the data is deleted or deactivated.

8. Rights of the data subject

You may request access to your data, rectification of inaccurate data, erasure of data and restriction of processing, object to processing, withdraw your consent and request data portability, insofar as the right in question applies. Data requests are primarily handled by email at tietosuoja@innohub.fi. If the service has its own profile or account management view, you may also use it, but a request by email is always possible.

If we process data on behalf of our customer as a processor, we will forward the request to the customer concerned where necessary or assist the customer in fulfilling the request in accordance with the agreement. You may lodge a complaint with the Data Protection Ombudsman of Finland: tietosuoja.fi.

9. Information security and incidents

We protect the service with technical and organisational measures, such as TLS encryption, role-based access rights, logging, backups and stronger authentication for administrator users. Access to personal data is restricted according to role and need.

If we detect a personal data breach, we will assess the risk and notify the controller, the data subjects and the authorities as required by the GDPR. When we act as a processor, our aim is to notify the customer without undue delay and no later than within the time limit agreed in the data processing agreement.

10. Changes

We update this Privacy Policy when our services, suppliers, legal bases or applicable legislation change. Material changes will be notified in the service or by email where reasonably necessary. The date is shown at the beginning of this Privacy Policy.