1. Controller and scope
Lensovia is provided by Tutkaneuvos, Finnish Business ID 1848320-7, Finland. Contact us about privacy at https://lensovia.com/contact/?topic=privacy. This notice covers personal data for Lensovia’s own customer relationships, accounts, enquiries, billing and service security. We process material supplied to a customer workspace on the customer’s behalf under the DPA; its controller is the customer or the party identified by the customer.
2. Data and sources
We process names, business contact details, company and role information, account and access identifiers, order and payment status, acceptances, support messages, and necessary usage, event and security data, such as IP addresses and timestamps. Data comes from the individual, their organisation, use of the service, and payment or messaging events. We do not need the customer’s full payment card number; payment takes place through Stripe. Workspace material may include contact details, emails, documents, sales and procurement information. Optional analytics and campaign tracking are disabled.
3. Purposes and legal bases
Our legitimate interest in delivering and maintaining the service covers accounts, organisation memberships, B2B contracts, support and service messages. Contract is the basis when the individual is personally a contracting party or requests pre-contractual steps. Statutory billing retention is based on law. Legitimate interests also cover abuse prevention and legal claims; we assess necessity and effects on the individual. Separate consent applies to marketing and non-essential tracking where required. Terms acceptance or acknowledging this notice is not general privacy consent. The customer determines the legal basis for its workspace material.
4. AI and automation
A document or its contents necessary for processing may be sent to the OpenAI API for the selected AI function. Data is not used to train Lensovia’s general AI models or benefit other customers. We do not authorise the model provider to train general models on customer material. The provider may nevertheless retain data for security and service functionality; we do not promise zero retention or exclusively EU processing. Lensovia does not use its own customer records to make solely automated decisions with legal or similarly significant effects on individuals. Customers are responsible for the automations they define, required personal data safeguards and authorisation of external actions.
5. Recipients and processing countries
Railway Corporation provides the application server environment in Amsterdam, the Netherlands. Supabase Pte. Ltd provides the database, authentication and file storage; the inspected Lensovia project is in Stockholm, Sweden. These region choices do not guarantee that all support and metadata processing remains in the EEA. Plus Five Five, Inc., trading as Resend, delivers emails and primarily processes them in the United States. OpenAI Ireland Ltd. and its service chain process AI requests; EU-only processing has not been confirmed. Stripe acts as a processor for particular payment services and as a controller for its own payment, fraud prevention and statutory purposes. Billing does not require sharing the entire workspace with Stripe. Data may also be disclosed to authorities where required or, as necessary, to advisers bound by confidentiality.
6. International transfers
Transfers outside the EEA require an effective data protection agreement and a GDPR Chapter V basis: an applicable adequacy decision or EU Standard Contractual Clauses with necessary transfer assessments and supplementary safeguards. An EU server location alone does not resolve every transfer. Information about transfer grounds and safeguards and copies of applicable clauses are available through the privacy contact; unrelated trade secrets may be redacted. A transfer will not continue without a lawful basis.
7. Retention and deletion
Account and membership data is retained during the relationship and deleted from active use within 30 days of account or relationship closure, unless limited retention is necessary on another disclosed basis. Sales enquiries and support are retained for at most 12 months after the last necessary handling; security and usage logs for at most 90 days. Information necessary for an open security incident or legal claim may be retained with restricted access while the matter is dealt with; necessity is reviewed at least annually. Invoices and vouchers are kept for at least 6 years from the end of the year in which the financial year ended; financial statements and accounting records for at least 10 years from financial year end. Workspace return and deletion follow the DPA. Backups expire within 90 days after deletion from active systems; separate statutory retention is excluded from this limit.
8. Security and required data
Protection relies on organisation-specific access rights, private file storage, authentication, protected connections and multi-factor authentication where appropriate. No system is risk free. Missing account, organisation or billing details may prevent service delivery; declining optional marketing consent does not prevent core use. Customers manage user access and supply only necessary, lawfully processable material. Special-category or criminal offence data should not be supplied without separately agreed processing and safeguards.
9. Cookies and optional functions
Login uses necessary session identifiers. The public website stores the language preference in browser localStorage as lensovia_public_lang. Optional analytics and campaign tracking are disabled. Optional contact-form dictation uses browser speech recognition, which may process audio through the browser provider; typing is always an alternative.
10. Rights and changes
Subject to applicable conditions, you may request access, correction, deletion, restriction or portability and object to processing based on legitimate interests. You may always object to direct marketing and withdraw consent for future processing. We normally respond within one month and inform you within that month of any legally permitted, justified extension. Identity checks are proportionate where necessary. Requests concerning workspace data are directed to its controller, which we assist under the DPA. You may complain to a competent supervisory authority, including Finland’s Office of the Data Protection Ombudsman, tietosuoja.fi. The page states the notice version and effective date; material changes are communicated before new processing begins. This notice does not require waiver of data subject rights.