Privacy notice - data controller
1. Data controller
Gosoft Oy is the data controller and is responsible for the personal data you provide under applicable data-protection law.
Gosoft Oy (Business ID: 3454099-6) Punavuorenkatu 7 B 38, 00120 Helsinki, Finland
2. Contact for register matters
3. Legal basis and purpose of processing
- Delivering the services Gosoft Oy provides
- Customer communication and actions to maintain the customer relationship, such as customer-satisfaction measurements and research, as well as communication with customers and stakeholders
- Fulfilling statutory requirements, risk management, and actions to prevent misuse
- Service administration, improvement, and quality assurance
- Planning and execution of customer events and similar gatherings in cooperation with our partners
- Marketing activities, including direct marketing and targeted campaigns for existing and potential customers, as well as development of marketing strategies
- Strategic business planning, service development, and data collection and analysis
4. Personal data processed
"Personal data" refers to any information relating to an identifiable individual, as further defined in data-protection legislation. We collect only the personal data necessary for the purposes described in this document. In addition, we may process other information voluntarily provided by users of our services.
In connection with the use of our services, we collect the following personal data about users:
- The user's name and contact details, such as address, phone number, and email
- The user's business ID and company name, as well as the date of birth of the company representative or sole trader
- Registration-related information, such as username, password, and other identifying data
- Customer-relationship information, such as billing and payment details
- Information related to customer communication and marketing
- Customer feedback and contact information
- Profile information voluntarily provided by the user
- Granted permissions and consents
- Responses to surveys and research
- Information collected by tracking technologies, such as IP address, electronic-communication identifiers, browser and operating-system data
5. Regular sources of data
We obtain personal data primarily directly from users of our services, in connection with marketing activities, through forms or interactive tools provided by Gosoft Oy, and when you contact us with requests. We may also obtain personal data through the organization a user represents, from that organization's website, or from other open sources. Where legally permitted, personal data may also be obtained and updated from third-party registers, such as the Trade Register, Suomen Asiakastieto, business databases, credit-information registers, or other similar public or private registers, as well as from cooperation partners.
6. Disclosure of personal data
Personal data may be disclosed to authorities when required by law. In emergencies or other exceptional circumstances, personal data may, where necessary, be shared with a third party. Personal data may also be transferred to debt-collection agencies, credit bureaus, and similar organizations in connection with invoicing and debt collection.
When processing personal data, we may use services from various providers and third parties, such as IT vendors, accounting and financial-administration specialists, and other partners.
Where appropriate, we provide information about the parties responsible for processing your personal data and the recipients of the data.
7. Regular disclosures and transfers outside the EU or EEA
Data is not transferred outside the EU or EEA unless necessary for service delivery or under a statutory exception.
8. Principles of register protection
When processing personal data, we follow measures aimed at protecting the security and privacy of personal data. This includes protection against unauthorized actions and prevention of accidental loss, destruction, or damage of data. We use various technical and administrative safeguards, such as security software, encryption, and access restrictions, and we train our staff to follow these measures.
Our employees and partners who handle personal data are bound by confidentiality obligations regarding the processing of personal data, both by law and by contract, ensuring the confidential handling of the data.
9. Data-retention period
We retain personal data only as long as necessary to achieve the purposes stated in our privacy notice, unless the law requires Gosoft Oy to retain the data for a longer period.
Personal data that is no longer needed is appropriately deleted from our register within a reasonable time.
The personal data we use for electronic direct marketing is retained as long as necessary, unless the person has withdrawn consent to direct marketing or asked us not to use their data for this purpose.
Granted consents and any marketing prohibitions are kept for as long as they remain valid, generally for an indefinite period.
We provide further information on personal-data retention to users of our services upon request.
10. Right of access and right to rectification
Anyone has the right to inspect the data about themselves in the register and to require correction of any inaccurate data.
11. Other rights related to the processing of personal data
The data subject has the right to require erasure of their personal data, restriction of processing, and to object to processing. The data subject also has the right to data portability between systems.
12. Visitors who use the chat and widgets on our website
Our own website (gosoft.fi) runs Gosoft Connect - the same AI chat and widgets we provide to customers. When you use them here, Gosoft Oy is the data controller. In that capacity:
- No cookies. The widget sets no cookies. To work, it keeps strictly-necessary data in your browser's local storage - a random visitor identifier (not your name), a security token, an erasure secret, and your open conversation - namespaced to this site and erased when the session expires or when you choose "Delete my data". We do not store a language cookie.
- What we store. If you chat with us, we store the conversation and messages, anything you submit through a form (including uploaded files), and any contact details you give us as a lead. We also record pseudonymous analytics (page views, clicks, dwell time, conversions) keyed to the in-browser visitor identifier. We do not store your IP address (it is used only momentarily for abuse rate-limiting).
- AI replies. To answer you, the AI chat sends your message and relevant content from our knowledge base to our sub-processor OpenAI Ireland Ltd (Ireland) under a data-processing addendum we have executed with it; where OpenAI transfers data outside the EU/EEA to its affiliates, those transfers rely on appropriate safeguards (Standard Contractual Clauses or an adequacy decision). API data is not used to train OpenAI's models. Knowledge-base search runs locally on our own infrastructure, and we use no third-party advertising or analytics trackers. Automated visitor profiling is off for this website.
- Retention. Conversations, messages, submissions and any profile are kept 90 days from last activity; analytics events and leads up to 365 days; AI usage records (no message content) are kept longer as accounting records.
- Your rights. You can download or delete your chat data directly from the widget ("Download my data" / "Delete my data"), authenticated by a secret held in your browser. If that secret is lost (you cleared your browser or the session expired), email privacy@gosoft.fi and we will act on your request manually. The rights in sections 10–11 apply.