Privacy Policy

Created:

September 18, 2026

Updated:

September 21, 2026

Jay Solutions Oy and its subsidiary Jay Solutions Sweden AB ("Jay Solutions", "we", "us", or "our") are committed to protecting your privacy and processing personal data in accordance with the EU General Data Protection Regulation (GDPR 2016/679), the Finnish Data Protection Act (1050/2018), the Finnish Act on Electronic Communications Services (917/2014), and other applicable privacy legislation.

This Privacy Policy applies to the processing of personal data collected through our website (jaysolutions.com), customer inquiries, marketing communications, recruitment activities, and direct business interactions.

Data Controllers:

Primary Controller: Jay Solutions Oy (Business ID: 2796213-9), Urho Kekkosen katu 2c, 00100 Helsinki, Finland.
Joint Controller: Jay Solutions Sweden AB, for joint group-level business operations, marketing, and cross-border customer relations. Inquiries regarding joint processing may be directed centrally to Jay Solutions Oy.

1. When and What Personal Data Do We Collect & Retention Periods

Purpose / Context	Types of Personal Data	Legal Basis (GDPR)	Retention Period
Contact & Inquiries Responding to contact forms, demo requests, and general communications.	Name, work email, phone number, company name, job title, message content, and communication history.	Legitimate Interest (Art. 6(1)(f)) to communicate with prospective and existing clients and partners.	Stored for 36 months following the last active communication, or until the matter is resolved, unless a business contract ensues.
B2B Marketing & Sales Outreach Direct B2B communication regarding Jay Solutions' services.	Name, business email, organization, job function, professional interests, and outreach logs.	Legitimate Interest (Art. 6(1)(f)) to engage relevant business representatives.	Retained for 36 months from the last meaningful engagement, or immediately upon objection/opt-out.
Newsletters & Event Invitations Distributing electronic newsletters, product updates, and webinar/event registrations.	Name, email address, company name, subscription preferences, and event registration details.	Consent (Art. 6(1)(a)).	Retained until you withdraw consent / unsubscribe (via the link in any email).
Website Operation & Security Ensuring platform security, server health, and technical operation.	IP address, access timestamps, requested URLs, browser type, operating system, and error logs.	Legitimate Interest (Art. 6(1)(f)) to protect IT infrastructure and guarantee site availability.	Server and security log files are deleted or anonymized automatically within 90 days.
Analytics & Site Performance Analyzing user trends and aggregate website usage.	Anonymized/pseudonymized IP, device identifiers, session duration, referral URLs, and interaction patterns.	Consent (Art. 6(1)(a)) collected via our cookie banner.	Analytics cookies and associated data expire after 12 months or upon deletion/withdrawal of consent.
Recruitment & Job Applications Assessing candidate qualifications and managing recruitment processes.	Contact details, CV/resume, cover letter, work history, education, references, and interview notes.	Consent (Art. 6(1)(a)) / Pre-contractual steps (Art. 6(1)(b)).	Maintained for 6 months following the end of the recruitment process, or up to 2 years with explicit consent for future openings.

2. On What Legal Grounds Do We Process Your Personal Data?

We process your data strictly under valid legal bases set out in Article 6 of the GDPR:

Consent (Art. 6(1)(a)): When you have given explicit consent (e.g., subscribing to newsletters, accepting non-essential analytics cookies, or opting into talent pools).
Contractual Performance & Pre-contractual Measures (Art. 6(1)(b)): When processing is necessary to prepare, enter into, or fulfill an agreement with you or your organization.
Legal Obligation (Art. 6(1)(c)): When processing is required by applicable EU or national laws (e.g., accounting, tax, or regulatory compliance).
Legitimate Interests (Art. 6(1)(f)): When necessary for our legitimate commercial interests (e.g., direct B2B marketing, maintaining network and information security, and managing customer/vendor relationships), balanced carefully against your privacy rights.

3. Direct Marketing, Cookies, and Tracking Technologies

Cookies & Consent: Our website utilizes essential cookies necessary for functionality and security. Non-essential cookies (such as analytics or marketing cookies) are deployed only after you provide consent via our cookie banner. You can modify or withdraw your cookie preferences at any time via the cookie settings on our website.
Email Tracking & Beacons: Our marketing communications and newsletters may contain web beacons or tracking pixels to monitor delivery, open rates, and link clicks. Under ePrivacy rules, this tracking is enabled based on your consent, which can be managed via communication preferences or by unsubscribing.

4. Who Do We Share Your Personal Data With?

We do not sell or lease your personal data. We disclose personal data only under the following circumstances:

Service Providers & Processors: Trusted third-party vendors who provide IT hosting, cloud infrastructure, CRM systems, email delivery, and analytics tools. All processors are bound by strict Data Processing Agreements (DPAs) pursuant to GDPR Article 28.
Intra-Group Entities: Between Jay Solutions Oy and Jay Solutions Sweden AB for administrative, customer management, and shared operational purposes.
Legal & Regulatory Authorities: When required by law, court order, or binding regulatory demand.

5. International Data Transfers

Whenever personal data is transferred outside the European Economic Area(EEA), we ensure appropriate safeguards are implemented in compliance with GDPR Chapter V:

Adequacy Decisions: Transfers to countries recognized by the European Commission as providing an adequate level of data protection (Art. 45 GDPR).‍
EU-U.S. Data Privacy Framework (DPF): Transfers to certified U.S. organizations under the DPF adequacy decision.‍
Standard Contractual Clauses (SCCs): Transfers based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR), supplemented by transfer impact assessments (TIAs) and additional technical/organizational security measures where necessary.

Right to Documentation: You have the right to request a copy of the applicable transfer safeguards (such as executed SCCs, with commercial terms redacted) by contacting us at info@jaysolutions.com.

6. Storage and Retention of Personal Data

We retain your personal data only for as long as necessary to fulfill the purposes specified in Section 1, or as required to comply with statutory retention obligations (e.g., Finnish Accounting Act requirements). Once the retention period expires or data is no longer necessary, it is securely deleted, overwritten, or irreversibly anonymized.

7. Technical and Organizational Security Measures

We maintain robust technical and organizational security measures (TOMs) aligned with ISO/IEC 27001 standards to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access:

Strict identity and access management (IAM), multi-factor authentication (MFA), and least-privilege access controls
Industry-standard encryption of personal data in transit (TLS 1.3) and at rest (AES-256).
Regular vulnerability assessments, threat modeling, backup testing, and continuous security monitoring.
Confidentiality agreements and regular data protection training for all personnel.

8. What Are Your Rights?

Under the GDPR, you have the following rights regarding your personal data:

Right of Access (Art. 15): Request confirmation of whether we process your data and receive a copy of your personal data.
Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data.‍
Right to Erasure / "Right to be Forgotten" (Art. 17): Request deletion of your personal data when it is no longer necessary, consent has been withdrawn, or processing is unlawful.‍
Right to Restriction of Processing (Art. 18): Request that we restrict processing under specific legal conditions.‍
Right to Data Portability (Art. 20): Receive personal data provided on the basis of consent or contract in a structured, commonly used, and machine-readable format.‍
Right to Object (Art. 21): Object at any time to the processing of personal data based on Legitimate Interests (Art. 6(1)(f)) or for direct marketing purposes.
Right to Withdraw Consent (Art. 7(3)): Withdraw previously granted consent at any time without affecting the lawfulness of prior processing.

Exercising Your Rights: To exercise any of these rights, submit your request in writing to info@jaysolutions.com. We will respond within one month of receipt, whichmay be extended by two additional months where necessary for complex requests.

‍Right to Lodge a Complaint: If you believe our processing violates applicable data protection laws,you have the right to lodge a complaint with a competent supervisory authority:

Finland: Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi.
Sweden: Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten - IMY), imy.se.

9. Contact Details

If you have questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

Jay Solutions Oy
Urho Kekkosen katu 2c
00100 Helsinki, Finland
Business ID: 2796213-9
Email: info@jaysolutions.com

10. Revision of Our Privacy Notice

We may update this Privacy Policy periodically to reflect changes in our legal obligations, technology, or business operations. Any updates will be published directly on this page with an updated revision date.

Last revised: September 17, 2026 (Version 1.0)

Get the Nordic Lens by Jay