Privacy Policy – Parvi & Co. Oy

Published 28.8.2026.

1. Data Controller

Parvi & Co. Oy (“we”, “us”) Business ID: 3626208-8 Lapinlahdenkatu 1 B, 00180 Helsinki, Finland Tel. +358 44 703 1352

1.1 Contact Details

If you have any questions about data protection at Parvi, send us an email at otso.karvinen@parvi.ai and we will get back to you.

1.2 When This Policy Applies to You – Parvi’s Roles

This policy applies to situations where Parvi acts as the data controller: our own sales, marketing, customer relationship management, recruitment, and the use of our website.

When we provide services to our customers – for example, marketing or sales carried out with the help of AI agents – and in doing so process personal data for which our customer is responsible (such as the data of our customer’s own customers or prospects), we act as a data processor on behalf of our customer. Such processing is not described in this policy; it is governed by the agreement and data processing agreement (DPA) concluded with the customer, and the customer acts as the data controller.

2. Why Was This Privacy Policy Created?

We collect personal data about our customers, potential customers, job applicants, other business partners, and people who wish to receive communications from us.

We process personal data for the following purposes and on the following legal bases:

• Delivering, developing, and providing our products and services and managing the customer relationship – the legal basis is the contract or pre-contractual measures, and, with respect to contact persons of our corporate customers, our legitimate interest in serving our business customers.
• Responding to enquiries sent to us – the legal basis is our legitimate interest in responding to messages you have sent us yourself.
• Marketing and targeting our marketing to current and potential customers – the legal basis is our legitimate interest in telling companies and their representatives about our services. Electronic direct marketing is based on your consent or, for representatives of companies, on direct marketing related to your professional role, which you can always opt out of.
• Processing job applications – the legal basis is taking steps at your request prior to entering into an employment contract, as well as our legitimate interest in assessing applicants during recruitment.
• Sending communications you have subscribed to (e.g. our newsletter) – the legal basis is your consent, which you can withdraw at any time.
• Complying with legal obligations, such as accounting requirements – the legal basis is a legal obligation.
• Analyzing and improving the use of our website through cookies and analytics – for non-essential cookies, the legal basis is your consent, which we request via the cookie banner.

Where processing is based on our legitimate interest, that interest is one of those described above: managing our customer and partner relationships, responding to contacts, marketing our services to companies, and recruitment. We have assessed that such processing does not override your rights and freedoms, and you always have the right to object to it (see Section 7).

3. What Data Do We Collect and Why?

Customers, Business Partners, and Other Contacts

If you are our customer, or if you want to contact us regarding new business or cooperation opportunities, or wish to subscribe to communications from us, we may collect and process the following data about you:

• Name and contact details (first and last name, email address, phone number, street address, postal code, and country)
• Information about your organization and your role
• Your requests to us and communications with us, and necessary related information such as invoicing details, ordered services, and information you provide about a project
• Information about your visit to our website, including your IP address, browser and device type, traffic source, the time and duration of your visit, and the pages you viewed.

This data is used to manage the business relationship between you and us, to communicate with you, to process requests sent to us, and to provide our services. The data is also used to analyze, plan, improve, and test our services and operations.

We primarily obtain the data from you or from the organization you represent. If we obtain your contact details from a source other than you – for example, from the public website of the company you represent, from the trade register, from professional networking services, or from a colleague of yours – we will inform you of the processing and the source of the data at the latest at the time of our first contact with you, or within one month of collecting the data.

Job Applicants

You can send us a job application by email or via our website. If you apply for a job with us, we collect and process the following data about you. Data is collected at different stages of the recruitment process.

• Name and contact details (first and last name, email address, phone number, street address, postal code, and country)
• Your application, CV, and any other information/files you choose to send us with your application
• Professional interests and skills
• LinkedIn profile (if you have chosen to send us a link)
• Other information relevant to processing your application, obtained in interviews, discussions, and other communications between you and Parvi.

This data is used solely to process your application and to communicate with you during our recruitment process. The data is not shared with anyone else unless required by applicable law or an order of a public authority.

If you have given permission to share your data with another company in the Ida Fram Group Oy group, we may share your data with a representative of that group company.

4. Cookies

We use cookies on our website to optimize and improve your experience. Cookies are small text files that may be stored on your device to identify and track visitors to our website. When you arrive on our website, we ask for your consent to store cookies on your device, other than those strictly necessary for the site to function. You can change your choices or disable cookies at any time via the cookie settings or your browser settings.

4.1 Log Files and Analytics

We automatically collect technical data about the use of our website, such as IP address, device and browser type, domain names, access times, and referring website addresses. This data is used to produce general statistics about the use of our website and to maintain service quality and information security. We do not link analytics data to your name or other direct identifiers; technical log data may be linked to you only where necessary to investigate a security incident or misuse.

5. Recipients and Transfers of Data

We never sell your personal data to third parties, nor do we disclose your data to third parties for direct marketing purposes.

5.1 Service Providers

We use carefully selected service providers that process personal data on our behalf. These include the following categories of recipients:

• website maintenance and hosting services
• email and newsletter tools
• customer relationship management (CRM)
• website analytics (Google Analytics / Google Ireland Ltd)
• AI services, such as large language model providers, to the extent we use them in our own operations, for example for drafting communications (e.g. OpenAI / Anthropic / Google). We do not use your personal data to train AI models, and we have agreed with our providers that the data is not used for model training.
• financial administration and invoicing

We enter into the data processing agreements required by the GDPR with all our service providers and ensure that your data is processed confidentially and only in accordance with our instructions. Personal data may also be disclosed to public authorities where required by law.

5.2 Transfers of Data Outside the EU/EEA

We primarily store personal data within the EU/EEA. However, some of the service providers we use (for example, Google and certain AI service providers) may also process data outside the EU/EEA, particularly in the United States. In such cases, the transfer is based on a European Commission adequacy decision, such as the EU–US Data Privacy Framework for companies certified under it, or on the standard contractual clauses approved by the European Commission, supplemented with additional safeguards where necessary. You can obtain a copy of the applicable safeguards by contacting us at the address given in Section 1.1.

5.3 Social Media

Our website contains social media features, such as share buttons and embedded content. This privacy policy does not apply to these features. Your interactions with these features are governed by the privacy and other policies of the companies providing them.

5.4 External Websites

Our website contains links to other websites. Please note that we do not control and are not responsible for the content or practices of these other websites. This privacy policy does not apply to those websites, which are subject to their own privacy and other policies.

6. How Long Do We Keep Your Data?

We retain your data for as long as it is needed for the purposes for which it was collected, or for as long as laws and regulations require (for example, accounting records for six years from the end of the financial year).

• Website visitors: a maximum of 2 years, after which the data is securely deleted.
• Customers and business partners: for the duration of the customer or contractual relationship and for a necessary period after it ends. The need for the data is reviewed regularly, and data is deleted when it is no longer needed.
• Potential customers: as a rule, for 1 year from the most recent contact.
• Job applicants: for the duration of the recruitment process and for a maximum of 2 years from the recruitment decision, after which the data is deleted. With your consent, we may keep your application longer for future positions.

You can also ask us to delete your data at any time. And that’s not all – read more about your rights in Section 7 below.

6.1 Corporate Transactions

If another company acquires us (or our assets), for example as a result of a merger, acquisition, or other transaction, personal data may be transferred as part of that transaction. In that case, the processing of the data will continue to be governed by principles equivalent to this policy, and we will inform you of any material changes.

7. What Are Your Rights?

If and when you agree to give us your personal data, this does not mean we own you. You have the right, at any time, to:

• obtain confirmation of whether we process personal data relating to you, and receive a copy of that data
• have inaccurate or incorrect data about you rectified
• have your data erased, subject to the conditions of data protection legislation
• restrict the processing of your data
• object to processing based on our legitimate interest, on grounds relating to your particular situation – and object to direct marketing at any time, without any justification
• receive the data you have provided to us in a machine-readable format and transmit it to another controller, where the processing is based on consent or a contract
• withdraw any consent you have given at any time; withdrawal does not affect the lawfulness of processing carried out before it. You can also unsubscribe from our newsletter directly via the “Unsubscribe” link in every message.

To exercise your rights, contact your contact person at Parvi if you have one, or send us an email at otso.karvinen@parvi.ai. We will respond to your request without undue delay and at the latest within one month of receiving it. If requests are numerous or complex, this period may be extended by a maximum of two further months – in that case, we will inform you of the extension and its reasons within one month of your request. If we have justified doubts about the identity of the person making the request, we may ask for additional information to verify identity.

8. Automated Decision-Making and Profiling

We may use data related to the use of our website and our marketing to target our marketing – for example, to determine which of our content is most likely to interest you. However, we do not make decisions about you that are based solely on automated processing and that would produce legal effects concerning you or similarly significantly affect you. You can object to marketing targeting at any time (see Section 7).

9. How Do We Protect Your Data?

Keeping your personal data safe is very important to us. We use appropriate organizational, technical, and administrative security measures to protect all data in our possession against misuse, loss, disclosure, unauthorized access, alteration, transfer, and other unlawful processing. Everyone who processes personal data is bound by a duty of confidentiality.

10. What If You Want to Lodge a Complaint?

If you believe your rights have not been respected, you can always contact us.

You can also lodge a complaint with the supervisory authority:

Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) Visiting address: Ratapihantie 9, 6th floor, 00520 Helsinki, Finland Postal address: P.O. Box 800, 00521 Helsinki, Finland Email: tietosuoja@om.fi Switchboard: +358 29 566 6700

11. Changes to This Privacy Policy

We may update this privacy policy from time to time as we improve and develop our operations, services, and website. Changes may also be based on changes in legislation. The updated policy will be published on our website, and we will separately inform you of material changes, for example by email or on our website.