Privacy Policy

Controller

The controller is:

Qevinto Oy
Business ID: 3583823-3
Rovaniemi, Lapland, Finland
Email: contact@qevinto.com

In this Privacy Policy, “Qevinto”, “we”, “us”, and “our” refer to Qevinto Oy.

Scope of this Privacy Policy

This Privacy Policy applies to personal data processed in connection with:

• Qevinto’s website at qevinto.com;
• enquiries sent to Qevinto by email or through website contact features;
• GreetScribe pilot, waitlist, product, or service enquiries;
• cookie consent management;
• analytics, where the visitor has given the required analytics consent;
• website delivery, maintenance, security, and troubleshooting;
• B2B communications and relationship management; and
• Qevinto’s own business administration, legal, and compliance activities.

For Qevinto’s own website and business communications, Qevinto acts as controller. For future customer-specific GreetScribe implementations, the customer and Qevinto may have separate roles depending on the agreed service model and data flows. Service-specific data processing terms are agreed separately where required.

Personal data we process

Qevinto processes only personal data that is relevant and necessary for the purposes described in this Privacy Policy.

3.1 Contact and enquiry data

If you contact Qevinto, we may process:

• your name;
• your email address;
• your company, property, operator, or organisation name;
• your role or professional context, if you provide it;
• your preferred language;
• the topic of your enquiry;
• your message and other free-text content;
• your approximate service need, enquiry volume, or timeline, if you provide it; and
• any other information you choose to include in your communication.

Some website contact features may open your own email client with a pre-filled message to contact@qevinto.com. In that case, the message is not sent to Qevinto until you send it from your own email client.

3.2 GreetScribe-related enquiry data

If you contact us about GreetScribe, a pilot, a waitlist, or a possible service implementation, we may process:

• your name;
• your work email address;
• your company, property, operator, or organisation name;
• information about your business, properties, units, activities, services, or guest communication needs;
• notes about your enquiry, pilot goals, or service needs;
• related correspondence; and
• other information you choose to provide.

3.3 Technical website data

When you visit the website, technical data may be processed for website delivery, security, maintenance, troubleshooting, and abuse prevention. This may include:

• IP address;
• browser and device information;
• user agent;
• requested page or URL;
• date and time of access;
• referrer information, if available;
• error logs; and
• security-related logs.

Technical data is used only as necessary for operating, protecting, and troubleshooting the website.

3.4 Cookie, consent, and analytics data

The website may use cookies or similar technologies. Non-essential cookies, such as analytics cookies, are used only where required consent has been given.

Qevinto uses a first-party cookie settings panel to manage cookie choices. In connection with consent management, we may process information such as consent status, selected cookie categories, consent timestamps, browser information, and related consent records.

Qevinto does not currently load analytics scripts. Analytics may be added later only if implemented and enabled according to the visitor's analytics consent choice. analytics may process information such as page views, usage events, browser and device information, approximate location information, analytics identifiers, and aggregated website performance information.

Qevinto does not use analytics to identify individual visitors.

3.5 Email communication data

Qevinto uses email for enquiries, business communication, customer discussions, and service-related communication. Email processing may include:

• sender and recipient email addresses;
• message subject;
• message content;
• sending and receiving time;
• attachments, if provided; and
• email thread metadata.

Access to Qevinto email is limited to authorised users.

Sources of personal data

Qevinto receives personal data from:

• you directly, when you send us a message or enquiry;
• your email client or email service when you send a message to Qevinto;
• technical website use;
• the consent management tool, where used;
• analytics, where analytics consent has been given; and
• customers or customer systems in customer-specific GreetScribe or chatbot implementations, where separately agreed.

Purposes of processing

Qevinto processes personal data for the following purposes:

• responding to enquiries;
• handling service, pilot, and waitlist requests;
• assessing whether Qevinto’s services may fit a requested use case;
• preparing a possible customer relationship or contract;
• managing B2B communications and business relationships;
• operating, maintaining, and securing the website;
• troubleshooting errors and preventing misuse;
• managing cookie and analytics consent choices;
• measuring and improving website performance through analytics, where analytics consent has been given;
• sending electronic direct marketing only where lawful;
• complying with legal obligations;
• establishing, exercising, or defending legal claims; and
• delivering customer-specific GreetScribe, chatbot, AI assistant, or related services under applicable agreements.

Legal bases for processing

Qevinto processes personal data only where there is a legal basis under applicable data protection law.

6.1 Contract or steps before entering into a contract

Qevinto may process personal data where this is necessary to respond to a service enquiry, evaluate a requested pilot, prepare a proposal, discuss a potential customer relationship, or deliver agreed services.

6.2 Legitimate interests

Qevinto may process personal data based on legitimate interests for purposes such as:

• responding to general B2B enquiries;
• managing business contacts and professional relationships;
• operating and securing the website;
• troubleshooting errors;
• preventing misuse and protecting systems;
• maintaining internal business records; and
• establishing, exercising, or defending legal claims.

Qevinto’s legitimate interests are to operate and develop its business, communicate with relevant business contacts, protect its systems, and manage legal and administrative matters.

6.3 Consent

Qevinto relies on consent where required, including for:

• non-essential cookies;
• analytics;
• marketing cookies or similar technologies, where used; and
• electronic direct marketing where consent is required.

You may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6.4 Legal obligation

Qevinto may process personal data where necessary to comply with legal obligations, such as accounting, tax, regulatory, or authority-related obligations.

Cookies and similar technologies

The website may use cookies and similar technologies. Some cookies may be necessary for the website to function. Other cookies, such as analytics cookies, are used only where required consent has been given.

Qevinto uses a first-party cookie settings panel so that visitors can accept, reject, change, or withdraw cookie choices. More detailed cookie information may be provided through the cookie banner, cookie settings, or cookie declaration on the website.

analytics

Qevinto does not currently load analytics scripts. Analytics may be added later only if implemented and enabled according to the visitor's analytics consent choice.

analytics helps Qevinto understand, for example, how the website is used, which pages are visited, and how the website can be improved. Qevinto does not use analytics to identify individual visitors or make significant decisions about them.

Electronic direct marketing

Qevinto may use contact details to respond to enquiries and communicate about a possible project, pilot, service, collaboration, or training.

Qevinto may send electronic direct marketing only where lawful. This may be based on consent, an existing customer relationship where permitted by law, or applicable B2B communication rules. Marketing messages will identify the sender and provide an easy way to unsubscribe or opt out.

Qevinto may retain minimal opt-out information to ensure that marketing objections are respected.

GreetScribe and customer-specific implementations

GreetScribe is Qevinto’s chatbot and customer-interface solution for hotels, accommodation providers, hosts, tourism companies, activity providers, and other hospitality businesses.

For Qevinto’s own website and business communications, Qevinto acts as controller. For future customer-specific GreetScribe implementations, the customer and Qevinto may have separate roles depending on the agreed service model and data flows.

Where Qevinto processes personal data on behalf of a customer, the processing is governed by the customer agreement and a data processing agreement where required. Service-specific data processing terms are agreed separately where required.

GreetScribe is not intended for the collection of special categories of personal data or unnecessary sensitive information. Users should not submit unnecessary sensitive personal data through the service.

Recipients and service providers

Qevinto may disclose or make personal data available to recipients and service providers where necessary for the purposes described in this Privacy Policy.

Recipients and service providers may include:

• email service providers;
• website hosting and technical service providers;
• consent management providers;
• analytics providers, where consent has been given;
• professional advisers;
• authorities, courts, or regulators where required by law; and
• customer-specific service providers where separately agreed.

Where a service provider processes personal data on behalf of Qevinto, Qevinto aims to use appropriate contracts and data processing terms.

Transfers outside the EU or EEA

Some service providers may process personal data outside the EU or EEA. Where this happens, Qevinto uses appropriate safeguards required by applicable data protection law, such as adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms where required.

Retention

Qevinto keeps personal data only for as long as necessary for the purposes described in this Privacy Policy, or as required by law, contract, legal claims, security, or accounting obligations.

When personal data is no longer needed, it is deleted or anonymised within a reasonable time.

Security

Qevinto aims to protect personal data with appropriate technical and organisational measures. Access to personal data is limited to what is necessary for the relevant purpose.

No website or online communication method can be guaranteed to be completely secure. Visitors should avoid sending sensitive or unnecessary personal data through forms or email.

Automated decision-making and profiling

Qevinto’s website is not intended to make solely automated decisions that have legal or similarly significant effects on individuals.

Qevinto does not use the website for automated decision-making within the meaning of Article 22 of the GDPR.

Analytics is not active on the website now. If analytics is added later, it will be used only according to the selected analytics consent category and not to identify individual visitors or make significant decisions about them.

GreetScribe is intended to support chatbot communication, answer questions, assist routing, and support service workflows. It is not intended to make legally or similarly significant solely automated decisions about individuals.

Children

Qevinto’s website is intended for businesses, professionals, hospitality operators, tourism companies, accommodation providers, hosts, and other business users. The website is not directed at children under 13, and Qevinto does not knowingly seek to collect children’s personal data through the website.

Your rights

Subject to the conditions and limitations in applicable data protection law, you may have the following rights:

• the right to receive information about the processing of your personal data;
• the right to access your personal data;
• the right to request correction of inaccurate or incomplete data;
• the right to request deletion of your personal data;
• the right to request restriction of processing;
• the right to object to processing based on legitimate interests;
• the right to withdraw consent where processing is based on consent;
• the right to data portability where applicable;
• the right to object to electronic direct marketing; and
• the right not to be subject to solely automated decision-making that has legal or similarly significant effects, where applicable.

You can exercise your rights by contacting:

contact@qevinto.com

Qevinto may need to verify your identity before handling your request. Not all rights apply in all situations, and legal limitations may apply.

Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.

In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.

You may also contact Qevinto first so that we can try to resolve the matter.

Changes to this Privacy Policy

Qevinto may update this Privacy Policy if the website, services, providers, cookies, analytics, GreetScribe implementations, technical systems, or legal requirements change.

The latest version will be made available on Qevinto’s website. Material changes may be communicated separately where appropriate.