Privacy Policy

Last updated: 5 July 2026

1. Controller

The controller responsible for the personal data described in this Privacy Policy is:

GästFors OY
Finland
Email: pp@gastfors.com

Please contact us at pp@gastfors.com if you have questions about this Privacy Policy or how we process personal data.

2. Scope of this Privacy Policy

This Privacy Policy applies to personal data processed through the GästFors website, request access forms, demo requests, and related professional communications.

GästFors is an AI-assisted guest experience automation platform for hospitality, tourism, and venue operations. At this stage, the website is mainly used to provide information, receive selected access and demo requests, and communicate with potential customers, partners, investors, and professional contacts.

3. Personal data we may collect

We may collect and process the following categories of personal data.

3.1 Information you provide to us

When you submit a form, request access, request a demo, or contact us, we may process information such as:

• name;
• company or organisation;
• email address;
• company website or profile;
• type of operation or business;
• number of properties, venues, or operating units, if provided;
• areas of interest, such as access automation, risk intelligence, incident documentation, maintenance workflows, owner reporting, or partnership discussion;
• message content and other information you choose to provide;
• communication history with us.

3.2 Technical website data

When you visit the website, certain technical information may be processed automatically to operate, protect, troubleshoot, and improve the website. This may include:

• IP address;
• browser type and version;
• device type and operating system;
• pages visited;
• date and time of visit;
• referring website, where applicable;
• server logs, error logs, and security logs.

3.3 Cookies and local storage

Our website may use essential cookies or browser local storage for basic functionality, such as remembering whether you have accepted the cookie notice.

We do not currently use advertising cookies on the website. If we introduce analytics, marketing, advertising, or third-party tracking tools in the future, we will update this Privacy Policy and request consent where required.

4. Purposes of processing

We process personal data for the following purposes:

• to respond to access requests, demo requests, partnership inquiries, investor inquiries, and other messages;
• to evaluate whether GästFors is relevant for your organisation, use case, or potential pilot project;
• to communicate with professional contacts and arrange follow-up discussions;
• to operate, secure, maintain, troubleshoot, and improve the website;
• to prevent misuse, spam, security incidents, and unauthorised access;
• to improve website content, product positioning, user flows, and platform development priorities;
• to manage business records and protect our legal and commercial interests;
• to comply with applicable legal obligations.

5. Legal bases for processing

We process personal data only when we have a legal basis under applicable data protection law. Depending on the situation, the legal basis may be:

• Legitimate interests: responding to professional inquiries, operating and securing the website, improving our services, managing business communications, and protecting our rights and systems;
• Consent: where you voluntarily submit information, accept optional cookies, or consent to receive specific communications;
• Pre-contractual steps: where processing is necessary to evaluate or prepare a possible demo, pilot, customer relationship, partnership, or other business relationship;
• Legal obligation: where processing is necessary to comply with applicable accounting, tax, corporate, regulatory, dispute-related, or other legal requirements.

6. Recipients and service providers

We do not sell personal data.

We may share or make personal data available to trusted service providers and professional advisors where necessary for the purposes described in this Privacy Policy, including:

• website hosting and infrastructure providers;
• email and communication service providers;
• IT, security, backup, and maintenance providers;
• form processing, CRM, or business workflow tools, if used;
• analytics providers, if introduced with appropriate notice or consent;
• legal, accounting, insurance, compliance, or other professional advisors;
• public authorities or courts, where required by law.

Service providers are expected to process personal data only for appropriate business, technical, legal, or service-related purposes.

7. Third-party resources used by the website

The website may load certain third-party resources, such as fonts, icons, JavaScript libraries, or content delivery network files. When your browser loads these resources, the relevant third-party provider may receive technical information such as your IP address, browser details, and the page from which the resource was requested.

We aim to keep third-party resources limited and appropriate for website functionality and presentation.

8. International transfers

We aim to use service providers located in the European Economic Area where practical. Some service providers or technical resources may process personal data outside the European Economic Area.

Where personal data is transferred outside the European Economic Area, we will use appropriate safeguards where required, such as European Commission standard contractual clauses or other legally recognised transfer mechanisms.

9. Retention

We keep personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Typical retention periods are:

• Access and demo request data: up to 24 months after the last meaningful contact, unless a customer, partner, legal, or business relationship requires longer retention;
• Technical server logs: usually 30–90 days, unless longer retention is needed for security investigation, troubleshooting, or legal reasons;
• Email and business communication: retained as long as necessary for business communication, relationship management, legal protection, or record keeping;
• Cookie consent and local storage information: stored in your browser until it expires, is replaced, or you clear it.

If a business relationship is created, certain records may be kept longer where required for accounting, contract, tax, legal, compliance, or dispute-related reasons.

10. Data security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure.

These measures may include access control, secure hosting practices, encrypted transmission where applicable, limited internal access, monitoring, logging, backup procedures, and regular review of technical safeguards.

No online service can be guaranteed to be completely secure, but we aim to process personal data responsibly and proportionately.

11. Your rights

Depending on the situation and applicable law, you may have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• withdraw consent where processing is based on consent;
• request data portability where applicable;
• lodge a complaint with a data protection supervisory authority.

In Finland, the supervisory authority is the Data Protection Ombudsman’s Office.

To exercise your rights, contact us at pp@gastfors.com. We may need to verify your identity before responding to certain requests.

12. Automated decision-making and AI

We do not currently use the public website to make legally or similarly significant automated decisions about individuals.

GästFors may develop AI-assisted tools for guest experience automation, operational risk intelligence, incident documentation, and review-ready summaries. Such tools are intended to support human review and professional decision-making, not to replace qualified legal, insurance, compliance, or operational judgement.

13. Children’s privacy

GästFors is intended for professional and business use. Our website and services are not directed to children, and we do not knowingly collect personal data from children through the website.

14. Third-party links

The website may contain links to third-party websites or services. We are not responsible for the privacy practices, content, or security of third-party websites. Please review their privacy policies separately.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time as GästFors develops, our website changes, or legal requirements evolve. The latest version will be published on this page with the updated date.

16. Contact

For privacy questions, requests, or concerns, contact:

GästFors OY
Finland
Email: pp@gastfors.com