Privacy Policy

1. Data Controller

AinaOpen Oy, Finland — contact: privacy@ainaopen.com.

For data subject requests please email privacy@ainaopen.com.

2. Personal Data We Collect

We process the following categories of personal data:

• Identification and contact data: name, company, email address, phone number, country/region.
• Order and enquiry data: cabinet model, quantity, location, free-text notes, locale.
• Payment-card identifier (tokenised) and a deposit reservation when you use a vending machine.
• Age verification result obtained via strong customer authentication (for example TUPAS bank credentials), in compliance with PSD2/SCA.
• Technical data: IP address, browser type, device identifiers, pages viewed, referring URL, session timestamps.
• Cookie and analytics data: see our Cookies section below.
• Camera surveillance recordings of vending machine premises (operated by the venue owner / our customer).

3. Purposes and Legal Basis

We process personal data for the following purposes and on the following legal bases (Art. 6 GDPR):

• Responding to enquiries and processing order requests — performance of a contract or pre-contractual measures (Art. 6(1)(b)).
• Operating vending machines, charging purchases and preventing fraud — performance of a contract and our legitimate interests (Art. 6(1)(b), (f)).
• Age verification for age-restricted products — compliance with a legal obligation (Art. 6(1)(c)) and your consent where required.
• Storing the age-verification status linked to a payment-card identifier for 30 days — legitimate interest in providing a smooth customer experience (Art. 6(1)(f)).
• Website analytics and product improvement — your consent for non-essential cookies (Art. 6(1)(a)).
• Compliance with accounting, tax and consumer-protection laws — legal obligation (Art. 6(1)(c)).

4. Cookies and Analytics

Our website uses strictly necessary cookies to operate, and — with your consent — Google Analytics 4 (measurement ID G-2ZKS1436ME) to understand aggregated usage. IP addresses are anonymised. You can withdraw or change your cookie consent at any time using the “Change cookies” link in the footer.

5. Recipients and International Transfers

We share personal data only with vetted processors acting on our behalf: Microsoft Azure (hosting; EU regions), Microsoft Graph (transactional email), payment service providers and authentication providers, and Google (analytics). Where data is transferred outside the European Economic Area, we rely on the European Commission’s Standard Contractual Clauses and additional safeguards as required by Chapter V GDPR.

6. Retention Periods

• Contact and order enquiries: up to 24 months from last contact.
• Age-verification token linked to a payment card: 30 days.
• Transaction records: 6 years (statutory accounting period in Finland).
• Camera surveillance recordings: typically 14–30 days, as set by the venue operator.
• Website analytics: anonymised event data retained up to 14 months.

7. Your Rights

Subject to the conditions of the GDPR you have the right to access, rectify, erase, restrict or object to the processing of your personal data, the right to data portability and the right to withdraw consent at any time. To exercise these rights please contact privacy@ainaopen.com. You also have the right to lodge a complaint with your local supervisory authority (in Finland: Office of the Data Protection Ombudsman, tietosuoja.fi).

8. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction, including encryption in transit and at rest, role-based access control and continuous monitoring.

9. Changes to this Policy

We may update this Privacy Policy from time to time. The latest version is always available at ainaopen.com/privacy/. Material changes will be communicated through the website.