Who are we?
Vox AI Productions Oy (hereinafter ”Vox AI”, “we” or “us”), is a European based AI start-up focused on the creation and licensing of ethical AI speech data of all European languages under the brand name ClubWrk. We are dedicated to delivering affordable high-quality speech training data for speech recognition services in European languages. We use a transparent and ethical method of sourcing the speech from sports and other clubs, who get compensated for their speech contribution.
Personal data refers to any information relating to a natural person (“data subject”) that can identify him/her directly or indirectly. Personal data, data subject, controller and other key terms are defined in the General Data Protection Regulation (2016/679, “GDPR”). Vox AI complies with the GDPR in all processing of personal data in conjunction with other applicable national data protection legislation (“data protection legislation”).
Third party services
Our services are not intended for children under 16 years of age. If you are under 16, please do not use our services. If we learn that we have collected or received personal data from a child under 16, we will delete that personal data. If you believe we might have any information from or about a child under 16, please contact our Data Protection Officer Andreas von Koskull at firstname.lastname@example.org .
Controller: Vox AI Productions Oy
Business ID: 3241332-8
Address: Aittatie 14 A 12, 00390 Helsinki, Finland
Controller representative: Andreas von Koskull (email@example.com.)
Purposes and legal basis for processing personal data
Personal data will be processed for the following purposes:
- Provision of our ClubWrk service as well as other products and services for you based on contract or its preparation, for example when you use our services.
- Managing and analyzing the customer relationship and use of our services based on our legitimate interest.
- Communication with you, for example, to send you alerts and notifications relating to our products and services, to inform you that our product and services have changed, and to ask for your feedback on our products and services based on contract or its preparation or our legitimate interest.
- Commercializing and licensing data to our customers who develop voice recognition services based on consent.
- Provision of information and materials related to our services, for example by newsletters and direct marketing based on our legitimate interest or consent.
- Direct marketing based on Vox AI’s legitimate interest to send data subjects promotional material about products and services they might be interested in. The data subject has the right to refuse personal data being used for direct marketing and may at any time recall prior consent.
- Ensuring security of our services and preventing abuses based on statutory obligation or our legitimate interest.
- Complying and fulfilling our legal duties and obligations such as tax law and accounting related obligations based on statutory obligation.
- Establishing, exercising, or defending against legal claims based on statutory obligation or our legitimate interest.
For processing activities that are based on a legitimate interest, we have carefully balanced such legitimate interest with the data subjects right to privacy and concluded that our interest outweighs the data subjects’ rights and freedoms.
Where the processing is such that a consent is required by the applicable legislation, we will state so and obtain the consent, and this will be the legal basis for the processing. However, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. If such withdrawal means that we are no longer able to provide our services, we may cease to provide the services.
What data is collected, stored and processed?
The following personal data from the data subjects will be processed:
- Contact information, such as email address, name
- Speech data
- Metadata such as gender, age bracket, city, dialect
- Information related to service accounts such as usernames and passwords, login details and user ID, usage details, IP address, data relating to the device you use to access the Vox AI’s services
- Information collected through cookies or other tracking technologies
- Consents and objections related to direct marketing
- Other information necessary for maintaining the external business partner relationship, such as billing information, purchase history, service requests, feedback.
The personal data is mainly collected directly from the data subjects themselves, for example, at the time of registration or use of our services.
The personal data may also be collected automatically when the data subject uses our services e.g when using our ClubWrk platform. In addition, and with the permission of the data subject, data may be collected in other ways in a marketing context.
Personal data may be updated and supplemented by collecting data from private and public sources.
Retention of personal data
We retain personal data only for a period that is necessary to achieve the purposes for which personal data is processed, unless there is a legal obligation to retain personal data for a longer period of time (for example, responsibilities and obligations under specific legislation, accounting or reporting obligations). The periods vary greatly from one type of processing to another. Vox AI may retain information for a longer period of time if it is required, for example, to exercise a legal claim, to defend a legal claim, or to settle a similar dispute. In general, we observe the following criteria for retaining and deleting personal data:
- Registration information of users of ClubWrk service is retained for the duration of using the service and thereafter for a maximum period of 2 years following the last login.
- In relation to our external business partners’ or clubs’ contact person’s personal data, personal data is stored for the duration of the relationship, after which unnecessary personal data will be deleted.
- In relation to the security of our services and preventing abuses, personal data is processed for the duration of the investigation of abuses or other harmful user experiences.
- Personal data is stored for as long as a certain legal obligation requires. For example, the Accounting Act imposes an obligation to maintain information on the accounting’s supporting material for 6 years following the end of the financial year.
Detailed retention times can be provided upon requests.
We evaluate the necessity and accuracy of the personal data on a regular basis and endeavor to ensure that the incorrect and unnecessary personal data are corrected or deleted.
Disclosures, transfers and recipients of personal data
Vox AI may provide speech data and related metadata (such as gender, age group, dialect) collected through your use of the Clubwrk service to its customers such as speech recognition services, meaning that we might disclose personal data to third parties outside Vox AI for such third parties’ own purposes. However, we do not provide our customers with your identification information such as email address, name or similar information.
In addition, we may share the personal data in connection with any merger, sale of our assets, or a financing or acquisition of all or a portion of our business and in connection with other similar arrangements. The personal data is also disclosed to third parties, if required under any applicable law or regulation or order by competent authorities, and to investigate possible infringing use of the services as well as to guarantee the safety of our services.
In order for Vox AI to provide the services, personal data is processed also by the following processors of Vox AI. List of the processors:
- Zoner Oy (server hosting)
- Microsoft Corporation (Microsoft Office tools)
- Google LLC (Google Drive and Google Gmail)
- Mailchimp (marketing platform)
- Frequency and sample rate software XLD
Is data transferred outside the european union or the european economic area?
Some of the services used by Vox AI for processing personal data may operate outside the territory of the European Union (EU) or the European Economic Area (EEA). Thus, personal data can be transferred outside the EU and the EEA.
In case personal data is transferred outside the EU/EEA, such transfers are either made to a country that is deemed to provide a sufficient level of privacy protection by the European Commission or transfers are carried out by using appropriate safeguards such as standard data protection clauses (SCC) adopted, including any supplementary measures, where assessed to be necessary, or otherwise approved by the EU Commission or competent data protection authority in accordance with the GDPR.
The following recipients may transfer personal data outside the EU/EEA:
- Microsoft Corporation
- Google LLC
- Mailchimp (marketing platform)
How is the data protected?
Securing the integrity and confidentiality of personal data is important to Vox AI. We have taken appropriate technical and organizational measures in accordance with industry standards in order to keep personal data safe and to secure it against unauthorized access, loss, misuse or alteration by third parties, such as [by firewalls, physical security measures, access controls, assignment of access rights, encryption and active monitoring of the aforementioned measures].
In addition, the recorded speech data files are stored separately from the data subject’s registration information. The speech data audio files are stored in servers located in Finland.
Nevertheless, considering the cyber threats in modern day online environment, we cannot give full guarantee that our security measures will prevent illegally and maliciously operating third parties from obtaining access to personal data or absolute security of the personal data during its transmission or storage on our systems.
All parties processing personal data have a duty of confidentiality in matters related to the processing of personal data. Access to personal data is restricted to those employees and parties who need it to perform their duties. We also require our service providers to have appropriate methods in place to protect personal data.
Automated decision-making and profiling
Vox AI does not use any automated decision-making nor any profiling pursuant to the Article 22 GDPR.
Rights of data subjects
The data subject has a number of rights under applicable data protection laws.
Right of access and right of inspection
The data subject has the right to obtain confirmation as to whether or not personal data concerning them is being processed.
The data subject has the right to inspect and view data concerning them and, upon a request, the right to obtain the data in a written or electric form. This applies to information that the data subject has provided to Vox AI insofar the processing is based on a contract/consent.
Right to rectification and right to erasure
The data subject has the right to demand the rectification of inaccurate personal data concerning them and to have incomplete personal data completed.
Right to data portability
The data subject has the right to receive the personal data that they have provided to Vox AI in a structured, commonly used and machine-readable format and, if desired, transmit that data to another controller. The right to data portability applies on the processing of the personal data based on consent or a contract.
Right to restriction of processing
The data subject has the right, under conditions defined by data protection legislation, to request the restriction of processing of their personal data. In situations where personal data suspected to be incorrect cannot be corrected or removed, or if the removal request is unclear, we will limit the access to such data.
Right to object to processing
The data subject has the right to object to the processing of data where Vox AI is relying on its legitimate interests as the legal ground for processing. For example, the data subject may object to their personal data being used for marketing purposes.
Right to withdraw consent
In cases where the processing is based on the data subjects’ consent, the data subject has the right to withdraw their consent to such processing at any time.
Right to lodge a complaint with a supervisory authority
The data subject has the right to lodge a complaint with a competent data protection authority if the data subject considers that the processing of personal data relating to the data subject infringes current legislation.
However, we request that the matter will be dealt with Vox AI in the first instance.
The relevant authority in Finland is the Data Protection Ombudsman (www.tietosuoja.fi).
Identity will be checked before the information is given out, which is why we may have to ask for additional details. The request will be responded to within a reasonable time and, where possible, within one month of the request and the verification of identity.
If the data subject’s request cannot be met, the refusal shall be communicated to the data subject in writing. We may refuse a request (for example erasure of data) due to a statutory obligation or a statutory right of Vox AI, such as an obligation or a claim relating to our services.
If you have any questions relating to our data protection policies or wish to exercise your rights, please do not hesitate to contact us.