Updated September 18, 2026

1. General Information and Adicio’s Two Roles

This Privacy Notice explains how Adicio AI Oy ("Adicio", "we") processes personal data. The Notice has been prepared in accordance with the EU General Data Protection Regulation (2016/679). It applies to both our online service and the Adicio mobile application.

Adicio has two roles in the processing of personal data:

a) Adicio as the data controller. As the data controller, we process the basic information of our customers’ users (account management, authentication, billing, customer communications), technical service usage data (information security and service development), information about prospective customers (sales and marketing), visitor data from our website, and job applicants’ information. This privacy notice applies to such processing.

b) Adicio as a processor. When our customer (a construction company) uses the Adicio service and uploads project content to it—text, files, images, audio, and contact details—the customer determines the purposes for processing this content and acts as the data controller. Adicio processes the content on the customer's behalf and for the customer's account as a data processor. This processing is agreed upon with the customer in a Data Processing Addendum (DPA).

If your personal data is included in content entered into the service by one of our customers, please direct your inquiries primarily to the company in question.

2. Contact details of the data controller

Adicio AI Oy, Business ID 3586272-7
Radiokatu 3, 00240 Helsinki
Contact details for data protection matters: info@adicio.ai

Adicio has not appointed a Data Protection Officer pursuant to Article 37 of the General Data Protection Regulation. The CEO is responsible for data protection matters.

3. What personal data do we process and where do we obtain it?

User register: first name, last name, phone number, email address, organization (Business ID) and role, account activity data and login details. We obtain the data from the user, the user's employer, or the organization that invited the user to the project.

Customer and marketing register: contact persons’ names, contact details, organization and role, quotation and contract details, and communication history. We obtain the information from the individuals themselves, their organizations, or public sources.

Technical usage and log data: IP address, device and browser information, login and session information, event data related to the use of the service, and error and security logs. This data is generated automatically when the service is used.

Website visitor data: see our Cookie Policy.

Recruitment information: application details, CV, and contact information. We receive this information directly from the applicant.

4. Mobile App and Device Permissions

The Adicio mobile app requests permission to access features on your device. Granting permission does not mean that we collect any data. Information related to your device’s features—such as an image, audio, file, contact, or location—is only transferred to the service when you perform an action that requires it.

All permissions are optional, and you can revoke them in your device settings. If you do, the relevant feature will stop working, but the rest of the app will continue to function normally.

• Camera — take photos within the service. The photo will be uploaded to the service once you confirm and submit it.
• Photos — attach photos saved on your device. Only the photos you select, and only when you send the attachment.
• Files — attach files saved on your device. Data is transferred when you send the attachment.
• Microphone — to record audio for the service's audio and dictation features. Data is transferred when you use the relevant feature; see section 7.
• Contact details — import one contact of your choice into the project. The contact will only be imported once you submit the pre-filled form.
• Location — linking location data to project content. It will be transferred when you save the location as part of the project content.

The app can also read the clipboard to paste a one-time sign-in code into the login field—but only when you tap the paste button.

Your location is accessed only while the app is in use. The app does not track your location or access your microphone in the background.

Contact information. The app only reads the fields of the contact you select: name, first email address, first phone number, and company. The information is used to pre-fill the form on your device and is only sent to the service if you submit the form.

Speech recognition. Voice features may use either your device’s operating system speech recognition or speech recognition provided through our service. The latter is described in more detail in Section 7.

Where the content goes. Images, files, audio, contact details, and location tags are stored as content in the project you are working on. The processor role described in section 1(b) applies to this content: the organization that owns the project determines how the content is processed.

5. Purposes and Legal Bases for Processing

• Service delivery, account management and authentication — performance of a contract or steps taken prior to entering into a contract; legitimate interest (performance of the contract with the user's employer)
• Providing the service to a user invited to a project whose employer does not have an agreement with Adicio (e.g. a subcontractor’s or client’s representative) — legitimate interest: enabling the project participant to access the tasks and information assigned to them and ensuring the security of the service
• Billing and accounts receivable management — contract; legal obligation (accounting)
• Customer communications and support — contract; legitimate interest
• Service security and prevention of misuse — legitimate interest
• Service development (technical usage data) — legitimate interest
• Sales and marketing to prospective customers — legitimate interest (B2B); consent (electronic direct marketing to individuals acting as consumers)
• Recruitment — pre-contractual measures; consent (retaining the application after the process has ended)

Where processing is based on legitimate interest, we have assessed that it does not override the data subject’s interests or rights: the processing is foreseeable to the data subject and relates to their professional role.

For a user invited to a project, the processing is also foreseeable because their employer has committed to information exchange between the project parties as part of the construction project's contractual chain, and the invitation is based on the user's role in the project.

6. Recipients of the data

The following describes the operation of the service as a whole. With regard to the customer's project content, Adicio acts as a processor (section 1(b)), and the processing is agreed upon with the customer in the data protection addendum.

We use service providers (personal data processors) for cloud infrastructure, AI processing, email delivery, and error monitoring. An up-to-date list of the subprocessors we use is available on our website and will be provided upon request.

Project content is visible to users and contacts who have access to the relevant organization or project. When you share content with another application using your device’s built-in sharing feature, the shared content is transferred to the service you select in accordance with its own terms.

We disclose information to authorities to comply with our legal obligations.

We do not sell personal data. We do not use your data for advertising or track you across other apps. The service and mobile application use a usage analytics tool (PostHog, EU environment), which collects information about page and view visits as well as button usage for the purpose of improving the service. The application does not use advertising or tracking tools. Our website, adicio.ai, uses consent-based analytics and embedded YouTube video content; see our Cookie Policy.

7. Transfers outside the EU/EEA

As a rule, we process personal data within the EU: the service infrastructure, databases, storage, and all AI processing are located in Frankfurt, Germany.

There is one exception regarding the service: audio recordings are converted into text (speech recognition) via the OpenAI Ireland Ltd API. OpenAI Ireland Ltd is a company established in the EEA, but it may transfer data outside the EEA for processing. These transfers are subject to the standard contractual clauses approved by the European Commission. Audio recordings and transcripts generated from them are not used to train AI models.

If you use your device’s operating system’s built-in speech recognition, the device manufacturer’s own terms apply to the processing.

With regard to visitor data from our website, the analytics service provider may process data outside the EU/EEA on the basis of standard contractual clauses; see our Cookie Policy.

The other service providers we use and their transfer mechanisms are described in our list of subprocessors. If a service provider processes data outside the EU/EEA, we ensure that the transfer is lawful by using transfer mechanisms compliant with the General Data Protection Regulation: European Commission adequacy decisions (including the EU–US Data Privacy Framework), Standard Contractual Clauses, or approved Binding Corporate Rules (BCRs).

8. Retention periods

• User data: until the user's access to the service is revoked, but no longer than the term of the customer agreement plus 90 days, unless a longer retention period is required by law
• Billing information: in accordance with the Accounting Act (6/10 years)
• Marketing data: for as long as the data remains up to date and the individual has not objected to its processing
• Technical usage and log data: 12 months
• Recruitment data: for the duration of the recruitment process; with consent, for up to 12 months after the process ends

The retention periods for project content are determined by the organization that owns the project and agreed with the customer in the data protection appendix.

When data is deleted from active systems, copies may remain in backups and logs until their respective retention periods expire.

9. Your Rights

You have the right to:

• access your data
• request the correction or deletion of data
• request restriction of processing
• object to processing, particularly direct marketing, which will always be discontinued upon request
• receive the data in a portable format
• withdraw your consent

Where processing is based on legitimate interests, you have the right to object to the processing on grounds relating to your particular situation. In such cases, we will stop the processing unless there are compelling legitimate grounds for continuing it.

We do not make decisions concerning you based solely on automated processing that produce legal effects or otherwise significantly affect you, nor do we profile you for the purpose of such decision-making.

Account deletion. You can request the deletion of your user account and associated data by contacting info@adicio.ai. Because accounts are managed at the organization level, we will coordinate the deletion with the organization that manages your account. Project content belonging to the organization may remain in the organization's records even after your account has been deleted.

Exercise your rights by contacting: info@adicio.ai. We may request additional information to verify your identity.

If you believe that we are processing your personal data unlawfully, you have the right to lodge a complaint with the Data Protection Ombudsman (tietosuoja.fi).

10. Changes to this statement

We update this statement as necessary. We will notify you of material changes through the service or by email. The latest version is always available on our website.

11. Sub-processors

Updated on 16 September 2026. Adicio uses the following service providers to process personal data. An agreement in accordance with Article 28 of the General Data Protection Regulation is in place with each provider.

Notification of changes. We will notify our customers of the addition or replacement of subprocessors at least 30 days before the change takes effect, as agreed in the Data Protection Addendum.

AI processing. Customer data is not used to train AI models.

Adicio AI Oy · Radiokatu 3, 00240 Helsinki · Business ID 3586272-7 · info@adicio.ai