Data Controller: Lifetime Oy
Business ID: 0772407-9 (VAT ID FI07724079)
Registered Address: Laidunmaanraitti 2 A 25, 02330 Espoo, Finland
Regulatory Framework
Operations are conducted in strict accordance with applicable European Union statutes, specifically:
- General Data Protection Regulation (GDPR)
- Digital Services Act (DSA)
- NIS2 Directive (Cybersecurity)
- EU AI Act
I. Architecture & Data Sovereignty
1. Flexible Sovereignty: Public & Private Cloud
Lifetime DWS IQ is engineered to support diverse regulatory and operational requirements through multiple deployment models:
- Global Cloud: Deploy on AWS, Google Cloud, or Microsoft Azure for maximum scalability and global reach.
- European Cloud (EU Compliance): Hosted exclusively within the EU/EEA on providers like OVHcloud, Open Telekom Cloud, or Scaleway, strictly adhering to EU Law (GDPR, DSA, AI Act).
- Sovereign Private Cloud: For entities requiring strict data isolation, we deploy the "Industrial Brain" (DWS IQ) directly into your on-premise infrastructure or EU-headquartered cloud environment for maximum sovereignty.
- Intellectual Property Protection: Regardless of deployment model, we adhere to a strict No-Training Policy. Your proprietary industrial data, knowledge bases, and operational metrics are never used to train our public foundation models.
- Sovereignty: The client retains 100% ownership and control of all data assets processed by the system.
II. Data Collection & Processing
2. Data Minimization & Collection Categories
In accordance with GDPR principles, we limit data collection strictly to what is necessary for service provision, security, and statutory compliance (e.g., Accounting Act).
- Commercial Information (B2B): Professional contact details (Name, Work Email, Phone, Billing Coordinates) necessary for contract fulfillment.
- Telemetry & Security Logs: Technical usage data required for license verification, system stability, and NIS2 security monitoring.
- Payment Verification Data: Transaction IDs and payment status (Success/Fail) received from our payment partners (PayPal, Revolut, Google Pay). We do not store raw credit card data.
- Commercial Outreach: Contact information sourced from public professional registers (e.g., LinkedIn) or direct engagement, processed under the legal basis of Legitimate Interest for relevant B2B communications.
3. Purpose of Processing
Data is processed strictly for defined operational purposes:
- Service Provisioning: Deployment, maintenance, and invoicing of the Lifetime software suite.
- Critical Communications: Delivery of security advisories, patch notes, and essential updates (NIS2/DSA requirements).
- Regulatory Support: Processing data as a processor on your instructions to facilitate your CSRD and Fit for 55 reporting obligations.
3a. Legal Basis and Retention
For each purpose, the legal basis under the GDPR and how long we keep the data. Source: our record of processing activities (GDPR Art. 30). Deletion is reviewed manually once a year until it is automated.
| Purpose | Legal basis | Retention |
|---|---|---|
| Website enquiries and leads | Legitimate interest (Art. 6(1)(f)); steps before a contract (6(1)(b)) | 24 months after last contact |
| Meeting bookings | Steps before or under a contract (6(1)(b)) | 24 months after last contact |
| B2B outreach and tender leads | Legitimate interest (6(1)(f)); balancing test on file | 24 months after last contact; deleted at once if you object (Art. 21) |
| Investor relations | Contract (6(1)(b)); legitimate interest (6(1)(f)) | Executed investments: 10 years (share register: permanent); contacts that did not invest: 24 months after last contact |
| Customer orders and payments | Contract (6(1)(b)); legal obligation, Accounting Act (6(1)(c)) | 6–10 years (Accounting Act) |
| Identity verification (KYC/IDV) | Legal obligation or legitimate interest (6(1)(c)/(f)); explicit consent for biometric data (9(2)(a)) | Images and documents: deleted after verification; result: customer relationship + 5 years |
| Email correspondence | Legitimate interest (6(1)(f)) | 24 months after last contact; accounting records 10 years |
| Website analytics | Consent (6(1)(a)), given in the cookie banner | 14 months; your consent choice is asked again after 12 months |
| Personnel administration | Contract (6(1)(b)); legal obligation (6(1)(c)); health data 9(2)(b) | Payroll 10 years; employment certificate data 10 years; other files 2 years after employment ends |
| Job applicants | Steps before a contract (6(1)(b)) | 12 months after the hiring decision |
Service providers used for our own processing (as controller) include Supabase, Cloudflare, Google Workspace (EU data region), Proton (Switzerland, adequacy decision), Google tags loaded only after consent, and the payment providers in Section 10. Providers that process customer data in the DWS IQ platform are listed in the sub-processor list.
III. Security & Compliance Standards
4. Security Posture & NIS2 Alignment
As a digital service provider to essential entities (Energy, Transport, Manufacturing), Lifetime Oy aligns its security posture with the NIS2 Directive.
- Encryption Standards: Data is protected by industry-standard encryption both in transit (TLS 1.3) and at rest (AES-256).
- Identity & Access Management: We enforce strict Role-Based Access Control (RBAC) and mandatory Multi-Factor Authentication (MFA) for administrative access.
- Vulnerability Management: Continuous code scanning (via Snyk) and rapid patch management protocols.
- Incident Response: We are committed to the 24-hour early warning notification standard for significant cyber threats affecting client systems.
5. AI Transparency & Safety (EU AI Act)
Our AI deployments are governed by the transparency obligations of the EU AI Act.
- Disclosure of AI Interaction: Users interacting with agents (e.g., Firehorse Coach) will always be explicitly informed that they are communicating with an AI system.
- Generative Output & Oversight: Content generated by our systems (reports, analysis, imagery) is machine-generated. It should be reviewed by a qualified human expert before being used for legal or safety-critical decision-making.
- System Categorization: DWS IQ is designed as a decision-support tool. It is not classified as a "High-Risk AI System" under the Act, as it does not perform biometric identification or safety-critical component functions without human oversight.
IV. Operations & User Rights
6. International Data Transfers
Our primary deployment strategy prioritizes data residency within the EU/EEA. Personal data is shared only with the service providers (sub-processors) that run our services. They are named, with their purpose, data location and parent-company jurisdiction, in our sub-processor list.
- EU data location, US parent: some providers (for example Supabase, Google Cloud, Cloudflare) store data in EU regions but have US parent companies, so US law can reach them.
- Transfers outside the EEA: two AI providers (Anthropic, Groq) process pseudonymised data in the USA under the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914) with supplementary measures. Ask privacy@lifetime.fi for a copy of the safeguards.
- Payments: payment partners (Section 10) receive the data needed to process a payment.
7. Digital Services Act (DSA) & Content Moderation
For users participating in "Lifetime World" community spaces, we enforce a strict, DSA-compliant content moderation policy.
- Illegal Content: Zero-tolerance policy for illegal content (including hate speech, terrorism, and CSAM). Such content is removed immediately upon detection.
- Code of Conduct: Harassment, bullying, and non-professional conduct are strictly prohibited.
- Procedural Rights: In the event of content removal, the affected user will receive a specific "Statement of Reasons." Appeals regarding moderation decisions may be directed to moderation@lifetime.fi.
8. Data Subject Rights (GDPR)
- Access & Rectification: You retain the right to request access to, correction of, or erasure of your personal data held by Lifetime Oy.
- Right to Object: You may opt out of direct marketing communications at any time via the unsubscribe link or by contacting the Controller.
- Restriction & Portability: You may ask us to restrict processing, and to receive data you gave us in a machine-readable format.
- How to ask: write to privacy@lifetime.fi. We acknowledge within 2 business days and answer within 30 days.
- Right to Complain: you may lodge a complaint with the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), Finland, tietosuoja.fi.
9. Third-Party Technologies & Cookies
- Google Customer Reviews: To facilitate the Google Customer Reviews program, third parties (including Google) may place and read cookies on your browser or utilize web beacons to collect technical information.
- Transaction Data: Google may receive aggregated information regarding transactions conducted on this site for review verification purposes.
- Analytics (consent only): Google Tag Manager and the analytics tags it loads run only after you choose “Accept analytics” in the cookie banner (legal basis: consent, GDPR Art. 6(1)(a)). If you reject or make no choice, they do not load. To change your choice, clear your cookie choice.
- User Control: You may manage, block, or delete cookies via your browser settings. Note that disabling essential cookies may impact service functionality.
V. Financial Integrity & Payments
10. Payment Processing (PayPal, Revolut, Google Pay)
To ensure the highest security for financial transactions, Lifetime Oy does not store or process your full credit card number or bank login credentials on our servers.
- Third-Party Processors: We utilize trusted global payment processors—specifically PayPal, Revolut, and Google Pay—to handle payments.
- Data Sharing: When you make a payment, strictly necessary details (transaction ID, amount, and billing reference) are shared with these providers.
- Privacy Governance: Your financial data is subject to the privacy policies and security standards of the respective processor. These entities act as independent Data Controllers for the financial transaction data they process.
11. Tax Compliance & Accounting (ALV/VAT)
- VAT Compliance: All invoices and transactions are processed in compliance with Finnish Tax Administration (Verohallinto) regulations, including appropriate Value Added Tax (Arvonlisävero / ALV) calculations based on the customer's location (EU Reverse Charge for valid B2B VAT IDs).
- Statutory Retention: In accordance with the Finnish Accounting Act (Kirjanpitolaki), we are legally required to retain accounting vouchers and transaction data for a minimum of six (6) to ten (10) years. This statutory obligation overrides requests for data erasure under GDPR regarding billing records.
12. Anti-Money Laundering (AML) & Sanctions
While Lifetime Oy is a software provider, we maintain a strict policy against financial crime.
- Sanctions Screening: We strictly adhere to EU Sanctions Lists and international trade embargos. We do not engage in business with entities or individuals located in sanctioned jurisdictions or listed on EU asset freeze lists.
- Fraud Prevention: We reserve the right to suspend any transaction that triggers our internal fraud detection systems or appears suspicious under the Act on Preventing Money Laundering and Terrorist Financing.
- Identity Verification (KYC): For high-value enterprise contracts, we may request official corporate registration documentation to verify the Ultimate Beneficial Owner (UBO) of the counterparty.
VI. Contact Information
13. Contact & Governance
Data Protection Contact
Lifetime Oy is not required to appoint a Data Protection Officer (GDPR Art. 37) and has not appointed one.
privacy@lifetime.fi
Lifetime Oy
Laidunmaanraitti 2 A 25
02330 Espoo, Finland
Designated Contacts:
- Technical & Site Security: cso@dws10.com
- Executive Controller (CEO): Risto Anton Päärni, risto.paarni@lifetime.fi, +358 400 319 010