Privacy Policy

1. Introduction

CR Enterprise Oy ("Vasta", "we", "us", or "our"), a company incorporated in Finland with business ID 3574969-5, operates the website vasta.cx and provides AI-powered voice call automation services. This Privacy Policy explains how we collect, use, store, and protect personal data in connection with our website and services.

We are committed to protecting your privacy and processing personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and applicable Finnish data protection legislation.

2. Data Controller

CR Enterprise Oy
Business ID: 3574969-5
Email: info@vasta.cx

3. Personal Data We Collect

We collect personal data in the following contexts:

3.1 Website visitors

• IP address and approximate location
• Browser type, operating system, and device information
• Pages visited, time spent, and referral source
• Cookies and similar tracking technologies (see Section 9)

3.2 Contact and demo requests

• Full name and work email address
• Company name and monthly call volume
• Any information you voluntarily provide in correspondence

3.3 Service usage (customers)

• Account credentials and contact details
• Call metadata (timestamps, duration, caller ID where applicable)
• Voice recordings and transcripts processed through the Vasta platform, as directed by the customer
• Integration data from connected third-party systems

4. Legal Basis for Processing

We process personal data on the following legal bases under GDPR Article 6:

• Contract — processing necessary to perform our services agreement with customers
• Legitimate interests — analytics, security, and improving our services, where not overridden by your interests
• Consent — for marketing communications and certain cookies, where required
• Legal obligation — where processing is required by applicable law

5. How We Use Your Data

• To provide, operate, and improve the Vasta platform and services
• To respond to demo requests and sales enquiries
• To send service-related communications and product updates
• To detect, prevent, and respond to security incidents or misuse
• To comply with legal and regulatory obligations
• To conduct analytics and measure website performance

6. Voice Data and Call Recordings

Where Vasta processes voice calls on behalf of customers, we act as a data processor and the customer acts as the data controller for any personal data contained in those calls. Customers are responsible for ensuring that their callers are informed of any recording or automated processing in accordance with applicable law, including the Finnish Act on Electronic Communications Services and GDPR.

Voice recordings and transcripts are retained only as long as required to deliver the service or as specified in the customer's data processing agreement. We do not use call content from one customer to train models for or share data with other customers.

7. Data Sharing and Third Parties

We do not sell personal data. We may share data with:

• Service providers — infrastructure, cloud hosting, and analytics providers acting as processors under appropriate data processing agreements
• Professional advisers — legal, financial, or compliance advisers under confidentiality obligations
• Authorities — where required by law or to protect our legal rights
• Business transfers — in connection with a merger, acquisition, or asset sale, subject to standard confidentiality obligations

Where we transfer personal data outside the European Economic Area, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

8. Data Retention

We retain personal data only as long as necessary for the purposes for which it was collected, or as required by law. Specifically:

• Contact and demo request data: up to 3 years from last interaction
• Customer account data: for the duration of the contract and up to 3 years thereafter
• Call recordings and transcripts: as specified in the customer agreement, typically 30–90 days unless extended by the customer
• Website analytics: aggregated and anonymised after 26 months

9. Cookies

We use essential cookies required for the website to function and, with your consent, analytics cookies to understand how visitors use our site. You can manage cookie preferences through your browser settings. Essential cookies cannot be disabled as they are necessary for the site to operate.

10. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate or incomplete data
• Erasure — request deletion of your data in certain circumstances
• Restriction — request that we limit processing of your data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at info@vasta.cx. We will respond within 30 days. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

11. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include encryption in transit and at rest, access controls, and regular security assessments. No method of transmission or storage is 100% secure; we will notify affected parties and authorities of any data breaches as required by law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify customers of material changes by email or through the platform. The date at the top of this page indicates when it was last revised. Continued use of our services after changes constitutes acceptance of the updated policy.

13. Contact

For any questions or requests relating to this Privacy Policy or your personal data, please contact us at:

CR Enterprise Oy
info@vasta.cx