Legal
Privacy Notice
Last updated: 13 October 2026
Who we are
DIKAI OÜ (trading as DIGI-KAI), registered in Tallinn, Estonia. Contact: contact@digi-kai.com
We are the data controller for the processing described below. We have not appointed a Data Protection Officer – we are not required to – so questions go straight to the address above.
What this covers
Three situations: you used our free AI maturity assessment, you contacted us, or we contacted you first. The third one is the case most notices skip, so it is set out in full below.
1. If you completed the free assessment
- What we collect
- Your name, business email, company, role, and the answers you give, along with the maturity scores calculated from them.
- Why
- To produce and send you the result, and to follow up on it.
- Legal basis
- Taking steps at your request before entering a contract (Art 6(1)(b)) for delivering the result; legitimate interest (Art 6(1)(f)) for following up.
- How long
- 24 months from submission if nothing further comes of it.
Automated decision-making: the assessment calculates scores automatically. It produces a description of maturity – it does not make any decision that has a legal or similarly significant effect on you.
2. If you contacted us
- What we collect
- Your name, business contact details, and whatever you tell us.
- Why
- To reply and, if it goes further, to discuss and deliver work.
- Legal basis
- Legitimate interest in responding (Art 6(1)(f)); contract where we go on to work together (Art 6(1)(b)).
- How long
- 24 months from our last contact, unless we become clients and colleagues – in which case contract and accounting rules apply.
3. If we contacted you first
We do targeted business-to-business outreach. If you received a message from us and had never heard of us, this section explains where your details came from.
- What we hold
- Your name, business email, LinkedIn profile URL, job title, employer, publicly available professional information, and a record of our contact with you.
- Where we got it
- Public professional sources – your employer's website, LinkedIn, published material, industry sources. Not from data brokers or purchased lists.
- What we do not collect
- Your personal email address, personal phone number, private social media, or anything about your life outside work.
- Why
- To reach people whose role suggests our services may be relevant.
- Legal basis
- Legitimate interest (Art 6(1)(f)). Our interest is finding clients; we have assessed it against your rights and concluded that a targeted, individually researched message to a business address, about a business matter, is within what someone in your role reasonably expects. You may disagree – which is exactly why the next paragraph exists.
You can stop this instantly and permanently. Reply with "remove", or email contact@digi-kai.com. We will delete your details and keep only a minimal suppression record – your email address and the fact you objected – so that our research does not find you again and start the cycle over. That record exists solely to honour your objection. This is an absolute right for direct marketing (Art 21(2)): there is nothing to weigh up and we will not ask you to reconsider.
How long: 24 months from our last contact. If you tell us you are not interested, we delete your name and email within 12 months and keep only a company-level note.
4. Meetings
If we meet, we take notes. If a meeting is recorded or transcribed, we tell you at the start and you can say no – the meeting goes ahead either way.
Legal basis: legitimate interest in accurate business records (Art 6(1)(f)). How long: 12 months, unless the notes are part of active work together.
5. Cookies and analytics on this website
This website sets no analytics cookies unless you click "Accept all" in the cookie banner. Until then, nothing is requested from Google.
If you accept, we use Google Analytics to count visits and see which sections are read. It records pages viewed, approximate location (country or city), device and browser type, and how you arrived. It does not tell us who you are, and we do not combine it with anything else we hold.
Legal basis: your consent (Art 6(1)(a) GDPR and the ePrivacy rules on cookies). How long: Google Analytics keeps the data for 2 months. Who: Google Ireland Limited, as our processor; data may reach Google LLC in the US under the EU–US Data Privacy Framework.
You can change your mind at any time with the Cookie settings link at the bottom of the home page, or by clearing this site's data in your browser. We remember your choice in your browser's local storage, not in a cookie.
Fonts are served from our own domain. The booking page (Cal.eu) and the free assessment (assessment.digi-kai.com) have their own notices.
6. If you are our client
When we deliver an engagement, we usually process personal data on your instructions – your documents, your systems, your people's interview responses. In that situation you are the controller and we are the processor, and the terms are in the Data Processing Addendum attached to your engagement letter, not in this notice.
If someone whose data we process for a client contacts us directly, we forward the request to that client rather than answering it ourselves. That is not evasion – it is the correct handling, because it is their data and their decision.
7. Who else sees your data
We use service providers to run the business – hosting, database, CRM, email delivery, workflow automation, meeting transcription, and AI models used in our analysis and delivery work.
Some are outside the EU. Where that happens, transfers are made under an adequacy decision or Standard Contractual Clauses.
On AI specifically: we minimise before we send. Identifiers that a task does not need are removed or replaced before anything goes to a model provider.
The current list of providers is available on request – just ask. Clients receive it as an annex to their contract.
We do not sell your data. We do not share it for anyone else's marketing.
8. Your rights
You can ask us to:
- give you a copy of your personal data
- correct it if it is wrong
- delete it
- restrict what we do with it
- object to processing based on legitimate interest – and for direct marketing, that objection is absolute
- port it to another provider, where that right applies
Write to contact@digi-kai.com. We reply within one month. There is no charge.
One honest exception: if we have worked together, we keep contracts and invoices for seven years because Estonian accounting law requires it. A deletion request does not override that – we will delete everything else and tell you exactly what was kept and why.
If you are unhappy with how we handled it, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at aki.ee, or to the supervisory authority where you live or work. We would rather you told us first, but that is your call, not ours.
9. Changes
We update this notice when what we do changes. The date at the top tells you when it last changed.