Privacy Policy
Last Updated: January 12th, 2026
Tairo Partners provides AI automation and transformation services for businesses. Protecting the privacy and security of data — whether from our business clients or processed on behalf of their customers — is central to our operations.
We act as:
- Data Controller only for business contact information of our direct clients (e.g., names, roles, emails of company representatives).
- Data Processor for personal data belonging to our clients' customers, guests, or leads, processed strictly under client instructions and Data Processing Agreements (DPAs).
1. Information We Collect
From Business Clients (Controller role)
- Company and representative contact details (name, email, phone, job title)
- Contract, billing, and communication records
From Clients' Customers (Processor role)
- Contact details (name, email, phone)
- Service interaction data (bookings, forms, CRM entries)
- Communication logs (AI chat, transcripts, social responses)
- Usage and performance data generated during AI interactions
System & Operational Data
- Analytics and usage logs to optimize automation models
- Aggregated, anonymized data for benchmarking and service improvement
2. How We Use Information
As Controller (for business client data)
- To deliver and maintain contracted services
- To provide support and respond to inquiries
- To manage billing and compliance obligations
- To send important updates and notifications
As Processor (for clients' customer data)
- To process inquiries, bookings, and communications on behalf of clients
- To operate AI chat, call, and automation services as instructed by clients
- To support quality assurance, compliance, and analytics for client systems
We do not use our clients' customer data for independent purposes.
3. Legal Basis for Processing
- Contractual necessity – providing services to business clients under signed agreements
- Legitimate interests – maintaining service integrity, fraud prevention, internal analytics (for controller data only)
- Legal obligations – compliance with GDPR, Norwegian Personal Data Act, and UAE Data Protection Law
- Consent – only when required (e.g., call recordings if mandated by client's jurisdiction)
4. Security & Compliance Standards
We maintain enterprise-grade data security aligned with industry best practices:
Security Framework
Our security controls are designed in accordance with ISO 27001 and GDPR requirements:
- Risk-based information security management
- Regular security assessments and continuous improvement
- Documented policies and procedures for data protection
We are actively pursuing formal ISO 27001 certification as part of our commitment to security excellence.
5. Data Processing Agreements (DPAs)
For enterprise clients, we provide a Data Processing Agreement that:
- Defines processor/controller roles clearly
- Covers data subject rights and deletion on termination
- Lists authorized sub-processors
- Grants audit and inspection rights
- Details breach notification timelines
6. Data Sharing & Sub-Processors
We only share data in limited cases:
- With sub-processors (e.g., cloud providers, CRM integrations) under binding contracts
- With legal or regulatory authorities if required
- Never sold or rented
A list of current sub-processors is available upon request.
7. Data Retention
- Business Client Data (Controller role): Retained for duration of contract + 3 years
- Clients' Customer Data (Processor role): Retained only as instructed by client or required by law (typically ≤ 7 years for compliance/QA)
- Financial/Legal Records: Retained up to 10 years in line with statutory requirements
Automated deletion processes are applied where possible.
8. International Data Transfers
- Data may be processed in Norway, EU, and UAE
- Cross-border transfers are secured with Standard Contractual Clauses (SCCs) or equivalent safeguards
- Transfer Impact Assessments (TIAs) are documented and available under NDA
9. Rights of Data Subjects & Clients
Business clients (Controller role)
Right to access, correction, deletion, portability, restriction, objection
Clients' customers (Processor role)
Rights must be exercised through the client (we support clients in fulfilling requests)
We acknowledge all privacy requests within 48 hours and aim to resolve them within 5–10 business days. In rare cases where additional time is required (e.g. complex requests or third-party verification), we will inform you and ensure completion within the 30 days required by law.
10. Children's Privacy
Our services target businesses and are not designed for individuals under 13. If such data is identified, it will be deleted immediately.