Privacy Policy

This website, rayca.ai (the Website), is operated by Rayca Precision Ltd, a company incorporated in the United Kingdom. In this policy, Rayca, we, us and our mean Rayca Precision Ltd and, where relevant, its affiliates, Rayca Precision Oy, a company incorporated in Finland, and Rayca Precision Inc., a Delaware corporation in the United States.

Rayca Precision Ltd is the controller of the personal data described in this policy, within the meaning of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where we process personal data of individuals in the European Economic Area (EEA), the EU General Data Protection Regulation (Regulation (EU) 2016/679, EU GDPR) also applies, and our affiliate Rayca Precision Oy acts as our point of contact in the European Union. In this policy, GDPR means the UK GDPR and, where it applies, the EU GDPR.

This policy applies to personal data we process when you browse the Website, submit one of its forms, or correspond with us as a result. It does not cover the processing of personal data under a separate agreement with us, for example a research collaboration or services agreement, which is governed by the terms of that agreement. It also does not cover third-party websites linked from the Website, including our social media pages, which follow their operators’ own privacy policies.

How we use cookies and similar technologies is explained in more detail in our Cookie Policy, which forms part of this policy.

This policy is a notice given under data protection law. It is not a contract, and it does not create any rights or obligations beyond those that data protection law provides.

Information you give us

When you use a form on the Website, to propose a partnership, scope a pilot, apply for a role, contact the team or make a privacy request, we collect the information you enter. Depending on the form, this is:

• your name and email address (always required);
• your organisation and role;
• the target, area of interest or timeline you describe;
• a link you provide, such as a LinkedIn profile or CV;
• the content of your message.

With each submission we also record the date and time and your browser’s user agent string (which describes the browser and operating system), to help us detect misuse and automated spam.

Please do not send us special categories of personal data, such as information about your health, ethnic origin, religious beliefs or political opinions, or confidential information belonging to you or to anyone else. Our forms are not designed to receive it. If you submit personal data about another person, you confirm that you are entitled to do so.

Information collected automatically

Like any website, the Website cannot be delivered without processing certain technical data. When you visit, our hosting and security provider, Cloudflare, processes your IP address, the pages and files requested, the date and time, your browser and device type, and the referring page, to deliver the Website, keep it available and protect it from attacks and abuse.

Analytics, only with your consent. If you allow analytics in our cookie settings, we use Cloudflare Web Analytics to understand how the Website is used: for example which pages are viewed, how visitors arrived, the type of browser and device, the country of the visit and how quickly pages load. Cloudflare Web Analytics does not use cookies or local storage, and, according to Cloudflare, does not fingerprint visitors or track them across other websites. We see the results in aggregated form only.

Your cookie choice. We store your cookie choice in a strictly necessary cookie together with a randomly generated identifier, and we keep an anonymous record of the choice (identifier, choice, policy version, whether your browser sent a Global Privacy Control signal, and the time) so that we can demonstrate it. This record does not include your IP address or any information that identifies you directly.

Information from other sources

If you apply for a role and give us a link to a public professional profile, we may review the information available at that link for the purpose of your application.

We use personal data only for the purposes below, and only where we have a legal basis to do so.

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can ask us for more information about this assessment, and you may object at any time (see section 9).

We do not send marketing emails to people who have only submitted an enquiry, unless they have asked to receive them or the law otherwise allows it. Every marketing message we send will include a simple way to opt out. We do not use personal data for advertising or profiling.

Providing personal data through our forms is voluntary. If you do not provide your name and email address, we will not be able to respond to you.

We do not sell personal data, and we do not share it for advertising. We disclose it only to:

• Service providers acting on our behalf. Cloudflare, Inc. hosts and delivers the Website, protects it, stores form submissions and consent records in its database service, and provides Web Analytics. Cloudflare acts as our processor under a data processing agreement and may use only the data it needs to provide its services to us.
• Our affiliates, Rayca Precision Oy and Rayca Precision Inc., where needed to respond to you or manage our relationship, under the same protections as this policy.
• Professional advisers, such as lawyers, auditors and insurers, under a duty of confidentiality, where necessary for their advice.
• Authorities and others where the law requires it, or where disclosure is necessary to establish, exercise or defend legal claims, or to protect the rights, property or safety of Rayca, our users or others.
• A buyer, investor or successor, in connection with a merger, acquisition, financing or sale of all or part of our business, subject to confidentiality and to this policy.

We are based in the United Kingdom, and also operate in Finland and the United States. Our service provider Cloudflare operates a global network, so personal data may be processed outside the United Kingdom and the EEA.

Where personal data is transferred outside the EEA or the UK, we make sure it is protected by:

• adequacy regulations of the UK Government or, for EEA data, an adequacy decision of the European Commission. These cover transfers between the United Kingdom and the EEA, and to US organisations certified under the EU-US Data Privacy Framework and its UK Extension, which Cloudflare is; or
• the UK International Data Transfer Agreement or Addendum and, for EEA data, the European Commission’s Standard Contractual Clauses, together with any additional measures that are needed.

You can ask us for more information about these safeguards, or a copy of them, using the contact details below.

We keep personal data only for as long as we need it for the purposes above:

We may keep data longer where the law requires it or where it is needed to establish, exercise or defend a legal claim, and only for that purpose. When data is no longer needed, we delete or anonymise it.

We use technical and organisational measures appropriate to the risk to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include encryption of data in transit (HTTPS), access to submissions limited to authorised personnel, protection against automated abuse, and the security controls of our hosting provider.

No method of transmission over the internet is completely secure. If a personal data breach occurs that is likely to put your rights at risk, we will notify the relevant authority and, where required, you, as the law requires.

Under the GDPR, and subject to the conditions and exceptions it sets, you have the right to:

• access your personal data and receive a copy of it;
• rectification of data that is inaccurate or incomplete;
• erasure of your data, for example where we no longer need it;
• restriction of processing, for example while the accuracy of the data is checked;
• data portability, to receive data you provided in a structured, machine-readable format, where we process it on the basis of consent or a contract by automated means;
• object at any time to processing based on our legitimate interests, on grounds relating to your particular situation, and to object without condition to any direct marketing;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal. You can withdraw analytics consent from Cookie settings at the foot of every page;
• lodge a complaint with a supervisory authority (see section 14).

To exercise a right, use the privacy request form or write to us at the postal address in section 14. We will respond within the period the law requires, normally one month from receiving your request. Where a request is complex or we receive many requests, we may extend this by up to two further months and will tell you why. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive. We may ask for information to confirm your identity before acting on a request, so that we do not disclose data to the wrong person.

Depending on the state you live in, and where its law applies to us, you may have rights under US state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act. This section supplements the rest of this policy. Our affiliate in the United States is Rayca Precision Inc., a Delaware corporation.

• Categories collected in the last 12 months: identifiers (such as name, email address and IP address), professional or employment-related information, internet or other electronic network activity information, and the content of your messages. Sources, purposes and recipients are described in sections 3 to 5, and retention in section 7.
• We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the last 12 months. We do not knowingly sell or share the personal information of anyone under 16.
• We do not use or disclose sensitive personal information for purposes that would give a right to limit its use.
• You may have the right to know, access, correct and delete personal information, and to opt out of sale, sharing and targeted advertising. We honour the Global Privacy Control (GPC) signal as a request to opt out, applied to the browser that sends it.
• You may use an authorised agent to make a request on your behalf. We may ask the agent for proof of authorisation and verify your identity directly. We will not discriminate against you for exercising your rights.

The Website is intended for professionals and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, please contact us and we will take reasonable steps to delete it.

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

We may update this policy to reflect changes in the law, our services or how we process personal data. The date at the top shows when it was last updated. If we make material changes, we will make them clear on the Website and, where the law requires, ask for your consent again.

For any question about this policy or how we handle personal data, or to exercise your rights, use the privacy request form, or write to us by post:

If you are not satisfied with our response, or believe we are processing your personal data unlawfully, you have the right to complain to a supervisory authority. Our supervisory authority is the UK Information Commissioner’s Office (ico.org.uk). If you are in the EEA, you may also complain to the authority in the country where you live, work or where the alleged infringement took place, for example, in Finland, the Office of the Data Protection Ombudsman (tietosuoja.fi). We would, however, appreciate the chance to address your concern first.