PRIVACY POLICY – Lentävä liitutaulu Oy
Updated on March 31, 20231. Introduction
This Privacy Policy describes the principles according to which Lentävä liitutaulu Oy (hereinafter referred also as "Seppo" or "we") as a data controller collects and processes personal data relating to: a) SEPPO users (Section 4.1 below),b) customers and business partners (Section 4.2 below),
c) marketing (Section 4.3 below),
d) employees (Section 4.4 below), and
e) job applicants (Section 4.5 below), as well as
f) on legal grounds and for legal purposes (Section 4.6 below). Personal information is any information related to an identified or identifiable person, such as a name, email address or photograph.
2. Controller and contact details for privacy questions
Lentävä liitutaulu OyBusiness ID: 2500405-9
Päivöläntie 52
00730 Helsinki
FINLAND
www.seppo.io
Email: info@seppo.io Please use the above contact details, if you have any questions regarding privacy matters. Our contact person in privacy matters is Tero Kulha.
3. Seppo as a data processor
By offering the Seppo online platform, we may also operate in the role of a data processor to an organization, person or entity who uses our service as a SEPPO platform customer. The purposes and principles of personal data processing are determined in these situations in the agreement Seppo has concluded with the customer. Seppo may not process such data for any purposes other than for the benefit of the customer in question and in accordance with the customer's instructions. The principles of how Seppo's customers process personal data is described in their own privacy policies.4. What personal data we process, for what purpose, what is the legal basis for the processing and the applicable data retention period
We collect, store and process personal data only for predefined purposes and only on legal grounds. We process personal data mainly for the following purposes and on the following grounds:4.1 SEPPO users
Purpose Provision of digital and onlinebased software and services, i.e. the SEPPO platform Description of the processing In connection with the provision of digital and online-based services, personal data relating to SEPPO platform users is processed, for example, for (1) concluding a user agreement and accepting the terms of use, (2) creating a user account, (3) identifying the user during use of the service, (4) providing support and communicating with the users, and (5) operating the SEPPO webshop. Processed personal data Game developers:- Email address*
- Password*
- Name
- Phone number
- Game content developed by the game developer
- Email address*
- Password*
- Name of the organization*
- Email address*
- Details for invoicing*
- Number of licenses*
4.2 Customers and business partners (incl. potential)
Purpose Creating and maintaining customer and business relationships Description of the processing We process personal data in various functions to conclude and execute business-to-business contracts, such as contracts of sale, license and user agreements, subcontracting agreements and other partnership agreements. During the customer or business relationship, we process personal data for usual purposes, for example to provide services, customary correspondence and communication, invoicing, payments and debt collection and to handle feedback and technical problems. Processed personal data- Name*
- Name of the company/employer*
- Job title
- Email address*
- Phone number*
- Company address information*
- Contract details*
- Business segment
- Concluded deals, purchased products/services and invoicing details
- Customary business correspondence
4.3 Marketing
Purpose Marketing and analytics Description of the processing We process personal data to send newsletters, for direct marketing purposes, to target and personalize marketing and content, and to analyze website usage and marketing. Processed personal data- Name
- Organization
- Email address
- Campaign group
- Contact methods and phase
- Responses
- Marketing consents
- Email openings, send group
4.4 Employees
Purpose Employment matters Description of the processing We collect, store and process personal data relating to employees for fulfilling rights and obligations relating to employment agreements, customary human resource management purposes, payroll and payment of salaries as well as other employment-related rights and obligations, e.g. those based on law and collective agreements. Processed personal data Personal data usually provided by the employee: Name, address, phone, birth date, social security id, bank account, education, degrees, feedback for performance review purposes, emergency contact. Personal data usually created by the employer: Start/end date of employment, employment contract, working time, insurance policy, position and employment related mandatory documentation. Other data: Work travel information (if any) and absence information. Other sources: Tax data. Legal basis: We must fulfill our obligations as an employer in relation to the requirements of the employment agreement, legislation, collective agreements and various authorities. Such processing is based on legal obligation or fulfillment of an agreement. The processing of personal data is also necessary to fulfill our legitimate interests so that we can fulfill our obligations as an employer in relation to the employment contract, legislation, collective agreements and the requirements of various authorities. As an employee, you have a reasonable expectation in terms of your existing employment relationship to expect that we will as an employer process your data described in this privacy policy. Taking into account the purposes mentioned above, your justified expectations and the nature of the data, we consider that this processing does not conflict with your fundamental rights or freedoms. We process information related to work ability and health, and we only carry out tests and investigations within the limits of legislation when your position requires it or if the problems caused by work otherwise give reason to them. Health information is processed to find out if there is a justified reason for the absence from work, or when the processing is necessary for the payment of sick pay or comparable health-related benefits. In addition, health status data can be processed in other situations separately regulated by law. The processing of personal data related to work ability is based on our legal obligation. Various test data, references, suitability assessments, drug testing and other health-related checks and examinations are based on your consent. Data retention period: We do not store your data for a longer period than necessary for their purpose or for longer than necessary for the performance of a contract. Retention periods may also be based on applicable laws, such as employment contracts act as well as bookkeeping and tax laws. We may also update the data if necessary. Following retention periods also apply:- the information needed to write the employment certificate can be kept for 10 years after the end of the employment relationship;
- payroll records can be kept for 10 years after the end of the accounting period;
- travel, expense reimbursement and other payment receipts can be kept, e.g. for at least the current year and the following 6 years;
- general employment data can be stored throughout the employment and for approximately 24 months after the employment has ended, due to the general time limit for presenting legal claims; and
- a list of employees exposed at work to biological agents that cause serious danger or serious illness to persons must be kept for at least 10 years after the end of the exposure.
4.5 Recruiting and job applicants
Purpose Recruiting Description of the processing We process personal data relating to recruitment so that we can receive and process job applications and make decisions about open positions or open applications, and, ultimately, offer employment and conclude employment contracts. Processed personal data- Basic details
- Education, work experience, skills
- Possible job application and resume
- References (with consent)
- Data from personality and aptitude tests as well as health inspections (if any, with consent)
4.6 Legal grounds and legal obligations
Purpose Legal grounds and legal obligations Description of the processing To a limited extent, personal data may be processed and stored for legal reasons and obligations Processed personal data- Accounting and bookkeeping materials*
- Any other information required by law*
- Preparing for and responding to legal claims and actions
- Investigating violations
5. From which sources has the personal data been obtained
We receive personal data mainly from you in connection with contacting us. The information may be given by you or also derived from the use of services or website. In addition, we may collect personal data about you from other reliable sources. Examples of data from these sources could be your public profile information (e.g. LinkedIn), interest in our products and services, and references from your colleagues or other people.6. With whom do we share personal data
As a general rule, your personal data is processed by the personnel of our company when performing their duties. We may also use service providers for processing personal data. The service providers we use may not use personal data for any of their own purposes, but only for our benefit. We always make sure, for example through contracts, that the confidentiality of your data is maintained and that the data is also otherwise processed in accordance with the law. What data our service providers process at any given time related to the task and purpose for which we use the service provider. We may share personal data with others especially in the following situations: (a) SEPPO platform. SEPPO platform is operated on a third party platform (Heroku). Relevant customer data may be shared to our local business partners in the territory where the SEPPO platform customer is located for customer relationship management and for offering customer support. We use also third party subcontractors for developing the SEPPO platform; (b) Sales and marketing. We use third-party service providers for various sales and marketing purposes (e.g. Pipedrive, Salesloft, LeadIQ, DuxSoup and Active Campaign); (c) HR and recruitment. We use cloud services for storing employment data and job applications (Google Workspace). We use service providers also for payroll and payment of salaries (Palkka.fi, Netvisor); (d) Official and other legal reasons. We may also disclose information when required by law, a court or a competent authority, to respond to a legal claim or to prepare one; (e) Corporate and business arrangements. We may also disclose information if we were involved in a merger, business transaction or other reorganization of our business; and (f) Consent of the data subject. We may also disclose information if the person has given their consent to the disclosure of information.7. International transfers of personal data
The servers with Seppo data are located in the EU. Personal data may be transferred outside the EU/EEA especially in the following situations: (a) Our services provider, such as a cloud-based software we use for marketing, is located outside the EU/EEA; (b) We have a customer, for instance a SEPPO user, who is located outside the EU/EEA; or (c) We need to share information for customer service and support purposes to our local business partner located outside the EU/EEA. If personal data were to be transferred outside the EU/EEA to a country that is not included in the EU Commission's decision on an adequate level of data protection, we will make sure that the processing, transfer and storage of your data is carried out on the grounds required by law and with adequate protection mechanisms, such as using the standard contract clauses confirmed by the EU Commission. The standard contract clauses can be found here (part of the text is in English): https://ec.europa.eu/info/law/law-topic/data-protection_fi. The standard contractual clauses have different modules for different situations, most likely we would apply modules 1 (controllercontroller) 2 (controller-processor) or 3 (processor-sub-processor), depending on the situation.8. Personal data retention periods
Specific retention periods for various types of processing activities are described in Sections 4.1 to 4.6 We do not store personal data for longer than is necessary for the purpose of their use or as required by contract or law. Personal data can also be deleted in the situation when the data subject withdraws his/her consent or requests the deletion of his/her data (and there is no other legal basis for the processing). Data retention periods can also be governed by legislation (e.g. accounting law, tax laws) and the expiration of deadlines related to presenting legal claims (e.g. statutes of limitations). The necessary storage time can vary, but typically it can mean a few years. Information that is necessary for defending against legal claims may have to be stored for up to 10 years. Accounting documentation is typically kept for 6-10 years. We maintain a minimum information register of data subject requests made in accordance with the data protection legislation (e.g. a request made by a data subject for deletion of data) so that we can demonstrate afterwards that we have implemented the requests of the data subject in accordance with the data protection legislation. We store online behavior data collected with cookies and other similar technologies as described in the cookie statement produced by our cookie tool. The cookie statement is available on our website.9. Your rights
You have the following rights in relation to your personal data: Updating your own informationIn case you are a registered user in our digital services, or a customer in our online store, you may have certain limited possibilities to check and update your profile data by accessing your account in the service or online store. The right to access personal data
You have the right to receive confirmation from us as to whether we are processing personal data concerning you and to know what personal data concerning you we are processing (e.g. a copy of the data). In addition, you have the right to receive additional information about the basis of the processing of your personal data. However, the right to access personal data can be restricted based on legislation, the protection of privacy of other persons and the protection of business secrets. The right to correct data
You have the right to have your incomplete, incorrect or outdated personal data supplemented or corrected. The right to delete data
You have the right to request the deletion of your personal data. Your data will be deleted if there is no longer a legal basis for processing personal data. The right to restrict processing
You may have the right to restrict the processing of your personal data. In this case, the controller generally does not process personal data other than by storing the data. You may have this right, for example, when you dispute the accuracy of your personal data, if the processing is against the law, or if you have objected to the processing of your personal data and are waiting for a response to the request for action in question. Right to object
If we process your personal data based on our legitimate interest, you have the right to object to such processing based on your personal reasons. The right to transfer data from one system to another
If we have processed your data on the basis of your consent or to fulfill a contract and the processing has taken place automatically, you have the right to receive the data you have provided us electronically in a commonly used machine-readable format so that the data can be transferred to another data controller. Withdrawal of consent
If the processing of personal data is based on consent, you have the right to withdraw it at any time. Withdrawal of consent does not affect the legality of the processing of personal data that took place before the withdrawal. The processing of your personal data is based on consent, for example when you have given permission for electronic direct marketing by subscribing to our newsletter. The processing of non-essential cookies on our website is also based on your consent. You can manage the cookie consents you have given yourself using the cookie tool on our website. The right to prohibit direct marketing
You always have the right to object to the processing of your personal data for direct marketing purposes and the right to withdraw any consent you may have given for marketing purposes.