Privacy policy

Luma Software Oy

Business ID: 3498264-7

Pietolankatu 41 B 4, 04440 Järvenpää

Email: hei@siivio.fi

Questions and requests about data protection can be sent to the email address above.

Website and contact form. When you send the contact or demo request form, we store the details you provide:

—name

—company name

—email address

—phone number, if you give one

—your company’s employee-count range

—the content of your message

—the form’s language and the time it was sent

The website’s server may also record technical log data, such as IP address, browser details and request times, to keep the service secure and working.

Siivio user accounts. When your company registers or a user signs in to the service:

—the name and email address of the person who opened the account, and the company name

—users’ sign-in details: email address and a password that is stored only as a hash (we cannot see it)

—acceptance of the terms: the accepted version, when and by whom

—push notification device tokens on the devices where the user has turned notifications on

—technical log data on sign-ins and use of the service, such as times, IP address and browser details

—error reports: when an error occurs in the app, the error message, page address, browser details, app version and the user’s and company’s identifiers

Subscription and billing. The subscribing company’s name and billing contact details, the chosen plan and billing interval, and invoice and payment details. Card details are handled by the Stripe payment service and are never stored by us.

Enquiries. We use the form data to reply to your enquiry, arrange a demo and tell your company about our service. The basis is our legitimate interest in responding to business enquiries and handling the early stage of a possible customer relationship (GDPR Article 6(1)(f)) and, where relevant, taking steps prior to entering into a contract (Article 6(1)(b)).

Providing the service. User account, sign-in, subscription and billing data are needed to provide the service, manage the customer relationship and tell you about matters concerning the service, such as the end of the trial or changes to the terms. The basis is the customer agreement (Article 6(1)(b)). Billing data that forms part of the accounts is kept to meet a legal obligation (Article 6(1)(c)).

Security and fixing errors. We use log data and error reports to keep the service secure, prevent misuse and fix errors. The basis is our legitimate interest in keeping the service secure and working (Article 6(1)(f)).

—Enquiries: as long as needed to reply and to start a possible customer relationship, and for no more than 24 months after the last contact if no customer relationship begins.

—User accounts: for the duration of the customer relationship. When the trial or subscription ends, the data is kept for 90 days and then deleted in line with the terms of service. A single user’s login is removed when the company’s admin deletes it.

—Billing: invoices and payment details for as long as the Finnish Accounting Act requires; vouchers six years from the end of the financial year.

—Log data and error reports: about 30 days.

—Push notification device tokens: until the user turns notifications off or signs out on the device, or the token expires.

We do not sell data or disclose it to third parties for marketing. We use the following service providers, who process data on our behalf and on our instructions:

—Google Firebase and Google Cloud (Google Ireland Limited) — delivering the website and the app, storing form and service data, sign-in, push notifications, logs and error reports

—Stripe Payments Europe, Limited — subscription payments and invoices

—Resend — the service’s emails, once email features are switched on

Push notifications reach the device through the push service of the user’s browser or phone (Google, Apple or Mozilla).

The service’s database, background functions and files are located in Belgium (Google Cloud, europe-west1). Some services, such as sign-in, push notifications, logs and sending email, may also process data outside the EEA. Such transfers use safeguards required by the GDPR, such as the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework.

The website uses no cookies and no visitor tracking, and there are no third-party advertising or analytics scripts on its pages. Fonts are served from the site’s own server. When you send the form, the Firebase library that delivers it may store technical data in your browser that the submission requires.

The app stores in the browser only what using the service requires: the sign-in, settings such as language and notifications, and, in the worker app, saves waiting to be sent while offline. The app has no advertising or analytics tracking.

You have the right to:

—know what data we process about you and get a copy of it

—have inaccurate data corrected

—have your data erased

—object to processing or ask for it to be restricted

—receive the data you provided under the agreement in a machine-readable format

—lodge a complaint with a supervisory authority

To use your rights, email hei@siivio.fi. If you believe your data is being processed in breach of data protection law, you can complain to the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi).

Data is transferred over an encrypted connection and stored encrypted. The form can only send data, not read it. In the service, each company’s data is kept separate, and users see only what their role allows. The database is backed up daily and weekly. Access to stored data is limited to the people who need it for their work.

This policy does not cover data that a customer company stores in Siivio, such as its customers, sites, workers and customer portal users. For that data the customer company is the controller and we act as the processor. Its processing is agreed in the data processing agreement, which is part of the terms of service.

If you are a cleaning company’s employee or customer, that company is your first point of contact about your data. We forward requests we receive to it.

We may update this policy when our practices or the law change. The current version is always on this page.