Treanglo Ltd. Privacy Notice

Effective from 4.3.2024

With this Privacy Notice we provide you information on why and how we process your personal data in the course of our business operations.

1. What definitions are used in this Privacy Notice?

Personal data means any data concerning a data subject or data with which a data subject can be identified with.

Processor means a party that processes personal data for and on behalf of the controller.

Purpose of processing means the reason why the controller processes personal data of a data subject.

Legal basis for processing means the legal basis with which the controller processes personal data of a data subject. Article 6 of the GDPR contains provisions on legal basis for processing.

Controller means a party that is in charge of the personal data processing activities.

Data subject is a term for a human being in accordance with data protection laws.

Privacy notice means a data protection document that has been drafted according to Articles 13 and 14 of the GDPR, and with which the controller may inform its data subjects of the ways their personal data is processed.

2. Who is the controller of your personal data?

The controller of your personal data is Treanglo Oy (2623329-1), which is located at Unioninkatu 7 B 12, 00130 Helsinki.

If you have any questions regarding the privacy notice, please contact Arttu Väisänen (arttu@treanglo.com).

3. When do we act as a processor?

We also act as a processor of personal data when we process the personal data of our merchant customers members on behalf of the merchants through our Kide.app service. The merchants are the controllers of such personal data.

We apply the provisions of our Data Protection Agreement with regard to the processing of those personal data (see Section 9 of the Merchant Terms).

4. Why do we process your personal data?

We process your personal data for the below-mentioned purposes of processing. Below you will also find information on what personal data we process and what are the legal basis for our processing activities.

a) Customer relationships with the customers of the Kide.app-service

Explanation: We process personal data for the purposes of our customer relationships
Category of data subjects: Customers
Categories of personal data: Basic and contact information
Legal basis for processing: Contractual obligations

b) Customer relationships with merchants of the Kide.app service

Explanation: We process personal data for the purposes of customer relations between us and merchants
Category of data subjects: Merchants (their representatives)
Categories of personal data: Basic and contact information
Legal basis for processing: Contractual obligations

c) Development of services and responding to customer needs

Explanation: We process personal data in order to develop our service and meet our customers' needs
Category of data subjects: All customers
Categories of personal data: Data related to the use of the service
Legal basis for processing: Our legitimate interest

d) Our legal obligations

Explanation: We process personal data in order to comply with our legal obligations
Category of data subjects: Subjects of statutory obligations, e.g. data subjects whose personal data is in the accounting material
Categories of personal data: Basic and contact information and other information required by law
Legal basis for processing: Our legal obligation

e) Cooperation relationships

Explanation: We process personal data for the purposes of our cooperation relationships
Category of data subjects: Collaborators (contact persons)
Categories of personal data: Basic and contact information
Legal basis for processing: Contract enforcement

f) Markkinointi

Explanation: We process personal data for marketing purposes
Category of data subjects: Customers and potential customers
Categories of personal data: Basic and contact information and information about the use of our services
Legal basis for processing (potential customers, electronic direct marketing): Consent of the data subject
Legal basis for processing (customers/potential customers, non-electronic direct marketing): Our legitimate interest, as we need to market our services in order to conduct our business. Our interest outweighs the interest of the data subject, as we market our services in accordance with applicable law.

NB! You may have the right to exercise your right to object (see the section on your rights).

g) Communication

Explanation: We process personal data for communication purposes
Category of data subjects: Communication partners
Categories of personal data: Basic and contact information and other information that may be disclosed to us
Legal basis for processing: Our legitimate interest, as we need to communicate in order to carry out our business. Our interest outweighs the interest of the data subject, as our data subjects expect us to communicate with them

NB! You may have the right to exercise your right to object (see the section on your rights).

h) Website management

Explanation: We process personal data to manage our websites
Category of data subjects: People who visit our websites
Categories of personal data: IP addresses and location data
Legal basis for processing: Consent in accordance with Section 205 of the Information Society Code (917/2014) for non-essential cookies and consent for location data

i) Recruitment

Explanation: We process personal data for recruitment purposes
Category of data subjects: Jobseekers
Categories of personal data: Basic and contact information, CVs and other information provided to us
Legal basis for processing: Our legitimate interest, in accordance with which we manage our recruitment. Our interest outweighs the interest of the data subject, as our data subjects expect us to process their personal data for recruitment purposes

NB! You may have the right to exercise your right to object (see the section on your rights).

5. From where do we collect your personal data?

We collect personal information about the data subjects from data subjects themselves (including the terminal device and browser they use) when using our Services and from our partners (e.g. service providers used to comply with the AML Act), authorities and public sources (e.g. trade register).

6. Do we disclose or transfer your personal data?

As a general rule, we will not disclose your personal data to third parties. However, if we are required by mandatory law or governmental authorities to disclose your personal data, we will assess the legality of such disclosure on a case-by-case basis with the assistance of our Data Protection Officer.

However, we do share, i.e. transfer your personal data to others as part of our normal business activities when using various digital services. For example, we use the following digital services provided by data processors, which involve the processing of personal data: data storage services (e.g. cloud services) and communication services (e.g. e-mails).

7. Do we process your personal data outside the EU and EEA area?

Your personal data may be processed outside the EU and the EEA area. In these situations, we ensure an adequate level of data protection, for example, through standard contractual clauses and other similar arrangements.

8. How long do we retain your personal data?

The period for which we keep your personal data depends on the purpose for which we process your personal data:

Personal data processed in contractual relationships will be processed for as long as the contractual relationship in question is in force.
Personal data processed on the basis of consent will be processed for as long as we have the data subject's consent to the processing of personal data.
The retention period of personal data regarding cookies depends on the cookie in use.
Personal data processed in the recruitment process will be kept for a maximum period of 12 months from the date of receipt of the job application or the deadline for the job advertisement.
Personal data other than those listed above will be kept for as long as necessary for the purposes for which the personal data are processed.

We regularly check the relevance of the information in the registers and keep a record of the checks.

9. What data protection rights do you have?

You may be entitled to exercise your rights under the EU General Data Protection Regulation (679/2012):

Right of inspection (art. 15)
Right of rectification (art. 16)
Right of withdrawal (art. 17)
Right of restriction (art. 18)
Right of transfer (art. 20)
Right of objection (art. 21)
Right to object to automated individual decisions, including profiling (art. 22)

Any communication concerning the rights should be made in writing to the contact person of the controller. Your rights can only be exercised once your identity has been duly verified.

You may have the right to lodge a complaint with the Data Protection Ombudsman if you believe that personal data concerning you is being processed in breach of data protection laws.

10. Can this privacy notice be amended?

We have a unilateral right to modify this privacy notice. We modify the privacy notice whenever necessary, for example, in the case of changing legislation. The modifications take effect immediately when we post the up-to-date version of this privacy notice on our website.

If we make significant changes to the privacy notice, or if there is a significant change in the way it is used, we will notify the data subjects.