Privacy policy

01Overview

This policy explains how plops Oy processes personal data as a data controller. It covers visitors to our website, people who contact us, and the contact persons of our subscribing customers.

When our customer processes their own employees' data in the service (shifts, absences and other HR), the customer is the data controller and Sutja acts as a data processor. That processing is governed by a separate data processing agreement, described on the GDPR page.

02Data controller

Company

plops Oy

Business ID

3596026-3

Postal address

Linnanpellonkatu 52, 70300 Kuopio

Privacy

tietosuoja@sutja.fi

The data controller is plops Oy (business ID 3596026-3). Postal address: Linnanpellonkatu 52, 70300 Kuopio, Finland.

We have not appointed a separate data protection officer, but for data protection matters you can contact tietosuoja@sutja.fi.

03Controller or processor

Sutja is the controller for the data it controls itself: website visitors, enquiries and the contact persons of customers.

For the personal data a customer enters about their own employees, the customer is the controller and Sutja processes the data on the customer's behalf. This policy does not cover that processing; it is governed by the data processing agreement with the customer.

04What we use data for

We process personal data for the following purposes:

• Providing the service, managing user accounts and sign-in
• Customer relationship management, support and communication
• Billing and statutory accounting obligations
• Improving the service, security and abuse prevention
• Website usage statistics without cookies
• Marketing and contact with business contact persons
• Measuring the effectiveness of advertising campaigns, only with consent
• Meeting legal obligations

05What data we process

We mainly process the following data:

• Contact details: name, work email, phone number, organisation and role
• Account data: user identifier and account settings
• Contract and billing data
• Enquiries and support correspondence
• Technical data: log data, IP address and session data to keep the service working and secure
• Ad measurement data, if you arrived from an ad or a campaign link and allowed measurement: the ad click identifier (Google Ads: gclid, gbraid or wbraid), the campaign link's UTM tags (source, medium and campaign name) and the time of the form submission or registration
• Website visitor statistics: the page opened without the query part of its address, the page language, the device class (phone, tablet or computer), the domain of the referring website, the campaign UTM tags in the page address and a visitor identifier that changes daily. The identifier is calculated from the IP address and the browser identifier, but neither is stored, and nothing is stored on your device

For in-app feedback and support requests we store the type, subject, description, sender, workspace, role, page path, browser identifier, app version and status history. The subject and description are encrypted. Only the sender and Sutja staff can see the request; workspace administrators cannot see other users’ requests. Support replies by email. Requests are included only in the sender’s self-requested data package. Additional technical details may include the preceding page path without query parameters, browser language and time zone, viewport size, capture time and the time of the error.

06Where data comes from

We receive data mainly from the data subject or their employer (the customer organisation) when the service is taken into use or used. Some data is generated through use of the service. Company information may be supplemented from public registers such as the trade register.

07Legal bases for processing

Processing is based on the following GDPR legal bases:

• Contract: providing the service to the subscriber and users
• Legitimate interest: customer relationship management, service development, website usage statistics and security
• Consent: electronic direct marketing and measuring the effectiveness of advertising campaigns
• Legal obligation: for example accounting legislation

Where processing is based on legitimate interest, we have assessed each of the purposes listed above separately and concluded that our legitimate interest is not overridden by the interests, rights or freedoms of the data subject. The assessments are documented and reviewed annually.

You have the right to object to processing based on legitimate interest on grounds relating to your particular situation. Tell us at tietosuoja@sutja.fi and we will stop the processing unless there are compelling legitimate grounds for continuing it.

Some data is necessary to enter into the agreement or use the service; without it we cannot provide the service.

08Recipients and processors

We do not sell personal data. Data is processed on our behalf by carefully selected processors that provide, for example, hosting, email and accounting services. Providers’ purposes and processing regions are described in this policy.

Providers for Sutja’s own business activities are listed in the next section. Sub-processors of customer workspace data are listed separately on the GDPR page and are covered by the data processing agreement with the customer.

Subscription invoicing is handled in Procountor (Accountor Finago Oy). When we invoice a customer's subscription, we transfer the billing details there: company name, business ID, billing address, the billing contact's email address and the invoice details. Procountor also produces and delivers the invoice and serves as our accounting system, so invoice data is retained for the period required by accounting legislation.

Tuumo Oy processes the website visitor statistics on our behalf in its event analytics service. The website's own script first sends the event to our server, which forwards it to Tuumo. Your browser does not connect to Tuumo, and Tuumo does not receive your IP address, browser identifier, email address or any other form data. To calculate the visitor identifier, our server uses the IP address and browser identifier only momentarily: it combines them with a random salt that changes daily and calculates a hash from which they cannot be recovered. Visits on the same day count as one visitor, but visits on different days cannot be linked to each other. Campaign UTM tags are included in the statistics even without consent to measurement, but they are not linked to your name, contact details or user account, and they are not sent to advertising platforms.

Data may be disclosed to authorities where required by law.

The customer can grant an external payroll clerk limited access to a workspace without creating an employment relationship. The clerk can view payroll data by pay category, approved reimbursements with their expense lines, the payroll reports (hours and flexitime, card purchases, absences, leave balances, collective agreement deviations, and weekend and public holiday work), and the personal and employment details needed to set up employees in payroll, including personal identity codes, bank accounts, addresses and salary information. The clerk can correct payroll IDs, cost centre codes and payroll settings, and initiate payroll exports, but cannot approve hours or reimbursements. Balances are visible to the clerk for reconciliation only; recording a balance transaction is the employer's task and the clerk has no route to it. The customer is responsible for granting access and for its own payroll clerk; the clerk is not a subprocessor selected by Sutja. Opening employee details is recorded in the activity log without the identity code, bank account or other displayed values. Access can be revoked in workspace settings.

When Slack notifications are enabled, the title, description and technical context of in-app feedback or support requests are forwarded to Sutja staff's Slack support channel. Slack Technologies Limited provides this service for Sutja's own customer support. Separate contact and billing details are shown only in Sutja's internal admin panel.

Ad measurement works the same way on every form on the website and in registration. If you arrive from an ad or a campaign link, the form shows a separate checkbox for ad measurement. It is unticked by default. Only if you tick it do we store the ad click identifier and the campaign link's UTM tags with the form's contact in Brevo, or with your user account when you register. The first workspace you create gets its acquisition channel from them, and the channel is also stored in the sales data of the workspace trial in Brevo.

To Google Ads we send only the ad click identifier, the time of the event and a fixed conversion value. We do not send your name, email address, phone number or the UTM tags. Google processes this data as an independent controller under the Google Ads data protection terms. The UTM tags only show us which channel, such as LinkedIn or Facebook, the contact came from. They are not sent to any advertising platform.

You can withdraw consent by writing to tietosuoja@sutja.fi. We then remove the identifiers and send no conversion unless it has already been sent.

09Providers for Sutja’s own business activities

The providers below process data for which Sutja is the controller, such as our own invoicing data. In this role, they are not sub-processors under the customer’s data processing agreement.

10Transfers outside the EU and EEA

Application data is stored in Finland, and so are the website visitor statistics. Processing of customer support notifications in Slack is described separately below.

Nor is the service's traffic processed outside the EU: DNS, content delivery and the firewall are provided by BunnyWay (bunny.net), a Slovenian company, and traffic is served from EU locations under a documented restriction recorded in the data processing agreement.

Slack notifications for Sutja's own customer support are a separate processing activity: feedback or request titles, descriptions and technical context may also be processed in the United States. Slack describes its international transfer safeguards in its privacy information.

Google Ads measurement data is received by Google Ireland Limited, and Google may also process it in the United States. Google describes its transfer safeguards in its privacy policy.

11How long we keep data

We keep personal data only as long as necessary:

• Account and customer data: for the duration of the customer relationship and up to 90 days after it ends, after which data is deleted or anonymised
• A user account with no active workspace membership: anonymised automatically once the account has been unused for 90 days
• Accounting-related data: for the period required by accounting law, generally 6 years
• Enquiries: up to 12 months
• Ad measurement data (click identifier, UTM tags and upload status): with the form's contact in Brevo for as long as the contact is kept, and with your user account until the account is deleted or anonymised. The workspace acquisition channel is kept with the workspace and its sales data in Brevo. Google retains a conversion it has received under its own policies.
• Error and performance data we process for troubleshooting and improving the service: at most 60 days
• Traffic logs from the protection layer, processed for security and abuse prevention: 3 days
• The service usage log, which contains the IP address and browser identifier: 24 months. The log arises in the customer's workspace and the customer is its controller, but Sutja also uses the same log to monitor its own security
• Website visitor statistics: events are kept at Tuumo for 2 years and then deleted. The daily salt used to calculate the visitor identifier is deleted within 48 hours, after which the identifier can no longer be linked to an IP address
• Backups: kept for 31 days
• Feedback and support requests sent in the app: during handling and for 24 months after closure. Permanent deletion of the workspace also deletes the requests.

When a workspace is deleted, access ends immediately and the data is destroyed permanently after 58 days. As the last step of that destruction we destroy the workspace's encryption key, which makes its encrypted data permanently unreadable. In backups taken before the deletion, the data remains until those backups expire 31 days after they were taken.

The employee data a customer stores in their workspace is subject to its own staged retention periods. The controller for that data is the customer, so it falls outside this policy. They are collected into a single table on the GDPR page.

Notifications forwarded to the Slack support channel are retained in Slack for one year from sending. On the Free plan, messages older than 90 days are hidden but are not deleted until one year has passed. Deletion from Sutja’s database or deletion of a workspace does not delete Slack messages; Slack retention is measured separately from sending.

12Your rights

You have the right to:

• Access and review your data
• Have inaccurate data corrected
• Request erasure of your data
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent you have given

You can delete your own user account yourself on your profile page in the service. For other rights, contact tietosuoja@sutja.fi. We respond to requests generally within one month.

If your request concerns data your employer has stored in their workspace, your employer is the controller and we route the request to them. The stages of deletion and the retention periods are described on our GDPR page.

13Automated decision-making

We do not carry out automated decision-making or profiling covered by this policy that produces legal or similarly significant effects on you.

The automated shift planning performed in the service concerns the customer's employees' data, where the customer acts as the controller. That processing is governed by the data processing agreement.

14Security

We protect personal data with appropriate technical and organisational measures. Data is encrypted in transit and at rest, access is restricted by role on a least-privilege basis, and use is monitored through logs. Sutja's application database is hosted in Finnish data centres and backed up regularly.

The most sensitive data, such as absence reasons and their attachments, bank account, address and the contents of employment contracts, is additionally encrypted field by field and file by file with the workspace's own encryption key before it is stored. The master key is not kept in the database, and keys can be rotated. Within the employer organisation, this data is visible only to the employee, their own supervisor chain and administrators. Once a workspace's key is destroyed, the fields and files encrypted with it cannot be recovered with any key.

If a personal data breach occurs, we notify the supervisory authority and, where required, you, as required by law.

15Right to lodge a complaint

If you consider that the processing of your personal data is unlawful, you can lodge a complaint with the supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (tietosuoja.fi).

16Cookies

Our website uses no tracking or analytics cookies and stores no identifiers on your device. The website contains no Google or other third-party scripts or pixels. The website's own script sends our server a visitor statistics event for each page opened, as described in the section on recipients. If you arrive from a Google Ads ad or a campaign link, the ad click identifier or the campaign UTM tags are in the page address. The UTM tags are included in the visitor statistics; the ad click identifier is not. They are used for advertising measurement only if you submit a form during the same visit and separately allow measurement. A registration link passes them to the app in the page address, and the app stores them in the browser session storage only once you allow measurement. Fonts and other resources are served from our own server. The service itself uses only essential cookies to maintain sign-in and sessions.

17Changes to this policy

We may update this policy as the service or legislation changes. We publish the current version on this page and note the update date at the top.