{"id":1074,"date":"2023-10-11T07:40:40","date_gmt":"2023-10-11T05:40:40","guid":{"rendered":"https:\/\/sotender.io\/?page_id=1074"},"modified":"2025-10-14T12:24:02","modified_gmt":"2025-10-14T10:24:02","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/sotender.io\/sv\/privacy-policy\/","title":{"rendered":"Privacy policy"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Last updated: 18 September 2025<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Koivu Solutions Oy (&#8220;Koivu&#8221;, Business ID FI28695705), Tiedepuisto 4, A 251, 28600 Pori, Finland, acts primarily <strong>as a processor <\/strong>of personal data on behalf of our customer organizations (the <strong>controllers<\/strong>) that use our Sotender and Koivu Cloud services. For a few limited purposes described below (e.g., our website, support tickets, billing contacts), Koivu acts <strong>as a controller<\/strong>.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>If you are an end user (e.g., a temporary worker or scheduler) usingSotender for a specific hospital, city or company, that organization is your data controller. <\/strong>Their privacy notice governs how your personal data is used. Koivu processes your data only according to the controller\u2019s written instructions and our Data Processing Agreement (DPA).<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>1. Roles and contact<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Controller for tenant data<\/strong>: Your employer\/ordering organization using Sotender\/Koivu Cloud. Please see their privacy notice (usually linked from inside the app or your employer\u2019s intranet)for purposes, legal bases, retention and rights.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Processor<\/strong>: Koivu Solutions Oy, contact: support@koivusolutions.com.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Controller for Koivu<\/strong>\u2019<strong>s own operations<\/strong>: Koivu Solutions Oy for website analytics, sales\/CRMcontacts, support tickets you send directly to us, and account\/admin contact data in contracts and invoicing.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>2. Personal data we handle as a processor (on behalf of customer controllers)<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The exact data and legal bases are determined by each controller and their privacy notice. Typical categories include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Identification and contact data (e.g., name, email\/phone) to operate the service<\/li>\n\n\n\n<li>Employment-related information relevant to shift management (e.g., qualifications, availability)<\/li>\n\n\n\n<li>Authentication identifiers (email\/ID provider subject) and technical logs for security<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Use of data for improvements\/AI: <\/strong>We do not use customer personal data for Koivu\u2019s own product training or marketing. Aggregated and de\u2011identified statistics may be used to operate and improve reliability and security. Any broader analytics or AI training using personal data is done only if <strong>explicitly instructed <\/strong>by the controller and covered by the DPA.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Retention: <\/strong>We retain personal data only as long as the controller instructs or as required to provide the service (including short\u2011term backups and logs). Upon contract end or instruction, data is deleted or returned per the DPA and backup cycles.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Sub\u2011processors: <\/strong>We use audited sub\u2011processors to provide the service (hosting, email delivery, identity). The current list and locations are maintained here:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sotendern Trust center page at:&nbsp;<a href=\"https:\/\/storage.googleapis.com\/koivusolutions\/trustcenter.html\">https:\/\/storage.googleapis.com\/koivusolutions\/trustcenter.html<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>International transfers: <\/strong>Production hosting is in the EU. Limited personal data (typically email address and minimal auth metadata) may be transferred to the US for transactional email (SendGrid) and authentication brokering (Google Identity Platform). Transfers rely on DPF adequacy or, if not available, SCCs + TIA as documented in our DPF records.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Security: <\/strong>We are ISO\/IEC 27001:2022 sertified; encryption in transit and at rest, access control, logging\/monitoring, backups and tested restore; incident response and customer notification processes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Your rights: <\/strong>Please contact your organization (controller). Koivu will assist the controller to answer access, correction, deletion, objection and portability requests according to GDPR and our DSAR procedure.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>3. Personal data we process as a controller (Koivu<\/strong>\u2019<strong>s own operations)<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Website &amp; Marketing<\/strong>: visitor analytics and B2B marketing contacts (legitimate interest; opt\u2011out available)<\/li>\n\n\n\n<li><strong>Support<\/strong>: messages you send to support@koivusolutions.com, contactus@koivusolutions.comor via in\u2011app forms (contract\/legitimate interest)<\/li>\n\n\n\n<li><strong>Account &amp; Billing Contacts<\/strong>: names, emails, phone numbers of customer admins for service management and invoicing (contract\/legal obligation)<\/li>\n\n\n\n<li><strong>Recruitment<\/strong>: applicants\u2019 data for hiring (consent\/legitimate interest)<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Retention: <\/strong>Per purpose\u2014e.g., support tickets 36 months, marketing contacts until opt\u2011out or inactivity, contracts and billing records retained per statutory requirements.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Your rights with Koivu as controller: <\/strong>Email support@koivusolutions.com. We will verify identityand respond per GDPR.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>4. Data recipients and transfers<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Hosting<\/strong>: Google Cloud Platform (EU regions)<\/li>\n\n\n\n<li><strong>Email delivery<\/strong>: Twilio SendGrid (US) \u2013 DPF\/SCCs<\/li>\n\n\n\n<li><strong>Authentication<\/strong>: Google Identity Platform (US) \u2013 DPF\/SCCs Additional processors may be used for monitoring, error tracking, and support tooling as listed in our Sub\u2011processor Registry.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>5. Security measures (high level)<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Encryption at rest and in transit; MFA and role\u2011based access<\/li>\n\n\n\n<li>Vulnerability management, logging\/monitoring, backups and tested restoration<\/li>\n\n\n\n<li>Incident management with customer notifications where we are processor; breach handling and registers maintained<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>6. How to make a request or complaint<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>If your data relates to a Sotender\/Koivu Cloud tenant<\/strong>, contact your organization\u2019s privacy contact (controller). Koivu will assist the controller.<\/li>\n\n\n\n<li><strong>If your request concerns Koivu<\/strong>\u2019<strong>s own operations <\/strong>(website, support, invoices), contact support@koivusolutions.com.<\/li>\n\n\n\n<li>You may lodge a complaint with the Finnish Data Protection Ombudsman.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>7. Links to detailed records and policies<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">See more at Sotender Trust Central at:&nbsp; <a href=\"https:\/\/storage.googleapis.com\/koivusolutions\/trustcenter.html\" target=\"_blank\" rel=\"noreferrer noopener\">Sotender Trust Center<\/a><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Appendix A \u2013 Short Privacy Notice Template for Controllers (for customers tolink)<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>[Organization Name] \u2013 Privacy Notice for Sotender\/Koivu Cloud<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Controller: <\/strong>[Organization legal name, address, contact]<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Processor: <\/strong>Koivu Solutions Oy, Tiedepuisto 4, A 251, 28600 Pori, Finland; support@koivusolutions.com<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">See more at Sotender Trust Central at: https:\/\/storage.googleapis.com\/koivusolutions\/trustcenter.html<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Purposes &amp; Legal Bases: <\/strong>We process personal data to manage shifts and staffing,communicate with workers, ensure compliance, secure access, and produce operationalreporting. Legal bases: performance of contract (GDPR Art. 6(1)(b)), legal obligation (e.g.,employment\/payroll), and legitimate interests (service administration and security). Specialcategories (if any) processed only where necessary and lawfully (e.g., occupational healthrestrictions) with appropriate safeguards.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Categories of data: <\/strong>identification and contact details; employment and qualification details; shiftpreferences\/availability; technical identifiers and logs for security.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Recipients: <\/strong>Koivu Solutions Oy (processor) and its sub\u2011processors for hosting, email andidentity. See Koivu\u2019s Sub\u2011processor Registry. Other recipients only where legally required ornecessary for the above purposes (e.g., payroll\/HR systems under contract).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Transfers outside EU\/EEA: <\/strong>Limited transfers to the US for transactional email and identitybrokering. Protected by the EU\u2013US DPF (or SCCs + TIA if DPF not applicable). See Koivu\u2019s DPFrecords.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Retention: <\/strong>We retain data no longer than necessary for staffing and legal requirements. Typicaloperational data is retained for [X] months after the last activity; logs [Y] days; backups perKoivu\u2019s backup cycles. Local retention details: [link to your policy].<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Your rights: <\/strong>GDPR rights of access, rectification, erasure, restriction, objection, portability.Contact: [controller contact\/email].<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Complaints: <\/strong>Finnish Data Protection Ombudsman (or your local authority).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Last updated: <\/strong>[date]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Last updated: 18 September 2025 Koivu Solutions Oy (&#8220;Koivu&#8221;, Business ID FI28695705), Tiedepuisto 4, A 251, 28600 Pori, Finland, acts primarily as a processor of personal data on behalf of our customer organizations (the controllers) that use our Sotender and Koivu Cloud services. For a few limited purposes described below (e.g., our website, support tickets, [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"_xspeed_no_cache":false,"_xspeed_expiry_hours":0,"footnotes":""},"class_list":["post-1074","page","type-page","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/sotender.io\/sv\/wp-json\/wp\/v2\/pages\/1074","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sotender.io\/sv\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/sotender.io\/sv\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/sotender.io\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sotender.io\/sv\/wp-json\/wp\/v2\/comments?post=1074"}],"version-history":[{"count":22,"href":"https:\/\/sotender.io\/sv\/wp-json\/wp\/v2\/pages\/1074\/revisions"}],"predecessor-version":[{"id":1252,"href":"https:\/\/sotender.io\/sv\/wp-json\/wp\/v2\/pages\/1074\/revisions\/1252"}],"wp:attachment":[{"href":"https:\/\/sotender.io\/sv\/wp-json\/wp\/v2\/media?parent=1074"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}