Privacy policy

1. Controller

Zimple Oy (3095157-9), Finland (“Zimple”)

2. Data protection officer

Juho Koski

support@zimple.fi

3. Purpose of policy

3.1. This privacy policy explains how Zimple processes the personal data of representatives of customers and prospects, as well as the personal data of persons visiting the website and social media channels, and of the persons sending messages via forms or other means, and of persons who are users of Zimple’s services, applications or other software. In this policy, each such person is defined as a “person”.

3.2. Provision of personal data to Zimple is voluntary. If Zimple does not have the personal data it needs, Zimple might not however be able to cooperate with the customer or prospect as intended or to respond to the person’s questions.


3.3. Zimple and its customer may also have entered into a data processing agreement regarding the processing of the customer’s personal data in the provision of Zimple's services, in which case Zimple acts as the processor and the customer as the controller of the personal data. In such cases, the terms of the data processing agreement take precedence over this privacy policy, and the person shall contact the person’s employer or other organization regarding the person’s personal data.

4. Personal data and categories of data subjects

4.1. ”Personal data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

4.2. All of the following information might not actually be personal data. For example, if the information only identifies a company, such as Zimple’s customer company, the information is not personal data.

4.3. The register contains the following information:

  1. name;
  2. person’s role in organization;
  3. address, phone number and/or email address;
  4. possibly other contact information;
  5. employer or other oganization;
  6. language;
  7. information necessary for billing purposes;
  8. interests (as defined by the person, and marketing preferences)
  9. questions and contact requests addressed to Zimple;
  10. information on browsing on the Zimple websites; and
  11. information collected by cookies potentially containing personal data.

5. Purposes of processing and legal basis for processing

5.1. Personal data is used for the following purposes:

  1. Offering Zimple's products and services, fulfilling contractual obligations or in order to take steps prior to entering into a contract, and exercising Zimple's contractual rights. The legal basis for the processing of personal data for this purpose is Zimple’s legitimate interest.
  2. Creating statistics and analyses on the use of Zimple's website, social media channels, products and services, as well as the development of Zimple's products, services and business. The legal basis for the processing of personal data for this purpose is Zimple’s legitimate interest. Once this personal data is anonymized, it no longer constitutes personal data.
  3. Taking care of data security. The legal basis for the processing of personal data for this purpose is Zimple’s legal obligation.
  4. Preventing fraud. The legal basis for the processing of personal data for this purpose is Zimple’s legal obligation.
  5. For managing the customer relationship as well as for administration and management of possible reclamations. The legal basis for the processing of personal data for this purpose is Zimple’s legitimate interest.
  6. Marketing and direct marketing of Zimple's products and services, as well as providing information on Zimple's products and services, delivering newsletters, invitations and bulletins, producing and targeting targeted advertising, communications and content, and optimizing marketing activities. When consent is required for these actions according to the legislation, consent is the legal basis for the processing personal data for this purpose. If the legislation does not require consent for these actions, the legal basis for the processing of personal data for these purposes is Zimple’s legitimate interest.

5.2.The legal basis for the processing of personal data:

  1. To the extent stated in section 5.1, the legal basis for the processing is the consent given by the person for the processing of personal data. When processing is based on the person's consent, the person has the right to withdraw the consent. However, the withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal.
  2. To the extent stated in section 5.1, the legal basis for the processing is Zimple's legal obligation.
  3. To the extent stated in section 5.1, the legal basis for the processing is Zimple’s legitimate interest. Zimple has conducted a balance test regarding its legitimate interests. The legitimate interests may include, for example, a customer relationship or other processing that the person can reasonably expect, and the interests or fundamental rights and freedoms of the person requiring protection of personal data do not override such legitimate interests. It is typical that businesses and organizations market their services and products. The interests and fundamental rights and freedoms of persons are respected, specific categories of personal data are not processed, and persons can reasonably expect such processing.

6. Sources of personal data

  1. From the person.
  2. From the person’s organization.
  3. From marketing data sources.
  4. From third parties mentioned in section 7.
  5. Personal data possibly collected by cookies.

7. Recipients of personal data

  1. Regular recipients of personal data are:
  2. Service providers who process personal data to provide services to Zimple. Further information on the service providers is available in Appendix 1.
  3. Personal data possibly collected by cookies according to the cookie-related information on Zimple's websites.

8. Transfer of personal data to third countries

8.1. The service providers used by Zimple could transfer personal data to countries outside the European Economic Area (EEA) or the European Union (EU) (”Third Countries”).

8.2. The legal basis for the transfer of the personal data to Third Countries are the Binding Corporate Rules, the European Commission’s Standard Contractual Clauses for the transfer of personal data to processors established in third countries (“Standard Contractual Clauses”), the EU-U.S. Data Privacy Framework, the European Commission’s decision on adequate level of data protection of another country, alternative data export mechanisms for the lawful transfer of personal data (as recognized under EU data protection laws) or another legal basis. The Standard Contractual Clauses are available here. Further information is also available in Appendix 1 (links to service providers’ terms and conditions).

9. Period for which personal data will be stored

9.1. The retention period of personal data depends on the type of the personal data and on the legal basis for the processing. For example, the personal data of representatives of current and former contractual partners are processed as long as necessary to verify and fulfill the responsibilities and obligations between the parties, if the processing of the personal data is necessary for this purpose. Pursuant to Finnish legislation, the main rule for expiry of debt is three (3) years.

9.2. Information on requests from data subjects and the implementation of data subjects' rights may be retained for a longer statutory retention period for the purpose of fulfillment and verifying the fulfillment of data subjects' rights.

9.3. The personal data is processed for longer than the above-mentioned time periods, if the personal data in question is necessary for the establishment, exercise or defence of legal claims.

10. Principles of data security

Zimple has implemented appropriate technical and organizational measures to protect the processing of personal data. Zimple uses its own and its service providers’ tools, such as firewalls, encryption technologies, passwords and antivirus software, in order to prevent unauthorized access to personal data.

11. Right of access

11.1 The person has the right to obtain from Zimple confirmation as to whether or not personal data concerning him or her is being processed by Zimple.

11.2. Where such personal data is being processed by Zimple, Zimple shall provide the person with a copy of the personal data and the following information:

  1. the purposes of the processing;
  2. the categories of personal data concerned;
  3. the recipients or categories of personal data, in particular recipients in Third Countries or international organizations;
  4. where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
  5. the existence of the right to request from Zimple rectification or erasure of personal data or restriction of processing of personal data concerning the person or to object to such processing;
  6. the right to lodge a complaint with a supervisory authority;
  7. available information on the source the personal data;
  8. the existence of automated decision-making, including profiling and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the person;
  9. where personal data is transferred to Third Countries or to international organizations, information on the appropriate safeguards.

11.3. For any further copies requested by the person, Zimple may charge a reasonable fee based on administrative costs.

12. Right to Rectification

The person shall have the right to obtain from Zimple without undue delay the rectification of inaccurate personal data concerning the person. Taking into account the purposes of the processing, the person shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

13. Right to erasure

13.1. Zimple erases the personal data concerning the person upon the person’s request where one of the following grounds applies:

  1. the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
  2. the person withdraws the consent on which the processing is based;
  3. the person objects to the processing and there are no overriding legitimate grounds for the processing;
  4. the personal data has been unlawfully processed;
  5. the personal data has to be erased for compliance with a legal obligation in applicable law to which Zimple is subject;
  6. the personal data has been collected in relation to the offer of information society service.

13.2. However, Zimple has no obligation to erase personal data to the extent the processing is necessary:

  1. for exercising the right of freedom of expression and information;
  2. to comply with a legal obligation requiring the processing;
  3. for archiving purposes in the public interest, or for scientific or historical research purposes or statistical purposes; or
  4. for the establishment, exercise or defence of legal claims.

14. Right to restriction of processing

14.1. ”Restriction of processing” means the marking of stored personal data with the aim of limiting its processing.

14.2. The person has the right to obtain from Zimple restriction of processing where one of the following applies:

  1. the accuracy of the personal data is contested by the person, for a period enabling Zimple to verify the accuracy of the personal data;
  2. the processing is unlawful and the person opposes the erasure of the personal data and requests the restriction of its use instead;
  3. Zimple no longer needs the personal data for the purposes of the processing, but the personal data is required by the person for the establishment, exercise or defence of legal claims;
  4. the person has objected to processing pending the verification whether the legitimate grounds of Zimple override those of the person.

14.3. In the aforementioned situations, Zimple processes the personal data only in the following circumstances:

  1. based on the person’s consent;
  2. for the establishment, exercise, or defense of legal claims;
  3. for the protection of another person’s rights; or
  4. for reasons of public interest of the European Union or a European Union member state.

15. Right to object

The person has the right to object, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her where the processing is based on either of the following legal basis: (i) the processing is necessary for the performance of a task carried out in the public interest or (ii) the processing is necessary for the purposes of the legitimate interests pursued by Zimple or by a third party. Zimple shall no longer process the personal data unless Zimple demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the person, or unless Zimple needs to process the personal data for the establishment, exercise or defence of legal claims.

16. Right to data portability

At the person’s request, if Zimple processes the personal data based on the person’s consent or based on a contract with the person and if the processing is carried out by automated means:

  1. Zimple shall provide the person with the personal data which he or she has provided to Zimple, in a structured, commonly used and machine-readable format; and
  2. if technically feasible, Zimple shall transmit the personal data in the same format directly to another controller.

17. Right to lodge complain with supervisory authority

If the person believes that Zimple’s processing of personal data infringes regulatory data protection requirements, the person may lodge a complaint with the supervisory authority. The contact details of the Finnish supervisory authority can be found here:

https://tietosuoja.fi/en/office-of-the-data-protection-ombudsman

18. Automated decision-making

Zimple is not using automated decision-making meant in the General Data Protection Regulation (GDPR).

APPENDIX 1 SERVICE PROVIDERS

Pipedrive

https://www-cms.pipedriveassets.com/documents/Data-Processing-Addendum-Aug_2024-for-signature.pdf

Google (cloud)

https://cloud.google.com/terms/data-processing-addendum