Your company is the controller, Kelomo (Tohmoco Oy) is the processor. A data subject’s request is therefore addressed to the employer.
Kelomo does not answer a data subject’s request on your behalf. If the request comes directly to Kelomo, it is directed to the controller and is not answered.
Answer an access request
An access request (GDPR Articles 15 and 20) is handled from the person card. Open the person’s Data protection section and choose DSAR (JSON) or DSAR (PDF). The section says what it is about: “The data subject’s right of access (GDPR art. 15/20): the full personal-data package.”
The action is available to the administrator only. It also works for an ongoing employment – the request does not have to wait until the employment ends.
The retention windows
Settings → Data lifecycle (GDPR) is the administrator’s page. The page says: “Personal data from ended employments is erased in stages, respecting statutory retention periods. Nothing is erased without confirmation.”
There are five data classes. The default window is counted from the end of the employment.
| Class | Default | Adjustable |
|---|---|---|
| Profile | 6 months | yes |
| Case notes | 24 months | yes |
| Development data | 24 months | yes |
| Identity data | 24 months | no – the Working Hours Act, section 32 |
| HR documents | 120 months | no – 10 years |
The workspace’s own values are limited to the statutory minimum: a value shorter than the law does not take effect, even if the setting lets you type the number.
The erasure queue
The queue proposes what to erase, the administrator confirms. There is no automatic erasure: data is erased only after confirmation.
An erasure request does not override the retention obligation
Working-time bookkeeping may not be destroyed. That is why identity data is pseudonymised, not destroyed: the membership is repointed to a stub user (Entinen työntekijä), and the working-time rows remain intact. The person is no longer identifiable.
The basis is the Working Hours Act, section 32, together with the time limit for bringing a claim: the Working Hours Act, section 40, gives two years from the end of the calendar year in which the right arose. An employee’s claim must remain verifiable after the employment as well, so the rows cannot be deleted on request.
When the contract ends
When the contract with Kelomo ends, the data is returned or erased within 90 days, taking mandatory retention obligations into account.
The controller’s checklist
These are the controller’s responsibility:
- a privacy notice for the staff
- the legal basis for the processing
- a record of processing activities (Article 30)
- a data protection impact assessment (DPIA) if you enable punching with location
The same list is in the last step of the setup wizard – see Setup for administrators.
If something goes wrong
| Situation | What you see | What you do |
|---|---|---|
| An employee asked Kelomo directly for their data | The request is directed to you | The answer is the controller’s. Run DSAR (PDF) or DSAR (JSON) and deliver it. |
| An employee demands the erasure of all their data | Identity data is not erased | Working-time bookkeeping must be retained. Explain that the data is pseudonymised at the end of the retention period. |
| The DSAR buttons are not visible | The person card’s Data protection section is missing | The action is available to the administrator only. Ask the administrator to run the package. |
| You want to shorten the identity-data window | The value will not go below the minimum | Identity data and HR documents are not adjustable. The law sets the floor. |
| Nothing has been erased even though the time has passed | The queue proposes erasures | There is no automatic erasure. Go through the queue and confirm. |