Privacy statement
How we process personal data in Kelomo and on the marketing site. A data processing agreement (DPA) and a sub-processor list are also available for procurement.
Controller
Tohmoco Oy (business ID 3387948-8), Viipurinkatu 12 L 246, 00510 Helsinki. Tohmoco Oy provides the Kelomo service. For privacy matters, contact: info@tohmoco.fi.
No separate data protection officer (DPO) has been appointed unless required by law.
Our role: processor or controller
In the customer application we process the employer’s workforce data as a processor on behalf of the employer (the controller) and according to its instructions. The data processing agreement (DPA) concluded with the customer then applies.
For customers’ contact persons and visitors to the marketing site we act as the controller ourselves, for contract administration, communication and developing the service.
What data we process and on what basis
Data processed in the customer application includes identification and contact details, employment and working-time data, shifts, absences and pay and reimbursement data – as well as, if those features are taken into use, clock-in and location data. The employer, as the controller, is responsible for the legal basis of the processing.
In our own role as controller we process contact persons’ data on the basis of performance of the contract (GDPR 6.1 b), legal obligations such as accounting (6.1 c) and legitimate interest (6.1 f, e.g. the service’s information security and customer communication).
Storage and location
The service’s data is kept in Finland (the database and the application infrastructure in Hetzner’s Helsinki data centre). Some sub-processors – payment processing and optional AI features – may process data outside the EU/EEA, in which case the transfer is safeguarded with the Commission’s standard contractual clauses (SCC).
Retention periods are determined by the purpose and legislation: contact persons’ data for the duration of the contract and at most 24 months after it ends, accounting material in accordance with the Accounting Act. The customer’s workforce data is returned or deleted in accordance with the DPA when the contract ends, taking mandatory retention obligations (e.g. working-time records) into account.
Sub-processors and disclosures
We use sub-processors to provide the service (e.g. database and server infrastructure, payment processing and sending notifications). We do not sell personal data. An up-to-date sub-processor list and the data processing agreement (DPA) are provided in connection with procurement.
Cookies
We use only cookies essential to the operation and no third-party advertising or tracking cookies. Read more in the cookie policy.
Your rights
You have the right to access your data, request rectification, erasure or restriction of processing, object to processing and have your data ported. For the customer application, requests are directed primarily to the employer as the controller, and we assist with this in accordance with the DPA. You also have the right to lodge a complaint with the supervisory authority (the Office of the Data Protection Ombudsman, tietosuoja.fi).
The steps, retention periods and ways to request deletion of an account and its data are described on their own page.
Want your account and data deleted?
A Kelomo account is managed by your employer. See how to request deletion, what is deleted, and what has to be kept by law.