Privacy statement
How we process personal data in Kelomo and on the marketing site. A data processing agreement (DPA) and a sub-processor list are also available for procurement.
Controller
Updated 11 September 2026.
Tohmoco Oy (business ID 3387948-8), Viipurinkatu 12 L 246, 00510 Helsinki. Tohmoco Oy provides the Kelomo service. For privacy matters, contact: info@tohmoco.fi.
No data protection officer has been appointed.
Our role: processor or controller
In the customer application we process the employer’s workforce data as a processor on behalf of the employer (the controller) and according to its instructions. The data processing agreement (DPA) concluded with the customer then applies.
For customers’ contact persons and visitors to the marketing site we act as the controller ourselves, for contract administration, communication and developing the service.
What data we process and on what basis
Data processed in the customer application includes identification and contact details, employment and working-time data, shifts, absences and pay and reimbursement data – as well as, if those features are taken into use, clock-in and location data. The employer, as the controller, is responsible for the legal basis of the processing.
In our own role as controller we process contact persons’ data on the basis of performance of the contract (GDPR 6.1 b), legal obligations such as accounting (6.1 c) and legitimate interest (6.1 f, e.g. the service’s information security and customer communication).
Storage and location
The service’s data is kept in Finland (the database and the application infrastructure in Hetzner’s Helsinki data centre). Some sub-processors – payment processing and optional AI features – may process data outside the EU/EEA, in which case the transfer is safeguarded with the Commission’s standard contractual clauses (SCC).
Retention periods are determined by the purpose and legislation: contact persons’ data for the duration of the contract and at most 24 months after it ends, accounting material in accordance with the Accounting Act. The customer’s workforce data is returned or deleted in accordance with the DPA when the contract ends, taking mandatory retention obligations (e.g. working-time records) into account.
Sub-processors and disclosures
We use sub-processors to provide the service (e.g. database and server infrastructure, payment processing and sending notifications). We do not sell personal data. The current sub-processor list and data processing agreement (DPA) can be read below.
Microsoft and Google accounts: sign-in and connections
You can sign in to Kelomo with your Microsoft or Google account and connect your Microsoft 365 or Google calendar to draft your working day. A salesperson can also connect their own Microsoft 365 mailbox for customer correspondence. Each connection is separate: you grant each one its own permission in the identity service, and you can revoke it in your own settings.
For sign-in we ask Microsoft or Google for your basic profile: name, email address and account identifier. We store the account’s permanent identifier, the email address, the account’s organisation identifier, whether the service verified the address, and the time of linking and last use. Your name is shown only when you confirm the link, and your profile picture stays with the identity service. We use this data solely to sign you in and identify your Kelomo account. The identity service sees that you signed in to Kelomo and applies its own policies, such as multi-factor authentication.
The calendar connection reads the times, durations and type of events in your calendar to draft your working day. We store only the times. Titles, descriptions, locations and attendees stay in your calendar, and events marked private are skipped. If you enable the destination-country hint for trip suggestions, a country code is derived from the event title and stored without the title. The connection’s authorisation is stored encrypted in Finland. When you disconnect, the authorisation and the stored times are deleted immediately.
Microsoft 365 mail reads changes in the Inbox and Sent Items folders. We store only messages whose sender or recipient is a contact or lead in the organisation’s CRM; nothing is recorded from the rest of the mailbox. Disconnecting removes the authorisation immediately. Messages already recorded are the organisation’s CRM data and are kept under its rules.
Microsoft and Google are not Kelomo’s sub-processors: we use your own or your organisation’s account and agreement with them. Data obtained through these connections is used only for the purposes described above. It is not disclosed to third parties, used for advertising or used to train AI models, and Kelomo staff read it only at your request in a support case or for security reasons. Kelomo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We protect data obtained through these connections in the same way as the rest of the service’s data. Transfers between Google or Microsoft and Kelomo, and between your browser and Kelomo, are encrypted with TLS. Connection authorisations are stored in the database encrypted with AES-256-GCM under a key kept separate from the database. The database is located in Finland, and each organisation’s data is isolated from other organisations with row-level access control in the database. Access to production systems is limited to named administrators with personal credentials, and connecting and disconnecting are recorded in the organisation’s event log. Times stored from your calendar are deleted when you disconnect, and at the latest when the organisation’s agreement ends.
You can revoke a link or connection in your own settings under Sign-in methods, Calendar connection and Microsoft 365 mail. You can also revoke Kelomo’s access directly in your account: for a Google account at myaccount.google.com/permissions, for a Microsoft account in the account’s app permissions. Kelomo notices the revocation on the next use. Removing a sign-in link does not delete your Kelomo account or your working-time data; the retention periods described above apply to them.
Cookies
We use only cookies essential to the operation and no third-party advertising or tracking cookies.
Your rights
You have the right to access your data, request rectification, erasure or restriction of processing, object to processing and have your data ported. For the customer application, requests are directed primarily to the employer as the controller, and we assist with this in accordance with the DPA. You also have the right to lodge a complaint with the supervisory authority (the Office of the Data Protection Ombudsman, tietosuoja.fi).
The steps, retention periods and ways to request deletion of an account and its data are described on their own page.
Want your account and data deleted?
A Kelomo account is managed by your employer. See how to request deletion, what is deleted, and what has to be kept by law.