General description and definitions

When companies and organizations use the Yohto system in their operations, personal data is processed according to this description.
In this description, the following definitions are used:
“Yohto”, “System” or “Service”: refers to the Yohto web service and mobile app
“The supplier” or the “Yohto company”: the company Yohto Ab Oy (F-number) which provides the Service
“The customer” alt. “Customers”: one or more companies/organizations that order the Service from the Supplier
“The user” alt. “User”: one or more users created in the Customer’s company or organization, who use the Service according to the Customer’s instructions

Organization responsible for personal data

A customer who uses Yohto constitutes a so-called personal data controller. Personal data is collected according to settings made by the customer.
The Yohto company is a personal data processor that processes the personal data according to an agreement made with the customer.

Responsible person at the Yohto company

Questions about personal data processing in the Yohto system are addressed to:
Magnus Sundell
magnus@yohto.fi

Purpose of the personal data processing

In Yohto, personal data is processed to help the customer with various parts of the management of the business. Depending on the customer’s choice, this may include one or more of the following purposes:
Customer register
Register of employees
Working hours follow-up
Driving diary
Scheduling
Payroll
News feed

Legal basis for the processing

The customer has made an agreement with the Yohto company regarding the use of Yohto. Personal data is processed in Yohto based on this agreement.
The legal basis for the customer’s personal data processing by Yohto is primarily based on agreements. Processing of employees’ personal data is based on an employment contract and the employer’s instructions. Processing of customers’ personal data is based on a legitimate interest in maintaining a customer register and being able to connect work performed to customers.

Personal data processed

The following categories of personal data are processed in Yohto.
Customer register
Name and contact details
Places of business
F number
Register of employees
Name and contact details
Language selection
Information on employment relationship (employment number, start date, end date)
Role and permissions in Yohto
Group division
Skills
Working hours follow-up
Date and time
Customer / location
Time worked and task type
Information about the absence (reason, comment, time, duration)
Additional information about work performed
Driving diary
Date, start time, end time
Route and distance
Purpose of the trip
Scheduling
Employees who must perform work
Customer/place where the work is to be performed
Date and time
Duration and execution interval
Task type
Payroll
Personal working time percentage
Account number
Working time bank and hourly balance
News feed
Access to news feed and various news
Reading receipt on news

Sources for the collection of personal data

Personal data processed in the Yohto system is entered by the customer or the customer’s user. Personal data is not collected from other sources.

Transfer and recipient of personal data

Personal data from the Yohto system is not transferred to third parties.
The Data Ombudsman in Finland, as a supervisory authority, has the right to have full access to information in order to carry out an inspection of the Yohto company’s personal data processing.

Transfer outside the EU or ETA area

The Yohto company performs all personal data processing within the ETA area, on servers that are physically located in Finland. No personal data is conveyed outside the ETA area.
Personal data storage period

A review of stored personal data is carried out once per calendar year.
Customer register
Will not be deleted (necessary for system operation)
Register of employees
Names and contact details are deleted after 10 years of inactivity
Working hours follow-up
Information is deleted 10 years after the creation of the time registration
Driving diary
Information is deleted 10 years after the creation of the drive
Scheduling
Information is deleted 10 years after the creation of the work pass
Payroll
Information is deleted 10 years after its expiry
News feed
Not deleted

Registered right to access and transparency

A user of the Yohto system has the right to gain access to and insight into the personal data processed about him. In the first instance, the user should contact the main user in their organization, who will forward the matter to the Yohto company.

Registered right to correction

A user of the Yohto system has the right to correct incorrect personal data. In the first instance, the user should contact the main user in their organization, who can correct data to a large extent. If necessary, the main user forwards the case to the Yohto company for action.

Registered right to erasure

A user of the Yohto system may have the right to delete personal data, e.g. if these are not needed for the functioning of the system or which lack a legal basis for processing. In the first instance, the user should contact the main user in their organization, who can correct data to a large extent. If necessary, the main user forwards the case to the Yohto company for action.

The right to restriction of processing was registered

If a user believes that their personal data is being processed in a way that is not compatible with current legislation, or that the information is incorrect, they should contact their main user and notify them of their case. At the same time, the user should immediately stop using the Yohto system until the matter is resolved.

Registered right to data portability

If a user in Yohto wishes to extract their personal data, they should contact the main user in their organization to gain access to the data. The main user is responsible for correct user information being retrieved and conveyed to the recipient.

Registered right to object to processing

In the Yohto system, personal data is not processed on such a basis that allows users to have the right to object to the processing of the data.

Automatic decision making / profiling

The Yohto system does not include any features that make automatic decision-making on the user’s behalf. There is also no function that profiles the users.

Protection principles for the personal data and the register

The Yohto system is built with modern tools and based on software that is continuously maintained.

Data traffic between mobile application, web application and server is always encrypted.

The server environment running the Yohto system is continuously updated with the latest security improvements.

User passwords are stored encrypted in the database behind a firewall and password protected.

Data Protection Officer

No Data Protection Officer has been appointed for the Yohto Service. In matters concerning data protection or personal data processing, contact:

Magnus Sundell

magnus@yohto.fi