Personal data processing in Yohto, Y2 and Y3

Updated: 7.11.2026

General description and definitions

When companies and organisations use the Yohto system in their operations, personal data is processed as described here. The following definitions are used:

• "Yohto", "the System" or "the Service": the Yohto web service and mobile app, as well as the Yohto 2 (Y2) and Yohto 3 (Y3) mobile apps.
• "The Supplier" or "the Yohto company": Yohto Ab Oy (3145732-9), which provides the Service.
• "The Developer": Oy Black Label Bytes Ab (2797246-7), which carries out the technical development.
• "The Customer" or "Customers": one or more companies or organisations that order the Service from the Supplier.
• "The User" or "Users": one or more users created in the Customer's company or organisation, who use the Service according to the Customer's instructions.

Controller and processor

A Customer who uses Yohto is the controller of the personal data. Personal data is collected according to the settings made by the Customer.

The Yohto company is a processor that processes the personal data according to its agreement with the Customer.

Contact person at the Yohto company

Questions about personal data processing in the Yohto system are addressed to:

Magnus Sundell, magnus@blb.fi

Purpose of the processing

In Yohto, personal data is processed to help the Customer manage various parts of its business. Depending on the Customer's choice, this may include one or more of the following purposes:

• Customer register
• Register of employees
• Working hours follow-up
• Driving log
• Scheduling
• Payroll
• News feed

Legal basis for the processing

The Customer has made an agreement with the Yohto company on the use of Yohto, and personal data is processed in Yohto based on this agreement.

The legal basis for the processing is primarily contractual. Employees' personal data is processed based on the employment contract and the employer's instructions. The personal data of the Customer's own customers is processed based on a legitimate interest in keeping a customer register and connecting work performed to customers.

Personal data processed

Which personal data is processed depends on the Customer's choices, such as which features are activated for its organisation. Depending on those choices, the following categories of personal data may be processed in Yohto.

Customer register

• Name and contact details
• Places of business
• Business ID

Register of employees

• Name and contact details
• Language selection
• Employment details (employee number, start date, end date)
• Role and permissions in Yohto
• Group membership
• Skills

Working hours follow-up

• Date and time
• Customer or location
• Time worked and task type
• Absence details (reason, comment, time, duration)
• Additional information about the work performed

Driving log

• Date, start time and end time
• Route and distance
• Purpose of the trip

Scheduling

• Employees who are to perform the work
• Customer or place where the work is to be performed
• Date and time
• Duration and interval
• Task type

Payroll

• Personal working time percentage
• Account number
• Working time bank and hour balance

News feed

• Access to the news feed and individual news items
• Read receipts for news items

Sources of personal data

Personal data processed in the Yohto system is entered by the Customer or the Customer's Users. Personal data is not collected from other sources.

Recipients of personal data

Personal data from the Yohto system is not sold or handed over to third parties, except to the subprocessors listed below, who process it on the Yohto company's behalf.

• Hosting and email: Planeetta Internet Oy (Hostingpalvelu), Finland. It runs the server environment of the Service and sends the Service's email, such as password resets. For email, the data involved is the recipient's name and email address and the content of the message.
• Push notifications: push notifications to the Y3 app are delivered through Pusher Beams (Pusher, a Bird company), Google Firebase Cloud Messaging and Apple Push Notification service. The data involved is the device's push token, a pseudonymous employee identifier and the notification's title and text.

The Data Protection Ombudsman in Finland, as the supervisory authority, has the right to full access to information in order to inspect the Yohto company's processing of personal data.

Transfers outside the EU or EEA

Personal data is primarily processed within the EEA, on servers located in Finland. Some subprocessors may process data outside the EEA. Such transfers are based on an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework) or on the European Commission's standard contractual clauses.

Storage period

Stored personal data is reviewed once per calendar year.

• Customer register: not deleted (necessary for the System to work)
• Register of employees: names and contact details are deleted after 10 years of inactivity
• Working hours follow-up: deleted 10 years after the time entry was created
• Driving log: deleted 10 years after the trip was created
• Scheduling: deleted 10 years after the work shift was created
• Payroll: deleted 10 years after it expires
• News feed: not deleted

Right of access

A User of the Yohto system has the right to access the personal data processed about them. The User should first contact the main user in their organisation, who will forward the matter to the Yohto company.

Right to rectification

A User of the Yohto system has the right to have incorrect personal data corrected. The User should first contact the main user in their organisation, who can correct most data. If necessary, the main user forwards the matter to the Yohto company.

Right to erasure

A User of the Yohto system may have the right to have personal data erased, for example data that is not needed for the System to work or that lacks a legal basis for processing. The User should first contact the main user in their organisation. If necessary, the main user forwards the matter to the Yohto company.

Right to restriction of processing

A User who believes that their personal data is processed in a way that is not compatible with current legislation, or that the data is incorrect, should contact their main user about the matter. The User should also stop using the Yohto system until the matter is resolved.

Right to data portability

A User who wishes to obtain their personal data from Yohto should contact the main user in their organisation. The main user is responsible for retrieving the correct data and delivering it to the recipient.

Right to object

In the Yohto system, personal data is not processed on a basis that gives Users the right to object to the processing.

Automated decision-making and profiling

The Yohto system makes no automated decisions on the User's behalf and does not profile Users.

Security of the personal data

• The Yohto system is built with modern tools and on software that is continuously maintained.
• Data traffic between the mobile apps, the web application and the server is always encrypted.
• The server environment running the Yohto system is continuously updated with the latest security fixes.
• User passwords are stored encrypted, in a database behind a firewall.

Data Protection Officer

No Data Protection Officer has been appointed for the Service. In matters concerning data protection or the processing of personal data, contact:

Magnus Sundell, magnus@blb.fi