Privacy Policy

 

 

 

 

 

 

 

 

 

 

 

All data that will be processed by Viima as either the Data Controller, or Data Processor, will be based on one or more of the lawful grounds for processing personal data according to Article 6.1 of the GDPR. Whenever feasible and reasonable, we always seek to acquire explicit consent from the data subject for most purposes, such as marketing or other communication. We also seek consent for each purpose separately, whenever feasible but do occasionally process data according to our legitimate interests, for example by performing actions aimed to grow the business, such as direct marketing, in which case you shall always have right to opt-out at any time by simply contacting our Data Protection Officer or via other applicable means.

 

 

We honor the data subjects’ rights and shall comply with relevant legislation as both as a Data Processor (for any data we Process on behalf of a Data Controller) and Data Controller (any data for which our Customers are the Data Controller for).

As a Data Subject, you shall have the following rights, except where otherwise determined by Applicable Law: to “be forgotten” (via deletion or pseudonymization), to have your personal data corrected or updated, to data portability and to receive a copy of the data being processed, to object to processing and collection of your personal data and to withdraw your consent at any time, as well as to lodge a complaint with the supervisory authority.

Whenever you withdraw consent, you acknowledge and accept that this may have a negative influence on the quality of the Site and/or Services as well as may cause the impossibility of access to certain Services. You further agree that Viima shall not be held liable with respect to any loss and/or damage to Your personal data. 

If you are a Data Subject looking to exercise your rights under this section (Data Subject Access Rights Procedure), you should notice that your personal data in the Viima App (Service) is usually owned and controlled by our Customers as Data Controllers. In practice, this means that we have no right to provide you with access to your data, or otherwise respond to your requests as we can only act on requests directly from the Data Controller. Thus, you should usually contact the Data Controller instead of us to exercise your rights as a data subject.

However, if you do want to exercise your rights under this section related to the data that we control regarding you, you should send a written request to dpo@viima.com. Prior to us being able to let you exercise your rights, you must verify your identity in order for us to ensure that your rights can’t be exercised, and your data be accessed, by another party. If your request is valid, we are the Data Controller for the said data, and you have successfully identified yourself, we shall comply with your request without unnecessary delay, typically within a month, unless there are legal, accounting, reporting or practical obstructions to your request, in which case we shall let you know of these obstructions in the same timeframe.

For our Customers, if you are the Data Processor and shall receive these kinds of requests from your data subjects, you are free to use our APIs to proceed with the request. For requests that require manual action from us, please submit your request to dpo@viima.com in writing and provide us with proof your authority to act on behalf of the Customer, as well as the original request by the Customer along with any and all information required to identify and prove that the request originates from said Data Subject. We shall seek to comply to you request without unnecessary delays, typically within the same one-month time period, unless there are legal, accounting, reporting or practical obstructions to your request, in which case we shall let you know of these obstructions within the same time period. Please note that this work is generally not part of any of our plans or contracts and we shall thus invoice you based on the hourly price from our mutual Agreement (or Terms of Use in case there isn’t a separate Agreement) and the realized number of hours required to fulfill the request.

 

To honor our commitments to data portability, we offer APIs for our Users and Customers that provide them self-service possibilities for exercising many of the aforementioned rights. Should the requests need Viima to deliver data in some formats, the used formats shall be a commonly used, structured and machine-readable format, such as JSON or CSV, which shall generally also be the formats supported by our APIs.

 

You also have the right to opt out of receiving electronic direct marketing communications from us: To opt out of all electronic direct marketing communications (such as email or SMS-messages) that you may receive from us, please adjust your notification settings by clicking on the link in the footer of any marketing email you’ve received from us, or by contacting us at dpo@viima.com.

 

Please note that certain Service and/or Site related email communication is mandatory for our Customers, such as communication related to billing and other transactions, as well as those related to certain actions performed by the user, such as password reset request. For other notifications from the Service, please adjust the notification settings of the relevant Service. If you have any concern about your privacy, you are kindly requested to forward an email to us at dpo@viima.com containing a detailed description of concerns. Viima will do its best to resolve such issues within a reasonable time and without unnecessary delay.

With respect to the retention of data in our Services, we seek not to keep or process data any longer than necessary to fulfill our obligations towards our Customers and other stakeholders. As a general rule of thumb, data is stored until Customer cancels their plan and up to a maximum of 12 months after that for customer service and backup purposes. If a User requests to delete their account, or exercise their rights related to Personal Data, their data can either be deleted or pseudonymized (for example if deletion would lead to loss of other data) to fulfill their right to be forgotten. Backups, which may contain otherwise deleted data, are kept for a maximum of 12 months. These policies are subject to exceptions due to obligations in areas such as legal, reporting and audit.

We currently store and process all of the data for our Service inside the European Union and are taking measures to keep the situation that way also in the future.  This also applies to the Sub-Processors we use as technical modules, infrastructure components or other parts of the Service. However, certain Sub-Processors of ours which are not directly related to the use of the Service, but to credit card payments and our marketing/CRM solutions have operations also outside of the European Union and, depending on the situation, may transfer data outside of the European Union. In these situations, we have binding agreements with our Sub-Processors to ensure they have taken appropriate measures to ensure an adequate level of protection for the data as described in the EU Data Protection Directive and other applicable legislation, such as the General Data Protection Regulation. We include a list of Sub-Processors used to provide the Service in our Data Protection Agreement and are also glad to provide you with a list of our current Sub-Processors for both the Service and the Site, as well as more details on the transfers being made upon a request to our Data Protection Officer.

 

We also reserve the right for the Service and/or the Site, or some elements of them, to be hosted on servers located in countries outside the European Union or European Economic Area. In this case, appropriate measures shall be taken to ensure the privacy, security and confidentiality of your data as described in appropriate legislation. However, the laws applicable to the protection of personal data in such countries may be different from those applicable in your home country. By using the Service and/or the Site, you consent to personal data about you being transferred outside the European Union.