Privacy Policy

1. Data controller

JL Screen Oy
Business ID: 3511210-9
Address: Ratamotie 1 B 12, 02620 Espoo, Finland
Email: info@alarmi.fi · info@jlscreen.fi
Phone: +358 45 124 0240

Data protection contact: info@alarmi.fi.

2. What data we process

• User accounts (customer staff): name, email, phone, role, language, login times/events, IP address.
• Residents: name, email, phone, apartment, language, move-in/out dates. Entered by the customer organization.
• Property & device data: properties, buildings, apartments, smoke alarms, tests, fault reports, and attached photos/documents.
• Communications: sent emails and their status, contact-form messages.
• Logs: audit log (who did what and when), technical logs, IP address and browser data.
• Order & billing data: chosen plan, business ID, billing address or e-invoice address and operator, billing reference. Billing is by invoice or e-invoice, we do not process or store payment-card data.
• Business contacts (B2B marketing): name, role, work email, organization, source of the data and the dates of contact (see section 3).

3. Purpose and legal basis

JL Screen Oy acts in two different roles depending on whose data is concerned.

JL Screen Oy as controller

For our own purposes we process the customer organization's staff user accounts, order and billing data, logs, contact-form messages, and business contacts' data for B2B marketing:

Contacting companies and their representatives (B2B marketing)

• Purpose: presenting the Alarmi service to property management companies and other organizations whose work the service relates to.
• Legal basis: legitimate interest (GDPR 6.1 f).
• Data: name, role, work email, organization, source of the data and the dates of contact.
• Sources: public business directories (e.g. Hae isännöintiä) and the organization's own website.
• Retention: up to 12 months from the last contact, unless a customer relationship begins. If you opt out of marketing, we keep only your email address and the date of the opt-out, so that the opt-out can be honoured.
• Opting out: you can opt out of marketing at any time by replying to the message or by writing to info@alarmi.fi. The opt-out takes effect without delay.

JL Screen Oy as processor (resident data)

For resident data, the controller is the customer organization (housing company or property manager), which determines the purposes and legal bases of the processing, typically fulfilling its obligations under the Finnish Rescue Act and its legitimate interest (e.g. sending test and fault reminders to residents). JL Screen Oy acts as a processor and processes resident data only on the customer's behalf and instructions. The processing terms required by GDPR Article 28 are included in the Terms of Service, section "Processing of personal data (DPA)", which the Customer accepts on registration. No separate agreement is needed. As controller, the customer organization is responsible for informing residents (GDPR Articles 13 and 14).

We do not carry out automated decision-making or profiling.

4. Retention

• Account and service data are kept for the duration of the contract.
• Audit logs are kept per the organization's setting (default 2 years).
• Accounting/billing records are kept per Finnish accounting law (6 years after the financial year).
• Business contacts' data (B2B marketing) is kept for up to 12 months from the last contact, unless a customer relationship begins. After an opt-out we keep only the email address and the date of the opt-out.
• Deleted data remains in the daily backups for up to 14 days, after which it is removed from them too.
• Data is deleted or anonymized once the basis for retention ends.

5. Recipients and processors

We use trusted sub-processors that process data on our behalf under a data processing agreement:

• Suomen Hostingpalvelu Oy (Finland), servers and database. Data stored within the EU/EEA.
• Resend, Inc. (United States), sending the service's emails (test reminders, fault reports, invitations, login codes). The content of sent messages and their delivery data (recipient, time, delivery status) are stored in the United States. The transfer is based on the EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses (SCCs), see section 6.
• Google Ireland Ltd. (Google Workspace, Ireland), company email (including B2B contacts) and documents.

We do not sell personal data, and we do not use the service's user or resident data for marketing. Data may be disclosed to authorities where required by law.

6. Transfers outside the EU/EEA

The server and database are within the EU/EEA. The service's emails are sent through Resend, Inc., a US company, and the content of sent messages and their delivery data are stored in the United States. The transfer is based on the EU-US Data Privacy Framework, which Resend has joined, and on the European Commission's Standard Contractual Clauses (SCCs) included in Resend's data processing agreement. Google Ireland Ltd.'s parent company is a US company. For Google, any transfers are safeguarded in the same way (SCCs and the Data Privacy Framework).

7. Your rights

• Right of access to your data
• Right to rectification and erasure
• Right to restriction of and objection to processing
• Right to opt out of direct marketing at any time (see section 3)
• Right to data portability
• Right to withdraw consent (where processing is based on consent)
• Right to lodge a complaint with a supervisory authority

To exercise your rights, contact info@alarmi.fi. If you are a resident, you may also contact your housing company/property manager, who is the controller of your data.

Account and data deletion: the organization's administrator can request permanent deletion of the entire account and its data by emailing info@alarmi.fi. Deletion is carried out within 30 days of the request and confirmed by email. Deleted data remains in the daily backups for up to 14 days, after which it cannot be recovered.

8. Cookies

We use only cookies strictly necessary for the service to function (such as session and login cookies). We do not use marketing tracking cookies.

The session notes the first page of your visit, the referring page and any campaign tags (utm). If you create an account, they are added to the sign-up notice so that we know where customers find the service (legitimate interest, 6.1 f). Otherwise they disappear with the session.

9. Security

Data is protected with encrypted connections (HTTPS), per-organization access control and roles, passwordless login (a one-time email code, we store no passwords), audit logging, and login-attempt rate limiting. Files are served only to authorized users and are stored outside direct web access.

10. Data location and backups

The application and database are hosted within the EU/EEA by a Finnish provider. Data is backed up daily, and backups are kept for up to 14 days within the EU/EEA. The service's email is sent via Resend, and the data of sent messages is stored in the United States (see sections 5 and 6).

11. Right to complain

You have the right to lodge a complaint with the data protection authority:
Office of the Data Protection Ombudsman, P.O. Box 800, 00531 Helsinki, Finland, tietosuoja.fi

12. Changes

We may update this policy. The current version is always available at alarmi.fi/tietosuojaseloste.