QOCO Services Privacy Policy

The processing is based on the legitimate interests of QOCO Systems. Such interests include managing the services, ensuring that only authorized users have access to the services, preventing misuse of the services and analyzing how users interact with the services in order to make them better fit the needs of our users. Some of the processing related to service analytics is based on consent.

Providing personal data is required in order to use the service as the user accounts are personal. QOCO Systems does not use personal for profiling or for making automated decisions with significant effects as referred to in Article 22 of the General Data Protection Regulation.

2 CATEGORIES OF PERSONAL DATA

QOCO Systems processes personal data of the users who have access to our services.

The categories of personal data can be grouped as described below. Some data may differ from service to service or depend on how the users or their employers are using the
services.

• User account data, such as name, email address, company, user certifications
• Technical usage data, such as log data about the use of the services, IP address, device and browser type
• Analytics data, such as data about how the users have used the services (analytics data does not usually directly identify the user, but as it may be possible to identify users by combining the data with other data, we handle it as personal data).

3 SOURCES OF PERSONAL DATA

The personal data is collected from the users themselves, their employers or automatically from the use of the service.

4 INTERNATIONAL TRANSFERS

QOCO Systems processes personal data primarily within the European Economic Area (EEA). Some of our service providers operate globally and may also process personal data outside the EEA. In case any personal data is transferred to such countries outside the EEA whose level of data protection the European Commission has not deemed adequate, the data is protected through the use of the transfer mechanisms recognized by the General Data Protection Regulation, such as Standard Contractual Clauses approved by the European Commission and additional safeguards implemented by our service providers.

5 RECIPIENTS OF PERSONAL DATA

QOCO Systems uses third-party service providers to run our services. These service providers process personal data on our behalf. Some data of our users is also available for the companies on whose behalf they are using the service. Personal data is not shared with other third parties.

6 STORAGE PERIODS

Personal data is generally processed for as long as the user has a valid user account for the services. Some usage data may be stored for longer, in accordance with the automatic log cycles. Changes to this Privacy Notice

7 YOUR RIGHTS

You have the right to access your data and the right to have any inaccurate or false data corrected. You also have the right to ask that your data is deleted, that the processing of your data is restricted, and to object to the processing. For any processing that is based on your consent, you have the option to withdraw your consent at any time. Please note that the withdrawal of consent does not affect the legality of the processing taken place prior to the withdrawal of the consent. You exercise your rights by contacting us at hello@qoco.aero. Please note that some of the rights are subject to additional requirements and may not be applicable in each case.

You also have the right to lodge a complaint with the data protection authorities in case you find that the processing does not comply with applicable law. QOCO Systems is supervised by the Finnish Data Protection Ombudsman’s Office, whose website is available at https://tietosuoja.fi/en/.