Privacy policy

1. Introduction

Your privacy and the protection of your personal data is important to us (Votech). When we refer to ‘personal data’ in this policy, we mean any information which can be used to personally identify you. This public privacy policy (or privacy statement) explains what personal data we process, how we collect it and why. We take the security of your personal data very seriously and this policy tells you what we do to ensure its protection. In this policy we also outline the rights we think you have with your personal data, and how you can exercise them. Please take the time to familiarise yourself with this policy as it contains important information.

2. Who we are

Votech is a global software as service provider of fast, accurate and secure technologies to facilitate the smooth running of AGMs, shareholder or member meetings, legislative meetings and elections – whether that is a physical in-room meeting, a virtual meeting or a hybrid meeting. Our headquarters are in Helsinki, Finland.

Votech Oy operates the website that this policy appears on.

We are not legally required to appoint a Data Protection Officer (DPO). However, we have nominated members of our Information Security Management System (ISMS) Team to take overall responsibility for matters of data protection and privacy. You can contact them with any questions or concerns about your personal data by emailing info@votech.fi (for more contact details see below section).

3. Our approach to privacy

We do not sell, rent, or trade your personal data to third parties for marketing or promotional purposes.  We do not abuse or misuse your personal data, or let it fall into the wrong hands.  We only process your personal data for the reasons we say we do.

As a business, we supply mobile technology products and services which process personal data to help our customers (Clients) better understand a group of people. We also process personal data for marketing purposes. That personal data is as important to us as it is to you.

We only process your personal data in accordance with our Clients’ instructions. If these instructions are ethical, moral and legal, then we comply with our Clients’ directions as to how they want us to process the personal data.  We also try to ensure that any obligations our Clients have concerning your privacy are carried out, subject to applicable laws.

We share your personal data with our Clients, who are the data controllers in respect of the personal data and have provided it to us and/or asked us to collect personal data and process it by using our technology and services. They have their own privacy policies that apply to your personal data. We are not responsible for those policies, and we suggest you read them carefully.

Technology, laws, or even our way of doing business can change from time to time, as can your rights and expectations. To ensure we comply with data protection regulations, we will update this privacy policy. When we make changes, we will always publish it here on our website - – we encourage you to check it from time to time for updates.

4. Our Companies and websites

The following companies are within scope of this policy;

• Votech Oy

The following websites are within the scope of this;

• https://www.votech.io
• https://portal.votech.app

• https://votech.app/d/  
• And any other website created by us (Votech Oy) with the address beginning with https://votech.app/d/  

5. Where and why, we collect your personal data

We collect your personal data from the following sources:

1. when you visit our website(s);

2. when you contact us for help or support (in person, by telephone, email, or webchat) including enquiring about our technology or technical support if you already use it;

3. when you use one of our products or services (e.g., joining or participating in a virtual meeting, completing a survey, downloading an application, sending a message, responding to an electronic poll, visiting a web application, liking a comment, etc.)

4. from cookies on our website

5. Meeting registration pages within the Votech platform;

6. via our IT systems;

7. from meeting entry systems and reception logs;

8. through automated monitoring of our websites and other technical systems, such as our computer networks and connections, CCTV and access control systems, communications systems, email and instant messaging systems;

Because our business revolves around helping our Clients to reach and better understand groups of people, we may also receive your personal data from those Clients, who have analysed the information they already have about you, or you have provided directly to them. We may also use publicly accessible information to verify information we have been provided and to manage and expand our business.

If you do not provide personal data, we ask for it may delay or prevent us from providing products or services to you.

We process your personal data for one or more of the following purposes:

1. you have come to us for our help and support (this could be enquiring about our technology or technical support if you already use it);

2. you have provided consent to our Clients who are using our services for us to process your data;

3. you are visiting our website;

4. to provide you with information you have requested from us;

5. to fulfil a contract that we have entered with you or with an entity that you represent;

6. to ensure the safe operation and security of our websites and underlying business infrastructure; or

7. to manage any communication between us and you.

8. conducting checks to identify meeting participants and verify their identity;

6. Our legal basis for processing your legal data

Under EU data protection law, we can only use your personal data if we have a proper reason, e.g:

• where you have given consent;
• to comply with our legal and regulatory obligations;
• for the performance of a contract with you or to take steps at your request before entering a contract; or,
• for our legitimate interests or those of a third party.

A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own.

You can object to processing based on legitimate interests at any time and, if you do so, we will stop processing the personal data unless we can show compelling legitimate grounds which override your rights and interests, or we need the data to establish, exercise or defend legal claims – see “Your rights” below.

Where we process special category (i.e., sensitive) personal data, we will also ensure we are permitted to do so under data protection laws, e.g.:

• we have your explicit consent;
• the processing is necessary to protect your (or someone else’s) vital interests where you are physically or legally incapable of giving consent; or,
• the processing is necessary to establish, exercise or defend legal claims.

7. What personal data we process

Our products and services require the processing of your personal data. Depending on the application, website or technology you are using, this may include:

1. your meeting registration including first name and surname, gender, date of birth, address, and any form of identification you have used to access a meeting on the Votech platform

2. biographical information that you have supplied to us or to our Clients;

3. location information, meaning information which reveals a geographical location of you and/or your mobile or communications device (we only process this information where you have agreed to us or our Clients doing so or by agreeing to a notification on your mobile or communications device);

4. information about the type of mobile or communications device you are using our products and services on (such as type of operating system, version of firmware, IP address, etc.);

5. website and application metadata, meaning information about the way in which our applications and websites are used and how they function on your mobile or communications device (e.g. which application screens you use most, how long it takes to transmit information to us, the volume of information, etc.) which we process in order to improve the usability, security and performance of our website;

6. survey, voting or any other type of information requested by our Clients and/or provided by you, meaning information contained in the responses you submit to surveys or electronic polls, how you vote in an electronic election or other information you provide or enter through our products and applications, an online dashboard or website (your participation is always voluntary and you do not have to provide any personal data); or

7. personal data received from other sources including other websites we or our Clients operate or the other services we provide.

If you are visiting our website or trying to contact us for information, assistance or technical support, then the personal data we process or may ask for could include:

1. your first and last name;

2. your gender if you choose to give us this;

3. your date of birth;

4. your contact details, such as a phone number and/or email address;

5. Information from accounts you link us to;

6. your approximate location (depending on the settings on your device);

7. technical data such as an Internet Protocol (IP) address, time zone, operating system and platform and information about your internet browser application;

8. which of our products and/or services you use;

9. which pages on our website you have visited, including where you have clicked your mouse and what buttons you have pressed (i.e., where you came to us from, where you went in our site, how you got there and serve you relevant content once you have left);

10. which Client of ours you represent and your role within that organisation (e.g., your job title);

11. information about our hardware which you own or use and information about the mobile or communications device accessing our online products and services; or

12. any technical or diagnostic information we deem necessary to fix a problem or resolve an issue you are experiencing with our products or services.

8. Sharing information with third parties

We do not disclose any personal data about you to any third party for marketing, advertising or promotional purposes, unless you have given us express consent to do so or unless otherwise described in this privacy policy.

The confidentiality, integrity and availability of your personal data remain of the utmost importance to us, especially if we need to transfer it to a third party (for international transfers please see Section 10 below). To demonstrate the measures, we take to ensure the security of your personal data when being transferred to a third party, please see Section 9 below for more information, where we have considered any potential risks and taken necessary precautions.

We may share your personal data with:

1. our Clients, including share registrars, who have asked us to process it on their behalf;

2. our cloud hosting partners Microsoft Azure (https://privacy.microsoft.com/en-ca/privacystatement);

3. our software development and support partners located in EU area such as Metatavu Oy or other partners involved in our support services.

4. our client portal host, XXX.

5. our sub-processors and/or suppliers/vendors working on our behalf, who provide us with IT and/or support services to help us process personal data, and who may require such personal data for the performance of any contract we enter with them to conduct our business, and other third parties we use to help us run our business;

6. our external professional advisors, consultants and auditors;

7. our group companies as listed in the Scope section above, who may provide related or ancillary services; or

8. internationally recognised legal or regulatory bodies.
   

We will only share your personal data in the following circumstances:

1. if we reasonably believe that it is necessary to comply with a law, regulation, public policy or legal request (e.g., to assist in matters of public interest or safety or in connection with actual or proposed litigation);

2. if we sell, transfer or otherwise share some or all of our assets in connection with a merger, acquisition, reorganisation or sale of assets, or in the event of liquidation or bankruptcy – potential purchasers and their advisors may have limited access to data as part of the process – (where we would endeavour to provide you with notice prior to the transfer of your personal data to a successor entity); However, use of your personal data will remain subject to this policy;

3. to complete any transaction or provide any product or service you have requested or authorised;

4. in relation to receiving professional advice or the audit of our accounts;

5. to maintain the security of our products and services; or

6. to protect ours, yours and our Clients’ rights and freedoms and to protect our property.

9. Security

We have implemented what we consider to be robust and appropriate technical and organizational security measures designed to protect the security of any personal data we process to guard against unauthorised or unlawful processing of your personal data and against accidental loss or destruction of, or damage to, your personal data. Risk assessment, including assessing risks to the rights and freedoms of data subjects, is at the heart of our Information Security Management System (ISMS), which is certified to the ISO/IEC 27001:2013 standard. Importantly, we also assess our suppliers and sub-processors, who maintain the same and/or additional accreditations, certifications and compliance programmes. We have security measures in place to protect our user database and access to this database is restricted internally.

However, even with these measures in place we have no control over what happens between your mobile or communications device and the perimeter of our information infrastructure. You should always be aware of the many cyber security risks that exist in the modern environment and take appropriate steps to safeguard your own personal data (keeping devices and applications up to date, good password practice, adoption of techniques such as two-factor authentication, being aware of modern threats such as phishing and malware, etc.)  

Despite the measures taken by us and the third parties we engage, the internet is not secure. As a result, others may nevertheless unlawfully intercept or access private transmissions or data. Our website(s) may contain links to third parties’ websites. We are not responsible for the privacy practices or the content of those websites. Therefore, please read carefully any privacy policies on those links or websites before either agreeing to their terms or using those websites. Note also that if you have asked us to share data with third party sites (such as social media sites), their servers may not be secure.

We take the privacy and protection of your personal data very seriously and use several methods to try to keep your personal data secure from loss or unauthorised use, alteration or access when it is in our possession or control and that of any third parties. These methods include reasonable physical, technical and organisational measures to restrict access to your personal data. Your personal data is encrypted at rest (i.e., whilst it is being stored) but also whilst in transit by using the latest cryptography technologies. Access to your personal data (e.g., amongst our employees and Clients) is strictly controlled by a combination of policies, secure passwords, permissions-based user roles, best practice processes and procedures, multi factor authentication and more. Additionally, we ensure that your personal data is further protected through enforceable contractual agreements with any third parties (e.g., Data Protection Agreements, standard contractual clauses, confidentiality clauses, etc.)

Where you have chosen a password which enables you to access certain parts of our website and/or applications, you are responsible for keeping this password confidential. You should never share a password with anyone, nor should it be used to provide shared access for example over a network and you should ensure that passwords are strong, unique and that you do not reuse or recycle passwords. You should also ensure no-one else uses the website while your device is logged on to the website (including by logging on to your device through a mobile, Wi-Fi or shared access connection you are using).

Where required by applicable law, we will notify you or our Clients of any loss of or unauthorised access or alteration to your personal data, and we will cooperate with the appropriate authorities to investigate such incidents in a timely fashion.

10. International transfers of personal data

We use cloud-based storage solutions, meaning that your personal data may be transferred and processed in locations outside of your state, province or country, where the privacy laws may not be as protective as those in your jurisdiction. Our Clients may also operate in such locations and may require that we transfer your personal data to them in those locations. Under data protection law, we can only transfer your personal data to a country outside the EEA and UK under certain legally prescribed circumstances such as where a so-called Adequacy Decision has been granted to a country or applying legally approved standard data protection contract clauses. We will ensure that protections required by applicable EEA and UK laws are met concerning such international transfers your personal data.

We take steps to ensure that your personal data is kept secure regardless of its location and when being transferred internationally, in compliance with applicable laws. Please refer to Section 9 above for more information on where we have considered any potential risks and taken necessary precautions.

11. Retention of your personal data

We keep your personal data for as long as is necessary to fulfil the purpose for which it was processed. In most cases, this will be the duration of a particular meeting, event, project or campaign for which our Client has asked us to process your personal data. However, we are subject to our Clients’ instructions and they may ask us to retain it for longer or to delete it sooner. We regularly audit the personal data we retain to ensure that it remains relevant to our current requirements and those of our Clients. In some circumstances we may also need to keep your personal data for as long as necessary in order to:

• respond to any questions, complaints or claims made by you or on your behalf;
• to show that we treated you fairly;

• to keep records required by law.

We may maintain a permanent record of anonymized location, demographic and survey information. This information is used to produce aggregated consumer insights and cannot be used to identify individuals.

12. Children

We do not knowingly process personal data of minors or children. We have no control over who contacts us, or means of verifying their age, but it is not our policy to conduct business with anyone under 18 years of age. For our Clients (the data controller), if they are using our products and services to process personal data of children, then they must comply with the data protection laws applicable to them. In these very rare circumstances, our Clients are obliged to obtain express consent from the children’s parents or legal guardians prior to the use of our service.

13. Your rights

As a data subject whose personal data we process, you have certain rights, subject to some conditions and exceptions. If you wish to exercise any of these rights, then please info@votech.io  or use the contact details supplied below. In order to process your requests, we may need to ask you to provide up to two valid forms of identification for verification purposes. Depending on the reasons we are processing your personal data, we may have to refer you to our Client you have provided consent to (i.e. as the data processor or in some cases sub-processor, we are obliged to refer you to the data controller to make such requests).

If you have given permission, we may contact you by mail, telephone, SMS, text/picture/video message, email about products, services, promotions, special offers, events, webcasts, conferences and charitable causes that may be of interest to you. If you prefer not to receive any direct marketing communications from us, you can opt out at any time. You have the right to object to the processing of your personal data for direct marketing purposes. If your objection is not to direct marketing in general, but to direct marketing by a particular channel e.g., email or telephone, please specify the channel you are objecting to.

Your rights are as follows:

1. The right to be informed. Further, you also have the right to access, correct, delete, restrict, be forgotten, or object to processing of, or request data portability of the personal data collected about you, subject to some conditions and exceptions. You can find out more about these rights in the EU and UK respectively by reading the EU General Data Protection Regulation here https://eur-lex.europa.eu/eli/reg/2016/679/oj. And the UK Data Protection Act 2018 here https://www.legislation.gov.uk/ukpga/2018/12/contents/enacted.  

2. The right of access. You may request a copy of the personal data we hold about We may need to verify your identity. In such instances, once we have verified your identity and, if relevant, the authority of any third-party requestor, we will provide access to the personal data we hold about you as well as the following;

1. The categories of personal data concerned

2. The purpose for processing the personal data

3. If applicable, who we have disclosed the personal data to

4. The proposed or planned retention period for that personal data

5. The source of personal data, if collected from a third party

3. The right to rectification. If you feel we hold inaccurate or incomplete personal data about you, you may exercise your right to correct or complete it. This may be used in conjunction with the right to restrict processing (see below) to make sure that incorrect or incomplete personal data is not processed until it has been rectified.

4. The right to erasure. Often referred to as the ‘right to be forgotten’. For example, where no overriding legal basis or legitimate reason continues to exist for processing your personal data, you have the right to request that we delete that personal data. We will always take all reasonable steps to ensure the erasure or deletion of your personal data.

5. The right to restrict processing. You have the right to ask us to stop processing your personal data. We will still store the personal data but will not process it further. This right is an alternative to the right to erasure. If any of the following conditions apply, then you may exercise your right to restrict processing;

1. You contest accuracy of your personal data, and we are verifying it.

2. Your personal data has been unlawfully processed and you oppose its erasure.

3. We no longer need the personal data for processing, but the personal data is required by you to establish, exercise or defend a legal claim).

4. You have exercised your right to object and processing is restricted pending verification as to whether the legitimate grounds of a data controller override yours (in some situations)

6. The right to data portability. You may request personal data which we hold, to be transferred to you, another controller, processor or third party. We must ensure we provide it in a structured, commonly used and machine-readable format. This right only applies where the lawful basis for processing is either consent or for the performance of a contract and the processing is carried out by automated means.

7. The right to object. You have the right to object to our processing of your personal data including in circumstances concerning your legitimate interests and direct marketing respectively.

14. Contact us

Should you have any questions, comments or concerns about this policy or how we handle and process your personal data then please email info@votech.fi  

As an alternative, you can get in touch with us at our headquarters using the following postal address or phone number; 

15. Complaints

If you wish to complain or discuss any grievances with us, please don’t hesitate to contact us using the details provided above. All complaints are treated confidentially. Should you be unhappy with how we are handling or have handled your personal data, or about any former complaints you have made to us, then you are entitled to escalate your complaint to a supervisory authority within the region you are based. As detailed above, our company headquarters are based in Finland, where the Office Of The Data Protection Ombudsman is the data protection regulator (https://tietosuoja.fi/en/home).

16. Cookies

Information about our use of cookies can be found at: Linkki