Privacy Policy

Kendis Oy is a company incorporated in Finland with Business ID 2874062-5 and registered office at Lapinlahdenkatu 16, 00180 Helsinki, Finland. Kendis Oy is the data controller for the processing described in this Privacy Policy, except where Section 2 states otherwise.

Privacy enquiries: privacy@kendis.io. Security reports: security@kendis.io.

Kendis processes personal data in two different capacities. Which one applies depends on the data concerned.

If you use the Service through an account operated by your employer or another organisation, that organisation is the controller of Licensee Data and decides how it is used. Questions and rights requests about Licensee Data should be directed to that organisation; we will assist it as required by the DPA.

Optional AI features. The Service includes optional AI features that are off by default and can be enabled only by a customer administrator. Their use is governed by the Kendis AI Terms of Use. When AI features are enabled, Kendis processes the relevant Licensee Data as processor on the customer's instructions, and any AI Subprocessor engaged is identified in the Schedule.

We do not intentionally collect special categories of personal data (for example health data or data revealing political opinions) and ask that you do not submit such data to us.

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You may object to processing based on legitimate interests at any time (Section 11).

Customers select a Hosting Region when they order the Service. Licensee Data is stored and processed only in the selected Hosting Region, including backups. The Hosting Region cannot be changed after the account is created.

Where the Germany Hosting Region is selected, access to Licensee Data is restricted to authorised personnel of Kendis and its Subprocessors located in the European Economic Area, the United Kingdom or Switzerland, as set out in Section 6 of the Schedule.

Account Data is processed in Kendis' business systems (customer relationship management, support, billing, email and productivity tools) irrespective of the Hosting Region. Some of these systems are operated by providers located outside the EEA; they are identified in Section 5 of the Schedule together with the transfer mechanism relied upon.

We share personal data only where necessary for the purposes in Section 4, with:

• Subprocessors and service providers. Hosting and database infrastructure for each Hosting Region, content delivery and edge security, transactional email delivery, customer relationship management, customer support and messaging, payment processing, business productivity and document storage, website and product analytics, marketing email, newsletter publishing and our customer training portal. The current list, including each provider's legal entity, location, the data it receives and the transfer mechanism relied upon, is maintained in the Schedule at trust.kendis.io/subprocessors. Customers are notified of additions or replacements in accordance with the DPA.
• Integration partners, at your direction. When a customer connects the Service to Jira, Azure DevOps or another tool, data flows between the Service and that tool as configured by the customer. The customer's agreement with the integration provider governs that provider's processing.
• Professional advisers and certification bodies. Auditors, accountants, legal advisers and our ISO/IEC 27001 certification body, bound by confidentiality.
• Authorities. Courts, regulators and law enforcement where disclosure is required by applicable law. Where a request concerns Licensee Data we will, unless legally prohibited, refer the requesting authority to the customer and notify the customer in accordance with the DPA.
• Business transfers. A purchaser or prospective purchaser of all or part of our business, subject to this Privacy Policy and appropriate confidentiality safeguards.

We do not sell personal data and do not share it with third parties for their own marketing.

The Website and the Service use cookies and similar technologies. Before non-essential cookies are set you are asked for consent through our cookie banner, in accordance with the ePrivacy Directive (2002/58/EC) as implemented in Finland by the Act on Electronic Communications Services (917/2014). You can change or withdraw your choices at any time through the banner or your browser settings. Blocking strictly necessary cookies may prevent parts of the Service from working.

The cookies currently in use are listed in the Cookie Schedule at the end of this Privacy Policy.

Kendis is established in Finland. Whether personal data leaves the European Economic Area depends on the data concerned:

• Licensee Data, Germany Hosting Region: not transferred outside the EEA.
• Licensee Data, United States Hosting Region: processed in the United States by Amazon Web Services, Inc. and MongoDB, Inc. under the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914). Amazon Web Services is additionally certified under the EU-US Data Privacy Framework.
• Account Data, all Hosting Regions: some of the providers listed in Section 5 of the Schedule are located in, or process data in, the United States or other countries outside the EEA.

For every transfer outside the EEA we rely on one of the following safeguards under Chapter V of the GDPR: (i) a European Commission adequacy decision, including the EU-US Data Privacy Framework for recipients certified under it; or (ii) the EU Standard Contractual Clauses, supported by a transfer impact assessment and supplementary measures such as encryption in transit and at rest and access restrictions. Transfers to the United Kingdom and Switzerland are covered by adequacy decisions. The transfer mechanism used for each provider is stated in the Schedule, and a copy of the relevant Standard Contractual Clauses is available on request.

Data may persist in encrypted backups for a limited period after deletion from live systems, after which it is overwritten in the ordinary backup cycle.

Kendis operates an information security management system certified to ISO/IEC 27001. Measures include encryption of data in transit (TLS) and at rest, single sign-on and multi-factor authentication, role-based access control, named individual accounts with no shared credentials, logging of administrative access, vulnerability management, regular backups and a tested incident response process. Our Subprocessors are bound by written contracts imposing equivalent obligations.

In the event of a personal data breach we notify affected customers as required by the DPA and the supervisory authority within 72 hours where required by the GDPR. If you believe your data has been compromised, contact security@kendis.io.

Subject to the conditions in the GDPR, you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate or incomplete data corrected;
• have your data erased;
• restrict our processing of your data;
• receive the data you provided to us in a structured, machine-readable format and have it transmitted to another controller;
• object to processing based on legitimate interests, including direct marketing; and
• withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise any of these rights, email privacy@kendis.io. We may need to verify your identity. We respond within one month, extendable by two further months for complex requests, and do not charge a fee unless a request is manifestly unfounded or excessive. Where a request concerns Licensee Data we will refer it to the customer that controls that data and assist the customer as required by the DPA.

If you are dissatisfied with how we handle your data you may lodge a complaint with the Office of the Data Protection Ombudsman of Finland (Tietosuojavaltuutetun toimisto, tietosuoja.fi) or with the supervisory authority in the EEA member state where you live or work.

We send marketing emails, newsletters and event invitations to business contacts who have consented or, where permitted by law, whose organisation has a customer or prospective customer relationship with us. Every marketing email contains an unsubscribe link, and you can also opt out by emailing privacy@kendis.io. Opting out of marketing does not stop service communications that are necessary to operate your account, such as security notices and Subprocessor change notices.

The Website and the Service are directed at businesses and are not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, contact us and we will delete it.

The Website and the Service contain links to third-party websites and services, including integration partners. We are not responsible for their privacy practices and this Privacy Policy does not apply to them.

We may update this Privacy Policy from time to time. Each version carries a version number and effective date. Material changes are notified to customer account administrators by email or in the Service before they take effect, and the current version is always published at kendis.io/privacy-policy.

Kendis Oy, Lapinlahdenkatu 16, 00180 Helsinki, Finland. Business ID 2874062-5.

Privacy: privacy@kendis.io. Security: security@kendis.io.

This Privacy Policy is governed by the laws of Finland.

The cookies currently set by the Website and the Service. If you believe this list is incomplete, let us know at privacy@kendis.io.