Vevex Pro App Privacy Policy

This privacy policy explains how Vevex Oy processes personal data in the Vevex Pro mobile app for iOS and Android. Vevex Oy (Business ID 2700259-1) is the controller of that data.

Vevex Pro is an internal tool for Vevex employees, used in the field to run on-site assessments, installations, and reclamations. This policy covers the app specifically.

How Vevex processes the personal data of its customers is described in our main privacy policy at vevex.fi/tietosuojaseloste. This app policy and the main policy together describe Vevex's processing.

Vevex Pro is a staff application. It is distributed as an unlisted app on the App Store and Google Play, and it is not directed at the general public or at children. Sign-in refuses anyone who is not already a registered Vevex employee.

There is no in-app registration. Employee accounts are provisioned by the employer. You sign in with a one-time code sent to your email or phone, or with Google sign-in.

When you use the app, we process:

• Account and identity: your name, work email, phone number, and your role and permissions, used to sign you in and show you the work assigned to you.
• Authentication: your session is kept in the device secure keystore (iOS Keychain or Android Keystore). The app does not store your password on the device.
• Face ID and biometric unlock (optional): if you enable it, biometrics re-lock the app after sign-in. Biometric data never leaves your device and is never sent to Vevex. The app only stores a local on or off preference.
• Diagnostics: crash and performance data through a diagnostics provider, to keep the app working. In the app, diagnostics are configured not to attach personal identifiers to events.

To do a job, employees capture data about Vevex's customers and their premises: photos of the customer's spaces taken with the camera or attached from the photo library, together with any drawings, annotations, and notes added to them. These photos are job evidence for assessments, installations, and reclamations.

So that the work can be done offline, the app keeps a local copy on the device of the job data you need, including customer names, addresses, contact details, and job specifics, along with a queue of photos and edits waiting to sync. This local copy is removed over time by the app's retention rules and when you sign out.

This customer data is processed under Vevex's main privacy policy at vevex.fi/tietosuojaseloste, which governs how Vevex handles the personal data of its customers.

The app deliberately does not collect the following:

• Location: the app requests no location or GPS permission. Distances are derived on the server from addresses, not from your device.
• Tracking and advertising: no advertising identifiers, no cross-app or cross-site tracking, and no third-party advertising or analytics tools. The app is not used to track you.
• Audio: photo capture is stills only. The app declares no microphone use.
• Contacts: the app does not access your phone's contacts.

The app asks for the following permissions, each only for the stated purpose:

• Camera: to photograph the customer's spaces during on-site assessments, installations, and reclamations.
• Photo library: to attach photos you have already taken.
• Face ID and biometrics: to unlock the app after sign-in. This is a screen lock, not a login credential.
• Notifications: to send you job and sync notifications.
• Background app refresh: to sync queued photos and edits when the app is closed.

We process this data to provide and operate the app: to authenticate you, show your assignments, capture and sync job photos and edits to Vevex's systems, send job and sync notifications, keep the app secure, and diagnose crashes. We do not use app data for advertising or for automated decisions that produce legal effects about you.

The legal basis for this processing is the performance of the employment relationship and Vevex's legitimate interest in operating its field service business, and legal obligations where applicable.

Vevex uses the following service providers, which process data on Vevex's behalf under data processing agreements and may not use it for their own purposes:

• Cloud database: the application database, hosted in the EU.
• Cloud storage: storage of job photos, hosted in the EU.
• Diagnostics provider: crash and performance diagnostics, hosted in the EU.
• Push-notification providers: delivery of push notifications through the mobile platforms' push services. This delivery uses global infrastructure, including in the United States.

Vevex does not sell your personal data.

The primary database, job photos, and diagnostics are hosted in the EU or EEA. Data stored on the device (the offline job cache, the photo queue, and your session) is kept only as long as needed to do the work, and is cleared by the app's retention rules and when you sign out.

Server-side retention follows the main privacy policy, including the statutory retention of accounting records for at least seven years under the Finnish Accounting Act (Kirjanpitolaki).

Almost all processing stays within the EU or EEA. The processing that reaches outside the EU is push-notification delivery, which is handled through the mobile platforms' global infrastructure, including in the United States. This routing is inherent to mobile push and cannot be confined to the EU.

A notification may include the address of the site the job relates to, so that it is useful on the lock screen. It does not include site access codes or other sensitive details. Transfers outside the EU or EEA rely on appropriate safeguards, such as the EU Standard Contractual Clauses and the EU-US Data Privacy Framework, consistent with the main privacy policy.

Under the GDPR and applicable data protection legislation, you have the following rights regarding your personal data:

• Right of access: You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data.
• Right to rectification: You have the right to request the correction of inaccurate or incomplete personal data.
• Right to erasure: You have the right to request the deletion of your personal data under certain conditions. Legal obligations (such as accounting requirements) may limit this right.
• Right to restriction of processing: You have the right to request the restriction of processing of your personal data in certain situations.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to object: You have the right to object to the processing of your personal data based on legitimate interest.
• Right to withdraw consent: where processing is based on your consent, you have the right to withdraw that consent at any time.

You can exercise these rights by contacting us at [email protected]. We may need to verify your identity before processing your request.

The app has no in-app registration and no self-service account deletion. Employee accounts are provisioned and deactivated by the employer. To have an account deactivated, contact Vevex at [email protected].

We implement appropriate technical and organizational measures to protect personal data from unauthorized access, alteration, disclosure, or destruction. Access to data is restricted to authenticated, authorized employees. Data in transit is encrypted using TLS, and the session token and biometric preference are stored in the device secure keystore. However, no method of transmission over the Internet or electronic storage method is completely secure.

If you believe that the processing of your personal data violates data protection legislation, you have the right to lodge a complaint with a supervisory authority.

In Finland, the supervisory authority is:

EU/EEA residents may also lodge a complaint with the supervisory authority in their country of residence.

Vevex Pro is a staff tool and is not directed at children or at persons under 18 years of age.

We may update this privacy policy from time to time. We will notify you of changes by posting the updated policy on this page and updating the "Last updated" date.

The data controller responsible for processing your personal data is:

If you have questions about this privacy policy or our data protection practices, please contact us at the email address above.