Privacy policy

Data controller

The data controller is Five Vision Oy (business ID 3633752-9), Teollisuustie 17 A, 96320 Rovaniemi, Finland.

Vide is a service for accounting firms: the firm requests receipts and other documents from its clients. The firm is our customer, and a contact person at the firm's client company reaches the client portal through a sign-in link sent by email.

The accounting firm is the controller of the personal data it stores in the service about its own clients. We process that data on the firm's behalf and on its instructions. For user accounts and the technical logs of the service, we are the controller.

This policy describes our own processing. The accounting firm tells its own clients separately how it processes their data.

Personal data we process

We get the data from the users themselves and from the accounting firm. We do not buy personal data from outside sources.

The service processes the following data:

• accounting firm user data: name, email address, role and permissions
• client company and contact person data: company name, business ID, contact name, email address, phone number and the delivery channel for reminders
• documents and attachments stored in the service, which may contain personal data
• messages and comments between the accounting firm and its client
• event data: sign-ins, request status and records of who did what and when
• technical data: a session cookie that keeps you signed in, and server logs
• contact form submissions: name, firm, email address, message and IP address

Purpose and legal basis

We process personal data so that the service works. Users can sign in, and requests and reminders reach the right contact person. The accounting firm can see which requests are still open and who has already replied.

We send messages about how the service is running: sign-in links, document requests, reminders and bulletins. Messages go by email, and where SMS reminders have been enabled for a client, a reminder may also arrive by text message. These service messages are part of the engagement, so they cannot be refused separately for as long as the account is in use. Marketing messages are a different matter: they are sent only if you have consented to them, and you can withdraw that consent at any time in the client portal or by telling the accounting firm. Withdrawing it does not affect service messages.

The legal bases are the contract with the accounting firm and our legitimate interest in running the service, keeping it secure and preventing misuse. For billing and accounting, the legal basis is a statutory obligation.

We do not use the data for profiling, automated decision-making or ad targeting.

If you send the contact form on our website, we process what you enter there to reply to you and to prepare a possible contract. The IP address is stored to prevent misuse of the form. The legal basis is our legitimate interest.

Retention periods

We keep data for as long as the accounting firm's contract is in force and the data is needed to run the service.

After the contract ends we delete or anonymize the data within a reasonable time. Some data, such as billing and accounting records, is kept longer where the law requires it.

The accounting firm can also delete individual documents and client records while the contract is running.

Documents stored in the service are retained for one year. Vide is a staging point, not an archive: the statutory retention duty under the Finnish Accounting Act rests with the party keeping the books, and the permanent home of the material is the accounting firm's own accounting system. We notify the firm well before documents leave the service. Messages and technical service logs are kept for as long as the accounting firm's contract is in force, and we delete them on request. Sign-in data expires on its own: a session after 90 days at the latest, and a sign-in link sent by email after 10 minutes. Data sent through the contact form on our website is kept until you ask us to remove it.

Disclosures and processors

We do not sell personal data and we do not disclose it for marketing.

We use subprocessors to run the service, for example hosting and email delivery providers. A subprocessor only processes data on our behalf, and a data processing agreement is signed with each one.

The service and its data run on infrastructure located in the EU.

Our hosting and email subprocessors operate within the EU, and a data processing agreement is in place with each of them. An up-to-date list of subprocessors is published on the Subprocessors page (vide.fi/subprocessors). We also look up public company register data from the Finnish Patent and Registration Office's YTJ service by business ID; that query carries no personal data about the people who use the service.

The service has no analytics and no third-party tracking scripts. Cookies are described in the Cookies section below.

We disclose data to the authorities only where the law requires it.

Cookies

The service uses one cookie for everyone: vide_session, an essential session cookie that keeps you signed in. Page scripts cannot read it (HttpOnly), and its lifetime follows the sign-in session: the session stays valid for at most 30 days from your last use, and ends 90 days after sign-in at the latest.

A second cookie, vide_device, is set only if you use two-factor authentication and tick "remember this device". It stores no session, just a signed note that this browser already passed the code prompt, so you are not asked again for 30 days. It is also HttpOnly, and turning two-factor off or setting it up again makes every earlier one stop working.

The service sets no analytics cookies, no advertising cookies and no third-party cookies. The public marketing pages store no cookies on your device.

Because both cookies are strictly necessary for the service and its sign-in to work, no consent is needed for them and the service shows no cookie banner.

Interface preferences such as language and theme are stored in the browser's local storage (localStorage). They stay on your device and are not sent to the server with requests.

If analytics or any non-essential cookies are added later, we will ask for your consent first and update this policy before any new cookie is set.

Your rights

Data protection law gives you rights over your own personal data. You can send a request to the contact address given at the end of this policy.

If you are a contact person at an accounting firm's client company, the controller is the firm that stored your data in the service. In that case we pass your request on to the firm.

Your rights are:

• the right to know what data is processed about you and to get a copy of it
• the right to have inaccurate or incomplete data corrected
• the right to ask for your data to be erased
• the right to ask for processing to be restricted
• the right to receive your data in a machine-readable format and transfer it to another service
• the right to object to processing based on legitimate interest
• the right to lodge a complaint with the supervisory authority, which in Finland is the Office of the Data Protection Ombudsman

Contact

In privacy matters you can contact us at software@koud.fi.

If your question concerns an accounting firm's own client records, you can contact that firm directly.

We answer requests within one month. If a request is broad or complex, we may extend the deadline and will tell you when we do.

The supervisory authority is the Office of the Data Protection Ombudsman (tietosuoja.fi).