Privacy Notice

Kameleon Document Automation Oy

Postikatu 2, 20250 Turku, Finland

+358 (0)207 888 200 · comms@kameleon.app

Jarkko Ollikainen · +358 (0)207 888 200

comms@kameleon.app

User register of the Kameleon SaaS software.

The legal basis for processing personal data is:

• The contractual relationship between the data subject and the controller.
• The legitimate interest of the controller (where access has been ordered on the user's behalf by their employer).

Personal data is processed primarily to deliver, maintain, secure, develop and support the functionality of the Kameleon software and customer service.

Personal data may also be processed for customer communication, marketing, user outreach and direct marketing, statistics and analysis, ensuring usability and reliability, preventing and investigating misuse, and for business planning and development.

Data recorded in the register is obtained from the data subject themselves and generated technically by the system.

User's first and last name, email, phone number, organization, title, and business unit. In addition, the user's Kameleon ID is stored.

Personal data is disclosed only to processors acting on behalf of the controller:

Microsoft

• Microsoft Azure is used to generate and distribute document templates to the data subjects. Kameleon databases are also hosted on Azure.

We use Google Analytics 4 (provided by Google Ireland Limited) to measure aggregated, anonymised usage of kameleon.app so we can improve the site. Analytics cookies and identifiers are set only after you accept on the cookie banner; if you decline, no analytics or advertising storage is written. IP addresses are anonymised before processing and we do not use Google Analytics for advertising or remarketing.

You can change your choice at any time by clearing the kameleon.cookie-consent.v1 entry in your browser's site storage, which will re-display the banner on your next visit.

Data is stored within the EU, in the data stores of the service providers used by Kameleon Document Automation Oy. Kameleon follows the Microsoft EU Data Boundary practices. Documents produced with Kameleon are stored by the customer in the customer's own systems; Kameleon has no access to the content of those documents.

The controller has implemented appropriate technical and organizational measures to protect personal data against accidental or unlawful loss, disclosure, misuse, alteration, destruction or unauthorized access. The controller has verified that the processors acting on its behalf comply with the GDPR and that their information security is implemented in line with industry good practice. Changes made to the system are recorded in the user log.

Register data is stored only in digital form.

Data is deleted from the Kameleon service 12 months after the service ends.

For all questions related to the processing of personal data and for exercising your rights, please contact the controller by email at comms@kameleon.app. Please title the email: "Regarding the Kameleon software user register".

Every person has the right to know what data concerning them is stored in the register. Access is free of charge once a year. When making the request, the person must prove their identity using a reliable electronic identification system (e.g. an electronic identity card), in person at customer service by presenting an identity document, or by a personally signed or otherwise verified document. Data is provided electronically or in writing on request. Personal access requests can be sent to comms@kameleon.app with the subject line above.

The controller will, on its own initiative or on request, delete, correct or complete any data that is incorrect, unnecessary, incomplete or outdated for the purpose of processing. Rectification requests must be made in writing.

On written request we will delete all data concerning the data subject if the personal data is no longer needed for the purposes for which it was collected.

The data subject has the right to prohibit the controller from processing their data for direct advertising, distance selling and other direct marketing, market and opinion research, and personal registries. The prohibition must be addressed to the contact person responsible for register matters.