CubiCasa (referred to as “CubiCasa”, “we, or “our”) is committed to protect personal data we process. This privacy notice explains why we collect personal data and what we do with it when we are the controller of personal data. Within CubiCasa and its entities, the data controller will be CubiCasa Ltd and/or the CubiCasa entities you have your relationship with.
We process individuals personal data for a number of reasons. When we write “you”, we mean you as, for example, our customer, our staff member, job applicant, a potential customer, our customer’s employee or other relevant parties, authorized representatives and associated parties.
By personal data we mean data defined under general data protection regulation (“GDPR”) (and/or any successor or equivalent legislation in the UK). According to GDPR, personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the economic or social identity of that natural person. Therefore, the definition of personal data is very wide – by personal data we don’t mean only direct identifiers such as names but also indirect identifiers such as some device data and online identifiers as well.
We may amend this privacy notice from time to time. If we make any changes we will post them on our websites, so that you will always be aware of the way we use your personal information.
1. What information do we process?
Personal data is in most cases collected directly from you or generated as part of the use of our services and products. Sometimes additional information is required to keep information up to date or to verify information we collect. The categories of personal data processed depends on your relationship to us.
Personal data we may collect can be grouped into the following categories:
- Identification information, such as name
- Contact information: such as phone numbers and addresses, including postal address
- Payment information
- Interaction information, such as communications related to the customer relationship, co-operation or job application
- Agreement information, such as customer agreements, employment contract, co-operation contract or supplier agreement
- Device information, such as device identifiers (UUID), device model or time stamps
- Information analyzed from visual material you provide to us, such as visual material of apartments
- Special Categories of Personal Data: such as sick leave certificates from employees
- Preferences and interest information provided by the user, such as observed data from the service use
- Permissions and consents, such as consent for processing of location information
- Information provided to surveys and research
I) Information you provide to us
We collect information you provide directly to us. For example, when becoming a new customer or creating an account, we collect personal data such as name, email address and phone number. We also collect information which you provide us with such as visual material, messages you have sent us, e.g. feedback or a request in our digital channels.
II) Information collected through observing the visual material you provide
We collect information from the target space which is scanned with the application. Information can include geometry, appliance or other descriptive data from the scanned target space. For example, CubiCasa can extract basic indoor geometry from the visual material provided and have information on what appliances are in the target indoor space.
III) Information collected through observing the use of our service
We collect information about how you use our services, such as the types of content you view or engage with or the frequency and duration of your activities. We collect information from or about the computers, phones, or other devices, depending on the permissions you’ve granted. Permission can be granted by, for example, adjusting settings of your device.
IV) Personal data we may collect from third parties
We may collect personal data from publicly available and other external sources, such as registers held by governmental agencies and third party sources, such as social media platforms, third party data providers and our joint marketing partners.
We take steps to ensure that such third parties are legally permitted or required to disclose such information to us. Examples of the information we may receive from other sources include: demographic information, device information (such as IP addresses), location, and online behavioral data (such as information about your use of social media websites, page view information and search results and links). We use this information, alone or in combination with other information we collect, to enhance our ability to provide relevant marketing and content to you and to develop and provide you with more relevant products, features, and services.
2. Purposes and legal bases for the processing of your personal data
In these cases processing is necessary for the performance of a contract to which you are a party or in order to take steps at the request of prior to entering into a contract;
- To register you for our services, for example when you become a customer of CubiCasa
- To enable you to use our services, including customer relationship management, support and communication, conducting customer surveys, customer complaint handling, maintenance, software and system updates, user identification as well as for problem diagnosis and fixing, for example when you use mobile application or other services provided by us
- To comply with obligations under e.g., a co-operation agreement or employment contract
In these cases processing is necessary for the purposes of the legitimate interests pursued by us or a third party or you have given us a consent for the processing;
- For communicating purposes; such as our newsletter or other communication towards customers, potential customers or job applicants.
- Analyzing and developing service contents as well as create new services; For example processing information collected through observing the use of our service and the visual material you provide. In addition, we process personal data to enable you to take part in surveys and polls if you wish to. We conduct surveys and polls, test features in development, and analyze the information we have to evaluate and improve products and services, develop new products or features, and conduct audits and troubleshooting activities.
- Advertising and marketing purposes including third party advertising platforms; communicating about our offerings, sales promotion and marketing purposes as well as for creating aggregated target groups for marketing. Knowing customers’ preferences enables us to target our offerings and offer products and services that better meet the needs and desires of our customers. Our digital marketing activities also utilize different third-party advertising services and networks, which allow us to reach you on different platforms (e.g. on social media). When those services provide a custom audience feature, you may be targeted with specific campaigns on third-party platforms based on your account information and your service activities. The account information is used to associate you with the platform’s data to enable us to reach you or exclude you from our marketing campaigns (e.g. a hashed email address or phone number is uploaded to the platform). Your data may be used for creating lookalike audiences as well.
In addition compliance with the obligations laid down in the law, regulations and decisions issued by authorities require us to process personal data. Examples of statutory obligations that require the processing of personal data:
- Prevention, detection and investigation of fraud
- Accounting and tax regulations
- Regulatory reporting
- Obligations related to risk management
- Customer communications in connection with legal obligations
- Other obligations related to service- or product-specific legislation
- Obligations under employment legislation
In certain situations, we ask for your consent to process your personal data. Such situations include, for example, consent to electronic direct marketing or the processing of data belonging to special categories. The consent request contains information on the processing of such data. If you have given your consent to the processing of your personal data, you also have the right to withdraw your consent.
3. How long do we retain your information?
The storage period depends on the nature of the information and the purposes of processing. The maximum period may therefore vary per use.
CubiCasa retains personal data we collect from you where we have an ongoing legitimate business need to do so. Once you have ended your relationship with us, we will delete your account data, unless statutory retention requirements apply (such as for taxation purposes).
4. How is this personal data we collect shared?
By sharing personal data we mean situations where some service is processing personal data on behalf of us or we are disclosing personal data to some other entity. We may share your personal data on the following situations:
4.1 Service providers
In addition, our application can be downloaded through the mobile application distribution platforms such as the Apple App Store or Google Play Store. We recommend users to familiarize themselves with the terms and privacy policies provided by mobile application distribution platforms.
4.2 Third-party Advertising and Marketing
We may work with third-parties for advertising and marketing purposes. When our digital marketing activities utilize different third-party advertising platforms’ custom audience features, we may target you by uploading your account information (e.g. a hashed email address or phone number) to such a platform. We may also use third-party tracking platforms, which collect data about how users interact with our ads for ads attribution analysis and effect evaluation purposes. Such third parties are operating under contract and acting on behalf of us and include data transfers to partners located in the US.
With Your consent, we may share your information with other selected third parties so they may contact you. We will also display certain details about you as a customer of Cubicasa.
4.3 For research purposes
In some cases, we may disclose data for scientific or other research purposes in compliance with the legislation on personal data protection.
4.4 For legal reasons
CubiCasa may disclose your personal data to third parties where access to or processing personal data is necessary to i) satisfy any applicable law and/or court order; (ii) detect, prevent, or otherwise address fraud, security or technical issues. CubiCasa will inform those concerned of this type of use of personal data when possible.
4.5 Within CubiCasa and Clear Capital – we may share your Personal Information within our family of companies
We may share personal data within our group for the purposes defined in this privacy notice.
4.6 For other legitimate reasons
We may also disclose data, based on the customer’s consent or an agreement, to our partners that are related to the products or services chosen by customers.
If CubiCasa is involved in a merger, acquisition or asset sale, we may transfer your personal data to the third party involved. However, we will continue to ensure the confidentiality of all personal data. We will give notice to all customers concerned before the personal data are transferred or become subject to a different privacy notice.
5. Transfers of personal data
We have entities in the US, Finland and Vietnam. We take care of cross-border transfers in accordance with applicable privacy legislation. This means that in regards to transfers of personal data to countries where local data protection legislation does not provide an adequate level of data protection, transfers are protected utilizing appropriate safeguards, such as standard contractual clauses approved by the European Commission. To learn more about the appropriate safeguards we use, please contact us by using the contact information provided below.
Our services are not targeted to children and we require you to be at least 18-years old.
Cookies are small text files that are stored on the visitor’s computer or other device when visiting CubiCasa’s websites or using the mobile application. When we refer to cookies in this privacy notice or cookie notice, this also includes other similar technologies and tools that collect and store information from your device.
On CubiCasa’s websites and services, cookies are used to maintain the session after the user logs in to the web service and to remember the selections made by the user when moving from one page to another. Cookies also allow us to individualize website visitors and to compile statistics on the visitors to our services. Cookies are also used in the chat service of CubiCasa’s websites and to target marketing. You can read more about cookies in our Cookie Notice.
8. Your rights
The General Data Protection Regulation grants the data subject a number of rights with which the data subject can govern the processing of their personal data. The data subject may use the following rights in relation to us insofar as we act as the controller for the data subject’s personal data:
Right of access and right to rectification
You have the right to receive confirmation on whether we process personal data relating to you and the right to access any such personal data. We may ask you to specify your request where necessary, for example with regard to activities to which the request relates.
In addition, you have the right to request the rectification of incorrect personal data relating to you, or to supplement incomplete personal data that CubiCasa is processing.
Right to data erasure
You have the right to request erasure of your personal data from our data systems. CubiCasa will comply with your request, provided we do not have a legitimate reason not to delete the data, such as a statutory obligation to continue processing the personal data. Personal data may not be deleted instantly from backup copies and other such data systems, but will be deleted through regular database retention practices.
Right to object
You also have the right to object to the processing of your personal data if your personal data is processed for other purposes than the fulfillment of legal responsibilities or the provision of services. You may object to the processing of your personal data for the purposes of direct marketing including use of your data on third party advertising platforms.
Right to restriction of processing
If you contest the correctness of the data which we have registered about you or lawfulness of processing, or if you have objected to the processing of the data in accordance with your right to object, you may request Us to restrict the processing of these data to only storage. The processing will only be restricted to storage, until the correctness of the data can be established, or it can be checked whether our legitimate interests override your interests.
If you are not entitled to erasure of the data which we have registered about you, you may instead request that we restrict the processing of these data to only storage. If the processing of the data which we have registered about you is solely necessary to assert a legal claim, you may also demand that other processing of these data be restricted to storage. We may process your data for other purposes if this is necessary to assert a legal claim or if you have granted your consent to this.
Right to data portability
you have the right to receive your personal data from us in a structured, commonly used format so that you may transfer your personal data to another controller, provided that the processing of your personal data is based on consent or a contract between you and CubiCasa.
9. Who is the controller and who can I contact?
You can use your rights by contacting us. The extent of your rights is subject to the legal basis for processing and exercising your rights requires identification.
The controller is the CubiCasa entity you have a contractual or other business relationship with.
Contact information: email@example.com
Right to lodge a complaint
If the processing of your personal data is in breach of applicable legislation, you have the right to lodge a complaint with the national supervisory authority. you can lodge the complaint with a competent supervisory authority. In Finland, this is the Data Protection Ombudsman, and the complaint must be lodged in accordance with instructions provided by the Office of the Data Protection Ombudsman. Please see http://www.tietosuoja.fi for more information.
10. Additional Information for California Residents
The California Consumer Privacy Act (“CCPA”), as amended and updated by the California Privacy Rights Act (“CPRA”, together “California law”), requires businesses to disclose whether they sell Personal Data. For more information, see sections 2 and 4 of this notice.
California law grants state residents certain rights, including the rights to access specific types of Personal Data, to learn how we process Personal Data, to request deletion of Personal Data, and not to be denied goods or services for exercising these rights.
For information on how to exercise your rights, please refer to Section 8 of this Privacy Notice. If you are an authorized agent wishing to exercise rights on behalf of a California resident, please contact us using the information in the “Contacting Us” section above and provide us with a copy of the consumer’s written authorisation designating you as their agent.
We may need to verify your identity and place of residence before completing your rights request.