Privacy Policy

This policy describes how Lapland Host Oy processes personal data in the Turnlap application (web + iOS + Android). It is based on the EU General Data Protection Regulation (GDPR), the Finnish Data Protection Act (1050/2018), the Act on the Protection of Privacy in Working Life (759/2004), and Apple’s App Store Review Guidelines 5.1 requirements.

1. Data controller

Lapland Host Oy
Pohjolankatu 12, 96100 Rovaniemi
Business ID: 3543315-6
For data protection matters: [email protected]
General contact: [email protected]

Processor (GDPR Art. 28): the Turnlap service is provided by Lepoku Oy (Business ID 3648958-1, Rovaniemi, Finland, [email protected]). Lapland Host Oy is the data controller and decides the purposes and means of processing; the service provider processes data on the controller’s behalf under the service agreement and a data processing agreement (DPA).

2. What personal data is collected

About cleaners (employees)

• Identification data: name, email, phone number
• Employment data: type of employment contract (collective agreement [TES] / individual contract [TTE]), hourly wage, employment start date
• Work performance data: cleanings completed, time spent, working days, payroll basis
• Location data (GPS): single-point coordinates at the start and end of the working day, a cleaning and a maintenance visit, and the start and end point of the mileage log — cleaners can switch location tracking off in their profile. Separate policy: processing of location data.
• Absence data: the fact and date(s) of sick leave, for reallocating shifts and calculating sick pay — no diagnosis or medical certificates. Health data (GDPR Art. 9) is processed under Art. 9(2)(b) and section 5 of the Act on the Protection of Privacy in Working Life (759/2004); access is limited to admin users — property owners and other cleaners cannot see this information.
• Device data: device model and operating system (troubleshooting), IP address (security)

About guests (in connection with reservations)

• Name, email, phone number, booking reference, arrival and departure dates, number of guests — received from the Hostaway system (GDPR Art. 14: the data was obtained from the booking channel, not directly from the guest)
• Used for: sending the guest’s door code, scheduling the cleaning around arrival, sending a feedback request after the cleaning
• Guest portal (personal link): messages sent through the contact form, orders for additional services, and technical usage logs of the portal (IP address, timestamp) for security purposes. Weather and aurora forecast data is retrieved from external services based on the property’s location, without any personal data.
• Guest message reply suggestions: when a guest sends a message, staff can ask an AI assistant for a draft reply. The content of the message is processed by the AI service (Anthropic, section 7) without the guest’s name; a human always approves the suggestion before it is sent.
• Review classification: review text left by a guest is classified by an AI assistant to identify cleaning/maintenance needs (without the guest’s name).

About property owners and customers (including prospective customers)

• Name, email, phone number, property details, fee/billing information
• Customer relationship management (CRM): contact stage, most recent contact, estimated monthly revenue
• Weekly sales-pipeline analysis: the CRM overview is summarised by an AI assistant (Anthropic, section 7). Customer and lead names are replaced with pseudonyms (“Customer A”) before sending; only the stage, estimated value and number of days since the last contact are transmitted.

3. Where the data comes from

• Directly from the user: when a cleaner logs in, updates their profile, or uses the application
• From the mobile device’s sensors: GPS coordinates, when the user has granted permission
• From the Hostaway system: synchronisation of bookings and guest data
• From supervisors: registration of employment data in the admin panel

4. Purposes of processing

• Shift planning and allocation (algorithm input)
• Time tracking and payroll (MaRa collective agreement legislation)
• Verifying cleanings (location verification + photos before the guest arrives)
• Operational communication: SMS and push notifications about new shifts, cancellations, alerts
• Service quality assurance: monitoring and correcting error situations
• Statutory obligations: Accounting Act (retention period 6+1 years), payroll legislation

5. Legal basis for processing

• Employment contract (GDPR 6(1)(b)): cleaner identification, pay, work performance
• Statutory obligation (GDPR 6(1)(c)): payroll records, taxation, documentation of working time
• Legitimate interest (GDPR 6(1)(f)): GPS location tracking (balancing test carried out — see the location data policy)
• Consent (GDPR 6(1)(a)): SMS notifications, marketing messages. Location data is processed solely on the basis of legitimate interest (right to object available in the profile) — no continuous location history is collected.
• Special categories of personal data (GDPR 9(2)(b)): the fact of sick leave, to fulfil employment-law obligations (sick pay, collective agreement)

6. Retention periods

• GPS coordinates (precise): 90 days → automatically anonymised
• Working-time records (timestamps): 6 years from the end of the financial year (Accounting Act)
• Payroll records: 10 years (Employment Contracts Act + pay regulations)
• Guest contact details: from Hostaway booking data we retain only financial, date, guest-count and channel information plus the guest’s name (no email, phone number or address). The name is automatically pseudonymised 2 years after the booking’s departure date; the booking’s financial and statistical data is retained for 6 years in accordance with the Accounting Act
• Guest messages (Hostaway messages, portal chat, SMS log, message threads and enquiries): 2 years → messages are deleted and thread contact details are automatically pseudonymised
• Guest reviews: from Hostaway review data we retain only ratings, the public review text, channel and dates, and the reviewer’s name (no private feedback); the name is automatically deleted after 2 years, while the rating and public text are retained for quality monitoring
• Guest portal access link: closes 7 days after departure, invalidated after 30 days
• Cleaning photos (before/after): 12 months from when the photo was taken (quality assurance and complaints) → automatically deleted; deleted earlier if the shift is moved or reassigned
• Employment contract document: for the duration of employment + the statutory retention period, in the archive; detached from the pseudonymised user record when the account is deleted
• Push notification device identifiers: until the device or account is deleted
• User account: retained for the duration of employment; can be deleted at any time (see section 9)
• Audit log (actions taken in the application): 2 years → automatically deleted
• Error log (Sentry): 90 days

7. Who the data is disclosed to (third parties)

Turnlap uses the following technical providers (sub-processors):

• Supabase Inc. (database + authentication) — EU, Ireland (AWS eu-west-1, Dublin). DPA: supabase.com/privacy
• Hetzner Online GmbH (server capacity) — EU, Helsinki. DPA: hetzner.com/legal/privacy-policy
• Functional Software Inc. (Sentry) (error reporting) — EU, Frankfurt. Error reports only, with personal data filtered out by a PII filter. Privacy: sentry.io/privacy
• 46elks AB (SMS gateway) — EU, Stockholm. Only the SMS recipient’s phone number + the message content. Privacy: 46elks.com/privacy
• Hostaway Inc. (booking system integration) — USA (Standard Contractual Clauses). Guest data, bookings. Privacy: hostaway.com/privacy-policy
• Apple Inc. / Google LLC (push notification delivery via APNs/FCM) — only the device token + message content, no user identification data.
• Anthropic PBC (AI assistants: morning briefing, weekly/monthly reports, guest message reply suggestions and classification, review classification, feedback summarisation, weekly CRM analysis) — USA. Transfer mechanism: not yet decided (EU-US DPF or SCCs); the data processing agreement (DPA) with Anthropic has not yet been signed (status: security/gdpr/SUB-PROCESSORS.md). API inputs are not used to train models. Transferred data is minimised: the names of cleaners, guests and customers are replaced with pseudonyms (“Cleaner A”, “Customer A”) or omitted from AI calls altogether, and WiFi passwords or door codes are never sent. The content processed includes property names, shift status and duration, the text of guest messages and reviews, and sales-pipeline stage and value data. Free-form text (a message, review, or ticket title) may contain a name the person wrote themselves. Privacy: anthropic.com/privacy

The application also has the following services integrated, which are not currently in use (no API key / feature switched off). Before any of them is activated, this policy will be updated and a data processing agreement will be signed with the provider: OpenAI (knowledge-base search index, USA), Resend (email notifications, USA), Telegram (admin alert channel, outside the EU). Google Distance Matrix (driving-route durations) processes only property coordinates, not personal data.

Data is not sold to third parties. Data is not used for advertising or profiling.

8. Transfer of data outside the EU

All primary databases are located in the EU (Supabase: AWS eu-west-1, Ireland; server: Hetzner, Helsinki; error reporting: Sentry’s EU data location, Frankfurt). Data is transferred outside the EU to the following processors:

• Hostaway (USA): guest contact details and bookings — Standard Contractual Clauses (SCCs).
• Anthropic (USA): inputs to the AI assistants, in which the names of cleaners, guests and customers have been pseudonymised or removed; may include the text of a guest message or review, cleaners’ shift data under a pseudonym, and CRM stage and value data under a pseudonym — transfer mechanism not yet decided (EU-US DPF or SCCs); DPA signature pending.
• Apple / Google: push notifications are routed via the standard APNs/FCM protocols (device token + message content).

No other transfers outside the EU are made. Transfer impact assessments (TIAs) and processing agreements are available on request.

9. Data subject rights

Under the GDPR, you have the following rights:

• Access to your own data (Art. 15) — as a cleaner you can download your own data in JSON format from the profile page (“Download my data”). Other requests via your supervisor or [email protected]; responses are provided within 30 days.
• Rectification (Art. 16) — incorrect data is corrected from the profile page or via your supervisor
• Erasure (“the right to be forgotten”) (Art. 17) — you can request deletion of your account from the profile page (while logged in). The deletion request is processed immediately; final anonymisation follows after a 30-day cancellation period. Data that must be retained by law (payroll, accounting) is anonymised to the extent permitted by law. Your name and email are also removed from admin notifications and alerts. The deletion event leaves an entry in the audit log (account identifier and timestamp, not the name or email) under the accountability obligation in Art. 17(3)(b) and Art. 5(2); the entry is removed after 2 years.
• Restriction of processing (Art. 18) — you can request restriction of processing in the event of a dispute
• Data portability (Art. 20) — JSON export from the profile page (cleaners) or on request from [email protected] (other data subjects)
• Objection (Art. 21) — you can object to processing based on legitimate interest (e.g. GPS location tracking). Toggle available on the profile page.
• Withdrawing consent (Art. 7) — SMS subscriptions can be cancelled at any time from the profile page
• Complaint to the Data Protection Ombudsman: tietosuoja.fi

10. Automated decision-making

The Turnlap shift algorithm suggests how cleanings are allocated among employees. Final confirmation is always made by a supervisor — the algorithm does not on its own make legal decisions concerning an employee. The algorithm uses as inputs the cleaner’s speed index, cluster skills, working-hour limits, and the MaRa collective agreement overtime threshold.

11. Data security

• Connections are encrypted using TLS 1.3 (HTTPS)
• The database is encrypted at rest (AES-256)
• Role-based access control (Row Level Security at the Supabase level)
• Passwords are stored as bcrypt hashes, never in plain text
• Access log: who accessed which data, and when (audit log retained for 2 years)
• Sentry error reports are filtered to remove PII

12. Children

Turnlap is intended for adult employees (aged 18 and over). The application is not marketed to children and does not collect data from anyone under the age of 16.

13. Use of mobile app permissions

• Location (while using the app): verifying the property for shifts. Location is used only while the app is open and you start or finish a cleaning — never in the background.
• Camera: taking before/after photos of the property being cleaned (only when the user themselves initiates the action)
• Push notifications: new shifts, cancellations, alerts (opt-in, can be turned off)

14. Cookies and similar technology (web)

• Necessary: login session (Supabase auth cookies)
• Functional: notification preferences (localStorage)
• No advertising cookies, no third-party tracking cookies

15. Changes to this policy

This policy may be updated as needed. Material changes are announced in the application, and users may be asked to acknowledge the new version. Earlier versions are archived and made available on request.

Updated: 12 September 2026 · Version 2026-09-12-v3
Related specific policy: Processing of location data