Netice Privacy Policy

Last updated and effective: 26 August 2026

This Privacy Policy explains how Netice Oy processes personal data in connection with the Netice websites, the Netice software-as-a-service application, app revenue and reporting workflows, customer support, sales, marketing, and other services that link to this Privacy Policy (collectively, the “Services”).

The company responsible for the processing described in this Privacy Policy is Netice Oy, Business ID 3188041-8, Finland (“Netice”, “we”, “us”, or “our”), except where Netice processes data solely on behalf of a customer as described in Section 4.

This Privacy Policy is intended to provide a complete and transparent description of our processing practices. It does not replace any Data Processing Agreement, order form, enterprise agreement, or other written agreement between Netice and a customer. If such an agreement conflicts with this Privacy Policy regarding Customer Data, the signed agreement controls to the extent of the conflict. Nothing in this Privacy Policy limits rights that cannot lawfully be limited.

Privacy at a glance

This summary highlights the main points. The full sections below provide the legally relevant detail.

• Netice is a controller for account, billing, security, support, website, and marketing data, and ordinarily a processor for Customer-selected source-report and destination data.
• Netice does not sell Personal Data, share it for cross-context behavioral advertising, operate as a data broker, or use raw Customer Data or credentials to train general-purpose AI models.
• Credentials are handled through protected secret-storage workflows, while Customer output is delivered to Customer-controlled destinations.
• The Services are not approved by default for protected health information or other special-category or highly regulated Personal Data.
• Processing locations depend on Netice providers and Customer-selected sources and destinations; no blanket country-specific residency promise applies unless agreed in writing.
• You can exercise applicable privacy rights by emailing info@netice.fi or using the Netice Support Portal.

Contents

1. Scope
2. Definitions
3. When Netice is a controller and when Netice is a processor
4. Personal data we collect or process
5. Sources of personal data
6. Purposes and legal bases
7. When data is required
8. Customer Data and customer responsibilities
9. Google user data and Google Sign-In
10. Cookies, local storage, analytics, and similar technologies
11. How and with whom we disclose personal data
12. Service providers and subprocessors
13. International data transfers and data residency
14. Data retention
15. Account, task, connection, and credential deletion
16. Security
17. Automated processing and service controls
18. No sale, targeted advertising, data brokerage, or unrelated AI training
19. EEA, UK, and Swiss privacy rights
20. United States privacy rights and California notice
21. Children
22. Sensitive and regulated data
23. Marketing communications
24. Third-party services and links
25. Changes to this Privacy Policy
26. Contact and privacy requests

1. Scope

This Privacy Policy applies when you:

• visit a Netice website that links to this Privacy Policy;
• create or use a Netice account;
• create, configure, run, monitor, or manage a data task, source connection, destination connection, workspace, or organization;
• purchase, trial, renew, or manage a Netice subscription;
• contact Netice for support, sales, demonstrations, security matters, or other business communications;
• receive business-to-business marketing from Netice; or
• otherwise interact with the Services in a context that links to this Privacy Policy.

This Privacy Policy does not govern a third-party website, platform, source system, destination system, payment service, authentication service, or other third-party service merely because the Services link to or interoperate with it. Those third parties process data under their own terms and privacy notices. It also does not govern an engagement covered by a separate privacy notice or signed agreement to the extent that the separate notice or agreement expressly applies.

2. Definitions

• “Customer” means the individual, company, organization, or other entity that purchases, trials, administers, or otherwise authorizes use of the Services.
• “User” means an individual who visits, registers for, accesses, administers, or otherwise uses the Services.
• “Customer Data” means data that a Customer or User submits to the Services, makes available through a connected source, instructs Netice to process, or causes Netice to deliver to a selected destination. Customer Data includes source report content, raw report artifacts, transformed or normalized output, and data included in customer-directed support materials.
• “Service Data” means account, configuration, usage, operational, diagnostic, security, billing, and support data generated or processed to operate, administer, protect, and improve the Services.
• “Personal Data” or “Personal Information” means information relating to, identifying, describing, or reasonably capable of being associated with an individual or household, as defined by applicable law.
• “Processing” means any operation performed on data, including collection, access, use, storage, transmission, transformation, disclosure, restriction, deletion, or destruction.

3. When Netice is a controller and when Netice is a processor

3.1 Netice as controller

Netice acts as a controller, business, or equivalent responsible entity when it determines the purposes and essential means of processing. This generally includes processing for:

• website operation and administration;
• account creation, identity, authentication status, and account security;
• workspace and organization administration;
• subscription, billing, tax, and commercial administration;
• customer support and communications;
• fraud, abuse, cost-abuse, security, availability, and legal compliance;
• service analytics and improvement using Service Data or properly de-identified data;
• business-to-business sales and marketing; and
• the establishment, exercise, or defence of legal claims.

3.2 Netice as processor or service provider

When a Customer selects app-platform reports, source systems, credentials, destinations, reporting windows, schedules, and processing instructions, the Customer ordinarily determines why the Customer Data is processed. In that situation, the Customer is the controller or business, and Netice acts as the Customer’s processor, service provider, or contractor. Netice processes that Customer Data only to provide, secure, support, and maintain the Services; follow documented Customer instructions; comply with applicable law; or as otherwise permitted by the applicable Data Processing Agreement.

If you are an individual whose personal data appears within Customer Data, the relevant Customer—not Netice—is normally responsible for providing the applicable privacy notice, establishing a legal basis, and responding to your request. Netice will assist the Customer as required by applicable law and the applicable Data Processing Agreement. Netice may direct your request to the Customer where appropriate.

3.3 Customer organization access

If your account belongs to or joins a Customer organization or workspace, the organization and its authorized owners, editors, administrators, or other members may be able to access or manage account-related information, membership data, roles, invitations, tasks, connections, subscription information, and Customer Data according to their permissions. The Customer controls its organization and is responsible for its users’ access.

4. Personal data we collect or process

The data actually processed depends on how you use the Services, the features you enable, the source and destination providers you select, your organization’s configuration, and the information you choose to provide.

4.1 Aggregated and de-identified data

Netice may create and use aggregated or de-identified statistics that do not reasonably identify an individual or Customer. We may use such data for service analytics, security, capacity planning, product development, benchmarking, research, reporting, and other lawful business purposes. Where required by law, Netice will maintain such data in de-identified form and will not attempt to re-identify it except to test the effectiveness of de-identification safeguards or as otherwise permitted by law.

5. Sources of personal data

Netice obtains Personal Data from the following sources:

• Directly from you, including through registration, account settings, task configuration, connection setup, checkout, support forms, email, meetings, surveys, and other communications.
• From your Customer organization, including an owner, administrator, inviter, billing owner, or other authorized user.
• From authentication providers, such as Google or Firebase Authentication, when you sign in or use multi-factor authentication.
• From billing and payment providers, including transaction, subscription, fraud, tax, and payment-status information.
• From Customer-selected sources, including Apple App Store Connect, Google Play, or other supported source systems that the Customer authorizes Netice to access.
• From Customer-selected destinations, including permission, target, write, and validation responses from BigQuery, Google Cloud Storage, Amazon S3, Snowflake, or other supported destinations.
• Automatically from the Services, including through logs, cookies, local storage, session technologies, security systems, and device or network interactions.
• From public and commercial business sources, such as company websites, professional directories, business databases, event lists, referrals, partners, or lawful business-contact providers, where permitted by law.
• From legal or security sources, such as regulators, courts, law enforcement, security researchers, fraud-prevention services, or other parties reporting misuse or a security concern.

6. Purposes and legal bases

The legal basis depends on the processing context and applicable law. Under the GDPR and equivalent laws, Netice generally relies on the following bases when acting as controller:

Where Netice relies on legitimate interests, we assess whether the processing is necessary and proportionate and whether your interests, rights, or freedoms override those interests. Where we rely on consent, you may withdraw consent at any time without affecting processing lawfully performed before withdrawal. Netice may continue processing where another legal basis applies.

7. When data is required

Some information is required to create or secure an account, enter into a contract, provide a selected feature, process payment, or comply with law. For example, an email address and required profile information are necessary for account creation; source and destination configuration is necessary to run a task; and billing or tax information may be necessary for a paid subscription. An optional phone number is not required for ordinary registration, but a phone number is required if you choose SMS-based multi-factor authentication. Marketing consent is optional.

If required information is not provided, Netice may be unable to create the account, authenticate the User, provide the selected connection or task, complete a purchase, respond to a request, or continue the relevant Services.

8. Customer Data and customer responsibilities

8.1 Customer instructions and lawful access

The Customer is responsible for determining what Customer Data is submitted or made accessible, choosing the source and destination, defining the purpose and legal basis, providing required notices, obtaining permissions or consents, and ensuring that its instructions comply with law and third-party terms. The Customer must have all rights and authority necessary to authorize Netice and its subprocessors to process Customer Data.

8.2 Selected report family and data minimization

Netice processes the source, report family, time window, and destination selected by the Customer. Customers should select only the reports, permissions, history windows, fields, and destination access needed for the intended workflow and should use least-privilege access wherever supported.

8.3 Customer-owned destinations

Netice is designed to deliver output to Customer-controlled destinations, such as BigQuery, Google Cloud Storage, Amazon S3, or Snowflake. Once data is written to a Customer-controlled destination, the Customer controls access, retention, copying, downstream use, backup, and deletion in that destination. Deleting data, a task, a connection, or an account in Netice does not automatically delete copies held in a Customer destination, source platform, export, backup, downstream system, or another User’s authorized records.

8.4 Credential grants remain under Customer control

Deleting or rotating a saved connection in Netice does not necessarily revoke the underlying permission, key, role, account grant, or API access at the third-party provider. The Customer must revoke or rotate provider-side access in the relevant Apple, Google, cloud, Snowflake, or other provider console when access should end.

8.5 Authorized operational access

Netice systems process Customer Data automatically. Authorized personnel may access limited Customer Data or configuration only when reasonably necessary to provide requested support, investigate a security or reliability issue, comply with law, protect rights, or perform another purpose permitted by the applicable agreement. Access is intended to be need-to-know, logged or otherwise controlled where appropriate, and subject to confidentiality obligations.

8.6 Data Processing Agreement

Customers that require a Data Processing Agreement may request one using the contact information in Section 26. The Data Processing Agreement, including any approved transfer mechanism and subprocessor terms, governs Netice’s processing of Customer Data on the Customer’s behalf.

9. Google user data and Google Sign-In

9.1 Google Sign-In data

If you use “Sign in with Google,” Netice may receive a Google account identifier, your primary Google account email address, your name and profile information made available through the authorized Google profile scope, and authentication status. Netice uses this information to authenticate you, create or link your Netice account, maintain account security, and prefill relevant account or checkout fields where appropriate.

The Google OAuth scopes used for Google Sign-In are:

• openid — associate you with your Google account identity;
• https://www.googleapis.com/auth/userinfo.email — view your primary Google account email address; and
• https://www.googleapis.com/auth/userinfo.profile — view basic Google profile information made available by Google.

9.2 Google API Services User Data Policy

Netice’s use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including the Limited Use requirements where applicable.

In particular, Netice does not use Google user data obtained through Google API scopes to:

• sell data to advertising platforms, data brokers, or information resellers;
• serve retargeted, personalized, interest-based, or cross-context behavioral advertising;
• determine creditworthiness or make lending decisions; or
• provide unrelated surveillance or profiling services.

Where Google’s Limited Use restrictions apply, human access is limited to circumstances permitted by those restrictions, such as with the User’s affirmative agreement for a specific support case, for security or abuse investigation, to comply with law, or for appropriately aggregated internal operations.

9.3 Google Play and other Customer-authorized Google data

Google Play report data or other Google data that a Customer authorizes Netice to access for a selected task is Customer Data. It is processed according to the Customer’s instructions, the applicable Google terms, this Privacy Policy, and any Data Processing Agreement. Google Sign-In does not by itself grant Netice access to the Customer’s Google Play reports, Google Cloud resources, or other Google data outside the scopes and permissions separately authorized by the Customer.

9.4 Revoking Google access

You may revoke Google account access through your Google account settings. Revoking authentication access may prevent Google-based sign-in. Revoking a source or destination grant may stop the affected task. Deleting a Netice connection does not replace provider-side revocation.

10. Cookies, local storage, analytics, and similar technologies

The Services may use cookies, local storage, session storage, pixels, tags, software-development kits, and similar technologies. These technologies may be set by Netice or by third parties that provide authentication, payment, security, content delivery, fonts, user-interface libraries, analytics, or other functionality.

10.1 Strictly necessary and security technologies

These technologies support authentication, session continuity, CSRF protection, security, fraud prevention, load management, language or interface preferences, account state, and other functions necessary to provide the Services. Because these technologies are necessary, disabling them may prevent parts of the Services from working.

10.2 Functional and preference technologies

These technologies remember choices such as language, interface state, or other preferences. Where required by law, Netice requests consent before using a non-essential functional technology.

10.3 Analytics technologies

Where enabled, analytics technologies help Netice understand website and product use, diagnose performance, and improve the Services. Netice will request consent before activating non-essential analytics cookies where applicable law requires it. The exact technologies in use may change, and the cookie notice or consent interface presented on the relevant website should be treated as the current list for that site.

10.4 Third-party technology requests

Third-party scripts or resources—such as Google or Firebase authentication components, reCAPTCHA used during certain security flows, Paddle checkout technology, content-delivery networks, hosted fonts, or software libraries—may receive network and device information such as IP address, user agent, page URL, and request time when your browser connects to them.

10.5 Advertising

Netice does not use cookies or similar technologies to sell or share Personal Information for cross-context behavioral advertising, and Netice does not serve targeted advertising based on activity across unrelated services.

10.6 Your choices

You may manage cookies through the consent interface where available and through your browser settings. Browser settings may not control all local-storage or software-development-kit technologies. Netice recognizes legally valid universal opt-out preference signals where required by applicable law. Because Netice does not sell or share Personal Information for cross-context behavioral advertising, such a signal does not change those practices. A browser “Do Not Track” signal is not treated as a separate consent mechanism where no uniform legal standard requires it.

11. How and with whom we disclose personal data

Netice does not disclose Personal Data merely because a recipient might find it useful. We disclose data only for the purposes described in this Privacy Policy, under Customer instructions, or as otherwise permitted or required by law. Recipients may include:

• Your Customer organization and authorized Users. Organization owners, editors, viewers, billing owners, and other authorized members may receive information according to their role and the Customer’s configuration.
• Cloud, hosting, database, authentication, security, and infrastructure providers. These providers help host, authenticate, store, secure, monitor, transmit, and operate the Services.
• Payment and billing providers. Paddle and related payment, tax, fraud, or invoicing providers may process checkout and transaction data under their own privacy notices and may act as independent controllers for processing they determine is necessary as merchant of record, payment provider, or for legal compliance.
• Customer-selected source and destination providers. Netice exchanges data with Apple, Google, Google Cloud, Amazon Web Services, Snowflake, and other supported providers when directed by the Customer. Those providers may process data as independent controllers, processors for the Customer, or subprocessors depending on the context and contract.
• Support, communications, and business-operation providers. These may include providers used for email, forms, customer support, communications, document management, accounting, auditing, and professional services.
• Professional advisers. Lawyers, accountants, auditors, insurers, financing parties, and other advisers may receive data where reasonably necessary and subject to professional or contractual confidentiality duties.
• Authorities and legal recipients. Netice may disclose data to courts, regulators, law enforcement, tax authorities, or other parties where required by law, necessary to protect legal rights or safety, or needed to investigate fraud, abuse, or a security incident. Where legally permitted and appropriate, Netice may seek to validate, narrow, challenge, or notify the affected Customer of a request.
• Corporate transaction recipients. Potential or actual investors, lenders, acquirers, sellers, successors, and advisers may receive data under appropriate confidentiality safeguards in connection with a financing, reorganization, merger, acquisition, sale of assets, insolvency, or similar transaction.
• Recipients you authorize. Netice may disclose data at your direction or with your consent.

A disclosure to a processor, service provider, contractor, Customer-selected destination, or other recipient for the purposes above is not a “sale” merely because data is transmitted as part of providing the Services.

12. Service providers and subprocessors

Netice uses third-party providers to deliver parts of the Services. Depending on the feature and configuration, providers may include Google Cloud and Firebase, Amazon Web Services, Paddle, authentication and security providers, email or support providers, content-delivery providers, and Customer-selected source or destination platforms.

Where Netice appoints a subprocessor for Customer Data, Netice uses contractual and organizational safeguards appropriate to the provider’s role and applicable law. A current subprocessor list and applicable Data Processing Agreement are available to eligible Customers upon request. If a Customer’s signed agreement includes advance subprocessor-notice or objection rights, Netice will follow that agreement.

A platform selected and independently controlled by the Customer is not necessarily a Netice subprocessor. For example, the Customer’s own BigQuery project, Google Cloud Storage bucket, Amazon S3 bucket, or Snowflake account may be part of the Customer’s infrastructure and remain governed by the Customer’s agreement with that provider.

13. International data transfers and data residency

Netice is established in Finland. Personal Data may nevertheless be processed in other countries because Netice uses international service providers and because Customers may select sources, destinations, users, or infrastructure located outside Finland or the European Economic Area (“EEA”). Those countries may have privacy laws or government-access rules that differ from those in your country.

Where Netice transfers Personal Data from the EEA, United Kingdom, or Switzerland to a country that is not recognized as providing adequate protection, Netice uses an appropriate transfer mechanism where required, such as the European Commission’s Standard Contractual Clauses, an applicable UK addendum, an adequacy decision, or another lawful safeguard. Netice may also use supplementary technical and organizational measures where appropriate.

The Customer controls important residency choices, including the region of its source systems and customer-owned destinations. If a Customer chooses a source, destination, User, or provider outside the EEA, the Customer instructs the corresponding international processing and is responsible for ensuring that its use has an appropriate legal basis and transfer mechanism.

Netice does not promise that all processing remains in the EEA, the United States, or any other specific country unless that commitment is expressly stated in a signed order form, Data Processing Agreement, or other written agreement. Selecting a region or destination does not by itself certify compliance with GDPR, CCPA, HIPAA, or any other framework.

14. Data retention

Netice retains Personal Data only for as long as needed to provide and secure the Services, meet legal obligations, resolve disputes, and protect legal rights. The periods below apply unless a valid legal hold or another applicable legal requirement requires longer retention.

14.1 Backups and legal holds

Individual account or workspace closure does not surgically rewrite historical backups. Live data is deleted through the closure process, and residual backup copies age out through bounded global recovery lifecycles. Backup data is not used for ordinary business purposes. If a backup is restored, newer closure and privacy records must be reconciled before the restored data can return to service.

For Netice SaaS application infrastructure, provider point-in-time recovery, if enabled, is limited to at most seven days. Ordinary Netice SaaS recovery points are limited to at most 30 days. One recovery point may remain for at most 90 days only when it is explicitly designated and documented as an incident or disaster-recovery baseline. WordPress marketing-site, customer-site, and Customer-owned backups are outside the Netice SaaS account-closure lifecycle.

Netice may preserve particular information longer where required by law, court order, a legal hold, a security investigation, fraud prevention, or a dispute.

14.2 Anonymization

Netice may retain irreversibly anonymized or aggregated information that no longer identifies an individual or Customer. Anonymization is not used as a substitute for deleting eligible active account or workspace configuration when a valid closure completes.

15. Account, workspace, task, connection, and credential deletion

Netice provides account and task controls and accepts verified deletion and closure requests. Cleanup is tenant-correct, retry-safe, and subject to these boundaries:

• Personal account closure. A valid personal closure removes eligible live personal profile, task, schedule, connection, session, and exclusive-credential state after cleanup completes. Deleting an ordinary organization member’s account does not delete data owned by that organization.
• Organization or workspace closure. An authorized closure removes eligible Netice-controlled tasks, schedules, saved connections, invitations, memberships, exclusive secrets, runtime configuration, and managed-target reservations. Closure is blocked where ownership or active billing must first be transferred, cancelled, or otherwise resolved.
• Closure record. A minimal closure record is retained for 30 days. It contains only the operation identifier, status, timestamps, and bounded result information needed for retries and immediate support. It does not contain destination names, credentials, provider report data, or customer revenue data.
• Customer-owned destinations. Account, workspace, task, or connection closure does not delete data already delivered to Customer-owned BigQuery, Snowflake, Google Cloud Storage, or Amazon S3 destinations.
• Provider-side data and access. Netice does not automatically delete provider-side accounts, data, cloud resources, or access grants. Customers remain responsible for provider-side revocation where applicable.
• Shared and exclusive secrets. Secret material shared by another authorized resource is preserved. An eligible exclusive secret is removed only after tenant ownership and the absence of every remaining reference are verified.
• Billing and legal records. Technical Paddle records follow the 90-day period above. Actual statutory accounting and other legally required records are not deleted merely because a SaaS account closes.
• Backups and security records. Residual backup copies and restricted security records follow the bounded lifecycles in Section 14 rather than per-account rewriting.

16. Security

Netice uses technical and organizational measures designed to provide security appropriate to the nature and risk of the processing. Depending on the system and feature, these measures may include:

• encryption in transit using modern transport security;
• encryption at rest or provider-managed storage protection where appropriate;
• server-side authentication, authorization, tenant, role, and subscription checks;
• multi-factor authentication options or requirements;
• session controls, CSRF and origin protections, rate limiting, and abuse controls;
• least-privilege source and destination access;
• protected secret storage and opaque secret references rather than raw credentials in ordinary task records;
• write-only handling for saved credentials so that raw values are not displayed back after saving;
• logging controls and redaction designed to avoid credentials and unnecessary Customer Data;
• monitoring, alerting, integrity checks, idempotency, locking, and safe retry controls;
• backup, recovery, patching, testing, and security-review processes; and
• need-to-know personnel access and confidentiality obligations.

No online service, transmission, credential, storage system, or security control is guaranteed to be completely secure. Netice therefore does not warrant absolute security or that every attack, error, loss, or unauthorized access will be prevented. Customers remain responsible for securing their own accounts, devices, users, source systems, destinations, permissions, and provider-side credentials; enabling appropriate multi-factor authentication; assigning minimum necessary roles; reviewing task output; and promptly revoking access that is no longer needed.

Do not include passwords, private keys, service-account JSON, tokens, full credentials, raw Customer Data, or other unnecessary sensitive information in support tickets, emails, screenshots, or public communications. Use the product’s designated credential workflow.

Where applicable law or a Data Processing Agreement requires notice of a Personal Data breach, Netice will provide notice to the relevant Customer, authority, or affected individual in accordance with that requirement. For more information about Netice’s public security posture, see the Netice Security Policy.

17. Automated processing and service controls

Netice does not ordinarily make decisions based solely on automated processing that produce legal effects or similarly significant effects concerning an individual, such as decisions about employment, credit, housing, healthcare, or education.

The Services do use automated controls to authenticate Users, evaluate subscription access, detect suspicious or abusive behavior, apply usage and cost controls, enforce task limits, validate permissions, reject unsafe inputs, rate-limit requests, stop duplicate work, pause or block tasks, and protect service integrity. These controls may temporarily restrict access or prevent an operation. They are designed to protect the Services and do not evaluate an individual’s creditworthiness or other protected life opportunity. A User may contact Netice if the User believes a control was applied incorrectly.

18. No sale, targeted advertising, data brokerage, or unrelated AI training

• No sale. Netice does not sell Personal Data or Customer Data for money or other valuable consideration as “sale” is defined by applicable privacy laws.
• No cross-context behavioral advertising. Netice does not share Personal Information for cross-context behavioral advertising and does not use Customer Data to target advertisements across unrelated services.
• No data brokerage. Netice does not operate as a data broker and does not provide Customer Data to information resellers.
• No credit or lending use. Netice does not use Customer Data or Google user data to determine creditworthiness or make lending decisions.
• No independent marketing use of Customer Data. Netice does not use raw Customer Data, source-report rows, credentials, or customer-owned destination content to market unrelated products to individuals.
• No general-purpose AI training with raw Customer Data. Netice does not use raw Customer Data or credentials to train general-purpose AI models. Netice may use de-identified or aggregated Service Data, and may process bounded operational metadata with service providers, to improve security, reliability, support, and product functionality. Any materially different use of identifiable Customer Data for artificial-intelligence training would require an updated disclosure and any consent or contractual authorization required by law.

Netice may disclose data to processors, service providers, Customer-selected platforms, or transaction participants for the purposes described in this Privacy Policy. Such operational disclosure is not a sale or advertising share merely because data is transmitted.

19. EEA, UK, and Swiss privacy rights

Where applicable, you may have the following rights concerning Personal Data for which Netice acts as controller:

• Access: obtain confirmation of processing and a copy of relevant Personal Data.
• Rectification: correct inaccurate or incomplete Personal Data.
• Erasure: request deletion where the legal conditions are met.
• Restriction: request that processing be limited in certain circumstances.
• Portability: receive certain data you provided in a structured, commonly used, machine-readable format where the legal conditions are met.
• Objection: object to processing based on legitimate interests, taking account of your situation.
• Direct-marketing objection: object at any time to processing for direct marketing, including related profiling.
• Withdraw consent: withdraw consent at any time where processing relies on consent, without affecting prior lawful processing.
• Automated decisions: exercise rights concerning a solely automated decision that produces legal or similarly significant effects, where applicable.
• Complaint: lodge a complaint with a competent supervisory authority.

You may exercise these rights using the methods in Section 26. Netice may request information reasonably necessary to verify your identity, authority, account, or request. Netice may decline or limit a request where permitted by law, including where Netice cannot verify the requester, the request would adversely affect another person’s rights, the request is manifestly unfounded or excessive, or retention is required for law, security, fraud prevention, or legal claims.

Netice responds within the period required by applicable law. If additional time is lawfully needed because of complexity or volume, Netice will provide notice. Netice generally does not charge a fee, but may charge a reasonable fee or refuse repetitive, excessive, or manifestly unfounded requests where permitted by law.

If the request concerns Customer Data controlled by a Netice Customer, contact that Customer first. Netice may forward the request to the Customer and assist under the applicable Data Processing Agreement.

The lead supervisory authority in Finland is the Office of the Data Protection Ombudsman. You may also complain to the supervisory authority in the EEA country of your habitual residence, place of work, or alleged infringement.

20. United States privacy rights and California notice

20.1 Rights under applicable U.S. state privacy laws

If a U.S. state privacy law applies to Netice and your Personal Information, you may have rights to request access or confirmation, correction, deletion, portability, information about categories and recipients, opt-out of sale or targeted advertising, limitation of certain sensitive-data uses, review of certain automated decisions, or an appeal of a denied request. You may also have a right not to receive discriminatory treatment for exercising a privacy right.

Netice does not sell Personal Information, does not share it for cross-context behavioral advertising, and does not process it for targeted advertising as described in Section 18. Netice does not offer a financial incentive or price difference in exchange for Personal Information. Where legally required, Netice honors recognized universal opt-out preference signals. An authorized agent may submit a request where permitted by law, but Netice may require evidence of the agent’s authority and may verify the request directly with you.

To submit a request or appeal, use the email or Support Portal listed in Section 26 and identify the request as a “U.S. Privacy Request” or “Privacy Appeal.” Netice will verify and respond within the period required by the applicable law.

20.2 California notice at collection

The following table describes categories of Personal Information that Netice may have collected in the preceding 12 months when acting as a business or controller. Netice does not necessarily collect every example from every person. The purposes, sources, retention criteria, and recipient categories are described in Sections 4–14.

Netice may disclose these categories for business purposes to the recipients in Section 11, including infrastructure, authentication, payment, security, support, professional-adviser, Customer-organization, and Customer-selected source or destination recipients. Netice has not sold these categories or shared them for cross-context behavioral advertising in the preceding 12 months.

21. Children

The Services are business services and are not directed to children. You must be at least 18 years old, or the age of legal majority in your jurisdiction if higher, to create or administer an account unless Netice expressly agrees otherwise in writing. Netice does not knowingly collect Personal Data from children through the Services. If you believe a child has provided Personal Data to Netice, contact us so that we can investigate and take appropriate action.

22. Sensitive and regulated data

The Services are not designed or approved by default for special-category or highly regulated Personal Data, including protected health information, medical or genetic data, government identification numbers, full payment-card data, bank-account credentials, biometric identifiers used for identification, precise geolocation, criminal records, children’s data, or information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, health, sex life, or sexual orientation.

Customers must not submit, connect, or instruct Netice to process such data unless Netice has expressly agreed in a signed written agreement that identifies the data, permitted purpose, security requirements, and legal terms. Netice does not provide HIPAA compliance or sign a Business Associate Agreement by default, and no “HIPAA version,” “CCPA version,” or regional configuration should be inferred from ordinary use of the Services.

If Netice becomes aware of prohibited or materially risky data, Netice may restrict processing, quarantine or remove data, suspend the affected task or account, require remediation, or take other action permitted by the Terms of Service and law. The Customer remains responsible for unlawful or unauthorized submission and for its own compliance obligations.

23. Marketing communications

Netice may send service communications that are necessary for an account or business relationship, such as authentication notices, security alerts, task or billing notices, support responses, and material operational updates. These are not marketing communications, and you may be unable to opt out while the relevant account or relationship remains active.

Netice may separately send newsletters, product information, event invitations, or other business-to-business marketing where permitted by law. You can opt out at any time through the unsubscribe method in the message or by contacting Netice. Opting out of marketing does not stop necessary service communications. Netice may retain a minimal suppression record to ensure that the opt-out is honored.

24. Third-party services and links

The Services interoperate with and may link to third-party services. Netice does not control and is not responsible for a third party’s independent privacy, security, availability, terms, or data-retention practices. Before authorizing a source, destination, sign-in method, payment provider, or other third party, review its terms and privacy notice. A Customer’s instruction to connect a provider authorizes the data exchange necessary for that connection, subject to the Customer’s permissions and the applicable agreement.

25. Changes to this Privacy Policy

Netice may update this Privacy Policy to reflect changes in law, the Services, providers, security practices, or processing activities. The “Last updated and effective” date shows when the current version took effect. For a material change, Netice will provide notice appropriate to the nature of the change, such as through the Services, account email, website notice, or a request for consent where consent is legally required. Continued use after an effective date does not waive rights that require affirmative consent under applicable law.

26. Contact and privacy requests

Data controller contact:

Netice Oy
Business ID: 3188041-8
Finland
Email: info@netice.fi
Support Portal: https://netice.fi/product/support/

Use the subject line “Privacy Request”. Existing Users should submit the request from the email associated with their account and, where safe and available, include the User ID shown in the Account section. Do not include passwords, private keys, tokens, full credentials, or raw Customer Data in the request.

To protect Users and Customers, Netice verifies requests using information proportionate to the request and risk. Verification may include a logged-in request, confirmation from the account email, an internal User ID, organization authorization, or other reasonable evidence. Netice will not disclose account data or act on a destructive request unless it can reasonably verify identity and authority.

If your request concerns data controlled by your employer, client, or another Netice Customer, contact that Customer first. If you contact Netice directly, identify the relevant Customer so that Netice can route and assist with the request.

27. Interpretation and contractual priority

This Privacy Policy describes Netice’s general privacy practices. It is not a certification, audit report, data-residency guarantee, security warranty, service-level agreement, or promise that a particular Customer’s use complies with every law. Customers remain responsible for configuring and using the Services lawfully.

For Customer Data, a signed Data Processing Agreement, order form, or enterprise agreement controls over this Privacy Policy to the extent of a direct conflict. For Netice’s controller processing, this Privacy Policy applies subject to mandatory law. If this Privacy Policy is translated, the English version controls to the extent permitted by law.