1. Data Controller

Oodi Oy Business ID (Y-tunnus): 3591926-9 Address: Rantapolku 1 B 1, [TBD], Finland
Email: [TBD: e.g. privacy@oodi.app]

2. Data Protection Contact Person

Data Protection Contact Email: [TBD: e.g. privacy@oodi.app] (We highly recommend using a dedicated email address for privacy-related requests and user communications.)

3. Name of the Register

Oodi Service User and Customer Register.

4. Purpose and Legal Basis for Processing

Personal Data We process your personal data for the following purposes: Service Provision and Contract Performance: To provide the core functionalities of the Oodi app (such as manual logging of baby crying and daily routines), manage user accounts, and provide customer support.

Customer Communication and Marketing: To inform you about service updates, news, and to send newsletters (subject to your consent or legitimate interest).

Service Improvement: To enhance the user experience of the app and collect anonymized statistical data to develop the scientific and technical foundation of our service.

Lawful Bases for Processing (EU GDPR and UK GDPR): Contract: Processing is necessary for the performance of a contract when you use our app and accept our Terms of Service. Consent: We request your explicit consent for electronic direct marketing (newsletters) and for processing sensitive information (baby wellbeing logs). You can withdraw your consent at any time. Legitimate Interest: For B2B pilot programs, professional outreach, and ensuring the fundamental security and functionality of our platform.

5. Categories of Personal Data Processed (Data We Collect)

We process only the personal data necessary for the service: Basic User Information: Email address, password (encrypted), and login credentials.

Child’s Information (as entered by the user): Child’s birth date or due date (required to activate app features tailored to the child’s development stage), child’s first name or nickname (optional).

Usage Logs and Recorded Data: Infant crying amounts, times, and other daily logs manually recorded by the user.

Technical Data: IP address, device type, and app usage statistics (analytics).

Payment Details: Information on subscription tiers, deposits, and purchase history (payments are processed securely via our third-party payment gateway; we do not store your credit card information).

6. Regular Sources of Data

Personal data is collected directly from you when you register for the app, participate in our pre-order or beta phases, subscribe to our newsletter, or use the app’s features.

7. Regular Disclosures and Data Transfers Outside the EU/EEA

We do not sell or disclose your personal data to third parties for marketing purposes. We use trusted service providers (such as hosting and payment processors) who process data on our behalf under strict data processing agreements. Data Transfers (especially UK/EEA):

As our service targets consumers in both Finland (EU) and the United Kingdom (UK), personal data may be processed in both jurisdictions. The European Commission and the UK Government have both issued reciprocal adequacy decisions for each other. This means personal data can flow freely between Finland and the UK without requiring additional transfer safeguards (such as SCCs). Our primary servers are located within the EU/EEA.

8. United Kingdom (UK) Representative

In accordance with Article 27 of the UK GDPR, Oodi Oy has designated a representative in the United Kingdom to act as a local point of contact for UK customers and the UK supervisory authority: UK Representative Name: [TBD: e.g. UK GDPR Representative Service Provider Ltd / Local Representative]
Contact Details: [TBD: Postal address and email address in the UK]

9. Data Retention Period

We store your personal data only as long as necessary for the customer relationship or service provision: Account data and logs are stored for as long as your account is active. You can delete your account and all associated data at any time through the app settings.

If your account remains inactive for more than [TBD: e.g. 24 months], your account and associated data will be automatically deleted or anonymized. Marketing data is retained until you opt out or unsubscribe.

10. Data Security Measures

Your data is protected using modern technical and organizational security methods. All communications between the app and our servers are encrypted (SSL/TLS encryption). Access to databases is strictly restricted to authorized personnel who require access to perform their duties, and strong authentication is mandatory.

11. Your Rights under EU and UK GDPR

You have the following rights regarding your personal data: Right of Access:

The right to receive a copy of the personal data we hold about you (Subject Access Request). Right to Rectification and Erasure: The right to request correction of incorrect data or deletion of your data (“the right to be forgotten”).

Right to Data Portability: The right to receive your data in a structured, machine-readable format to transfer it to another service.

Right to Object: The right to object to the processing of your data for direct marketing. All our emails contain an easy “unsubscribe” link (opt-out).

Right to Withdraw Consent: If processing is based on your consent, you can withdraw it at any time, and we will cease processing. To exercise your rights, please contact us at [TBD: e.g. privacy@oodi.app].

We will respond to your request within the statutory timeline of one (1) month.

12. Right to Lodge a Complaint

with a Supervisory Authority: If you believe we are processing your data in violation of data protection laws, you have the right to lodge a complaint with a regulatory authority: In Finland: Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) (www.tietosuoja.fi) In the UK: Information Commissioner’s Office (ICO) (www.ico.org.uk)