Go to content

Privacy Policy

Johku Privacy Policy and Data Protection Principles for Processing Personal Data

This privacy policy describes the key data protection principles according to which Aptual Commerce Oy (business ID 2735384-2, hereinafter Johku) processes personal data.

Johku is not the controller of personal data that its contractual partners collect through the Johku Service. Johku is the controller of the data in the Merchant Register and the User Accounts.

Contents

Johku

Johku is a browser-based system built for digital commerce. It enables a company, association or other entity with a business ID to sell its products and services, which are purchased by private customers, companies or associations. Johku is developed and maintained by Aptual Commerce Oy.

Controller and contact person

For matters relating to data protection and the processing of personal data, please contact:

Sami Hänninen
sami@johku.com
tel. +358 40 721 7717

Aptual Commerce Oy / Johku
Business ID 2735384-2
Niittymäentie 13, 46110 TUOHIKOTTI, Finland
tel. +358 40 721 7717
tuki@johku.com

Transparency

Johku operates responsibly and is open about how it processes personal data. Johku informs you of the predefined purposes for which your personal data is used.

Principles of processing personal data

Johku processes personal data with awareness of and respect for the following data protection principles:

  • data must be processed lawfully, fairly and in a transparent manner in relation to the data subject
  • data must be processed for specified, explicit and legitimate purposes (purpose limitation)
  • data must be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed (data minimisation)
  • data must be accurate and, where necessary, kept up to date (accuracy)
  • data is not kept for longer than necessary (storage limitation)
  • data must be processed in a manner that ensures appropriate security of the personal data (integrity and confidentiality)
  • data is not transferred to third parties without appropriate safeguards
  • the rights of the data subject must be respected in the processing of data

Data collected

Johku's starting point is to minimise the amount of data processed in all of its processes. Johku collects data that is relevant for establishing, analysing and developing a successful customer service process and for managing the customer and contractual relationship.

Johku collects and processes the following data on its customers, users and partners that arises in its processes: name, telephone number, email address, company name, business ID, billing address and other data provided to Johku or generated through the use of the Johku Service.

In addition to customers and partners, data may also be collected from website visitors and other parties interested in Johku, as described in this policy.

Johku separately collects data on the use of its services, using cookies and other technical data, in order to improve the user experience and analyse the use of its services. The analytics systems of the online services also collect device-specific identifiers in accordance with the cookie policy. For visitors to Johku's websites, the following data is recorded, for example: IP address, browser type, type of computer or other device, time and date of the user's visits, time spent on the website, the website from which the user arrived at the service, or other similar technical data. In addition, data relating to various usage situations in Johku is recorded.

Website visitors can set their web browser to block cookies. A decision to block cookies may mean that some parts of the services do not work properly.

Johku may also use targeted forms of electronic marketing in its communications if the user of the service has given consent to this.

Johku collects and processes the above data for the following purposes:

  • management of the personal data of logged-in users (Johku users, user accounts)
  • maintenance of the Johku Service
  • communications relating to the Johku Service and management of the customer relationship
  • producing, providing, developing, improving and securing the Johku Service
  • merchant-specific personalisation of the Johku Service
  • analysis and statistics on the use of Johku
  • development, analysis, segmentation and statistics of customer relationships
  • prevention and investigation of misuse
  • other similar purposes

Legal basis for processing personal data

The legal basis for processing is primarily the performance of the contract concluded with Johku's contracting customer, but also compliance with Johku's legal obligations (for example, the Accounting Act), Johku's legitimate interest (for example, maintenance, development and statistics) or the user's consent (for example, marketing).

Contract and consent

The data subject may give unambiguous consent to the processing of their personal data for one or more purposes. The legal basis for processing data relating to a customer acting as a Johku merchant is the contract that is formed when the customer orders the Johku Service. Where applicable, consent is also a legal basis for processing, to enable the purposes listed above.

For others, the legal basis for processing is typically consent, given for example by registering a user account, subscribing to a newsletter or announcements, or otherwise given separately.

Legitimate interest

Processing of personal data may be in the legitimate interest of the controller, for example where there is a relevant relationship between the controller and the data subject. This means that the data subject is, for example, a customer or employee of the controller. In its sales processes, Johku also adds persons in decision-making positions in companies and associations to its marketing register on the basis of legitimate interest. Each business decision-maker added to the register is selected by assessing the usefulness of Johku to the company they represent.

Legal obligation and public interest

Johku may also process personal data on the basis of legislation and the public interest (for example, separately regulated journalistic purposes in certain cases), as provided by law. Such processing is based on applicable legislation, and Johku does not apply it expansively or contrary to guidance from the authorities.

Regular sources of data

The data in the register originates from the customers themselves and accumulates through the use of the services.

Personal data concerning data subjects is, as a rule, collected from the data subjects themselves by electronic means when they deal with Johku. The data provided may be combined with data found in public sources, such as Trade Register data or social media accounts that have been made public.

Data retention period

Data is retained for as long as a contract or other consent between the data subject and Johku is in force. Johku retains the data subject's data, according to each category of data, only for as long as is necessary to fulfil the purposes defined in this policy, in accordance with the legislation in force at the time. Johku informs the data subjects in the personal data registers it maintains about matters relating to the processing of personal data and offers them the opportunity to have their data removed from the register, which also removes the contract and/or consent. If the data subject does not keep the contract or consent active through their own activity, Johku automatically deletes the data from its registers after 24 months.

Data may also be partly transferred to the marketing register or converted into a form from which the data subject can no longer be identified (anonymisation). If a person refuses marketing, Johku retains the information about the refusal and the contact details in order to ensure that the refusal is complied with.

Data may be retained for longer to the extent necessary to fulfil the terms of a contract or obligations imposed by applicable legislation, such as accounting obligations (6 years from the end of the financial period), and to demonstrate that these have been properly fulfilled.

Google Calendar

The user may choose to use Google Calendar to view booking data in Johku and to restrict the availability of bookable products.

When the user grants Johku access to their calendar, Google Calendar allows the following:

  • Johku can create calendars for selected products and/or resources.
  • Johku can create, update and delete events in the calendars that Johku has created in Google Calendar for products and/or resources.
  • Johku can retrieve a list of the user's Google Calendars and, based on it, create a selection list for allowing or blocking availability in resources.
  • Johku can read busy times from calendars selected by the user in order to block or allow the availability of resources.

To update Google Calendar data, Johku uses a key (access token) stored in Johku's settings, which was created when Google Calendar was connected.

When the user allows Johku to use their Google Calendars, the user can enable synchronisation of bookings to Google Calendar. This feature automatically creates, updates and deletes events, including all order details, in the Google Calendar corresponding to the product or resource.

Johku does not download or store data contained in the user's existing Google Calendars and their events. Johku only uses and stores the names of the calendars selected by the user in its database. Calendar names are shown only to authenticated users who have access to product and resource management.

Google Account

The user may choose to use a Google Account to log in to Johku. A logged-in user has access either to Johku administration or, alternatively, to an environment for logged-in users defined by Johku or by a Johku merchant.

When the user grants Johku permission to use their Google Account for logging in, the Google Account allows Johku to receive and store the user's name, email address details and a key (access token) from that account.

Microsoft Account

The user may choose to use a Microsoft Account to log in to Johku. A logged-in user has access either to Johku administration or, alternatively, to an environment for logged-in users defined by Johku or by a Johku merchant.

When the user grants Johku permission to use their Microsoft Account for logging in, the Microsoft Account allows Johku to receive and store the user's name, email address details and a key (access token) created for this purpose from that account.

Disclosure of data

The data that Johku collects in its registers is used exclusively by Johku.

With the user's consent, data may be disclosed to partners or to other merchants (for example, when a sales channel is published to other Johku merchants). As a rule, data may only be disclosed for purposes that are not in conflict with Johku's data protection principles.

Data may also be disclosed to buyers in connection with corporate transactions, if Johku sells or otherwise reorganises its business.

Data may be transferred to partners and/or subcontractors selected by the controller who process the data on behalf of the controller, on the basis of an agreement between the parties. In such cases, the processor has no right to process the transferred data on its own behalf.

Data is not transferred outside the territory of the Member States of the European Union or the European Economic Area unless this is necessary for the purposes of processing the personal data or for the technical implementation of the processing. Johku maintains a list of its partners and subcontractors, which also shows the location of each party and the data protection principles applied to the transfer: DPA, Annex A Sub-processors.

Protection of personal data in Johku's operations

Only the controller's staff have access to the complete data. All staff members are bound by a valid confidentiality agreement.

Johku is hosted exclusively in a server environment controlled by Aptual Commerce Oy, which is isolated from other servers. The server environment is protected by a firewall, and remote administration access is strictly limited to specific persons over a secure connection. No other services run in the same server environment. The server environment is located in the highly reliable and highly secured cloud of UpCloud Oy (upcloud.fi), physically located in Finland within the EU.

The server environment uses up-to-date, secure software versions. All browser traffic is transmitted over an encrypted HTTPS connection. Johku.com has an SSL rating of A+ (SSL Labs test).

All data is protected against unauthorised access and against accidental or unlawful destruction, alteration, disclosure, transfer or other unlawful processing.

Where Johku uses partners or subcontractors in processing its registers, Johku pays particular attention to the service provider's data protection practices and technical implementation. In addition, partners and subcontractors must demonstrate that they act in accordance with the requirements of data protection regulation. Johku has valid agreements in place with all the processors it uses.

Rights of the data subject

Right of access, rectification and erasure

The data subject has the right to access the personal data stored about them. At the data subject's request, personal data that is inaccurate, unnecessary, incomplete or outdated for the purposes of the processing may be rectified, erased or supplemented. A Johku user can review the data stored about them and make corrections where necessary directly in their user account settings.

For other registers, a merchant may at any time submit a request to Johku's contact person for the data concerning them, and may review the data, request rectification and otherwise exercise their rights under data protection legislation.

Right to data portability

The data subject can have the personal data they have provided transferred to themselves or to another controller by contacting Johku. Data portability requires that the data has been provided to Johku by the data subject themselves, or that the data is processed by automated means on the basis of consent or a contract.

Right to object and restriction of processing

The data subject may object to processing on lawful grounds. Processing may also be restricted, for example, where the data subject contests the accuracy of the personal data, in which case processing is restricted for a period that enables Johku to verify the accuracy of the data.

The data subject may at any time prohibit the disclosure and processing of their data for direct marketing and related profiling by contacting Johku.

Right to withdraw consent

The data subject may withdraw their consent at any time by contacting Johku.

Right to lodge a complaint with a supervisory authority

The data subject has the right to lodge a complaint with the authority if they consider that their data has been processed in breach of this privacy policy, these principles or the legislation in force at the time. The contact details of the Data Protection Ombudsman can be found at the end of this privacy policy.

Johku hopes that the data subject will first contact Johku so that the matter can be resolved quickly and effectively:

Johku
tel. +358 40 721 7717
tuki@johku.com

Sami Hänninen
sami@johku.com
tel. +358 40 721 7717

Profiling and automated decision-making

Johku does not use profiling or automated decision-making based on profiling.

Changes to this privacy policy

Johku continuously develops its services and reserves the right to amend this privacy policy. Changes may also be based on changes in legislation.

Last updated

30 June 2026, SH

Supervisory authority contact details

Office of the Data Protection Ombudsman

Visiting address: Lintulahdenkuja 4, 00530 Helsinki, Finland
Postal address: P.O. Box 800, 00531 Helsinki, Finland
Switchboard: +358 29 566 6700
Email: tietosuoja@om.fi