Varjo Technologies Oy (“Varjo” or “we”) is committed to respecting your privacy and protecting your personal data.

This Privacy Policy describes how Varjo, as the data controller, processes personal data relating to:

• our current and potential customers (consumers and organisations), vendors, and other business partners, including personal data of their employees, representatives and other contacts;
• users of our products or services, including our website and social media services; and
• other business contacts.

In this Privacy Policy, you will find information about the personal data Varjo collects about you, how it is used, and with whom it is shared. This Privacy Policy also provides you with information about your rights.

If you have any questions or concerns about this Privacy Policy or Varjo’s processing of your personal data, or if you wish to exercise your rights, please contact us by emailing privacy@varjo.com.

1. When do we process your data?

1.1 Provision of Varjo’s products and services and customer communications

If you are a customer, associated with one of our customers or otherwise use our products and services, we may process your personal data to:

• register customer and user accounts, register products, and deliver our products and services to you, including providing related maintenance, troubleshooting, support, and customer service;
• manage and administer contracts, accounts, licenses and subscriptions with us;
• maintain and develop our relationship with customers and users, including sending important notices to you, processing feedback, and providing other customer communications to you;
• provide and manage warranties, and ensure product safety, including notifying you of product recalls and potential safety issues concerning our products;
• manage invoices and transactions;
• uphold the security of our products, services and IT environment, and protection of data;
• prevent abuses and unauthorized use of our products and services; and
• comply with our other obligations and enforce our rights under the contracts for the products and services.

For these purposes, we may process the following categories of personal data:

• basic customer and user information, such as customer ID and account information, contact information, organization, country in which you are located, and type of customer;
• your IP address and the location of your connection approximation based on your IP address at country, state, or city level;
• login information, such as your username and password;
• subscription and service adoption details, such as active subscriptions and past subscriptions;
• device and activation information, such as the type, model, firmware and accessories of the device(s) used, and the serial number / ID, date of activation, and warranty validity period;
• usage data, such as session data including the software, services and features used, the duration of the session and the configuration and hardware setup;
• technical data, such as network, temperature and power conditions, device fault codes and other error messages;
• for users of Varjo’s cloud based streaming services, eye-tracking data as necessary for provision of the service;
• for users of Varjo’s cloud based services, any personal data that may be uploaded by our customer in connection with using the service;
• information received in connection with or needed to resolve a support request, including your approximate location;
• feedback and communications; and
• error and security log data from our website and services, including your IP address.

We process the personal data described above based on our legitimate interests relating to our relationships with our customers and users, in preventing and following up on defects in our products or services, and in performing our obligations and exercising our rights in contracts with our customers and related agreements and terms, such as end user license agreements and warranties.

However, we will only access, collect and further process data stored in Varjo products (for example, device usage data) or equipment you use in connection with our services (for example, to set cookies used by our website) with your permission. As an exemption, we do not need your permission to do so if the data is necessary to enable communications or to provide the requested service.

1.2 Newsletters, marketing and sales

If you are associated with one of our existing or potential customers or business partners, if you have subscribed to our newsletters, or if you are otherwise identified as a relevant contact, we may process your personal data to:

• provide you with information and materials about our products and services, for example by sending you newsletters and direct marketing messages, and through advertising;
• target and tailor marketing messages to you, including to detect user trends;
• understand the use, promotion, and sales of Varjo’s products to conduct more accurate overall marketing messages;
• develop and analyze our relationships with our business partners and our customers;
• adapt our interactions to provide you with the best communications experience;
• register participants for, arrange, and follow up on our events and webinars;
• collect, receive and process feedback and surveys;
• perform market and customer analysis;
• contact you to provide information about our services and assess your potential interest in Varjo’s products and services; and
• prepare and make offers concerning our products and services.

For these purposes, we may process the following categories of personal data:

• your basic contact information;
• your IP address and the location of your connection approximation based on your IP address at country, state, or city level;
• publicly available information (e.g., on public websites or professional social media); and
• your marketing preferences.

In addition, if you are a customer, user, or otherwise associated with a customer, we may also process the following categories of personal data:

• customer information relating to you, such as customer ID and account information, organization, country in which you are located, type of customer, and any information freely given by you;
• your IP address and the location of your connection approximation based on your IP address at country, state, or city level;
• subscription and service adoption details, such as active subscriptions and past subscriptions;
• customer satisfaction data, such as customer survey data;
• device and activation information, such as the type, model, firmware and accessories of the device(s) used, and the serial number / ID, date of activation and warranty validity period; and
• usage data, such as session data, including the software, services and features used, the duration of the session and the configuration and hardware setup.

We process the personal data described above based on our legitimate interest in promoting Varjo’s products, services and brand, including our interest in offering the benefit of a customized communications experience and conducting more accurate marketing and sales activities.

However, we will only access, collect and further process data stored in Varjo products (for example, device usage data) or equipment you use in connection with our services (for example, to set cookies used by our website) with your permission. As an exemption, we do not need your permission to do so if the data is necessary to enable communications or to provide the requested service.

1.3 Business management and improvement of Varjo’s products and services

If you are associated with one of our existing or potential customers or business partners, connected to our products and services or otherwise interact with us, we may process your personal data to:

• develop our products and services, including by means of research and analysis;
• track and manage our device inventories and flow on the markets;
• enable us to plan and manage our business and customer facing activities, including by means of data analysis;
• analyze account and use data (mainly in combined and aggregated form) to support the processing purposes described in this Privacy Policy.

For these purposes, we may process the following categories of personal data:

• basic customer and user information, such as customer ID and account information, contact information, organization, country in which you are located, and type of customer;
• your IP address and the location of your connection approximation based on your IP address at country, state, or city level;
• login information, such as your username and password;
• subscription and service adoption details, such as active subscriptions and past subscriptions;
• device and activation information, such as the type, model, firmware and accessories of the device(s) used, and the serial number / ID, date of activation and warranty validity period;
• usage data, such as session data including the software, services and features used, the duration of the session, and the configuration and hardware setup;
• technical data, such as network, temperature and power conditions, device fault codes and other error messages;
• customer satisfaction data, such as customer survey data; and
• your IP address and the location of your connection approximated based on your IP address at country, state, or city level.

We process the personal data described above based on our legitimate interests in developing and improving our products and services, as well as our business and relationships with customers, business partners and their contacts, and in succeeding in communications and promoting our services.

However, we will only access, collect and further process data stored in Varjo products (for example, device usage data) or equipment you use in connection with our services (for example, to set cookies used by our website) with your permission. As an exemption, we do not need your permission to do so if the data is necessary to enable communications or to provide the requested service.

1.4 Management of vendor and other business relationships

If you are associated with to one of our current or potential vendors or another business partner, we may process your personal data to:

• prepare and execute contracts and orders;
• manage invoices and transactions;
• comply with our obligations and enforce our rights under the contracts with the business partner; and
• provide communications.

For these purposes, we may process the following categories of personal data:

• your contact details;
• information relating to contracts, transactions and deliveries with us;
• information relating invoices from us; and
• your communications with us.

We process the personal data described above based on our legitimate interests relating to our relationship with our current and potential vendors and other business partners.

1.5 Compliance with laws and legal defense

We may process personal data to comply with our legal obligations, including under tax, corporate, accounting, product liability and anti-money laundering laws. If necessary, we may also process personal data to bring legal claims and/or respond to and defend against legal claims.

For these purposes, we may process the following categories of personal data:

• basic identification and contact information;
• details of relationships with customers and business partners;
• information relating to product safety, including in relation to potential recalls;
• invoicing and transactions data;
• details in accounting and company records; and
• any personal data necessary to establish, exercise or defense of legal claim.

We process the personal data described above based on our legal obligations, and our legitimate interest in assessing, bringing and defending against legal claims, including  investigating  misconduct and fraud.

2. From where do we collect your personal data?

We primarily obtain your personal data directly from you or the customer or business partner you are connected to, for example when you order and use our services or have any other communication and interaction with us, including product usage data you have chosen to share to us. We may receive your personal data also if it is uploaded by a customer when using Varjo’s cloud-based services. We may also collect personal data from public and private third parties, such as information service providers, social media and websites.

Please read our Cookie Policy to learn how we use cookies and similar tracking technologies in our website.

Please note that you need to provide certain personal data to use our services and products, and refusal to provide such data may affect the availability or delivery of our services and products.

3. Who do we share your personal data with and why?

For the purposes described in this Privacy Policy, we may share your personal data with:

• Connected parties. We may share your personal data with the customer or business partner who you are associated with, and their other representatives or contacts.
• Our group companies. We may share your personal data within our group of companies, including our affiliates and other associated companies, for any of the legitimate purposes described in this Privacy Policy.
• Vendors and third-party service providers. We may share your personal data with our vendors and third-party service providers which provide us with services related to, for example, IT, logistics or marketing.
• Authorized third parties. We may share your personal data with authorized third parties, such as our resellers.

Third-party application providers may access, collect, and further process data in Varjo products and services when chosen to be used in connection with Varjo products and services. Please note that we do not have direct control on when or how such third-party application providers process such data. For further information about the access, collection, and processing of data by such third parties, please carefully read the third-party service provider’s privacy and data usage policies. For avoidance of doubt, Varjo does not collect consents on behalf of such third-party application providers, but you are offered an option to technically permit or prevent such collection of data in the product settings.

We may also need to share your personal data where required under any applicable law or regulation or by the order of a court or public authority, to protect or exercise our or your rights (including to investigate possible infringing use of our products and services), to ensure the safety of our products and services, or to prepare or carry out a merger, asset sale, acquisition or other similar arrangement, or to seek financing.

4. Where is your personal data processed?

We are located in Finland, but operate worldwide, including in the United States and the United Kingdom as well as other locations in which we have customers, users, business partners, employees, affiliates and other connections. Therefore, your personal data may be transferred outside the European Union and the European Economic Area (“EU/EEA”), as needed to provide you with our products and services and for purposes of communicating with you.

In cases where personal data is transferred outside the EU/EEA, we ensure by means of agreements (using the EU Commission’s Standard Contractual Clauses) or otherwise (by the EU Commission’s adequacy decision, for example) that transfers are made in accordance with the GDPR and other applicable data protection laws.

Please do not hesitate to contact us at privacy@varjo.com for more detailed information on the recipients abroad and applicable safeguards.

5. How do we protect your data?

The security, integrity and confidentiality of your personal data are extremely important to Varjo. We have implemented technical and organizational measures to protect your personal data from accidental, unauthorized or unlawful access, loss, misuse or alteration by third parties. For example, we have implemented encryption, access controls and firewalls to protect your personal data.

Please be aware that, despite our best efforts, no data transmission or storage can be guaranteed to be completely secure from illegal and malicious attempts from third parties.

6. How long do we store your data?

We keep personal data for as long as necessary or permitted to fulfil the purposes for which it was collected and processed as described in this Privacy Policy unless a longer retention period is required or permitted by law. We apply the following criteria when determining how long we store specific personal data:

• the length of time we have an ongoing relationship with you or the customer / business partner you are associated with,
• the length of time we provide services or products to you,
• after the relationship above has ended, the length of to maintain sufficient records in case of your return within reasonable time or to protect against claims,
• whether we are under a legal obligation to retain your personal data (for example, under accounting, tax or product liability laws); and
• whether the retention of the personal data is necessary and/or justifiable based on another reason, including to protect our rights or enforce our terms of use, applicable statutes of limitations, litigation or regulatory investigations.

We regularly assess the necessity and accuracy of the personal data about you that we have collected and we delete or rectify any unnecessary, outdated or incorrect personal data, as necessary.

Please do not hesitate to contact us at privacy@varjo.com for more detailed information on our data retention policies.

7. Your rights and options

You have certain rights and options with respect to your personal data:

• Right to access your personal data. You have the right to get confirmation from us as to whether we are processing your personal data and to request a copy of your personal data.
• Right to correct your personal data. You can ask us at any time to rectify any inaccurate personal data about you.
• Right to erasure. We will delete or stop processing your personal data at your request if it is no longer needed for the purpose, it is or was being processed for or if we no longer have legal grounds for the processing.
• Right to restrict processing. Under certain circumstances, you may also have the right to restrict our processing of your personal data.
• Right to object processing. If we process your personal data based on a legitimate interest, you can object to the processing. For example, you can object to the use of your personal data for marketing purposes.
• Right to withdraw your consent. If we process your personal data based on your consent, you have the right to withdraw that consent. Withdrawal of your consent does not affect the processing of your personal data before you have withdrawn your consent.
• Right to opt out of marketing. If you wish to stop receiving marketing from us, you can opt out of our marketing communications by clicking the “unsubscribe” button on any marketing email sent by us.
• Right to data portability. If we process your personal data based on your consent or an agreement between you and us, and we process the personal data by automated means, you have the right to obtain a copy of your personal data in a structured, commonly used and machine-readable format upon your request.

Please note that certain personal data is strictly necessary in order to achieve the purposes defined in this Privacy Policy and may also be required to be retained based on applicable law, in which case you will not be able to exercise all of your rights or options described above.

You can exercise your rights by sending a written request to privacy@varjo.com. For your protection, we may need to verify your identity before acting on your request. We will try to comply with your request as soon as reasonably practicable and always in accordance with applicable law.

If you believe that our processing of your personal data infringes the EU General Data Protection Regulation, other data protection laws or your rights have been violated, you may have the right to make a complaint with your local (or other competent) data protection authority.

Contact details of authorities in other EU Member States can be found in the directory maintained by the European Data Protection Board.

8. Updates to this Privacy Policy

Varjo reserves the right to amend this Privacy Policy at any time by notifying you on our website or by other appropriate means. We recommend that you check the latest version of the Privacy Policy on our website every now and then.

If you object to any of the changes to this Privacy Policy, you should stop using our products and services.