GrindzeroSuomeksi

Privacy Policy

Last updated: July 8, 2026

Data Controller: Grindzero Oy (3411998-2), Mukulakuja 4 A9, 04300 Tuusula

This Privacy Policy describes how Grindzero Oy ("Data Controller") processes the personal data of users of the Grindzero application and related digital services ("Service"). The Service is primarily intended for business and organizational customers.

Scope

This Privacy Policy applies to the processing of personal data related to the use of the Service. The policy covers users acting on behalf of Business Users (e.g., employees and drivers).

Personal data processed

The following personal data may be processed in the Service:

  • phone number (user identifier and login)
  • email address (user identifier and login)
  • name, company, and position
  • technical identifiers related to the user account
  • precise location (GPS), including background updates when the user has enabled location sharing for an assigned truck
  • images and documents uploaded to the Service that may contain personal data
  • log and usage data (e.g., logins, timestamps)
  • message or contact content
  • technical data (e.g., IP address, cookie data)

Purpose of personal data processing

Personal data is collected for the following purposes:

  • user identification and login
  • implementing Service functionalities
  • coordinating construction sites and logistics
  • ensuring the security and functionality of the Service
  • fulfilling legal obligations
  • processing account-deletion requests and retention

Legal basis for processing

Processing of personal data is based on:

  • contract (Service Terms of Service)
  • legitimate interest of the data controller (safe and efficient use of the Service)
  • applicable legislation

Location data

The mobile application may collect precise GPS location from drivers who enable location sharing in the Service or grant the required device permissions. Depending on settings, this includes foreground and background location while the driver is assigned to a truck — including when the app is not in the foreground — so authorized users can see live truck positions for logistics coordination.

Location updates are stored with the assigned truck record and may be visible to other authorized users in the same organization (e.g. on maps, for distances and dispatch). Drivers can turn off sharing in the app profile/settings or by revoking location permissions on the device.

The admin web application uses location only when you actively use map features in the browser; it does not perform background GPS tracking on phones.

Location processing is based on the Service Terms, the Data Controller's legitimate interest in operating logistics for Business Users, and — where required by the operating system — your choice when responding to location permission prompts.

Text messages and authentication

Login is performed using a one-time SMS verification code. Third-party SMS providers are used: Tavoittaja.fi (Prospectum Oy) for Finnish numbers (+358), and GatewayAPI (OnlineCity ApS) for other international numbers. Tavoittaja is the primary provider for Finland. The same providers may be used for other transactional SMS (e.g. account-deletion warnings). Verification codes are automatically deleted after use.

Data retention period

Data is retained only for as long as necessary for the purpose of processing or as required by law. Truck position history is kept while the truck assignment and account are active and as needed for logistics records. Scheduled account deletion and anonymization are described in Account deletion.

Account deletion

You can request deletion of your user account through self-service:

  • Mobile application: Profile → Delete account
  • Admin web application: admin.grindzero.app → Profile → Delete account

When you confirm a deletion request:

  1. Sign-in is disabled immediately for that account.
  2. Permanent anonymization is scheduled after an organisation-specific retention period (default 30 days from the request; your organisation may configure a longer period, up to 365 days).
  3. You may receive a reminder by SMS (and by email when email delivery is configured) seven days before anonymization.

After the scheduled date, personal data in your profile is anonymized. Some historical business records (e.g. logistics entries linked to your user or truck) may be retained in anonymized or pseudonymous form where required for operations, accounting, or legal obligations.

Before the anonymization date, an organisation administrator or Grindzero support may help cancel a scheduled deletion and restore access. After anonymization, deletion cannot be reversed.

Recipients and third parties

The Service uses the following processors:

  • Supabase (Supabase Inc.): authentication, database, and file storage (EU region)
  • Google Maps Platform (Google LLC): map and location services
  • Tavoittaja.fi (Prospectum Oy): SMS messages to Finnish phone numbers (+358)
  • GatewayAPI (OnlineCity ApS): SMS messages to other international phone numbers
  • Resend (Resend Inc.): transactional emails
  • Sentry (Functional Software Inc.): error tracking and performance monitoring

Data disclosure and transfer

Data is not disclosed to third parties unless necessary for the provision of the Service (e.g., website hosting, invoicing) or required by law. Data is not transferred outside the EU or EEA without an adequate level of protection.

Data subject rights

The data subject has the right to:

  • access their personal data
  • request correction of inaccurate data
  • request deletion of data or their user account ("right to be forgotten")
  • object to or restrict data processing
  • withdraw consent (if processing is based on consent)
  • file a complaint with the Data Protection Ombudsman

Account deletion: see Account deletion. Other requests: info@grindzero.io.

Data security

Data is processed with care and protected by technical and administrative measures. Only persons who are authorized to process data in the course of their duties have access to it.

Changes to this policy

The Data Controller may update this Privacy Policy. Material changes will be communicated through the Service.

Contact

For data protection inquiries, please contact:

Grindzero Oy Mukulakuja 4 A9, 04300 Tuusula Finland info@grindzero.io