Privacy Policy — Semel Beacon

1. Who is responsible (data controller)

Semel Oy, Valimotie 21, 00380 Helsinki, Finland.

Contact for privacy matters: tietosuoja at semel.fi.

Data Protection Officer: not appointed.

2. What data we process

From your Microsoft work account (when you sign in):

• Your name and work email address.
• Your Microsoft Entra (Azure AD) user identifier.

Your status data:

• The status you set (In office, Remote, Focus, Lunch, Away, Checked out), its start and end time, an optional short message, and duration.
• A history of your recent status changes (including where each change came from — the app, the web portal, Slack, or automation).

Your settings and connections:

• Your sync preferences (which of Teams, Slack, and Tuntivelho a check-in updates; your workday end).
• Whether you have connected Slack and Tuntivelho.

Integration credentials (only if you choose to connect a service):

• A Slack authorization token (via Slack sign-in).
• Your Tuntivelho username and password, stored encrypted, used only to clock you in/out.

Technical data:

• Sign-in tokens needed to use the service.
• Your latest status is cached on your device so the app works offline.
• If you use the Apple Watch app, your current status with its start and end time, and during lunch, focus time or away the check-in it returns to and when that ends, are also cached on your paired Apple Watch, for the watch app and its complications. Your message is not. The watch holds no sign-in tokens. This copy is cleared when you sign out on your iPhone, or the next time the watch connects to it if it is out of range then.
• Standard server logs kept to operate and secure the service.

We do not collect: location, advertising identifiers, analytics or tracking data, contacts, photos, health, or biometrics. The App requests no special device permissions, contains no advertising or third-party tracking, and its only third-party component is Microsoft’s sign-in library (MSAL).

3. Why we process it, and the legal basis (GDPR Art. 6)

• To show your work status and sync it to the tools you use (Teams, Slack, Tuntivelho) — so the service can do its job within the employment relationship.
• To record work time in Tuntivelho (only if you enable it) — supporting Semel’s working-hours record-keeping.
• To operate, secure, and troubleshoot the service. Legal basis: legitimate interests.

4. Who can see or receives your data

• Your Semel colleagues: your current status is visible to others inside Semel — in Teams and Slack and in internal Semel tools (such as the status roster). Your status is meant to be shared.
• Microsoft — for sign-in (Entra ID) and to set your Teams availability and work location, in your own Microsoft 365 account.
• Slack — to set your Slack status (only if you connect Slack).
• Mepco / Tuntivelho — to clock your work time (only if you connect it).
• Microsoft Azure — hosts the backend service.

We do not sell your data and do not share it for advertising or third-party tracking. Microsoft and Slack may process data outside the EU/EEA under appropriate safeguards (e.g. Standard Contractual Clauses / EU–US Data Privacy Framework).

5. How long we keep it

• Your current status and recent activity are kept while you use the service — 12 months.
• When you leave Semel or your account is offboarded, your data is removed in line with Semel’s retention policy.
• Work-time entries sent to Tuntivelho are retained in that system under its own rules and any legal requirements.
• You can delete your Beacon data yourself at any time (see section 7).

6. Security

• All communication uses encryption in transit (HTTPS/TLS).
• Sign-in uses Microsoft OAuth — the App never sees or stores your Microsoft password.
• Stored integration secrets (such as your Tuntivelho password) are encrypted at rest.
• Access is limited to what is needed to run the service.

7. Your rights

Under the GDPR you may request access, rectification, erasure, restriction of processing, objection, and data portability, and you may lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi).

You can delete your Beacon data yourself in the web portal under Settings (the account / data-deletion section). To exercise any other right, contact us at tietosuoja at semel.fi.

8. Children

The App is intended for Semel employees and is not directed at children.

9. Changes to this policy

We may update this policy. The current version is shown by the effective date above; we will communicate material changes via tietosuoja at semel.fi.

10. Contact

Semel Oy — tietosuoja at semel.fi — Valimotie 21, 00380 Helsinki, Finland.