Privacy policy

Updated 11.10.2026.

This policy explains how Codeva Oy processes personal data on the Tuntivo website and in the Tuntivo service. We process personal data in two different roles:

1. As controller for website visitors, people who request a demo, our customers' contact persons and the sign-in data of user accounts in the service.
2. As processor for the data our customers store in Tuntivo about their staff (for example shifts, time entries, absences and employment contracts). The customer is the controller of that data.

1. Controller and contact details

Codeva Oy
Business ID: 2767062-9
Address: Aurinkotie 28, 96190 Rovaniemi
Email: info@codeva.fi

Questions and requests about data protection can be sent to info@codeva.fi.

2. Codeva Oy as controller

Website visitors

We use Fathom Analytics for visitor statistics. Fathom uses no cookies and collects no identifiable personal data, and individual visitors cannot be tracked across websites. We only receive aggregated figures, such as page views and referring sites. Because no cookies or personal data are collected for analytics, the website has no cookie consent banner.

The web server may also keep technical logs, such as IP address and browser details, for security and troubleshooting. Logs are kept for at most 30 days.

Demo requests and enquiries

When you request a demo or contact us, we process the details you give us:

• name
• organisation
• email address
• phone number
• number of staff and industry
• message
• language.

Purpose: answering your enquiry, arranging a demo and sales follow-up.
Legal basis: legitimate interest (Article 6(1)(f) GDPR). Our interest is to respond to businesses that contact us and tell interested organisations about our service.
Retention: 12 months from the last contact, unless a customer relationship is formed.

Customer contact persons

We process the names, contact details and job titles of contact persons at customer organisations, as well as contract and billing details. The legal basis is performance of a contract, our legitimate interest in managing the customer relationship, and obligations under the Finnish Accounting Act. The data is kept for the duration of the customer relationship and afterwards as long as the law requires (for example 6–10 years for accounting records).

User accounts and sign-in

For Tuntivo user accounts we process data related to sign-in and security: name, email address, language, password hash, two-factor authentication and passkey details, single sign-on identifiers (Microsoft, Google) and logs of sign-ins and events. The processing is based on our legitimate interest in keeping the service secure and on performance of the contract with the customer.

3. Codeva Oy as processor

Our customer (the employer) stores data about its staff in Tuntivo, for example:

• name, contact details and employee number
• shifts, time entries and, where the customer has enabled the location check, the location (GPS) at clock-in
• absences, holiday balances and shift wishes
• qualifications and certificate expiry dates
• employment terms and employment contracts, including their electronic signatures
• pay events transferred to payroll.

For this data the customer is the controller and decides on the purposes and means of processing. Codeva Oy processes the data only on behalf of the customer and in accordance with the data processing agreement (DPA) concluded with the customer. Employees should direct requests about their data primarily to their employer. We assist the customer in handling such requests.

Electronic signatures. When an employee or a person signing for the employer signs a contract in Tuntivo, the service records evidence of the signature: the name typed by the signer, the user account they were signed in with, the time of signing, the IP address, the device and browser details, and a fingerprint (SHA-256) of the contract document that was sent for signature. This evidence is added to the signed contract document and kept with the contract for as long as the customer keeps the contract. It is processed on behalf of the customer to show that the contract was signed and by whom.

Tuntivo does not calculate tax, pension contributions or net pay, and the service does not process, for example, tax card details.

4. Cookies

The website and the service only use cookies that are strictly necessary for them to work: a session cookie that keeps you signed in and a CSRF protection cookie that prevents misuse of forms. We use no advertising or tracking cookies.

5. Recipients and sub-processors

We use the following service providers. They process data only on our instructions.

Provider	Purpose	Location
Laravel Cloud (Laravel Holdings Inc.)	Hosting of the service, its database and files	EU (Frankfurt, Germany)
Resend	Sign-in links, notifications and other system emails	EU (Ireland)
Flare (Facade BV)	Error and performance monitoring of the service	EU-based provider (Belgium)
Cloudflare	Domain name service and protection of network traffic	EU and Cloudflare's global network
Google Workspace	Email correspondence, for example replies to demo requests	EU and other countries
Fathom Analytics	Cookieless visitor statistics (no personal data)	EU
Netvisor	Transfer of pay events, when the customer has connected payroll	EU

Data is transferred to Netvisor only if the customer has connected payroll. An up-to-date list of sub-processors is available on request.

Visma Sign is an optional integration. If a customer connects its own Visma Sign account and chooses to sign contracts through it, the contract and the signers' names and email addresses are sent to Visma Sign. Visma Sign then processes the data under the customer's own agreement with Visma, not as Codeva's sub-processor. Contracts signed in Tuntivo are not sent to any outside signing service.

6. Transfers outside the EU and EEA

We store data in the EU. Some of our service providers (Laravel, Resend, Cloudflare and Google) are based in the United States or have group companies there, so data may be accessed from outside the EU and EEA, for example for support or security. Such transfers are based on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses.

7. Security

Data is stored in protected server environments and connections are encrypted. Access to data is limited by user role, and the service supports two-factor authentication and passkeys. Important changes are recorded in an audit log. Each organisation's data is kept separate from others.

8. Your rights

Under the GDPR you have the right to:

• access your data
• have inaccurate data rectified
• have your data erased
• restrict processing
• object to processing based on legitimate interest
• port your data to another system, where processing is based on a contract or consent.

Send your request to info@codeva.fi. We will reply within one month. If your data is processed in Tuntivo on behalf of your employer, please contact your employer first.

9. Right to lodge a complaint

If you believe that the processing of your personal data breaches data protection law, you can lodge a complaint with the Office of the Data Protection Ombudsman (tietosuoja.fi).

10. Changes

We may update this policy when the service or the law changes. The date of the latest update is shown at the top of this policy.