Privacy Notice - Whistleblowing Reporting Channel
Last updated: 7 April 2026
Controller: Lemonsoft Oyj
1. Controller
Name: Lemonsoft Oyj
Business ID: 2017863-1
Address: Vaasanpuistikko 20 A, FI-65100 Vaasa, Finland
2. Contact Person for Data Protection Matters
Data Protection Officer: Jaakko Suninen
Email: jaakko.suninen@lemonsoft.fi
3. Purpose of the Processing
Personal data submitted through the whistleblowing reporting channel is processed for the following purposes:
• reporting suspected misconduct, breaches of law, or unethical conduct;
• handling and investigating reports;
• complying with statutory obligations; and
• safeguarding the organisation's operations, ethical standards, and security.
The reporting channel may be used by both employees and external individuals.
4. Legal Basis for Processing
The processing of personal data is primarily based on:
• Compliance with a legal obligation (GDPR Article 6(1)(c))
o Finnish Whistleblower Protection Act.
Where applicable, processing may also be based on:
• Legitimate interests (GDPR Article 6(1)(f))
o preventing, detecting, and investigating misconduct.
5. Categories of Personal Data
The whistleblowing reporting channel may process the following categories of personal data:
• information relating to the reporting person (where the report is not submitted
anonymously);
• information relating to the person who is the subject of the report;
• information relating to other individuals mentioned in the report; and
• the content of the report and descriptions of the reported events.
Reports may also contain special categories of personal data or information relating to suspected criminal offences.
6. Sources of Personal Data
Personal data is obtained from:
• the reporting person (employee or external individual); and
• information collected during the handling and investigation of the report.
7. Recipients and Disclosure of Personal Data
Personal data is processed only by specifically authorised individuals whose duties require access to the information (for example, members of the HR function).
Personal data may also be processed by the service provider operating the whistleblowing reporting system, acting as a Processor on behalf of Lemonsoft.
Personal data may be disclosed to competent authorities where required by law.
8. Transfers of Personal Data Outside the EU/EEA
Personal data will not be transferred outside the European Union (EU) or the European Economic Area (EEA) unless appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses (SCCs).
9. Retention Period
Personal data is retained only for as long as necessary:
• to process and investigate the report; and
• to comply with applicable legal obligations.
When the information is no longer required, it will be securely deleted or anonymised.
10. Data Subject Rights
The data subject has the right to:
• access their personal data;
• request the rectification of inaccurate personal data;
• request the erasure of personal data;
• request the restriction of processing; and
• object to the processing of personal data.
These rights may be restricted where necessary:
• to safeguard the handling of the report;
• to protect the integrity of an investigation; or
• to protect the rights and freedoms of other individuals.
The data subject also has the right to lodge a complaint with the competent supervisory authority.
11. Protection of the Reporting Person's Identity
Reports may be submitted anonymously.
Where the identity of the reporting person is known, it will be protected throughout the entire reporting and investigation process in accordance with applicable legislation.
12. Security Measures
Personal data is protected by appropriate technical and organisational measures, including:
• restricted access rights;
• encryption of personal data;
• logging and monitoring; and
• secure information systems.
13. Changes to this Privacy Notice
This Privacy Notice may be updated from time to time to reflect changes in legislation or in the
processing of personal data.
Revision History
7 April 2026
• Initial version of the Privacy Notice