Privacy policy

Effective date: 14 September 2026

Kuori Oy ("us", "we", or "our") operates the DSM (Digital Signage Management) web application (hereinafter referred to as the "Service" or "DSM"). This page informs you of our policies regarding the collection, use and disclosure of personal data when you use the Service and the choices you have associated with that data.

DSM is a tool for managing digital signage devices. You use it because a Customer organization, or Kuori on its behalf, has given you access. This policy covers what DSM stores about you as a user of the web application.

How you may use the Service is set out in the DSM Terms of Use, which is a separate document.

Definitions

• Service. The DSM web application operated by Kuori Oy.
• Customer. An organization whose devices are managed in the Service. Your access to the Service is always access to one or more Customers, with a role in each.
• Personal Data. Data about a living individual who can be identified from that data, or from that data together with other information in our possession or likely to come into our possession.
• Cookies. Small files stored on your device (computer or mobile device).
• Data Controller. The natural or legal person who, alone or jointly with others, determines the purposes for which and the manner in which any personal information is processed.
• Data Processors (or Service Providers). Any natural or legal person who processes data on behalf of the Data Controller. We use a small number of Service Providers, named below, to run parts of the Service.
• Data Subject (or User). Any living individual who uses our Service and is the subject of Personal Data.

Personal Data Collection and Use

Sources of Data

We collect Personal Data from the following sources to operate, secure, and maintain the Service:

• Directly from you. Information you provide when you interact with the Service, such as updating your notification settings or managing your user profile.
• From your organization. Initial identity and account details—including your name, email address, image link, and organizational role assignments. In this case, your organization acts as a data controller.
• Automatically. Technical data collected automatically as you use the Service, including security audit logs, IP addresses, and essential session cookies generated during your interactions.

Types of Data Collected

Identity and Account Data

We collect identity and account information to establish your user profile, manage your access permissions across different organizations, and ensure proper account administration.

Identity and account information may include:

• Email address
• Name
• Profile image link
• Which Customers you may access and your role in each
• Your notification settings
• The date and time you accepted the Service's terms of use

Sign-in to the Service is handled by Kuori's authentication service. You sign in with a one-time code sent to your email address, with your Google account, or your organization's own single sign-on solution. The Service never sees your password or your one-time code.

We do not use your Personal Data to contact you with newsletters, marketing or promotional materials.

Audit Log Data

We keep security audit logs to ensure accountability and to meet our legal and contractual obligations to our Customers. These logs record actions that modify data within the system, including user account management, changes to access rights, device configuration changes, commands sent to devices, and changes to your own notification settings.

Each audit log entry may include:

• The email address and role of the user who performed the action
• The type of action performed and its outcome
• The date and time of the action
• The Customer, device or other entity the action was performed on, and the values before and after the change
• The IP address and browser identification the request came from
• For sign-in events, the email address or account identifier the attempt was made with

Cookies and Session Data

We use cookies to operate our Service and to keep you signed in. We do not use cookies or other tracking technologies to track your activity.

DSM sets two cookies. Both are strictly necessary for signing in and staying signed in.

Cookie	Purpose	Lifetime
dsm.session-token	Identifies your DSM session. Over HTTPS the name carries the __Host- prefix.	Until sign-out, or session expiry
dsm.oidc	Encrypted. Holds the login handshake values and the page you were heading to.	Deleted when the sign-in completes

There are no analytics or advertising cookies. Because both cookies are necessary for the Service to work, DSM does not ask for cookie consent. If you instruct your browser to refuse them, you cannot sign in.

Use of Data

We use the collected data for the following purposes:

• To provide and maintain the Service, including deciding what you may see and do in it
• To send you the alert, event and summary emails you have subscribed to
• To keep a record of who did what in the Service, for our Customers' accountability and our own
• To detect, investigate and prevent security incidents and misuse of the Service
• To provide customer support
• To notify you about changes to the Service or to its terms
• To comply with the law and to establish, exercise or defend legal claims

We do not use your data for marketing, profiling or advertising. We send you no messages other than the ones you subscribe to and the notices listed above.

Retention of Personal Data

Kuori Oy retains your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy.

• Identity data. Your identity at the Kuori authentication service outlives your DSM account, because it may still be in use for another Kuori application. A monthly job disables identities that no application uses any more and deletes them permanently 60 days after that.
• Account data. Your email address, name, image link, access rights, notification settings and terms acceptance are kept while you have access to the Service. Deleting your user account removes them, apart from the audit log entries described below. Withdrawing your access to a Customer takes effect on your next request.
• Audit log data. We keep an audit log entry for 36 months after the action and then a scheduled job deletes it. That period follows the limitation period for claims, because the entry is the record we would rely on to answer one. Where an entry relates to an open or foreseeable dispute, we keep it until the dispute is resolved. Entries are not copied into separate archive files, and the email address, role, IP address and browser identification in an entry are not pseudonymized.
• Session data. A session record ends after 8 hours of inactivity and always within 24 hours of sign-in. Signing out deletes the record at once.
• Backups. Database backups are deleted 30 days after they are taken, so a deleted record can survive in them until then, and no longer. The long-term archive files that hold old device telemetry contain no audit log entries and no user records.

Transfer of Personal Data

Kuori Oy runs the Service on infrastructure it operates within the European Economic Area (EEA), and your information, including Personal Data, is stored and processed there. If you are located outside the EEA and use the Service, your data is transferred to the EEA and processed there.

The following third party services receive data as part of the Service:

• Google Maps. The device map in DSM loads Google Maps in your browser. When you open it, your browser sends Google your IP address and the map requests, as on any page that embeds Google Maps. DSM also sends device addresses to Google's Geocoding API from its own servers. That data describes device installation sites, not you.
• Email service. Alert, event and summary emails are sent from signage@kuori.tech through third party mail servers, so your email address and the message contents are transferred to our Service Provider.
• Authentication provider. If you choose to sign in using Google or your organization's single sign-on system, the third party authentication provider will record your sign-in activity.

Kuori Oy will take all the steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy, and no transfer of your Personal Data will take place to an organization or a country unless there are adequate controls in place, including the security of your data and other personal information. For Google, those controls are Google's data processing terms and the standard contractual clauses they incorporate.

Business Transaction

If Kuori Oy is involved in a merger, acquisition or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.

Legal Requirements

Kuori Oy may disclose your Personal Data in the good faith belief that such action is necessary:

• To comply with a legal obligation
• To protect and defend the rights or property of Kuori Oy
• To prevent or investigate possible wrongdoing in connection with the Service
• To protect the personal safety of users of the Service or the public
• To protect against legal liability

Service Providers

We may employ third-party companies and individuals to facilitate our Service ("Service Providers"), provide the Service on our behalf, or perform Service-related services. These third parties have access to your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

The Service Providers that touch your data are:

• Google LLC, privacy policy: Privacy Policy – Privacy & Terms – Google

Your information is not shared with anyone outside Kuori Oy for commercial purposes.

Security of Personal Data

The security of your data is important to us, but remember that no method of transmission over the Internet or method of electronic storage is 100 percent secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

Links to Other Sites

The service might contain links to external web pages. If you click such a link, you will be directed to another web site. We advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

Children's Privacy

DSM is a business tool. Accounts exist only because an administrator created one for a member of a Customer's staff or for Kuori's own staff. The Service does not address anyone under the age of 18 ("Children"), and we do not knowingly collect personally identifiable information from anyone under 18. If you are a parent or guardian and are aware that your Child has provided us with Personal Data, please contact us and we will remove that information.

Legal Basis for Processing Personal Data Under the General Data Protection Regulation (GDPR)

Kuori Oy's legal basis for collecting and using the personal information described in this Privacy Policy depends on the Personal Data we collect and the specific context in which we collect it.

Kuori Oy may process your data because:

• We need to perform a contract with you or with your organization
• The processing is in our legitimate interests and it is not overridden by your rights
• To comply with the law

Where we process data on behalf of your organization, the organization determines the legal basis and we act on its instructions.

Your Data Protection Rights Under the General Data Protection Regulation (GDPR)

If you are a resident of the European Economic Area (EEA), you have certain data protection rights. Kuori Oy aims to take reasonable steps to allow you to correct, amend, delete or limit the use of your Personal Data.

In certain circumstances, you have the following data protection rights:

• The right of access. You have the right to request copies of your personal information.
• The right to rectification. You have the right to have your information corrected if it is inaccurate or completed if it is incomplete.
• The right to erasure. You have the right to request the deletion of your records from DSM and other Kuori applications, as well as the permanent deletion of your authentication identity.
• The right to object. Where we process your data on the basis of our legitimate interests (such as audit logging), you can object to that processing under Article 21 and ask us to explain why our interest overrides yours in your case.
• The right to restriction. You have the right to request that we restrict the processing of your personal information under certain circumstances.
• The right to data portability. You have the right to be provided with a copy of the information we have on you in a structured, machine-readable, and commonly used format.

Please note that we may ask you to verify your identity before responding to your request.

You have the right to complain to a Data Protection Authority about our collection and use of your Personal Data. In Finland that is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto). Elsewhere in the EEA, contact your local data protection authority.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the effective date at the top.

For material changes we will let you know via email or a notice in the Service before the change becomes effective. You are advised to review this Privacy Policy periodically. Changes are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Policy, please contact us:

• By email: privacy@kuori.tech
• By post: Kuori Oy, Linnoitustie 6 A, 02600 Espoo, Finland