Privacy Policy KMM

Last Updated: 11.09.2026

Kuori Oy ("us", "we", or "our") operates the KMM (Kuori Mobile Management) service (hereinafter referred to as the "Service").

This page informs you of our policies regarding the collection, use and disclosure of personal data when you use our Service and the choices you have associated with that data.

We use your data to provide and improve the Service. The Service is used by organizations to manage Android devices they own or provide to their employees. Where the Service processes data about those devices and the people who use them, the organization decides what is collected and why, and we process it on the organization's behalf.

DEFINITIONS

• Service — Service is the KMM mobile device management service operated by Kuori Oy, consisting of the KMM management console, the KMM Client application installed on managed devices, and Kuori's sign-in service.
• Personal Data — Personal Data means data about a living individual who can be identified from that data (or from those and other information either in our possession or likely to come into our possession).
• Usage Data — Usage Data is data collected automatically either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
• Cookies — Cookies are small files stored on your device (computer or mobile device).
• Data Controller — Data Controller means the natural or legal person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal information is, or are to be, processed. The organization that has enrolled a device in the Service is the Data Controller of the data collected from that device and of its administrators' accounts. We are the Data Controller of the data we process to operate and secure the Service itself.
• Data Processors (or Service Providers) — Data Processor (or Service Provider) means any natural or legal person who processes the data on behalf of the Data Controller. We act as a Data Processor for the organizations that use the Service, and we may use the services of various Service Providers in order to process your data more effectively.
• Data Subject (or User) — Data Subject is any living individual who is using our Service and is the subject of Personal Data: the administrators who sign in to the console and the people who use managed devices.

INFORMATION COLLECTION AND USE

We collect several different types of information for various purposes to provide and improve our Service to you.

Types of Data Collected

Personal Data

While using our Service, the organization that administers your account provides us with certain personally identifiable information that can be used to contact or identify you ("Personal Data"). Personally identifiable information may include:

• Email address
• Name
• Your role in the Service and the organization you belong to
• Cookies

Sign-in to the Service is handled by Kuori's sign-in service. You sign in with a one-time code sent to your email address or with your Google account. When you sign in with Google, Google supplies your email address, name and profile picture to the sign-in service. The sign-in service holds your login identity; the Service links it to your account with an identifier that reveals nothing about you.

We do not use your Personal Data to contact you with newsletters, marketing or promotional materials.

Device Data

The Service collects information about the managed Android devices enrolled by an organization, through Google's Android Management API and, where the organization has enabled it, the KMM Client application installed on the device:

• Serial number and hardware identifier
• Brand, manufacturer, model and hardware information such as memory and storage size
• Android version and software information such as build details and security patch level
• Security posture and compliance with the organization's policies
• Installed applications
• Whether the KMM Client application is connected
• Screenshots of the device screen, taken only when an administrator of the organization requests one

KMM does not access contacts, messages, photos or other content stored on the device, except that a requested screenshot shows whatever is on the screen at that moment. Screenshots are taken only on request, for remote support and troubleshooting, and only the five most recent per device are kept. The organization decides when screenshots are requested and is responsible for informing the people who use its devices.

Usage Data

We do not collect Usage Data. The Service does not record your browser type, browser version, the pages you visit, the time spent on them or unique device identifiers of your computer.

Tracking & Cookies Data

We use cookies to operate our Service and to keep you signed in. We do not use cookies or other tracking technologies to track your activity.

Cookies are files with a small amount of data which may include an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your device.

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you will not be able to sign in to our Service.

Examples of Cookies we use:

• Session Cookies. We use Session Cookies to operate our Service and keep you signed in. They cannot be read by scripts running in your browser and are only sent over secure connections.
• Sign-in Service Cookies. Kuori's sign-in service uses its own Session Cookie so that you can sign in to other Kuori applications without a new prompt.

USE OF DATA

Kuori Oy uses the collected data for various purposes:

• To provide and maintain our Service
• To sign you in and control access to your organization's data
• To enroll, configure and monitor the managed devices of your organization and keep them compliant with its policies
• To provide remote support and troubleshooting for managed devices
• To keep a record of administrative actions and sign-ins for accountability
• To notify you about changes to our Service
• To provide customer support
• To monitor the usage of our Service
• To detect, prevent and address technical issues

LEGAL BASIS FOR PROCESSING PERSONAL DATA UNDER THE GENERAL DATA PROTECTION REGULATION (GDPR)

If you are from the European Economic Area (EEA), Kuori Oy's legal basis for collecting and using the personal information described in this Privacy Policy depends on the Personal Data we collect and the specific context in which we collect it.

Kuori Oy may process your Personal Data because:

• We need to perform a contract with you or with your organization
• You have given us permission to do so
• The processing is in our legitimate interests and it is not overridden by your rights
• To comply with the law

Where we process data on behalf of your organization, the organization determines the legal basis and we act on its instructions.

RETENTION OF DATA

Kuori Oy will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes and enforce our legal agreements and policies.

• Your account data is kept for as long as your organization keeps your account and is deleted when an administrator deletes the account.
• Your login identity at Kuori's sign-in service is disabled once no Kuori application grants you access and deleted sixty (60) days later. Backups of the sign-in service are kept for thirty (30) days.
• Device data is kept for as long as the device is enrolled and deleted, together with its screenshots, when the device is removed from the Service.
• Records of administrative actions and sign-ins are kept for up to three (3) years. They contain the email address of the person who acted and identify what was changed, which may include another person's email address and name or a device serial number, and they outlive the deletion of the account or device they concern.

TRANSFER OF DATA

Your information, including Personal Data, may be transferred to – and maintained on – computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction.

If you are located outside Finland and choose to provide information to us, please note that we transfer the data, including Personal Data, to Finland and process it there.

Kuori Oy will take all the steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy and no transfer of your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of your data and other personal information.

Business Transaction

If Kuori Oy is involved in a merger, acquisition or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.

Legal Requirements

Kuori Oy may disclose your Personal Data in the good faith belief that such action is necessary to:

• To comply with a legal obligation
• To protect and defend the rights or property of Kuori Oy
• To prevent or investigate possible wrongdoing in connection with the Service
• To protect the personal safety of users of the Service or the public
• To protect against legal liability

SECURITY OF DATA

The security of your data is important to us but remember that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

The Service stores no passwords; sign-in is handled by Kuori's sign-in service. Access to an organization's data is limited to the accounts of that organization, according to their roles.

YOUR DATA PROTECTION RIGHTS UNDER THE GENERAL DATA PROTECTION REGULATION (GDPR)

If you are a resident of the European Economic Area (EEA), you have certain data protection rights. Kuori Oy aims to take reasonable steps to allow you to correct, amend, delete or limit the use of your Personal Data.

If you wish to be informed about what Personal Data we hold about you and if you want it to be removed from our systems, please contact us by email at info@kuori.tech. If your organization is the Data Controller of the data in question, we will assist it in responding to your request.

In certain circumstances, you have the following data protection rights:

• The right to access, update or delete the information we have on you. Administrators of your organization can update or delete your account in the Service. If you are unable to perform these actions yourself, please contact us to assist you.
• The right of rectification. You have the right to have your information rectified if that information is inaccurate or incomplete.
• The right to object. You have the right to object to our processing of your Personal Data.
• The right of restriction. You have the right to request that we restrict the processing of your personal information.
• The right to data portability. You have the right to be provided with a copy of the information we have on you in a structured, machine-readable and commonly used format.
• The right to withdraw consent. You also have the right to withdraw your consent at any time where Kuori Oy relied on your consent to process your personal information.

Please note that we may ask you to verify your identity before responding to such requests.

If you use a device managed through the Service, the organization that provided it is the Data Controller of the data collected from it. Please direct questions about monitoring and requests concerning that data to your organization.

You have the right to complain to a Data Protection Authority about our collection and use of your Personal Data. For more information, please contact your local data protection authority in the European Economic Area (EEA). In Finland this is the Office of the Data Protection Ombudsman, https://tietosuoja.fi/en/.

SERVICE PROVIDERS

We may employ third-party companies and individuals to facilitate our Service ("Service Providers"), provide the Service on our behalf, perform Service-related services or assist us in analyzing how our Service is used.

These third parties have access to your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

Google

Android Management API — Managed devices are enrolled, configured and monitored through Google's Android Management API. Google processes the device data described above under its own terms.

Google Play — When an administrator selects applications in the console, the Google Play embedded store is loaded from Google, and Google receives the administrator's IP address and any Google cookies present in the browser.

Google sign-in — If you sign in with your Google account, Google authenticates you and supplies your email address, name and profile picture to Kuori's sign-in service.

For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page: https://policies.google.com/privacy?hl=en

Analytics

We do not use analytics services.

Behavioral Remarketing

We do not use remarketing or advertising services.

LINKS TO OTHER SITES

Our Service may contain links to other sites that are not operated by us. If you click a third-party link, you will be directed to that third-party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services. Applications that your organization distributes to managed devices through the Service are subject to their own providers' privacy policies.

CHILDREN'S PRIVACY

Our Service does not address anyone under the age of 18 ("Children").

We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your Child has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from children without verification of parental consent, we take steps to remove that information from our servers.

CHANGES TO THIS PRIVACY POLICY

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

We will let you know via email and/or a prominent notice on our Service, prior to the change becoming effective and update the "Last Updated" date at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

CONTACT US

If you have any questions about this Privacy Policy, please contact us:

• By email: privacy@kuori.tech

Company Information: Kuori Oy Linnoitustie 6 A, 02600 Espoo Phone: +358(0)103371700 Email: privacy@kuori.tech