KIERTUE
Suomeksi Start free

Privacy Policy

Updated: October 1, 2026 · Version 1.10

1. Data Controller

Koodisto Digital
Sole trader, entered in the Finnish Trade Register
Business ID: 2829298-1
Postal address: Viertolantie 2, FI-00730 Helsinki, Finland
Email: [email protected]

The controller of the KIERTUE application (the "Service") is Koodisto Digital (Business ID: 2829298-1). The Service is used through the web application (app.kiertue.com) and the iOS and Android apps, and this privacy policy covers all of them. The controller is responsible for the processing of your personal data in accordance with this privacy policy and the requirements of the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).

Dual role: controller and processor. KIERTUE acts as the controller for data relating to your user account and the operation of the Service: authentication, billing, analytics (with consent), security and service messages. This privacy policy covers that processing. However, for the personal data of third parties that you yourself enter into the Service — in particular the names of guests on guest lists and the contact details of venue and production contacts — the controller is you (or your band), and KIERTUE processes that data on your behalf and on your instructions as a processor (GDPR Art. 28). The terms of that processing are set out in the data-processing addendum of the Terms of Service.

Organisation account: a booking agency or another organisation can manage several bands in the Service through an organisation account. For the data of bands that belong to the organisation – for example the data of crew members, contacts and shows – the controller is the organisation, and KIERTUE processes that data on the organisation’s behalf as a processor (GDPR Art. 28). The terms of that processing are agreed in the data processing agreement concluded with the organisation, and the data-processing addendum of the Terms of Service does not apply to that data. If you wish to exercise the rights described in section 9 regarding the data of an organisation’s band, we forward your request to the organisation. If a band does not belong to an organisation, the controller of its data remains the user or the band, even if a member of the band belongs to an organisation. For the organisation’s own data, such as the data of its members and billing contact, the controller is KIERTUE (see sections 3, 5 and 8).

2. Legal Basis for Processing

Processing of your personal data is based on the following legal grounds:

  • Contract (GDPR Art. 6(1)(b)): Processing is necessary for providing the Service to you in connection with creating a user account and using the Service.
  • Legitimate interest (GDPR Art. 6(1)(f)): Service development, ensuring information security, preventing misuse, collecting customer feedback, customer-relationship reminders about incomplete onboarding, and email delivery management (identifying bounced and blocked addresses). You may object to processing based on legitimate interest (Art. 21).
  • Consent (GDPR Art. 6(1)(a)): Direct marketing messages (product updates and newsletter) are sent only on the basis of your separate consent, in accordance with Section 200 of the Finnish Act on Electronic Communications Services (917/2014). You may withdraw your consent at any time.

AI-assisted extraction of third-party personal data and receipt of messages forwarded to a band-specific address: for these, KIERTUE acts as a processor (see section 1, dual role), so the legal basis for the processing is the responsibility of the user/band acting as controller. To the extent the processing concerns the user’s own (controller) data, the legal bases per purpose are: (1) AI-assisted extraction of production information: legitimate interest (GDPR art. 6(1)(f)) — to offer a user-initiated, optional and efficient way to enter production information; the processing covers only material the user attaches themselves and the result is always a draft approved by the user (you can object to the processing (Art. 21) by notifying us at [email protected]; no processing takes place if you do not use the feature); (2) receipt of messages via the email intake: legitimate interest (art. 6(1)(f)) on the same grounds — the address is created by the user and messages reach it only through the user’s own action; (3) technical operation of the Service, prevention of misuse and maintenance of information security: legitimate interest (art. 6(1)(f)).

Organisation account and API: we process the data of the organisation’s members and billing contact so that we can perform the agreement concluded with the organisation. These persons are not themselves parties to the agreement, so the legal basis is legitimate interest (GDPR Art. 6(1)(f)): we and the organisation have an interest in delivering the agreed service and managing the customer relationship. The data of a personal API key and of an account-specific API permission is processed on the basis of contract (Art. 6(1)(b)), because you have requested the key or the use of the API yourself. For the data of an organisation’s key, as for the organisation’s other data, the legal basis is legitimate interest (Art. 6(1)(f)). The API usage log, the monthly API usage counter and the administration log are also processed on the basis of legitimate interest (Art. 6(1)(f)). The purpose is to detect misuse and security incidents, to monitor the agreed usage limits and to establish afterwards who has changed the organisation’s members or access rights.

3. Personal Data Collected

We collect and process the following personal data:

  • Authentication data: email address, password (encrypted), sign-in method (email, Google, or Apple).
  • Profile data: first name, last name and language preference.
  • Account activity data: when your account was created, when you last signed in and the date you last used the Service. The date of use is updated at most once a day. This data is stored for all users to manage user accounts (see section 4) and is not part of the consent-based analytics.
  • User-generated content: bands, tours, events, schedules, travel information, setlists, songs, guest lists, production info, and venue data.
  • Uploaded files: band logos, attachments (e.g., sound and light patches).
  • Subscription data: subscription type, status, and subscription store (Stripe).
  • Technical data: device information and log data for error resolution. The Android app includes the Firebase Cloud Messaging notification service. When the app starts, it registers with Google Firebase (see section 6), which creates a notification registration token and a Firebase installation ID for the device. The Service does not currently send notifications and does not store these identifiers in its own database.
  • Analytics data (with consent): page views, usage events, device information, a pseudonymous user identifier that links the same user’s events, and the domain of your email address (for example gmail.com). Your name and your full email address are not sent. Google Analytics also derives an approximate location (city, region and country) from the IP address. According to Google, the IP addresses of users in the EU are not stored but are discarded as soon as the location has been derived. The data is collected via Firebase Analytics only if you have given explicit consent.
  • Email settings and consents: marketing consent (given or withdrawn, with timestamps), per-message subscription choices (product updates, tips, surveys), and email delivery status (e.g., bounced or spam-flagged messages).
  • Feedback and survey responses: the rating, reasons, free-text comments, and price opinion you voluntarily provide.
  • Organisation data (organisation account): the organisation’s name, its members’ email addresses and roles (administrator or producer), the billing contact’s name and email address, and the agreement’s validity, reference and maximum number of seats. KIERTUE creates the organisation on the basis of an agreement. Members are added by the organisation’s administrator or by KIERTUE at the organisation’s request. The organisation’s data also includes draft shows imported via the API (date, venue, city, country, schedule and notes) and information on which key imported a draft and who published or discarded it.
  • API keys: the key’s name, identifier and prefix, permissions, validity, creation time, time of last use, revocation status and the user identifier of the key’s creator. For a personal key, the holder’s email address and the bands to which the key is limited are also stored. The key itself is not stored: only a hash is stored, from which the key cannot be recovered. If the API is opened for your account with a separate permission, we store your account’s email address, who granted the permission, the reason and the time. Granting and revoking the permission are also recorded in the administration log without the email address.
  • API usage log: for calls made via the API and the AI assistant connection (MCP), we log the key identifier, the action, the band and show identifiers, the result and the time. For read calls we also log the duration, the number of shows returned and whether the response included contact details. The same log records drafts created by AI-assisted extraction or via the band-specific email address, with a user or band identifier. The log does not store the key, the content of shows or contact details, but an entry can be linked to the key and its creator.
  • Monthly API usage counter: the number of calls per calendar month for the organisation or for the holder of a personal key, and whether a usage-limit notice has been sent.
  • Organisation administration log: the creation of the organisation and changes to it, the addition and removal of members and changes to their roles, and bands created for the organisation. Each entry stores the action, the user identifier of the person who performed it and the time. When a member is added or removed or their role changes, their email address is stored as a hash, so it does not appear in the log in plain text.

We do not collect special categories of personal data (sensitive data).

4. Purpose of Processing

Personal data is used solely for the following purposes:

  • Sending service emails: welcome message, band invitations (at the user’s request), and subscription-related notifications such as a reminder about the end of the trial period. These are messages related to providing the Service, not marketing.
  • Creating, managing, and securely authenticating user accounts.
  • Storing and syncing tour, event, and setlist data between band members in real time.
  • Managing subscriptions and access rights.
  • Technical maintenance and development of the Service.
  • Ensuring information security and preventing misuse.
  • Sending feedback surveys and processing responses to improve the Service. Surveys are voluntary and contain no sales.
  • Sending product updates and the newsletter if you have given your consent.
  • Email delivery management: we identify bounced and spam-flagged messages so we do not send to non-working or blocked addresses.
  • AI-assisted extraction of production information: when you attach text, a PDF file or an email to a show, its content can be extracted with AI into a proposal of production information. The result is always a draft that a band administrator reviews and approves before it is saved — this is not automated decision-making.
  • Receipt and extraction of messages forwarded to a band-specific email address: a band can be given its own email address to which forwarded production messages are received, and their content is extracted in the same way into a draft of production information for an administrator to approve.
  • Organisation account management: maintaining the organisation’s members and roles, applying members’ access rights to the organisation’s bands, monitoring the seat limit and the validity of the agreement, and billing.
  • API and AI assistant connection (API and MCP): a user or an organisation can create an API key with which their own system or AI assistant reads a band’s shows, proposes changes to a show’s details and imports shows as the organisation’s drafts. The API does not change a published show without human approval. A draft show is visible only to the organisation’s members until the organisation’s administrator or producer publishes it.
  • Monitoring API usage: with the usage log we detect misuse and security incidents and investigate matters that the user or the organisation asks us to look into. We count calls per month. When 80% of the monthly quota has been used, we send an email notice to the organisation’s administrators or to the holder of the personal key; the notice is a service message, not marketing.

We do not profile you or make automated decisions about you. We send direct marketing (product updates and newsletter) only on the basis of your separate consent, and you can withdraw it at any time via the unsubscribe link or your email settings.

5. Data Transfers

The application uses Google Firebase (Firestore Database, Firebase Authentication, Cloud Storage) for data storage and processing. Due to the nature of the service, personal data may be processed and transferred outside the European Union (EU) and the European Economic Area (EEA), particularly to Google servers in the United States.

Google complies with the EU-U.S. Data Privacy Framework and provides EU Commission-approved Standard Contractual Clauses (SCCs) to ensure adequate data protection in accordance with the GDPR.

For other data processors operating in the United States (such as Stripe and Resend), the protection of data transfers is ensured through Standard Contractual Clauses (SCCs) approved by the EU Commission and data processing agreements (DPAs).

We do not sell, rent, or otherwise disclose your personal data to third parties for marketing purposes.

Organisation members: the administrators and producers of an organisation are administrators of the bands that belong to the organisation. They can therefore see the data of those bands, such as members’ names and email addresses, crew members, contacts and shows, in the same way as other band administrators. The organisation’s members have access to each other’s email addresses and roles and to the billing contact’s details. The band’s other members see the organisation’s members in the band’s member list.

API: when a user or an organisation gives an API key to their own system or AI assistant, we disclose to that system the data covered by the key’s permissions, on the key holder’s instructions. This includes band names and the details, schedules and production information of shows, whose free-text fields may contain personal data. The names, roles, phone numbers and email addresses of contacts are disclosed only if the contacts permission has been selected separately for the key. The API does not disclose guest-list names or the email addresses of band members, but the AI assistant connection shows the free-text guest-list notes. The systems and services chosen by the key holder, such as an AI assistant, are not our data processors. The key holder – the user, the band or the organisation – is responsible for the data transferred to them, including when the service is located outside the EU or the EEA.

AI-assisted extraction of production information and cancellation-feedback reply drafts are processed with Google Cloud Vertex AI in the EU region (europe-west1): the material is processed in the EU under the regional commitments of the Google Cloud Data Processing Addendum and is not used to train AI models. For Cloudflare (USA), used to route incoming email, the primary transfer mechanism is the European Commission’s adequacy decision on the EU–U.S. Data Privacy Framework (GDPR Art. 45, Commission Implementing Decision (EU) 2023/1795; Cloudflare is a framework participant), with the Commission’s Standard Contractual Clauses (SCCs) as a binding fallback under Cloudflare’s Data Processing Addendum. You may obtain a copy of the safeguards applied to transfers outside the EU/EEA — the Commission’s Standard Contractual Clauses (SCC) and, where applicable, the transfer terms of the Data Processing Agreements (DPA) — by sending a request to [email protected].

Data Processing Agreements (DPA):

  • Google Cloud: cloud.google.com/terms/data-processing-addendum
  • Stripe: stripe.com/legal/dpa
  • Apple: apple.com/legal/privacy
  • Resend: resend.com/legal/dpa

6. Third Parties and Data Processors

The Service uses the following data processors (GDPR Art. 28):

  • Google Firebase (Google LLC, USA): Database, cloud storage, authentication, cloud functions, and the Android app’s notification service (Firebase Cloud Messaging). Privacy policy: https://firebase.google.com/support/privacy
  • Google reCAPTCHA v3 (Google LLC, USA): Automatic bot protection in the web application. reCAPTCHA collects device and browser information (IP address, browser type, interaction data) to prevent abuse. The service operates invisibly and requires no user action. Privacy policy: https://policies.google.com/privacy
  • Apple App Attest (Apple Inc., USA): Automatic app integrity verification in the iOS application. The service sends device information to Apple to verify that requests originate from a genuine application.
  • Stripe Inc. (USA): Payment processing and subscription management. Stripe processes payments on our behalf and also acts as an independent controller for its own purposes, such as fraud prevention and meeting its legal obligations; these are described in Stripe’s privacy policy. Stripe stores payment card details and invoice history in its own systems. Upon account deletion, Stripe customer data is automatically deleted, but invoice history is retained as required by accounting obligations (see section 8). Privacy policy: https://stripe.com/privacy
  • Apple Inc. (USA): Sign-in option (Sign in with Apple).
  • Google Analytics for Firebase (Google LLC, USA): Usage analytics for service development. Data is collected only with the user's explicit consent. Data collected: page views, usage events, device information, approximate location derived from the IP address, a pseudonymous user identifier and the domain of the email address (see section 3). Consent is requested separately and can be withdrawn at any time. Privacy policy: https://firebase.google.com/support/privacy
  • Resend Inc. (USA): Delivery of service and lifecycle emails (welcome message, band invitations, subscription and onboarding reminders, API usage-limit notices, feedback surveys, and consent-based product updates and newsletter). Data processed: name, email address, language preference, and message delivery status (e.g., bounced or spam-flagged messages) for delivery management. Emails are sent from servers located in the EU. When a user sends a band invitation by email, the recipient address is used solely to deliver the message and is not stored in the service. Privacy policy: https://resend.com/legal/privacy-policy
  • Google Cloud Vertex AI – Gemini (Google LLC / Google Cloud, processed in the EU region europe-west1): (1) AI-assisted extraction of production information from attached text, a PDF file or an email into a draft; (2) generation of a reply draft based on cancellation feedback. The material processed may contain personal data. The material is not used to train the model. Data processing terms (DPA): https://cloud.google.com/terms/data-processing-addendum
  • Cloudflare, Inc. (USA): Receipt and routing of messages forwarded to a band-specific email address (in.kiertue.com) (Email Routing / Workers). Incoming messages may contain third-party personal data. Transfer mechanism: EU–U.S. Data Privacy Framework (Cloudflare is a framework participant), with EU Standard Contractual Clauses (SCCs) as a binding fallback under Cloudflare’s Data Processing Addendum. Handled messages are automatically deleted 90 days after receipt (see section 8). Privacy policy: https://www.cloudflare.com/privacypolicy/

All processors comply with GDPR requirements and have committed to appropriate data protection measures.

App stores: the iOS app is distributed through Apple’s App Store and the Android app through Google Play. Apple and Google process data relating to downloading and updating the app and to your store account as independent controllers under their own privacy policies; they are not our processors.

Reporting purchases to app stores: when you buy a subscription from the iOS or Android app by going to our own payment page (Stripe), the app store’s terms require us to report the purchase to Apple or Google. The report contains the purchase identifiers, subscription details (for example the subscription period), the amount, VAT, currency, country and time, as well as any refunds. Your name, email address and payment card details are not reported. Apple and Google process the reports as independent controllers; here too, they are not our processors.

Use of AI for travel and train lookups (no personal data): The Service uses Google Gemini (Google LLC, USA) for the automatic lookup of flight and train details (the Look up feature). Only non-personal lookup data is sent to the interface — the vehicle number, the date, and public station and airport names — never names, passenger lists, emails, or other personal data. No personal data is therefore sent, and Google does not act as our processor here. Privacy policy: https://ai.google.dev/gemini-api/terms

AI-assisted extraction of production information (Google Cloud Vertex AI): When you ask the Service to extract production information from text, a PDF file or an email you have provided, the content is processed with Google Cloud Vertex AI (the Gemini model) in the EU region (europe-west1). The material you submit may contain third-party personal data (for example the names, phone numbers and email addresses of contacts), so Google acts as our processor here (GDPR Art. 28). The Service is configured so that the material is not used to train the AI model. The result of the extraction is always a draft that a human (a band administrator) reviews and approves before it is saved. This processing is covered by the Google Cloud Data Processing Addendum (DPA).

AI-assisted processing of customer feedback (Google Cloud Vertex AI): When your subscription is cancelled and you leave free-text feedback about the reason, a service administrator may use AI to draft a personal reply to you. The feedback text you provide is processed with Google Cloud Vertex AI (the Gemini model) in the EU region (europe-west1); the text is not used to train the AI model. The reply is always a draft that an administrator reviews and edits before sending — this is not automated decision-making. Legal basis: legitimate interest (GDPR art. 6(1)(f)) in managing the customer relationship and developing the Service.

Address geocoding and routing: When you add a travel or venue address, it is sent to geocoding and routing services to compute coordinates, driving routes, distances, and the time zone. The web app and the Android app use OpenStreetMap Nominatim (geocoding) and OSRM (routing) — open services with their own terms and privacy policies. The iOS app uses Apple’s map service (Apple Inc., USA). Only the entered address or coordinates derived from it are transmitted — never names, passenger lists, emails, or other data. If an entered address (for example a departure point) constitutes personal data, it is used solely to compute the route and coordinates. OpenStreetMap privacy: https://osmfoundation.org/wiki/Privacy_Policy

7. Cookies and Local Storage

The Service does not use third-party tracking cookies without consent. Cookies and local storage are divided into two categories:

Necessary (no consent required):

  • Firebase Auth sign-in identifiers — maintaining the authentication state.
  • Browser local storage (localStorage): kiertue_consent_v2 (your consent choice), kiertue_lang and other preferences (language, time format, timezone), and kiertue_offline_* (offline cache for the week's shows).
  • Google reCAPTCHA v3 cookies (e.g. _GRECAPTCHA) to ensure the proper functioning of bot protection.

These are strictly necessary for the functioning and security of the Service and do not require separate consent.

Analytics (only with consent):

  • Google Analytics 4: _ga cookies and analytics identifiers are set only if you accept analytics in the cookie banner, in the app’s consent prompt or in the app settings. Data collected includes page views, usage events (e.g. login, event creation), device information, basic browser data and approximate location derived from the IP address (see section 3). The data is used for service development — we do not use it for advertising, profiling, or automated decision-making. Withdrawing consent immediately stops collection.

Consent log: consent choices are recorded to fulfil the GDPR accountability obligation (Art. 7). The log stores the choice (accepted/declined per category), a timestamp, the consent version and the platform (web, iOS or Android). No IP address is stored; instead, a hash (a pseudonymised identifier) is derived from it and used to limit misuse. Log entries are retained for a maximum of 24 months.

You can change or withdraw your choice at any time in the app settings or via the Cookie settings link in the site footer.

The iOS application stores settings in the device local storage (UserDefaults). The Android app stores the same settings in the app’s own browser storage (WebView localStorage).

8. Data Retention and Deletion

Personal data is retained as long as your user account is active and the Service is in use.

You can delete your account and all associated data at any time:

  • From the application settings by selecting "Delete account".
  • By contacting us via email: [email protected]

When your account is deleted:

  • All your personal data is permanently removed from the database.
  • If you own bands, you must first transfer ownership to another member or delete the band.
  • Any active Stripe subscription is automatically cancelled.
  • Your Stripe customer data (card details, contact information) is deleted. Invoice history is retained as required by accounting obligations.
  • Band data remains available to other members if the band has other members.
  • You are removed from the organisations of which you are a member, and your personal API keys and any account-specific API permission are deleted.
  • The API usage log and the administration log are retained for the periods stated below, because they allow us to investigate misuse afterwards. They do not contain your name or your email address in plain text, only a user or key identifier. The same identifier remains in the organisation’s data if you have created an organisation key or published or discarded a draft show.

Deletion is carried out without undue delay, within 30 days of the request at the latest.

Retention periods:

  • Event and tour data is retained as long as the band is active
  • Archived tours are retained until the band owner deletes them
  • Invoices and other accounting vouchers: at least 6 years from the end of the year in which the financial period ended (Finnish Accounting Act 1336/1997, chapter 2, section 10(2))
  • Server logs: ~30 days (Google Cloud Logging)
  • Survey and feedback responses: data linked to you (identifier and email address) is removed when your account is deleted; anonymous feedback may be retained to develop the Service
  • Consent and email-settings data: for the lifetime of the account as a record of consents given and withdrawn; removed when your account is deleted
  • Incoming emails (band-specific address): we store the subject, sender, text content and the AI-extraction result (not the original message file or attachments). Unprocessed messages remain in the band admin’s triage queue until handled; handled messages are automatically deleted 90 days after receipt
  • Text or PDF attached in the app (AI fill): not stored — processed in memory only for the extraction. The extraction result is saved as a draft that an admin approves or rejects
  • Production-information drafts: rejected drafts are automatically deleted 90 days after rejection. The data of an approved draft becomes part of the show’s production information, and the approval record is retained as part of the show’s data (deleted when the show is deleted)
  • AI-extraction material (Google Vertex AI): KIERTUE does not retain the material after extraction. Google may hold the material in a short-lived cache (in memory only, not on disk; up to 24 hours; stays in the selected EU region) to speed up the service, and does not use the material to train AI models
  • API usage log: 13 months from the entry, after which the entry is deleted automatically. The period covers the maximum validity of an API key (365 days) and one month for investigation
  • Monthly API usage counters: 13 months from the end of the month counted, after which the counter is deleted automatically
  • API keys: a key stops working when it expires or is revoked. The data of a personal key is retained until the account is deleted, and the data of an organisation’s key together with the organisation’s data
  • Organisation data and draft shows: for the term of the agreement. When the agreement ends, the data is deleted or returned to the organisation, as it chooses, on an agreed schedule. Invoices are retained as required by accounting obligations. The data of bands that belong to the organisation is retained and deleted in accordance with the agreement concluded with the organisation
  • Administration log (organisation changes and API permissions): 13 months from the entry, after which the entry is deleted automatically

9. Data Subject Rights (GDPR)

Under the EU General Data Protection Regulation, you have the following rights:

  • Right of access (Art. 15): You may request a copy of all personal data concerning you.
  • Right to rectification (Art. 16): You can correct inaccurate or incomplete data directly in the application or by contacting us.
  • Right to erasure (Art. 17): You can request deletion of all your data ("right to be forgotten").
  • Right to restriction of processing (Art. 18): You can request restriction of processing in certain situations.
  • Right to data portability (Art. 20): You can request your data in a machine-readable format.
  • Right to object (Art. 21): You can object to processing based on legitimate interest.
  • Right to withdraw consent (Art. 7): You can withdraw marketing consent at any time via the unsubscribe link or your email settings — without deleting your account. You may also withdraw other consents and delete your account entirely.

All requests are processed without undue delay, within one month at the latest. Contact: [email protected]

If your request concerns data for which the controller is a user, a band or an organisation (see section 1), we forward the request to that controller and assist it in responding (GDPR Art. 28(3)(e)).

10. Data Security

We protect your personal data with appropriate technical and organizational measures:

  • All data transmission is encrypted (TLS/HTTPS).
  • Passwords are stored encrypted (Firebase Authentication).
  • Database access is restricted by security rules (Firestore Security Rules).
  • File storage is protected by access restrictions (Firebase Storage Rules).
  • An API key is shown only once, and only a hash of it is stored. A key is valid for at most 365 days and can be revoked at any time. In addition, the API can be disabled for a single organisation or for the entire Service.

When we act as controller, we notify the supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk (GDPR Art. 33(1)). We notify data subjects without undue delay if the breach is likely to result in a high risk to their rights and freedoms (GDPR Art. 34). When we act as processor, we notify the controller – the user, the band or the organisation – without undue delay (GDPR Art. 33(2)).

Technical server logs may contain user identifiers (user ID, email) for debugging purposes. Logs are automatically deleted after approximately 30 days.

11. Minors

The Service is not directed at persons under 16. This is the Service’s own minimum age — KIERTUE is intended for professional tour management, and its use is based on a contract, not on a child’s consent. We do not knowingly collect personal data from persons under 16. If we become aware that we have collected data from a person under 16, we will delete it without delay.

12. Changes to This Privacy Policy

We reserve the right to update this privacy policy. The updated policy is published in the Service, and significant changes will be separately communicated via an in-app notification or by email. We recommend reviewing this policy regularly.

The updated policy takes effect on the date of publication.

13. Contact and Complaints

For all questions and requests regarding personal data processing, please contact:

Koodisto Digital
Sole trader, entered in the Finnish Trade Register
Business ID: 2829298-1
Postal address: Viertolantie 2, FI-00730 Helsinki, Finland
Email: [email protected]

Under Articles 11 and 12 of the Digital Services Act (Regulation (EU) 2022/2065), our single point of contact for authorities and for users of the Service is [email protected]. You can contact us in Finnish or English, and messages are answered by a person.

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority:

Office of the Data Protection Ombudsman (Finland)
Visiting address: Lintulahdenkuja 4, 00530 Helsinki, Finland
Postal address: P.O. Box 800, 00531 Helsinki, Finland
Email: [email protected]
Phone: +358 29 566 6700
Website: tietosuoja.fi

14. Venue Manager Account Data

When using KIERTUE as a Venue Manager, we collect and process the following additional information:

14.1 Data collected:

  • Venue name, address, and contact information (data you provide)
  • Official profile: contact person, phone number, email, technical details, description, website
  • Team members' email addresses and roles
  • Gig-specific technical notes and driving instructions (data you provide)
  • Subscription data (Stripe): payment transactions, subscription period

14.2 Purpose:

  • Displaying the show calendar with bands' permission
  • Maintaining the venue's official profile
  • Subscription management and billing
  • Service development

14.3 Data sharing:

  • Bands can see your official profile if they have approved its use
  • Team members can see shows marked for the venue
  • Stripe processes payment data (see Stripe Privacy Policy: stripe.com/privacy)

14.4 Retention period:

  • Venue data is retained as long as the account is active
  • Upon subscription cancellation, data is deleted within 30 days upon request

14.5 Your rights:

  • You have the right to request deletion of your data (GDPR Art. 17)
  • You can export your data under GDPR Art. 20 by requesting it at [email protected]
← Back to home