Log in

Privacy and cookies

Privacy & Cookies

This notice explains how we process personal data, how we use cookies, and how you can exercise your rights.

Controller and contact

Data controller: Grit company Oy (Business ID 3436415-2), Kurkimoisio 9 A, 00960 Helsinki, Finland. For privacy questions, rights requests, or complaints related to this notice, contact us at hello@gritcompany.fi.

What data we process

Depending on your interaction with our website and app, we may process:

  • Account and profile data you provide (name, email, company, role, profile details).
  • Project and workflow data entered by authorized users in the app.
  • Technical and usage data (device/browser metadata, timestamps, request logs).
  • Limited landing analytics data when analytics consent is granted.
  • Personal data about other people that users enter: the name, phone number and email address of a referee listed on an expert's profile, and the profiles consultant companies create for their employees (see “Data we receive from other people”).
  • Emails we send you: verification and sign-in codes, invitations and account notices, sent from our own mail server to your email provider.

Who can see profile data

Expert profiles are visible only to signed-in users, as follows:

  • Customers see profiles without the expert's identity: role, skills with years of experience and level, project history (descriptions, client type and length), availability, rates, location, languages and education. They do not see the expert's name, employer, contact details, photo, CV or referees. Details an expert writes into these fields can still point to them, so these profiles remain personal data.
  • Consultant companies see the profiles of their own employees. Freelancers see only their own profile.
  • Freelancers (for their own profile), the managers of the consultant company that employs an expert, and Grit staff see the full profile, including contact details, photo, CV and referees. Employees whose profile their company created cannot open it in the app; they can get a copy from their company or from us. An expert's identity is shared with a customer only as part of an engagement.

Data we receive from other people

  • References: when a referee is listed, we receive the referee's name, phone number and email address from the expert (or, for an employee profile, from their consultant company). We use them only to check the reference (legal basis: legitimate interest in verifying experts, Art. 6(1)(f) GDPR). They are visible only to the expert, the consultant company that employs them and Grit staff, and they are deleted with the profile. Referees can object to this processing or ask us to delete their details at any time: hello@gritcompany.fi.
  • Employee profiles: a consultant company can create and manage profiles for its own employees: name, contact details, skills, experience, education, CV, photo and referees. We process them so the company can offer its employees for engagements (legal basis: the legitimate interest of the company and of Grit in matching experts with engagements, Art. 6(1)(f) GDPR). A profile is kept until the company or the employee asks us to delete it. The consultant company provides this data and is responsible for informing its employees. Employees can object, or ask for access or deletion: hello@gritcompany.fi.
  • Invitations: if Grit staff invite you by email, we store your email address and the invitation (legal basis: legitimate interest in recruiting experts, Art. 6(1)(f) GDPR). The invitation is deleted 12 months after it expires or is revoked. You can object at any time: hello@gritcompany.fi.

Cookie categories and consent

  • Necessary cookies/storage: required for core functionality such as language preference, security controls, and sign-in/session handling.
  • Analytics cookies/storage: optional and disabled by default. We process analytics only after explicit opt-in.
  • You can withdraw or update analytics consent at any time from cookie settings.

Cookie and browser storage details

Current keys/categories used by our website and app include:

  • grit_consent_v1 (local storage): stores your cookie consent choices (necessary/analytics) and update timestamp. Category: necessary. Retention: until changed or cleared by user/browser.
  • landing_lang (local storage): stores landing page language preference. Category: necessary. Retention: until changed or cleared by user/browser.
  • landing_theme (local storage): stores the website's light or dark theme choice. Category: necessary. Retention: until changed or cleared by user/browser.
  • user_token (app storage): authentication/session tokens for signed-in use. Category: necessary. Retention: until logout, token expiry, or manual clearing.
  • user_role, user_name, user_email, user_last_active (app storage): session/profile context for app operation. Category: necessary. Retention: until logout, profile/account changes, or manual clearing.
  • device_token (app storage): a random key saved only if you choose at sign-in to remember this device, so it can skip the emailed sign-in code. Category: necessary. Retention: until cleared by user/browser; the server accepts it for 30 days, and a password change voids it.
  • theme_mode, locale (app storage): user interface preferences. Category: necessary. Retention: until changed or cleared by user/browser.
  • No non-essential analytics storage is used before explicit analytics opt-in.

Retention and deletion

  • Landing analytics aggregates: 13 months from event date, then purged or anonymized.
  • Security and access logs: at most 12 months. Admin audit records are deleted by a daily job after 12 months; web server and application request logs are removed earlier by log rotation.
  • Sign-in records (IP address and browser of each session): 30 days after the session ends. Remembered devices (browser label and a hash of a random key kept on the device): until their 30-day period ends. Rate-limit records (IP address): 30 days after the last attempt. One-time email codes: 1 day after use or expiry. Unfinished signups whose email address was never verified: 7 days. In-app notifications: 12 months.
  • Account and profile data: kept while the account exists. To close your account, email hello@gritcompany.fi; we then delete, without undue delay, your account, your own profile (with its photo, CV and referees), your cases and your applications. If your company has other members on Grit, the company's cases in your name, and its ownership if you own it, pass to one of them instead; if you are its last member, the company record and the employee profiles it created are deleted too. The admin record of the deletion (which includes your email address) and staff notifications that name you are kept for up to 12 months, database backups for up to 7 days, and anything we must keep by law or for legal claims until that obligation ends. Profiles a consultant company created for its employees stay with the company until the company or the employee asks us to delete them.
  • Project and workflow records: retained during the contract, deleted or anonymized 24 months after contract end; a customer's cases are deleted when their account is closed, unless they pass to another member of the customer's company. When a case is deleted, a record of the deletion (the case title, who deleted it, and the reason and comment given) is kept for 12 months; when an account is closed, its email address and comments are removed from these records, except from records of deletions made by Grit staff, which keep the staff member's email address and comment for the 12 months as the audit trail.
  • Authentication/session tokens: until logout, token expiry, or manual clearing.
  • Cookie consent record: until you change your preference or clear browser storage. Consent choices expire and are re-prompted after 6 months.
  • Preference keys (language, theme): until you change a preference or clear browser storage.
  • Backup archives: 7 days from creation, then automatically removed.
  • When retention ends, data is deleted, anonymized, or irreversibly aggregated. Legal holds override scheduled deletion until released.
  • Accounting and invoicing records: retained for the period required by Finnish accounting law (kirjanpitolaki, up to 10 years from the end of the financial year), then deleted.
  • Erasure requests may be refused where retention is required by law, or for the establishment, exercise, or defense of legal claims (Art. 17(3) GDPR).

Data sharing and processors

We use the following trusted service providers (processors) to deliver our services:

  • Tentacle Networks Oy (Finland) — server hosting, DNS, and domain management for our infrastructure.
  • Visma Solutions Oy / Netvisor (Finland) — invoice processing and bookkeeping.

Both processors are Finnish companies operating primarily within the EEA. Under their respective data processing agreements, each processor may engage sub-processors that operate outside the EEA, provided GDPR-compliant safeguards (such as Standard Contractual Clauses) are in place. See the "International transfers" section below for details. We require data processing agreements (DPAs) and contractual safeguards (Art. 28 GDPR) with all processors. Our analytics, notifications, and database services are fully self-hosted.

International transfers

All personal data is processed and stored primarily within the EEA (Finland). Our own infrastructure is hosted exclusively in Finland by Tentacle Networks Oy.

However, both Tentacle Networks Oy and Visma Solutions Oy/Netvisor reserve the right under their DPAs to engage sub-processors that may operate outside the EEA. In all such cases, transfers are governed by GDPR-compliant safeguards, including EU Standard Contractual Clauses (SCCs) and/or adequacy decisions, as well as supplementary technical and organizational measures where required (in line with CJEU Schrems II requirements).

The data categories potentially affected are limited to: (a) infrastructure data processed by Tentacle Networks (all platform data), and (b) invoicing/bookkeeping data processed by Visma/Netvisor (names, contact details, billing information).

Your rights

  • Access, correction, deletion, restriction, portability, and objection rights under GDPR.
  • Right to withdraw consent at any time (for consent-based processing).
  • Right to lodge a complaint with your local supervisory authority. You may contact the data protection authority in the EU/EEA country where you reside or work. For Finland: Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman), tietosuoja.fi.

Right to object: where we process your data on the basis of legitimate interest (Art. 6(1)(f)), such as security logging, reference checks, employee profiles and invitations, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). Email hello@gritcompany.fi.

To exercise rights, contact hello@gritcompany.fi. We may need to verify identity before fulfilling requests. We will respond within one month of receipt; in complex cases this may be extended by up to two additional months, with prior notice.

Security

We apply proportionate technical and organizational measures, including access controls, authentication, transport security, and monitoring to protect personal data from unauthorized access, loss, misuse, or alteration.

Data protection officer

Given the nature and scale of our processing activities, we are not required to appoint a Data Protection Officer under GDPR Art. 37. For all data protection inquiries, please contact us at hello@gritcompany.fi.

Obligation to provide data

The provision of account, profile, and project data is a contractual requirement necessary for us to deliver our services. If you choose not to provide this data, we may be unable to create your account or deliver the requested service. Landing page analytics data is collected only with your voluntary consent and is not required for service use.

Automated decision-making

We do not make automated individual decisions or profiling that produces legal effects or similarly significantly affects you (GDPR Art. 22).

Manage cookie settings

You can change your analytics preference at any time.

Policy updates

We may update this notice when our services, legal requirements, or processing practices change. Material changes will be reflected on this page.

Version 1.2 — Last updated: 25 September 2026