Suomeksi: Tietosuojaseloste

Privacy Policy — Thispatch

Last updated: 19 August 2026 Applies to: the Thispatch mobile application (com.thispatch.mobile) and the Thispatch web console.

1. Who is responsible for your data

Thispatch is a field-service dispatch tool licensed to organisations (security, alarm-response, and health and social care service providers).

Your employer or contracting organisation is the data controller for all personal data in the service: your user account, service-recipient (customer) records, tasks, task notes and reports, photographs, unit location data, security and audit logs, and application diagnostics. It decides what is collected and why.

Heroic Oy is the data processor throughout. We host and operate the service and process personal data only on the documented instructions of the controlling organisation, under a data processing agreement concluded in accordance with Article 28 of the GDPR. We do not use the data for our own purposes, and we do not repurpose diagnostic or analytics data for product development or any other use of our own.

Because Heroic Oy is a processor and not a controller, requests to exercise your rights are handled by your organisation. Contact it first; we assist it in responding.

Contact details


Controller	Your employer or contracting organisation — see its own privacy notice
Processor	Heroic Oy
Business ID (Y-tunnus)	2946245-2
Registered address	Hakatie 5, 01390 Vantaa, Finland
Privacy contact	Alberto Cruz, info@thispatch.fi
Data protection officer	Not appointed — see privacy contact above

2. What personal data is processed

2.1 Application user account (you, as a professional user)

Accounts are created by your organisation's administrators. The app has no public sign-up.

Name, email address, telephone number, optional profile picture
Role and team assignments, and which task categories you are permitted to see
Authentication data: password (stored only as a salted hash), password change timestamps, password-reset tokens, and — where your organisation uses single sign-on — the identifier issued by your organisation's identity provider
Session data: device identifier, unit (vehicle) assignment, session start and last activity times, screen-lock state, and — if you enable them — a hash of your device unlock PIN and a hash of the NFC tag used for quick unlock. The PIN and tag values themselves are not stored.

2.2 Location data

Precise location (GPS). While you are signed in to a unit and your organisation's policy has location collection switched on, the app reports the unit's position — latitude, longitude, accuracy, and where available speed and heading — so that dispatchers can assign the nearest available unit, follow task progress, and locate personnel in an emergency. A position history is retained for the period stated in section 5.
Photo location. Where a photograph is attached to a task, the coordinates at which it was taken may be recorded alongside it.

Whether location is collected is controlled according to your organisation's policy, not as an individual preference. The setting is held against your user account rather than the handset, so it is the same on whichever device you sign in to, and collection is on unless your organisation has decided otherwise. Where the organisation's policy allows individuals to control it, the switch under Settings → Location is usable; otherwise it is shown but fixed, and a request to change it is made to your organisation.

Collection is not limited to the time the app is on screen. While you are signed in to a unit, position is reported by a background service that keeps running with the screen off and while other applications are in use. Android shows a permanent notification for as long as that service runs, and the notification states whether position is being shared. The app does not collect location when you are not signed in to a unit, and signing out stops it.

Where the organisation's policy has location collection switched off, that background service still runs — it is what allows the phone to be alerted about a dispatched task nobody has accepted — but no position leaves the device.

Location data relates to the unit and, through the unit, to the person signed in to it. Section 4.2 explains the Finnish rules that apply to this.

2.3 Service-recipient and task data (processed on behalf of your organisation)

Depending on what your organisation records, task and customer records may contain:

Customer or service-recipient name, address, telephone numbers, and external reference identifiers
Access and risk information (key information, safety notes)
Task descriptions, notes, quick phrases, status history, completion reports, and custom fields defined by your organisation
Photographs attached to tasks
Records of contact attempts, telephone call sessions, and SMS sessions
Records of devices installed at the service recipient's premises

Special category data. Where the controlling organisation uses Thispatch to support health or social care service delivery, these records may contain data concerning health within the meaning of Article 9 of the GDPR. Heroic Oy processes such data solely as a processor, on the controller's instructions. The controller is responsible for identifying its legal basis (typically Article 9(2)(h)) and for compliance with Finnish sectoral legislation, including the Act on the Processing of Client Data in Health and Social Care (703/2023).

2.4 Technical, diagnostic, and security data

Crash reports and diagnostics (Firebase Crashlytics): crash stack traces, device model, operating system version, and application version. Crash reporting is always active, because a field application that fails silently is a safety problem — but your account identifier is attached to these reports only if you have enabled usage analytics (see section 4.3). Otherwise the crash data is not linked to your account.
Usage analytics (Firebase Analytics): off unless you turn it on. When enabled, it records events such as sign-in, sign-out, and unit selection, together with device and app identifiers and your account identifier.
Push notification registration (Firebase Cloud Messaging): a device registration token used to deliver task alerts.
Audit log: for security and accountability, the service records who accessed or changed which record, when, from which IP address, with which roles, and whether the request succeeded. Access to personal data — including service-recipient data — is logged.

We do not process payment card data, biometric data, or advertising identifiers, and the data is not used for advertising or profiling.

3. Where the data comes from

Data is obtained from you (entries you make in the app, photographs you take, your device's location sensor), from your employing organisation (account and role data), from the controller's own or integrated systems (customer and task records, alarm events), and generated by the service itself (audit and diagnostic records).

4. Purposes and legal bases

4.1 Delivering the service

Purpose	Legal basis
Providing dispatch, task management, and reporting functionality	Heroic Oy processes as processor under Article 28; the controller's own basis is typically Article 6(1)(b), (c), (e), or (f)
Account administration, authentication, and access control	The controller's basis, typically Article 6(1)(b) — performance of your employment or service contract
Security monitoring, audit logging, incident investigation, and abuse prevention	The controller's basis, typically Article 6(1)(c) — legal obligation to secure the data — or Article 6(1)(f)

4.2 Location data and Finnish employment law

Unit location is processed for dispatch efficiency, task verification, and the safety of lone workers. The legal basis relied on by the controlling organisation is normally Article 6(1)(f) — its legitimate interest in operating the service and protecting its personnel.

Where the persons tracked are employees, the controlling organisation must in addition comply with Finnish law:

the Act on the Protection of Privacy in Working Life (759/2004), under which personal data must be necessary for the employment relationship — a necessity that cannot be waived by employee consent; and
the Act on Co-operation within Undertakings (1333/2021), under which the introduction and use of technical monitoring of employees is subject to co-operation negotiations before it is deployed.

Heroic Oy makes location functionality available; the decision to enable it, the completion of co-operation negotiations, and the provision of information to employees are the controlling organisation's responsibility.

The product is supplied with location collection switched on, and the ability of an individual to switch it off is itself a permission the organisation grants to a role — reflecting that the necessity test under 759/2004 is answered by the organisation for the work being done, not by each person for themselves. An organisation that has not completed the co-operation procedure, or that concludes location is not necessary for a given group, is responsible for switching it off for the people concerned.

4.3 Diagnostics and analytics

Crash diagnostics are necessary to keep the application working safely and are processed on the controller's behalf on the basis it relies on for operating the service, normally Article 6(1)(f). They are not linked to your account unless you enable usage analytics.

Usage analytics are optional and off by default. Under section 205 of the Act on Electronic Communications Services (917/2014), storing information on, or reading information from, a user's terminal equipment for purposes that are not strictly necessary requires consent. Analytics are therefore not collected unless you switch them on yourself:

The setting is per user, under Settings → Privacy → Usage Analytics in the mobile app. It is stored against your own profile, so your choice follows your account and is not made for you by anyone else — administrators cannot set it on your behalf.
The default is off. No analytics events are collected until you enable it.
You may withdraw at any time by switching it off. Collection stops immediately and your account identifier is cleared from Firebase. Events already collected remain in Firebase until its retention period expires — withdrawal stops future collection, it is not a deletion request. To have earlier events deleted, contact your organisation.
Declining has no effect on your access to the application or any of its features.

4.4 What we do not do

There is no automated decision-making producing legal or similarly significant effects, and no profiling, within the meaning of Article 22 of the GDPR.

5. Retention

Data	Retention
User account and role data	For the duration of the account; deleted or deactivated when your organisation removes the account
Session and device records	Until the session is terminated, plus 12 months for security investigation
Unit location history	90 days, after which records are automatically and permanently deleted by a daily purge. The unit's current position is not history and is overwritten on each new report
Task, customer, and attachment data	Determined by the controlling organisation and its statutory obligations; Heroic Oy deletes or returns the data at the end of the processing agreement
Audit log	7 years, after which entries are automatically anonymised
Crash diagnostics and analytics	Per Google Firebase retention settings — crash reports 90 days (Crashlytics); analytics user-level data 2 months (Google Analytics for Firebase default)
Support correspondence	24 months from case closure

6. Who the data is shared with

We do not sell personal data and we do not disclose it for marketing purposes.

Data is disclosed to:

your employing or contracting organisation, as controller;
service providers acting as our sub-processors, listed below;
authorities, where we are required to disclose data by law.

Sub-processors

Provider	Function	Processing location
Microsoft Ireland Operations Ltd (Microsoft Azure)	Application hosting, database, file storage — for installations hosted by Heroic Oy	EU/EEA — European regions only
Google Ireland Limited	Firebase Crashlytics, Firebase Analytics, Firebase Cloud Messaging (push notifications)	EU, with onward processing by Google LLC in the United States

Telephony and call handling run on service infrastructure operated by Heroic Oy within the hosting environment above; no external email, SMS, or telephony delivery provider is currently engaged. Where a customer installation runs on infrastructure procured by the customer organisation itself, that organisation's own processing agreement annex names the hosting provider instead. This list is updated before any new sub-processor is engaged.

Transfers outside the EU/EEA. Application data — your account, tasks, service-recipient records, photographs, location history, and audit logs — is stored and processed in the EU/EEA and is not transferred outside it.

Three functions are the exception. Crash diagnostics, usage analytics (only where you have enabled them), and push notification delivery run on Google Firebase, which involves processing by Google LLC in the United States. Those transfers are made under the European Commission's Standard Contractual Clauses together with Google's data processing terms and supplementary technical measures.

What is sent to Firebase is limited, and deliberately so:

Sent to Firebase	Never sent to Firebase
Crash stack traces, device model, OS and app version	Service-recipient or customer records of any kind
A push notification registration token	Task descriptions, notes, reports, or custom field values
Analytics events (sign-in, sign-out, unit selection, screen views, push notification receipt) — only if you opted in	Photographs and their captions
Your account identifier — only if you opted in	Location coordinates and location history
	Names, email addresses, telephone numbers, or free-text entered in the app
	Any health or other special-category data

This data is still personal data. Device identifiers, IP addresses, and — where you have opted in — your account identifier make it attributable to you, so it is protected as personal data and covered by the safeguards above. What it does not contain is any content from the service: no service-recipient information, no task content, and no special-category data.

7. Security

All traffic is encrypted with TLS 1.2 or higher; release builds of the mobile application refuse unencrypted connections outright.
Access is governed by role-based permissions and denied by default; users see only data within their assigned care or service context.
Access to personal data is recorded in the audit log, including the identity of the person accessing it, the time, and the outcome.
Passwords are stored only as salted hashes; PIN and NFC unlock values are stored only as hashes.
Application data is excluded from device backups, and sessions lock automatically after a configurable period of inactivity.
Shared or generic user accounts are not permitted.
Personnel with access to production data are bound by confidentiality obligations and access it only where necessary for support and maintenance.

If a personal data breach occurs, we notify the affected controlling organisations without undue delay so that they can meet their obligations under Articles 33 and 34 of the GDPR.

8. Your rights

Under the GDPR you have the right to:

obtain confirmation of whether your data is processed, and a copy of it (Art. 15);
have inaccurate data corrected (Art. 16);
have data erased, where the conditions are met (Art. 17);
restrict processing (Art. 18);
receive data you have provided in a machine-readable format and have it transmitted to another controller, where applicable (Art. 20);
object to processing carried out on the basis of legitimate interest, including location processing, on grounds relating to your particular situation (Art. 21);
withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

How to exercise them. Address requests to your employing or contracting organisation, which is the controller for all data in the service. Heroic Oy acts on the controller's instructions and assists it in responding within the statutory time limit. If you are unsure who to contact, write to us at info@thispatch.fi and we will route the request to the correct controller — we cannot decide it ourselves.

The analytics setting is the one choice you make directly in the app: switch it off under Settings → Privacy at any time, without going through anyone.

Account deletion. Accounts are created and removed by your organisation's administrators; there is no in-app self-registration or self-deletion. Ask your administrator to deactivate your account.

Right to complain. You may lodge a complaint with the Finnish supervisory authority:

Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) Postal address: PL 800, 00531 Helsinki, Finland Visiting address: Lintulahdenkuja 4, 00530 Helsinki Telephone: +358 29 566 6700 Email: tietosuoja@om.fi https://tietosuoja.fi

9. Device permissions

The application requests the following permissions. Each may be declined; declining disables the corresponding feature but not the application as a whole.

Permission	Why
Precise location	Reporting unit position for dispatch and worker safety while signed in to a unit, collected according to your organisation's policy. Also used, with no position leaving the device, to alert you about a dispatched task nobody has accepted
Camera	Photographing work sites and completed installations as task attachments
NFC	Reading an NFC tag to unlock the app quickly and to identify installed equipment
Notifications	Delivering new-task and escalation alerts

10. Children

Thispatch is a professional tool provided to organisations for use by their personnel. It is not directed at, or intended for use by, persons under 18.

11. Changes to this policy

We may update this policy as the service changes. The date at the top of the page indicates the latest revision. Material changes are communicated to controlling organisations in advance through the ordinary service-communication channels.

12. Contact

Heroic Oy (processor) — Hakatie 5, 01390 Vantaa, Finland Privacy enquiries: Alberto Cruz, info@thispatch.fi

For your rights as a data subject, contact your own organisation as controller. The address above is for routing and for the controller's own enquiries.

A Finnish-language version of this policy is available at docs/tietosuojaseloste.md. In the event of a discrepancy, the Finnish version prevails.