Privacy Notice

Twentto is built to help B2B sales teams decide what deserves their attention. Doing that requires us to handle information responsibly and explain clearly what we do with it.

This Privacy Notice explains how personal data is processed when you visit twentto.com, use the Twentto application, request a demo or otherwise interact with Twentto.

1. When this Privacy Notice applies

This notice applies when you:

• visit twentto.com;
• request a demo or contact Twentto;
• communicate with us about becoming or being a customer;
• receive or accept an invitation to use Twentto;
• use the Twentto application;
• act as an administrator, salesperson, Sales Leader or other authorized user of a customer organization; or
• otherwise interact with Twentto in a business context.

2. Twentto and customer data

There is an important distinction between information Twentto processes for its own purposes and information processed on behalf of customers.

When you interact directly with Twentto, for example by visiting the website, requesting a demo or using a Twentto account, Twentto may determine how and why certain personal data is processed.

When a customer connects its CRM or other commercial systems and Twentto processes personal data as part of providing the service, the customer will generally determine the purposes of that processing and Twentto will process the data on the customer's behalf.

That relationship will be governed by the applicable customer agreement and, where required, a Data Processing Agreement.

If your information appears in Twentto because a company you interact with uses the service, that company may therefore be the appropriate organization to contact regarding that data.

3. Information we process

The information processed depends on how you interact with Twentto.

Website and demo requests

We may process information you provide when requesting a demo or contacting us, including:

• name;
• business email address;
• company;
• job title or role;
• telephone number if provided;
• information included in your request or message; and
• related communication history.

Account and organization information

When you use Twentto, we may process:

• name;
• business email address;
• authentication and account identifiers;
• organization membership;
• business role;
• Team membership;
• administrator permissions;
• invitation and account-recovery information;
• authentication-provider information; and
• account and access status.

Customer administrators manage access to their organization. They do not set, view or receive another user's password through Twentto.

Service usage and security information

We may process technical and operational information needed to provide, secure and maintain the service, such as:

• login and authentication events;
• timestamps;
• IP address and device or browser information where generated by the service;
• application events;
• configuration and integration status;
• security and audit events;
• error information; and
• actions taken within Twentto.

Commercial data from connected systems

When a customer connects supported commercial systems, Twentto may process information such as:

• companies and accounts;
• contacts;
• opportunities and deals;
• account and deal ownership;
• CRM activities;
• notes;
• calls;
• meetings;
• tasks;
• commercial commitments;
• logged email information where the connected source and permissions provide it;
• calendar information where a supported integration provides it;
• relevant commercial communications;
• source-system identifiers and metadata; and
• other commercial information made available through an agreed integration.

Twentto is intended for commercial B2B information. Customers should not intentionally use the service to provide special-category personal data or other highly sensitive information unless this has been specifically agreed.

Recommendations and feedback

Twentto may process information generated through use of the service, including:

• recommended sales actions;
• Why today? explanations;
• recommendation evidence;
• recommendation status;
• user corrections and feedback;
• timing corrections;
• indications that work was already handled or is no longer relevant; and
• related audit information.

4. Why we process personal data

Providing Twentto

We process information where needed to:

• authenticate users;
• manage organizations and access;
• connect authorized data sources;
• synchronize relevant commercial information;
• generate and present recommendations;
• operate Today, Team, Deals and related functionality;
• store user corrections;
• provide support; and
• maintain the service.

Depending on the circumstances, processing may be necessary for performing a contract or based on legitimate interests in providing and operating a B2B service.

Communicating with customers and prospective customers

We may use business contact details to:

• respond to demo requests;
• answer questions;
• conduct sales discussions;
• onboard customers;
• provide service communications; and
• maintain customer relationships.

Depending on the circumstances, this may be based on steps taken before entering a contract, performance of a contract or legitimate interests in operating the business.

Security and administration

We process appropriate technical, access and audit information to:

• prevent unauthorized access;
• enforce organization boundaries and permissions;
• investigate security issues;
• prevent abuse;
• maintain reliability; and
• protect Twentto, customers and users.

Improving Twentto

We may analyze service operation, recommendation feedback, failures and other relevant information to understand whether Twentto works as intended and how it can be improved.

Where this information is Customer Data processed on behalf of a customer, its use remains subject to the applicable customer instructions and contractual terms.

Legal obligations and legal rights

Information may also be processed where necessary to:

• comply with applicable law;
• meet accounting or tax obligations;
• respond to lawful requests;
• establish or defend legal claims; or
• enforce applicable agreements.

5. How Twentto uses AI

Twentto uses artificial intelligence together with deterministic rules and structured commercial information to support its sales-prioritization functionality.

Relevant commercial context may be provided to AI services to:

• interpret commercial situations;
• support recommendation reasoning;
• generate explanations; and
• produce suggested assistance such as emails, agendas or call openings.

AI-generated output may be incorrect or incomplete.

Twentto is designed as decision support. Recommendations can be corrected by users and should not be treated as unquestionable facts.

Twentto does not position its recommendations as legal, employment, financial or similarly significant decisions about individuals.

6. Service providers and subprocessors

Twentto may use third-party providers required to operate the service, including providers of:

• cloud infrastructure and hosting;
• authentication;
• CRM and productivity integrations;
• AI and model services;
• communications;
• monitoring and security;
• payment and accounting services where applicable; and
• professional services.

These providers may process information only as required to provide their services to Twentto and subject to appropriate contractual arrangements where required.

Twentto does not sell personal data to advertisers.

A current list of relevant subprocessors will be made available as part of the customer security and data-processing documentation.

7. International data transfers

Some service providers used by Twentto may process personal data outside Finland or the European Economic Area.

Where personal data is transferred to a country without an applicable adequacy decision, appropriate transfer safeguards will be used where required, such as the European Commission's Standard Contractual Clauses.

8. Data retention

Personal data is retained only for as long as reasonably necessary for the purpose for which it was collected.

Retention periods depend on factors such as:

• the duration of the customer relationship;
• whether an account remains active;
• customer instructions where Twentto processes data on the customer's behalf;
• security and audit requirements;
• applicable limitation periods;
• accounting, tax or other legal requirements; and
• the need to resolve disputes or establish legal claims.

Customer Data processed on behalf of a customer will be handled in accordance with the applicable customer agreement and Data Processing Agreement.

When a customer relationship ends, relevant Customer Data will be deleted or returned in accordance with those terms unless continued retention is required by law.

9. Security

Twentto uses technical and organizational measures designed to protect information against unauthorized access, alteration, disclosure or loss.

Current safeguards include:

• organization-scoped data access;
• server-side authorization;
• role-based permissions;
• separation between customer administration and internal Twentto administration;
• controlled integration permissions; and
• security and audit controls.

No internet-based service can guarantee absolute security.

10. Your data-protection rights

Depending on applicable law and the circumstances, you may have the right to:

• obtain information about how your personal data is processed;
• access your personal data;
• request correction of inaccurate information;
• request deletion;
• request restriction of processing;
• object to certain processing;
• receive personal data in a portable format where applicable; and
• withdraw consent where processing is based on consent.

These rights are subject to applicable legal conditions and exceptions.

Where Twentto processes information solely on behalf of a customer, requests relating to that information may need to be handled by the relevant customer.

You also have the right to lodge a complaint with the competent data-protection supervisory authority.

For activities subject to Finnish data-protection supervision, the supervisory authority is the Office of the Data Protection Ombudsman of Finland.

11. Cookies and similar technologies

Twentto may use cookies or similar technologies necessary to:

• authenticate users;
• maintain sessions;
• protect the service;
• remember essential settings; and
• provide requested functionality.

Non-essential analytics, advertising or similar technologies will only be used where the required consent mechanism is in place.

12. Marketing communications

Twentto may contact relevant business contacts regarding the service where permitted by applicable law.

Where consent is required, marketing will be sent on the basis of consent.

Recipients can opt out of marketing communications through the unsubscribe method provided in the communication.

Necessary security, account and customer-service communications are not considered marketing.

13. Children

Twentto is a B2B service intended for professional users. It is not directed to children.

14. Changes to this Privacy Notice

This Privacy Notice may be updated as Twentto, its processing activities or applicable requirements change.

Material changes will be communicated where appropriate.

The latest version will always show its most recent update date.