Privacy notice

1. Data controller

The controller for processing relating to the website, accounts, commercial administration, billing, security and support is Lytheron OÜ, based at Tuukri tn 19-202, Kesklinna linnaosa, 10120 Tallinn, Estonia. You can contact the controller at legal@lytheron.com. Registration details: Estonian registry code 17311276 · VAT EE102894091.

2. Scope of this notice

This notice covers the Lytheron Cloud website and CMMS platform: visitors, registered users, organisation members, administrative and billing contacts, and individuals whose data appears in customer tickets, work orders or documents. Other Lytheron OÜ products have their own notices.

3. Privacy roles of Lytheron and the customer

Lytheron as controller

Lytheron OÜ determines the purposes and means of processing for account registration, authentication, organisation management, security, abuse prevention, support, payments, billing, operational communications and legal compliance.

Lytheron as processor

When an organisation uses products to collect or publish data for its own purposes, the organisation normally acts as controller and Lytheron OÜ processes data on its behalf under documented instructions. In these cases the Data Processing Addendum applies.

The customer remains responsible for the lawfulness of uploaded data, information provided to its users and the legal bases needed to collect, publish or use that data.

4. Categories of data processed

• Account and authentication data: email, technical identifiers, verification status, sessions and information needed for access recovery.
• Organisation data: name, members, roles, invitations, activated products, settings and history of administrative operations.
• Profile data and content: names, professional roles, contacts, sites, assets, interventions, maintenance plans, deadlines, spare parts, costs and customer-uploaded documents.
• Operational data and attachments: reports, tickets, assignments, comments, photographs and activity history, which may contain names or other personal data entered by the customer.
• Administrative and tax data: business name, address, country, tax identification or VAT number, subscription status, payment references and billing documents.
• Technical and security data: IP address, user agent, logs, session identifiers, authentication events, diagnostic data and anti-fraud signals.
• Communications: support requests, reports, operational emails and content sent to Lytheron contact addresses.

5. Sources of data

We collect data directly from the individual, the organisation administrator inviting a member, public forms configured by the customer, technical systems needed to deliver the service, and payment or infrastructure providers to the extent necessary to manage the relationship. We do not purchase contact lists for profiling.

6. Purposes, legal bases and necessity of providing data

• Service delivery and account management: performance of a contract or pre-contractual measures. Mandatory data is needed to create an account, sign in and use products.
• Organisations, roles, invitations and authorisations: performance of a contract and legitimate interests in ensuring appropriate, traceable access.
• Payments, subscriptions and invoices: performance of a contract and legal accounting and tax obligations.
• Security, abuse prevention and defence of rights: legitimate interests of Lytheron and customers in protecting accounts, data, infrastructure and service continuity.
• Support and operational communications: performance of a contract and legitimate interests in answering requests and informing users of technical or security changes.
• Regulatory compliance and authority requests: legal obligation.
• Optional consent-based features: consent where a particular feature requires it. Consent can be withdrawn at any time without affecting the lawfulness of earlier processing.

If data needed for the contract, security or billing is not provided, we may be unable to create an account, activate a product, process a payment or maintain the service.

7. Recipients and providers

Data may be processed by authorised personnel and selected providers for hosting, databases, authentication, storage, operational email delivery and payments. The current categories and principal providers are listed on the Subprocessors page. Providers are subject to contractual confidentiality, security and data protection obligations consistent with their roles.

Data may also be disclosed to professional advisers, authorities or entitled parties where necessary for legal obligations, protection of rights, fraud prevention or dispute management.

8. Payments and billing

Full card details are collected and processed by the payment provider and are not stored in Lytheron application databases. Lytheron receives the information needed to verify payment outcomes, manage subscriptions, prevent fraud and produce tax documents. The payment provider may also act as an independent controller for regulatory obligations, fraud prevention and payment services.

9. International transfers

Some providers may process data outside the European Economic Area. Such transfers rely on an instrument recognised by applicable law, such as an adequacy decision, the Data Privacy Framework where applicable, standard contractual clauses or other GDPR safeguards. Further information is available from legal@lytheron.com.

10. Retention

• Accounts and organisations: for the relationship's duration and as long as necessary to handle closure, export, disputes and security.
• Customer content: until deletion by the organisation or termination of the service, subject to temporary backup copies and legal obligations.
• Billing and accounting data: for the period required by applicable tax and accounting law.
• Security logs: for a period proportionate to preventing, investigating and defending against abuse or incidents.
• Support requests and reports: as long as needed to handle them and protect rights.

Retention may be extended where necessary for legal obligations, disputes, security investigations or authority requests. At expiry, data is deleted or anonymised using reasonable procedures.

11. Cookies and local technologies

The service uses cookies and local storage needed for sessions, security and language preference. We do not use advertising or profiling cookies without a valid user choice. Details, durations and management methods are set out in the Cookie notice.

12. Automated decisions and profiling

Lytheron does not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals. Automated checks may be used for security, abuse prevention, technical limits and operation validation, with human review where necessary.

13. Minors

Lytheron services are designed for businesses, professionals and organisations and are not directed at minors. Customers must not knowingly collect minors' data through the platform without a valid legal basis and information or authorisations required by law.

14. Security

We adopt technical and organisational measures proportionate to risk, including access control, organisation-level data isolation, authentication, least privilege, key protection, validation, logging and incident management procedures. See the Security page for further information.

15. Individual rights

Where the GDPR provides, you may request access, rectification, erasure, restriction, portability, objection and withdrawal of consent. You may also request information on safeguards for international transfers.

Send requests to legal@lytheron.com. We may ask for reasonable information to verify identity and protect data against unauthorised access. We respond without undue delay and normally within one month, subject to lawful extensions for complex or numerous requests.

If data is processed on behalf of a Lytheron customer, we may forward the request to that customer as controller or assist its response.

16. Complaint to a supervisory authority

You may complain to the competent authority in your country or to the Estonian authority: Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia; email info@aki.ee; website aki.ee.

17. Changes to this notice

We may update this notice to reflect developments in the service, providers or law. The update date is shown at the beginning. For material changes, we will provide reasonable notice through the website, account or an operational communication.