Privacy Policy

1. Who we are

Ghost Con Oy ("Hero Monday", "we", "us") is a Finnish limited company registered in Finland. We operate the Hero Monday growth platform, which provides CRM, marketing automation, customer communication, and revenue operations tools to businesses.

If you have any questions about this Privacy Policy or how we handle your data, you can contact us at privacy@heromonday.fi. We are the data controller responsible for your personal data as described in this policy.

2. What data we collect

We collect data that you provide directly to us, data generated when you use our platform, and data from third-party integrations you connect. The types of personal data we may process include:

• •Account data: name, email address, phone number, company name, job title, and password (stored as a hashed value).
• •Usage data: IP address, browser type, device information, pages visited, and actions taken within the platform.
• •Customer data: contact records, pipeline deals, conversations, and other business data you store in your account.
• •Billing data: company billing address, VAT number, and payment method details (processed securely by our payment provider; we do not store full card numbers).
• •Integration data: information accessed through connected services such as Google Calendar, Outlook, or email providers, when you authorize those connections.

3. How we use your data

We process your personal data for the following purposes:

• •To provide, maintain, and improve the Hero Monday platform and its features.
• •To create and manage your account and to authenticate your identity.
• •To process payments and send you billing-related communications.
• •To send service notifications, product updates, and support responses.
• •To monitor and analyze usage to improve performance, security, and reliability.
• •To comply with legal obligations and to protect the rights, property, or safety of Hero Monday, our customers, or others.

4. Legal basis for processing

Under the EU General Data Protection Regulation (GDPR), we rely on the following legal bases to process your personal data:

• •Performance of a contract: processing necessary to deliver the services you signed up for under our Terms of Service.
• •Consent: where you have given clear consent for specific processing, such as receiving marketing emails (you can withdraw consent at any time).
• •Legitimate interests: processing that is necessary for our legitimate business interests, such as platform security and fraud prevention, where those interests are not overridden by your rights.
• •Legal obligation: processing required to comply with applicable laws, such as tax and accounting records.

5. Data sharing and sub-processors

We do not sell your personal data. We share data only with trusted service providers who help us operate the platform, under written agreements that require them to protect your data and process it only on our instructions. These sub-processors may include cloud hosting providers, email delivery services, analytics tools, and payment processors.

We may also disclose data when required by law, court order, or government regulation, or when we believe in good faith that disclosure is necessary to protect our rights, the safety of any person, or to prevent fraud or illegal activity.

6. International data transfers

Ghost Con Oy is based in Finland and primarily processes data within the European Economic Area (EEA). Where data is transferred to a country outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, or we rely on a recognized adequacy decision for that country.

7. Data retention

We retain your personal data for as long as your account is active, and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. When you close your account, we delete or anonymize your data within 90 days, except where we are legally required to retain it (for example, financial records required by Finnish tax law).

8. Your rights under GDPR

As a data subject in the European Economic Area, you have the following rights regarding your personal data:

• •Access: request a copy of the personal data we hold about you.
• •Rectification: request correction of inaccurate or incomplete data.
• •Erasure: request deletion of your data (the "right to be forgotten"), subject to legal retention requirements.
• •Restriction: request that we limit processing of your data in certain circumstances.
• •Portability: receive your data in a structured, machine-readable format and transmit it to another provider.
• •Objection: object to processing based on legitimate interests or for direct marketing.
• •Withdrawal of consent: withdraw consent at any time where processing is based on consent.

9. Security

We take reasonable technical and organizational measures to protect your data, including encryption in transit and at rest, access controls, regular security reviews, and staff training. No system is perfectly secure, but we work continuously to safeguard your information. For more detail, see our Security page.

10. Cookies

We use essential cookies to operate the platform and keep you logged in, and optional analytics cookies to understand how the platform is used. You can control cookies through your browser settings and through the cookie preferences presented on first visit. We do not use cookies for third-party advertising.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the platform or by email and update the "Last updated" date above. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

12. Contact

If you have questions, requests, or concerns about this Privacy Policy or your personal data, contact us at privacy@heromonday.fi or by post at Ghost Con Oy, Helsinki, Finland.