Privacy Policy

Last updated: 28 August 2026

This policy describes how KKG Fagerholm Oy (“we”, “us”), a company registered in Finland, processes personal data in connection with the Stedox P&L reporting service (the “Service”). The Service is a business analytics application that produces profit-and-loss reporting for e-commerce businesses (“Clients”) from data sources the Client connects, such as their advertising accounts and online stores. We act as a processor of the data our Clients connect, and as a controller for the account data of the people who use the Service.

Data we process

• User account data. Name, email address, and login credentials of Client staff who administer the Service.
• Advertising platform data. When a Client connects an advertising account (for example a Meta ad account), we retrieve aggregated advertising performance data through the platform’s official API: campaign names and identifiers, spend, impressions, clicks, and aggregated conversion metrics. This data is aggregate business data and does not identify the people who saw or clicked the ads.
• Order data. When a Client connects their online store (for example WooCommerce or Amazon), we retrieve order records through the platform’s official API. These records can include personal data of the Client’s customers, such as name, address, email address, country, and purchased items. We process this data solely to produce financial reporting for that Client.

How we use data obtained from Meta

Data retrieved from Meta’s APIs is used only to provide the Service to the Client whose ad account it belongs to: computing advertising cost, contribution margin, and related financial reporting. We do not sell it, use it for advertising of our own, combine it across Clients, or share it with anyone other than the subprocessors listed below. We process it in accordance with the Meta Platform Terms. Access tokens granted to us are stored encrypted and are used only server-side.

Legal bases

We process user account data to perform our contract with the Client (GDPR Art. 6(1)(b)). We process connected platform data on the Client’s documented instructions as their processor; the Client is the controller of that data.

Where data is stored and who can access it

Data is stored with our subprocessors: Supabase (database hosting, EU region) and Vercel (application hosting). Access within KKG Fagerholm Oy is limited to personnel who operate the Service. We do not sell or rent personal data. Aggregated dashboards can be shared by the Client via an unlisted link that the Client controls; these dashboards contain financial aggregates, not personal data of the Client’s customers.

Retention

Connected platform data is retained for as long as the Client uses the Service, so that reporting can cover past periods. When a Client disconnects a data source or terminates the Service, the associated access tokens are deleted immediately and the imported data is deleted within 30 days, except where retention is required by law. See Data Deletion for how to request deletion.

Cookies

The Service uses only cookies that are necessary for signing in to the administration interface. Public dashboard pages set no cookies and use no tracking.

Your rights

Under the GDPR you have the right to access, rectify, and erase your personal data, to restrict or object to its processing, and to data portability. If you are a customer of one of our Clients, please direct requests to that Client, who controls your data; we will assist them in fulfilling it. You also have the right to lodge a complaint with a supervisory authority — in Finland, the Office of the Data Protection Ombudsman (tietosuoja.fi).

Contact

KKG Fagerholm Oy, Finland
Email: privacy@kkgconsulting.fi

We may update this policy as the Service evolves; the date above shows the latest revision.