Data Processing Agreement (DPA) – Tehostaja

This Agreement is entered into under Article 28(3) of Regulation (EU) 2016/679 ("GDPR") and forms part of the Tehostaja service agreement (PALVELUEHDOT.md). With respect to the processing of personal data, this Agreement prevails.

1. Parties

2. Definitions

Terms defined in Article 4 GDPR apply. Service = the Tehostaja SaaS service; Customer Data = personal data stored in or collected by the Service on behalf of the Customer; Sub-processor = another processor engaged by the Supplier that processes Customer Data.

3. Subject matter, nature and purpose

The Supplier processes Customer Data solely to provide the Service and the modules ordered by the Customer:

Nature of processing: storage, organisation, retrieval, use, calculation, transfer to recipients instructed by the Customer (e.g. Tax Administration, Incomes Register, e-invoicing operator, bank), backup, erasure. The Supplier does not use Customer Data for its own purposes, does not sell it and does not use it to train AI models.

4. Duration

For the term of the service agreement and thereafter until Customer Data has been returned and deleted under clause 15. Confidentiality survives termination.

5. Categories of personal data

1. Identification and contact data: name, e-mail, phone, address, title, organisation, business ID.
2. Identifiers: personal identity code (payroll and authority reports), tax number (construction site register and reports), date of birth, Valtti card number or QR identifier.
3. Payroll and employment data: salary, pay components, working time, absences, tax card and withholding data, pension and insurance data, trade union fee deduction täydennetään, employer.
4. Bank and payment data: IBAN, payments, invoices, expense claims.
5. Location data (only if enabled by the Customer): coordinates at clock-in or geofence event, accuracy, timestamp, device (Appendix 1).
6. Access control data: site arrival and departure, start and end dates of work, employer details, details of posted workers' representative.
7. CRM data: contacts, messages, meetings, quotes, contracts, signature data.
8. User and log data: user ID, roles, MFA status, login and audit logs, IP address, browser.
9. Other data stored by the Customer (attachments, free-text fields).

Special categories (Art. 9): The Service is not intended for them. No biometric data is processed. The Customer shall not store health data or other special categories in free-text fields without a legal basis. täydennetään

6. Categories of data subjects

Customer's employees and other payees; Customer's users; workers on shared construction sites, including subcontractors' workers and self-employed persons; contacts of the Customer's customers, suppliers and partners; other persons whose data the Customer stores.

7. Instructions and Customer responsibilities

1. The Supplier processes Customer Data only on documented instructions: this Agreement, the service agreement, settings chosen by the Customer in the Service, and written (incl. e-mail) instructions.
2. The Supplier informs the Customer without delay if an instruction in its opinion infringes data protection law.
3. If Union or Member State law requires other processing, the Supplier informs the Customer beforehand unless prohibited by law.
4. The Customer is responsible for the lawfulness of processing, legal basis, informing data subjects (Arts. 13–14), DPIAs (Art. 35), employee co-operation and consultation (Act on the Protection of Privacy in Working Life 759/2004, s. 21; Co-operation Act 1333/2021) and for setting statutory retention periods.
5. The Supplier provides an employee notice template: TYONTEKIJATIEDOTE_SIJAINTI_KULUNVALVONTA.md.

8. Confidentiality

1. Persons authorised to process Customer Data are bound by confidentiality.
2. Access is granted on a need-to-know basis for providing, supporting or troubleshooting the Service.
3. Supplier staff do not view Customer Data without a support request, Customer request or security reason täydennetään.
4. AI-based development tools (coding agents) have no access to production Customer Data.

9. Security (Art. 32)

9.1 Access control and authentication

• Multi-factor authentication (MFA) is mandatory for owner and administrator roles (TOTP, AAL2 on every session). The Customer may require MFA for all users (organisaatioasetus) and step-up verification for sensitive actions. täydennetään
• Role-based access; tenant isolation through Row Level Security on all public tables.
• Service-role keys are never exposed to the browser.

9.2 Encryption

• Encryption in transit (TLS/HTTPS).
• Database and files are covered by the sub-processor's (Supabase) encryption at rest täydennetään.
• Backups are encrypted before transfer (9.3).
• Secrets are stored as encrypted environment variables, not in source code; automated secret scanning.
• Personal location tokens are stored as hashes only.

9.3 Backups and restore

• Daily encrypted backup of the production database (pg_dump, custom format) streamed directly into age encryption; no unencrypted dump is written to disk.
• Encrypted copies are stored in the Supplier's Microsoft 365 OneDrive; upload integrity verified by size and SHA-256.
• Rotation: 7 daily + 4 weekly (Sunday) + 12 monthly copies; older copies deleted automatically. Deleted data therefore disappears from backups within approx. 13 months.
• The backup server is the Supplier's own server in Finland, physically located at the Supplier's premises in Pieksämäki (own infrastructure, not a sub-processor).
• The decryption key is kept separate from the backup server.
• Monitoring alerts if the latest copy is missing, older than 26 hours or abnormally small.
• Restore drill frequency täydennetään; RPO/RTO täydennetään.
• Sub-processor's own backups täydennetään.

9.4 AI features

• Before text is sent to an external language model, the Service masks personal data: personal identity codes, IBANs, e-mail addresses, phone numbers, monetary amounts and names. If content cannot be checked it is not sent (fail-closed). täydennetään
• Limitation: images (e.g. receipts) are sent unmasked to image recognition.
• AI only suggests; humans approve entries, payments and reports.
• Model providers and locations: ALIKASITTELIJAT.md. The Supplier ensures providers do not use Customer Data for training täydennetään.
• Customer may request AI features to be disabled täydennetään.

9.5 Logging and monitoring

• Audit log of security-relevant events: logins, MFA events, member/role changes, payroll and payment actions, bank account changes (incl. e-payslip account confirmation, which notifies the payer), location consents and pauses, token creation/revocation, viewing of raw locations, exports and deletions.
• Bookkeeping change audit log: retained for 10 years together with bookkeeping records.
• Technical logs (logins, errors): 12 months.
• Daily automated security checks (secrets, RLS status).

9.6 Development and change management

Version control, code review and automated tests before production; production release requires separate approval; automated test blocks new tables without RLS; no production Customer Data in test environments täydennetään.

9.7 Organisational measures

Incident runbook with named owner; key rotation preprod first; regular review of measures without lowering the level of protection.

10. Sub-processors

1. The Customer grants general prior authorisation (Art. 28(2)) for sub-processors listed as in use in ALIKASITTELIJAT.md.
2. Change notice: the Supplier notifies the Customer by e-mail at least *täydennetään days* before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds; failing a solution, the Customer may terminate the affected service before the change takes effect without penalty and receive a refund of prepaid unused fees.
3. Urgent security-driven replacements may be notified without undue delay afterwards täydennetään.
4. Sub-processors are bound by written terms at least as protective as this Agreement; the Supplier remains fully liable for them (Art. 28(4)).
5. Integrations chosen by the Customer (Customer's own accounting software, bank, Tax Administration, Incomes Register, e-invoicing operator, social media) are transfers on the Customer's instruction, not Supplier sub-processors.

11. International transfers

1. The primary database is located in the EU (Ireland).
2. Some sub-processors are US-based or process data outside the EU/EEA. Transfers rely on Chapter V GDPR: the EU–US Data Privacy Framework adequacy decision where the recipient is certified, or Standard Contractual Clauses (2021/914) with supplementary measures. täydennetään
3. EU/EEA-only processing may be agreed separately for public-sector customers.

12. Assistance

1. Data subject rights (Arts. 12–23): export and erasure tools are available to the Customer (Settings → Privacy). Requests received directly are forwarded to the Customer without delay.
2. Arts. 32–36: security, breach notifications, DPIA and prior consultation. The Supplier provides a description of processing and security for the Customer's DPIA and prepares its own DPIA memo for the location feature before production use.
3. Reasonable standard assistance is free of charge; extensive or repeated assistance may be charged at täydennetään.

13. Personal data breaches

1. The Supplier notifies the Customer of a personal data breach without undue delay after becoming aware of it, with a target of 24 hours (Art. 33(2)).
2. Notification by e-mail to the Customer's designated contact täydennetään, containing the information in Art. 33(3) as available, supplemented as it becomes available.
3. The Customer notifies the supervisory authority (72 h) and data subjects as required; the Supplier assists.
4. The Supplier documents breaches and remedial actions.

14. Audits

1. The Supplier makes available information necessary to demonstrate compliance (this Agreement, security description, sub-processor list, backup evidence).
2. The Customer or an independent auditor bound by confidentiality may audit *täydennetään with täydennetään days'* notice, and always when required by an authority or after a breach.
3. Audits shall not unreasonably disrupt operations or compromise other customers' data. Each party bears its own costs täydennetään.
4. The Supplier currently holds no external security certification (e.g. ISO 27001) and has not performed penetration testing. täydennetään

15. Return and deletion

1. The Customer can export its data in machine-readable form throughout the term and *täydennetään days after termination täydennetään*.
2. Thereafter the Supplier deletes Customer Data from production systems within *täydennetään days*, unless retention is required by law. Data expires from backups with rotation (approx. 13 months); backups are used only for restore in the meantime.
3. The Supplier confirms deletion in writing on request.
4. Statutory retention (e.g. Accounting Act, OSH Act s. 52b, Contractor's Liability Act) is the Customer's obligation; the Customer exports such data before deletion unless a paid archiving service is agreed täydennetään.

16. Liability

1. Each party is liable towards data subjects under Article 82 GDPR.
2. Between the parties, the liability limitations of the service agreement (clause 12) apply, except that for data protection breaches (breach of this DPA or the GDPR) the Supplier's liability cap is the service fees paid by the Customer in the 24 months preceding the event (decision HS 7 Oct 2026). Limitations do not apply to intentional misconduct or gross negligence.
3. Each party bears administrative fines imposed on it.
4. The Supplier is liable for its sub-processors as for itself.

17. Term and amendments

Effective with the service agreement or upon electronic acceptance. Amendments in writing; changes required by law or authority guidance may be made with täydennetään days' notice. Governed by Finnish law; disputes as in the service agreement.

Signatures

Appendix 1 – Location data and construction site access control

Applies to the upcoming location-based working time/travel feature and site access control, once enabled by the Customer. Legal sources: TALOUS_KULUNVALVONTA_LAKI.md (not a legal opinion).

A1.1 Roles. The Customer (employer; on site the main contractor, principal implementer or developer) is the controller; the Supplier is the processor.

A1.2 Location data.

1. GPS/location is off by default (Art. 25). It is activated only if the Customer enables it at organisation level and the user activates it on their own device (versioned, timestamped, revocable).
2. No continuous tracking: location is accepted only during the Customer's working-time window (default Mon–Fri 06–20). Points outside working time, during a pause, or with accuracy > 500 m are rejected without storage. Users can pause.
3. For access control, location is stored at most at the clock-in moment and only if enabled.
4. Raw location points are deleted after 30 days (Customer may choose 7–90). Approved time and travel entries are kept under normal accounting/payroll retention without the raw route.
5. Only the user sees their raw locations; supervisors see suggestions and approved entries, not routes.
6. The system only suggests; nothing is booked automatically into hours, travel claims or payroll.
7. Legal basis: the employer's (Customer's) legitimate interest (Art. 6(1)(f)) for recording working time and travel, partly a legal obligation (Art. 6(1)(c): Working Hours Act 872/2019 s. 32; Prepayment Decree s. 17); necessity under Act 759/2004 s. 3; not consent. Location is collected only during working time and the employee confirms the entries. Raw locations are deleted when the employee confirms the day (decision HS 9 Oct 2026). The Customer documents the balancing test (template: SIJAINTI_ETUJEN_PUNNINTA.md). The Customer conducts co-operation/consultation before deployment (759/2004 s. 21) and a DPIA where required.

A1.3 Access control and worker register.

1. Biometrics are prohibited: no fingerprints, facial recognition or other biometric identifiers. Identifiers: QR code, Valtti card number and tax number.
2. Access control does not replace the photo ID required by OSH Act s. 52a.
3. Worker register data (s. 52b): name, date of birth, tax number, start and end dates, employer name and business ID, posted workers' representative.
4. Tax Administration worker reports (s. 15b) are generated on the Customer's instruction; the Customer is responsible for submission and accuracy.

A1.4 Retention (set by the Customer; Service defaults)

After retention expires, data is deleted automatically or upon Customer confirmation täydennetään.

Appendix 2 – Summary of technical and organisational measures

See the Finnish version, Liite 2 (same content): MFA mandatory for owner/admin; RLS tenant isolation; TLS and encrypted backups; daily encrypted pg_dump with 7d + 4w + 12m rotation; audit logging; PII masking before external AI (images excepted); location off by default; code review, tests and secret scanning; incident runbook with 24 h breach-notice target; no ISO 27001/SOC 2/pentest yet.