1. Parties and processing description
This DPA forms part of the Lensovia agreement between the customer and Tutkaneuvos, Finnish Business ID 1848320-7. The order identifies the customer, its identifier, contact and acceptance. The customer is a controller or a processor authorised by its controller; Tutkaneuvos is respectively a processor or subprocessor. Processing supports customer sales, procurement and technical work: receipt, storage, retrieval, structuring, AI analysis, drafts, approvals and separately authorised messages and integrations. Data subjects are customer employees, representatives, customers, suppliers and other contacts in the material. Data includes names, business contacts, roles, messages, documents, quotation and order information, and usage and approval events. Processing lasts for the service agreement and completion of agreed return and deletion.
2. Instructions and customer responsibilities
We process only under documented customer instructions, this DPA and service settings selected by authorised users. We inform the customer of an instruction we consider unlawful under data protection law and suspend the affected processing pending resolution. EU or Member State law may require other processing; we inform the customer before processing unless the law prohibits notice. The customer is responsible for legal bases, information duties, necessity of data and lawful instructions. Special-category and criminal offence data require separate written agreement and sufficient safeguards.
3. Confidentiality and security
Only authorised personnel with a task-related need may access data and they are bound by confidentiality. We maintain risk-appropriate GDPR Article 32 measures: protected transmission, organisation-specific access controls, private file stores, least privilege, multi-factor authentication for administration, event traceability, vulnerability remediation, backups and regular restoration checks. General Terms acceptance does not open another organisation’s data. A material reduction in protection requires advance notice and necessary compensating safeguards.
4. Subprocessors and changes
The customer gives general written authorisation for Railway Corporation for application servers, Supabase Pte. Ltd for database, authentication and files, Plus Five Five, Inc., trading as Resend, for messaging, and OpenAI Ireland Ltd. and applicable OpenAI entities for AI processing. Service-specific countries and roles appear in this delivery’s provider annex. Subprocessors are bound in writing to at least equivalent data protection obligations; we remain responsible to the customer for performance of those obligations. We give at least 30 days’ notice before adding or replacing a provider and disclosing data. Within that period the customer may object on substantiated data protection grounds. If protective changes or alternatives cannot resolve the issue, the customer may terminate the affected service without a termination fee and receive unused prepaid fees. Except for a legally justified emergency, no data is given to a disputed new provider before resolution.
5. Processing countries and transfers
The inspected application server region is Amsterdam, the Netherlands, and the Supabase project region is Stockholm, Sweden. Resend primarily processes in the United States; EU-only OpenAI processing is not promised. Support, metadata and subcontracting may require processing outside the EEA. Transfers and remote access are permitted only on documented GDPR Chapter V grounds, with necessary transfer assessments and supplementary safeguards. We supply material transfer information and clauses. This DPA is not itself an international transfer Standard Contractual Clause. Transfers without a lawful mechanism are suspended.
6. AI and purpose limitations
Customer material is not sold or used to benefit other customers, train general models or perform separate service development outside customer instructions. Structuring the customer’s own workspace knowledge and agreed feedback supports that customer’s service and does not authorise general model training. Only material required for the function is sent to the AI provider. We do not grant voluntary training permission. Necessary provider security retention and possible human review follow its data protection agreement and documented settings; they are not described as zero retention. Automation Policy and Human Gates limit external actions; the DPA or VERIFIED status alone does not authorise sending personal data outside the workspace.
7. Data subject requests
We promptly forward requests about customer material to the customer and assist access, correction, deletion, restriction and portability through available technical and organisational means. We do not decide requests on the customer’s behalf without instructions unless required by law. The customer determines the lawful outcome and response to the individual. Assistance arrangements or charges must not prevent timely compliance with legal obligations.
8. Personal data breaches
We notify the customer’s nominated contact of a personal data breach without undue delay and no later than 24 hours after becoming aware. Initial notice is not delayed until all information is established. We provide known facts, data categories and estimated scope, consequences, measures taken or planned and a contact, followed by updates as the investigation proceeds. We retain necessary investigation evidence and assist the customer. The customer determines its own notifications to authorities and individuals; its possible 72-hour deadline is not our notification deadline.
9. Assessments and audits
We assist with GDPR Articles 32–36, taking account of processing and information available to us. We provide necessary compliance information and allow audits and inspections by the customer or its independent auditor bound by confidentiality. Ordinary inspections are arranged on at least 14 days’ notice, normally once yearly; substantiated concerns, breaches or authority requirements permit additional inspections and shorter notice. Arrangements protect other customers’ data without negating audit rights. Reasonable exceptional assistance costs are agreed beforehand; assistance arising from our own breach is not separately charged.
10. Return and deletion
At service end the customer chooses return and deletion or deletion alone. Return must be requested within 30 days after termination; we securely supply original files and available structured data in commonly readable formats. The return window does not authorise other continued processing. We delete customer material and unnecessary copies from active systems within 30 days after termination or under agreed earlier deletion instructions. Where return was timely requested but technically unfinished, data is isolated solely for return and deleted immediately afterwards. Remaining backups are isolated from ordinary use and expire within 90 days of active-system deletion; deletion instructions are reapplied after any restoration. Only separate retention required by EU or Member State law continues for the necessary period. We confirm deletion on request and ensure equivalent subprocessor deletion.
11. Duration and precedence
An authorised representative accepts the DPA with the order or through separately documented acceptance before personal data processing. Merely acknowledging the Privacy Notice does not form this agreement. Acceptance records include customer and representative identifiers, version, language, timestamp and permanent contents of the agreement and annexes. The DPA and its processing, security and provider descriptions prevail over general Terms for personal data processing. A new purpose requiring consent cannot be added merely by changing terms. Other duties end on completed deletion; confidentiality and mandatory obligations continue.
12. Liability and disputes
Contractual liability between the parties follows the approved Terms’ limit based on actual Lensovia service fees paid during the previous 6 months and its exceptions. This DPA does not limit GDPR data subject rights, statutory compensation rights, authority powers or mandatory liability allocation. Finnish law and Itä-Uudenmaan käräjäoikeus in Finland apply to contractual disputes between the parties. Proceedings are in Finnish to the extent permitted by law; mandatory language, jurisdiction and data protection rules remain applicable.
Appendix A — processing details
Parties and processing description
This DPA forms part of the Lensovia agreement between the customer and Tutkaneuvos, Finnish Business ID 1848320-7. The order identifies the customer, its identifier, contact and acceptance. The customer is a controller or a processor authorised by its controller; Tutkaneuvos is respectively a processor or subprocessor. Processing supports customer sales, procurement and technical work: receipt, storage, retrieval, structuring, AI analysis, drafts, approvals and separately authorised messages and integrations. Data subjects are customer employees, representatives, customers, suppliers and other contacts in the material. Data includes names, business contacts, roles, messages, documents, quotation and order information, and usage and approval events. Processing lasts for the service agreement and completion of agreed return and deletion.
Confidentiality and security
Only authorised personnel with a task-related need may access data and they are bound by confidentiality. We maintain risk-appropriate GDPR Article 32 measures: protected transmission, organisation-specific access controls, private file stores, least privilege, multi-factor authentication for administration, event traceability, vulnerability remediation, backups and regular restoration checks. General Terms acceptance does not open another organisation’s data. A material reduction in protection requires advance notice and necessary compensating safeguards.
Recipients and processing countries
Railway Corporation provides the application server environment in Amsterdam, the Netherlands. Supabase Pte. Ltd provides the database, authentication and file storage; the inspected Lensovia project is in Stockholm, Sweden. These region choices do not guarantee that all support and metadata processing remains in the EEA. Plus Five Five, Inc., trading as Resend, delivers emails and primarily processes them in the United States. OpenAI Ireland Ltd. and its service chain process AI requests; EU-only processing has not been confirmed. Stripe acts as a processor for particular payment services and as a controller for its own payment, fraud prevention and statutory purposes. Billing does not require sharing the entire workspace with Stripe. Data may also be disclosed to authorities where required or, as necessary, to advisers bound by confidentiality.