Data Processing Agreement

Vaivatta provides a human-concierge service for Finnish small businesses to manage their digital tools. We process personal data only to perform the service contract — onboarding and ongoing operation of tools, customer communication, monitoring, incident management, and billing.

• Contact basics: name, email, phone, role
• Company data: name, business ID, address
• Service usage data: sign-ins, usage log, user preferences
• Concierge conversation contents: messages and attachments you send us
• Managed-tool metadata: tool inventories, vendors, contract details

We don't process special categories of data (sensitive data) under GDPR without a separate written agreement.

• Customer's employees and contact persons
• Administrators of the tools the customer uses
• Other individuals whose data the customer chooses to share via concierge conversations

• Processing personal data only on your documented instructions
• Ensuring our personnel are bound by confidentiality
• Implementing appropriate technical and organisational safeguards (described on the Security page)
• Engaging subprocessors only under the conditions listed below
• Assisting you in responding to data-subject rights requests
• Notifying you of personal-data breaches within 72 hours of detection
• Deleting or returning personal data when the agreement ends
• Providing reasonable information to demonstrate compliance

Mosparo (bot protection) and the per-customer Passbolt vault run on our own servers inside Hetzner and are not separate subprocessors. SCCs = EU Standard Contractual Clauses.

Your personal data is processed and stored primarily in Finland. Backups may live elsewhere within the EU. Data is not transferred outside the EU/EEA. If a transfer were to become necessary in the future, we would notify you in advance and ensure its lawfulness via EU Standard Contractual Clauses or another GDPR-recognised safeguard.

• Encryption in transit (TLS 1.3) and at rest on disk
• Access control on a least-privilege basis with two-factor authentication
• Prompt installation of security updates and vulnerability scanning
• Audit logging of significant events
• Regular testing of recovery from backups

A full description is on the Security page.

• A description of the breach and when it occurred
• The nature of the affected data and data subjects
• Likely consequences
• Measures we've taken or intend to take
• A contact for follow-up information

• With reasonable advance notice (at least 30 days)
• During normal working hours and without disrupting the service
• At most once per year, unless a security incident or regulatory requirement demands otherwise

Alternatively, on request we can provide a summary of our safeguards and most recent audits.

• You may request an export of your data in machine-readable form before the service ends
• We delete personal data in active use within 30 days of termination
• Backup data is deleted within 90 days according to our recovery schedule
• We may retain data if specifically required by law (e.g. accounting law)

This DPA enters into force automatically when you accept Vaivatta's service terms and start using the service. It is part of your service package and does not require a separate signature.

If you need a signed version for your archives or internal requirements, please contact us — we'll send a PDF on request.

For privacy and contract enquiries:

Privacy enquiries

[email protected]

Contracts

[email protected]