Data processing agreement

The controller is the customer, that is, the company that has registered for Siivio and accepted the terms of service.

The processor is:

Luma Software Oy

Business ID: 3498264-7

Pietolankatu 41 B 4, 04440 Järvenpää

Email: hei@siivio.fi

The customer decides what data is stored in the service and what it is used for. We process the data only on the customer’s behalf and on its instructions.

We process personal data to provide the service. We store and keep data, show and pass it to the customer’s users, workers and customer portal users, send notifications, and produce material the customer asks for, such as invoices, reports and payroll material. We also maintain backups, investigate errors and look after security.

Processing lasts for as long as the customer uses the service, and after that for the retention period described in section 13.

—the customer’s staff: administrators, supervisors and workers

—contact persons and customer portal users of the customer’s customers

—private households that are the customer’s customers

—people who answer customer satisfaction surveys

The service can hold:

—names, contact details (email, phone, address) and user roles

—login data and technical log and error data

—employment details, such as hourly wage, type of employment and skills

—working hours, breaks and absences

—location at the start of a visit, when a worker checks in at a site

—photos taken on visits

—messages and announcements

—site addresses and access and key information, such as door codes

—invoices, contracts and quotes

—survey answers and complaints

—device identifiers for push notifications

The type of an absence can reveal sick leave, which is health data, and photos can show people. The customer is responsible for having a basis for processing this data, and for not storing unnecessary special categories of personal data in the service.

The customer is responsible for making sure that:

—the processing has a lawful basis under the GDPR

—data subjects have been told about the processing, for example workers about the location recorded when they check in at a site and about photos taken on visits

—only necessary data is stored in the service, and it is kept up to date

—the customer’s instructions to us comply with data protection law

We:

—process personal data only on the customer’s documented instructions; the instructions are these terms and the choices and settings the customer makes in the service

—tell the customer if we believe an instruction infringes data protection law

—do not process the data for our own purposes or disclose it to third parties unless the law requires it; if an authority demands data, we tell the customer unless the law forbids it

—make sure the people processing the data are bound by confidentiality

—carry out the security measures in section 7

—assist the customer in fulfilling data subjects’ rights, handling personal data breaches and carrying out data protection impact assessments (GDPR Articles 32–36)

—keep a record of processing activities (Article 30(2))

We protect personal data with appropriate technical and organisational measures:

—data is transferred over an encrypted connection (TLS) and is also encrypted at rest

—each customer’s data is isolated from other customers’ data, and access depends on the user’s role; these restrictions are enforced in the security rules of the database and the file storage, not only in the app

—passwords are not stored in plain text

—the database is backed up daily, with backups kept for 7 days, and weekly, with backups kept for 12 weeks; in addition, the database can be restored to any point in time within the last 7 days, and it is protected against accidental deletion

—access to the production environment is limited to the people who need it for their work

The customer is responsible for securing its own devices and logins and for whom it gives access.

The customer gives general authorisation to use the following sub-processors:

—Google Ireland Limited (Firebase and Google Cloud): the database (Firestore), background functions (Cloud Functions) and files (Cloud Storage) in Belgium (europe-west1). Sign-in (Firebase Authentication), page delivery (Firebase Hosting), push notifications (Firebase Cloud Messaging) and log and error data (Cloud Logging and Error Reporting) may also process data outside the EEA.

—Stripe Payments Europe, Limited (Ireland): subscription billing and payments. Stripe processes only the subscriber’s billing contact and payment details.

—Resend: sending email, once email features are switched on. Data is processed in the United States.

—Browser push services (Google, Apple and Mozilla): deliver push notifications to the user’s device, depending on which browser the user uses.

We make sure sub-processors are bound by data protection obligations at least equal to this agreement, and we are responsible for them as for ourselves. We announce new or replaced sub-processors at least 30 days in advance. If the customer objects to a change on reasonable grounds, it can cancel the subscription to end before the change takes effect.

If personal data is transferred outside the EU and EEA, the transfer is based on the European Commission’s standard contractual clauses, or on the EU–US Data Privacy Framework where the recipient has signed up to it.

We notify the customer of a personal data breach without undue delay and at the latest 48 hours after becoming aware of it. The notification gives what we know at the time: what happened, which data and people it concerns, its likely consequences and what we have done. We add details as they become available.

As controller, the customer decides on notifying the Office of the Data Protection Ombudsman and the data subjects, and we assist it.

The customer can view, correct and delete most data itself in the service. If a data subject contacts us directly, we pass the request on to the customer. We assist the customer in fulfilling requests when it cannot do so itself in the service.

On request, we give the customer the information needed to show compliance with this agreement. The customer, or an auditor it appoints who is bound by confidentiality, may carry out an audit at the customer’s cost once a year, and in addition when a personal data breach or an authority’s demand gives reason for one. An audit is agreed at least 30 days in advance and must not put other customers’ data at risk. For sub-processors, we can provide their own audit reports.

When the trial or subscription ends, we keep the data for 90 days and delete it after that, unless the customer asks for earlier deletion or the law requires the data to be kept. On request, we deliver the data to the customer in a machine-readable format before deletion.

Deleted data disappears from backups as they expire, at the latest 12 weeks after deletion.

Liability for infringing the GDPR is determined under Article 82 of the GDPR. Otherwise, the limitation of liability in the terms of service applies to the parties’ liability to the extent the law allows.

This agreement is in force for as long as we process personal data on the customer’s behalf. If this agreement and the terms of service conflict on the processing of personal data, this agreement prevails. Changes to this agreement follow the change procedure of the terms of service.