Data processing agreement

In plain words

When your company uses Toimeen, your company decides what happens to the personal data in its mail and documents: it is the controller. We process that data only to provide Toimeen, only on your instructions, and we protect it, tell you about breaches, help you answer people's requests and delete it when you leave.

1. Parties and scope

This agreement ("DPA") is between the company that uses Toimeen ("Controller", "you") and Fidanet Solution Oy, Business ID 3497432-1, Marinkallio 6b, 02320 Espoo, Finland ("Processor", "we"). It supplements the Terms of use and becomes part of them when you create an account. It applies whenever we process personal data on your behalf in providing the Service.

Words such as personal data, processing, controller, processor, sub-processor, data subject and personal data breach have the meaning given in the GDPR (Regulation (EU) 2016/679).

2. Subject matter and duration

We process personal data to provide the Service described in the Terms: reading mail and documents, preparing drafts and proposals, keeping the approval inbox and the action log, connecting to the systems you choose, and storing the results for your users. Processing lasts as long as your account, plus the return and deletion period in section 11. Annex I lists the categories of data and data subjects.

3. Your instructions

We process personal data only on your documented instructions: these terms, this DPA and the way you use the Service's settings and connections. If the law requires other processing, we tell you first unless the law forbids it. If we think an instruction breaks data protection law, we tell you without delay.

An agent never sends, books or changes anything outside Toimeen on its own: each such action waits for approval by a person in your company. Approvals are your instructions.

4. Confidentiality

Everyone at Fidanet Solution Oy who can access your data is bound to confidentiality.

5. Security

We take technical and organisational measures appropriate to the risk, as GDPR Article 32 requires. Annex II describes them. We may improve them, but not weaken the overall level of protection.

6. Sub-processors

You give general permission for us to use sub-processors. Annex III lists them. Before we add or replace a sub-processor that processes your personal data, we tell you at least 30 days in advance. You may object on reasonable data protection grounds by writing to hello@toimeen.com within that time; if we cannot resolve it, you may end the agreement before the change.

We bind each sub-processor to data protection obligations no weaker than these, and we remain responsible to you for their work.

7. Transfers outside the EU

Your data is stored in Finland. Where a sub-processor processes it outside the EU/EEA (see Annex III), the transfer is based on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914). You authorise us to agree to those clauses with the sub-processor.

8. Requests from data subjects

We help you answer requests from people exercising their GDPR rights, taking into account what the processing is: we find, export, correct or delete the data concerned when you ask. If a person contacts us directly about data you control, we pass the request to you without delay.

9. Personal data breaches

We tell you about a personal data breach affecting your data without undue delay and at the latest within 48 hours of learning of it, with what we know of its nature, the data and people affected, the likely consequences, and what we have done or propose to do. We help you meet your own duties under GDPR Articles 33 and 34.

10. Impact assessments and audits

We help you, as far as is reasonable, with data protection impact assessments and prior consultation with the authority. We give you the information needed to show that we meet GDPR Article 28. You may audit our compliance once a year with 30 days' written notice, during business hours, under confidentiality and at your own cost, unless the audit finds a material breach of this DPA.

11. Return and deletion

When the agreement ends, you may ask for your data in a machine-readable form for 60 days. After that we delete it within 30 days, unless Union or Finnish law requires us to keep it.

12. Liability and order of precedence

Liability follows the limits in the Terms, except where the law does not allow a limit. On personal data matters this DPA takes precedence over the Terms. Finnish law applies, and disputes are settled as the Terms provide.

Annex I: Description of the processing

Nature and purpose: storing and reading mail, attachments and documents; preparing drafts, proposals, invoices and orders for approval; recording decisions; transferring approved work to connected systems; public-source research on request; sending notifications.

Data subjects:

• the Controller's users (owners, employees, others it invites);
• people who appear in the Controller's mail and documents: customers' and suppliers' contact persons, senders and recipients;
• people about whom the Controller asks for public-source research, if it has turned that on.

Categories of personal data:

• names, email addresses, phone numbers, job titles and company details;
• the content of mail, attachments and documents, and the drafts and proposals made from them;
• users' sign-in data (password hash, sessions with IP address and browser), actions in the action log, Telegram chat ID if linked;
• research findings from public sources.

Special categories: the Service is not designed for special categories of personal data (GDPR Article 9). Do not bring such data into it unless you have a legal basis and have agreed with us how it is handled.

Frequency and duration: continuous, while the account is active, plus the period in section 11.

Annex II: Technical and organisational measures

• Servers in Finland (Hetzner, Helsinki); connections encrypted with TLS.
• Each company's data separated in the database with row-level security.
• Passwords stored as scrypt hashes; access keys to connected services encrypted with AES-256-GCM using a server key kept outside the database.
• Email addresses confirmed at sign-up; a password change signs out the other devices, a reset signs out all of them; sign-in attempts limited.
• Roles inside each company decide who sees and approves what; an approval limit restricts large approvals to owners and administrators.
• Every approval, rejection and settings change recorded in the action log.
• Outbound actions only after a person approves them.
• Server access limited to named people at Fidanet Solution Oy.
• Research agent: public sources only, identifies itself as ToimeenBot, respects robots.txt, research on individuals off by default, findings deleted after 180 days by default.

Annex III: Sub-processors

Services that you choose to connect (your mailbox, accounting program, point of sale, Telegram and others) are not our sub-processors: they act under their own agreements with you.