Data Processing Agreement: Oivanto Business Manager (BMGR)

Parties

Controller: the Customer (the organisation that accepts this DPA when it activates the BMGR service) The address recorded in the Customer's BMGR organisation profile hello@oivanto.fi

Subject matter and duration of processing (Art. 28(3))

Subject matter: Processing of personal data necessary to provide the Oivanto Business Manager service (BMGR.fi) to the Customer: storing, processing, securing and backing up the data of the modules the Customer has enabled.

Nature, purpose, categories of data subjects and personal data

Purpose and nature of processing: Providing, maintaining and securing the BMGR service, support and backups, on the Customer's documented instructions. Instructions are given through the use and settings of the service and in writing.

Processing only on documented instructions (Art. 28(3)(a))

The Processor shall process personal data only on the Controller's documented instructions, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the Processor is subject; in such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

Confidentiality (Art. 28(3)(b))

The Processor shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

Security of processing (Art. 28(3)(c), Art. 32)

Measures actually in place: Database-level separation of organisations' data (PostgreSQL row-level security) and an application database role without superuser rights; role-based access control; encryption of protected fields (AES-256-GCM); authenticated sessions and multi-factor authentication the Customer can require of its users; rate limits on sign-in attempts and public requests; a sealed audit log of changes; virus scanning of uploaded files; encrypted transport (HTTPS); daily, verified database backups; data stored in a server environment located in Finland. Only named Oivanto personnel can access the production environment, using key-based authentication, and the administration panel is restricted by multi-factor authentication and IP restrictions.

Sub-processors (Art. 28(3)(d))

The Controller gives the Processor general written authorisation to engage sub-processors. The Processor shall inform the Controller of any intended changes concerning the addition or replacement of sub-processors, giving the Controller the opportunity to object to such changes. The Processor shall impose the same data protection obligations set out in this DPA on any sub-processor by way of a contract, and where that sub-processor fails to fulfil its data protection obligations, the Processor remains fully liable to the Controller for the performance of that sub-processor's obligations.

Assistance with data-subject rights (Art. 28(3)(e))

Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising the data subject's rights under Chapter III of the GDPR.

Assistance with security, breach notification and DPIA obligations (Art. 28(3)(f))

Taking into account the nature of processing and the information available to the Processor, the Processor shall assist the Controller in ensuring compliance with the obligations under Articles 32 to 36 of the GDPR (security of processing, notification of personal data breaches to the supervisory authority, communication of a personal data breach to the data subject, data protection impact assessment, and prior consultation).

Deletion or return of data (Art. 28(3)(g))

At the choice of the Controller, the Processor shall return all personal data to the Controller after the end of the provision of services relating to processing, and delete existing copies unless Union or Member State law requires storage of the personal data.

Information and audits (Art. 28(3)(h))

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR, and shall allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.

Governing law

Governing law: The laws of Finland