Subprocessors

What this list is

This is the list of subprocessors referred to in the data processing agreement. A subprocessor is a party that processes personal data held in the service on our behalf.

For each subprocessor the list states what it does, what personal data it sees and where the data is located. We keep the list up to date.

Each subprocessor is under a data processing agreement that places the same obligations on it as we have towards the accounting firm.

One row does not name a supplier yet: email delivery. The contractual arrangement for EU-region email delivery is being finalised, and we will name the supplier on this page as soon as the contract is signed. Until then the name is available on request from software@koud.fi. Every other row names its supplier.

Hosting and infrastructure

Supplier: UpCloud Ltd, a Finnish company.

Task: the servers, the database, the file storage and the backups the service runs on.

Personal data: all material stored in the service, including documents, messages, client records and user accounts.

Location: Helsinki, Finland (EU). The server, the managed database, the file storage bucket and the backup bucket are all in the same Helsinki region, and our provisioning tooling refuses to build a deployment outside the EU or the EEA.

Email delivery

Task: delivering the messages the service sends - sign-in links, request notices, reminders and digests.

Personal data: the recipient's name and email address, and the content of the message. Messages do not carry receipts as attachments.

Location: the EU. The supplier is not yet named on this page; the name is available on request. Receipts and other stored files are not sent by email, so an outgoing message carries the notice and the sign-in link, not the material.

Finnish Patent and Registration Office (PRH), YTJ

Task: looking up public company register data for a client record - name, address, industry, company form and register status.

Personal data: the query carries a company name or business ID. No personal data about service users is sent.

Location: Finland. This is an authority's open data (CC BY 4.0), not a contractual subprocessing arrangement.

Transfers outside the EU

No personal data held in the service is transferred outside the EU or the EEA. The servers, the database, the file storage and the backups are in Helsinki; the company register lookup goes to a Finnish authority; email delivery is required to be within the EU. There is nothing else: the service calls no other outside party.

Because there is no transfer to a third country, the European Commission's standard contractual clauses are not needed and no processing is carried out under them today. Saying otherwise would suggest a transfer that does not happen.

If a subprocessor outside the EU or the EEA ever becomes necessary, we announce it in advance as described under Changes, and the transfer is made under the standard contractual clauses together with an assessment of the safeguards in the destination country. Until such an announcement, the answer to the question of whether data leaves the EU is no.

What the service does not use

The service has none of the following, so no provider of them appears on this list:

If any of these is taken into use, it is added to this list and announced in advance as described under Changes.

• visitor analytics or third-party tracking scripts
• a content delivery network - every file on the site comes from our own server
• SMS delivery
• a payment provider - invoices are paid by bank transfer
• an error reporting or session recording service

Changes and objections

We notify the accounting firm of a new or changed subprocessor at least 30 days before the change takes effect.

The accounting firm may object on reasonable grounds before the change takes effect. If we cannot find a solution together, the firm may terminate the agreement with immediate effect.

Questions about this list, and requests to be notified of changes, can be sent to software@koud.fi.