Subprocessors

What this list is

This is the list of subprocessors referred to in the data processing agreement. A subprocessor is a party that processes personal data held in the service on our behalf.

For each subprocessor the list states what it does, what personal data it sees and where the data is located. We keep the list up to date.

Each subprocessor is under a data processing agreement that places the same obligations on it as we have towards the accounting firm.

Some rows do not name a supplier yet. The reason is this: contractual arrangements for EU-region hosting and email are being finalised, and we will name the supplier on this page as soon as the contract is signed. Until then the name is available on request from software@koud.fi.

Hosting and infrastructure

Task: the servers, database and file storage the service runs on.

Personal data: all material stored in the service, including documents, messages, client records and user accounts.

Location: the EU. The supplier is not yet named on this page; the name is available on request.

Email delivery

Task: delivering the messages the service sends - sign-in links, request notices, reminders and digests.

Personal data: the recipient's name and email address, and the content of the message. Messages do not carry receipts as attachments.

Location: the EU. The supplier is not yet named on this page; the name is available on request.

Finnish Patent and Registration Office (PRH), YTJ

Task: looking up public company register data for a client record - name, address, industry, company form and register status.

Personal data: the query carries a company name or business ID. No personal data about service users is sent.

Location: Finland. This is an authority's open data (CC BY 4.0), not a contractual subprocessing arrangement.

What the service does not use

The service has none of the following, so no provider of them appears on this list:

If any of these is taken into use, it is added to this list and announced in advance as described under Changes.

• visitor analytics or third-party tracking scripts
• a content delivery network - every file on the site comes from our own server
• SMS delivery
• a payment provider - invoices are paid by bank transfer
• an error reporting or session recording service

Changes and objections

We notify the accounting firm of a new or changed subprocessor at least 30 days before the change takes effect.

The accounting firm may object on reasonable grounds before the change takes effect. If we cannot find a solution together, the firm may terminate the agreement with immediate effect.

Questions about this list, and requests to be notified of changes, can be sent to software@koud.fi.