Data Processing Agreement

Provider

Selvia, a private trader (sole trader) (yksityinen elinkeinonharjoittaja)

Business ID

3554334-7

Domicile

Helsinki, Finland

Address

Konalantie 7, 00370 Helsinki, Finland

Email

support@selvia.fi

This DPA is between Selvia and the business customer named in the relevant service agreement.

This DPA applies wherever Selvia processes personal data on the customer's behalf and on the customer's instructions — most commonly, personal data about the customer's own customers, suppliers, employees or other contacts that appears in accounting, business or professional-service material the customer provides to Selvia (for example, names on invoices and receipts, or identity details in a document submitted for an Immigration & Visa Assistance engagement). For that data, the customer is the controller and Selvia is the processor.

This DPA does not cover personal data for which Selvia is itself the controller — the customer's own account and contact details, Selvia's own billing records, or the customer's communications with Selvia's support team. The Privacy Policy covers that data.

Subject matter

Processing of personal data contained in accounting, business and professional-service material the customer provides to Selvia.

Duration

For as long as the relevant service agreement is in effect, and afterwards only as described in "Deletion and retention" below.

Nature and purpose

Processing only to provide the agreed software and professional services — bookkeeping, VAT preparation and filing, invoicing, document capture and storage, and the other services described in the Terms of Service and Payment Terms — for no other purpose.

Types of personal data

Names, contact details, and other identifying or transactional information appearing in the customer's accounting material — for example on invoices, receipts, bank statements and supporting documents — and, for an Immigration & Visa Assistance engagement, identity and application-related information the customer or the relevant individual provides for that engagement.

Categories of data subjects

The customer's own customers, suppliers, employees and other individuals named in the material the customer submits; for Immigration & Visa Assistance, the individual the engagement concerns.

• Selvia processes this personal data only on the customer's documented instructions — given by using the service as described in the Terms of Service, Payment Terms and the relevant service agreement — unless Finnish or EU law requires otherwise, in which case Selvia tells the customer before processing, unless the law prohibits this.
• Anyone Selvia allows to process this data is bound by an obligation of confidentiality.
• Selvia applies the technical and organisational measures described on the Security & Data page.
• Selvia helps the customer respond to a data-subject rights request concerning this data, to the extent Selvia is able to given the nature of the processing.
• Selvia helps the customer meet its obligations under GDPR Articles 32–36 (security, breach notification, impact assessments and prior consultation), as far as reasonably possible given the nature of the processing and the information available to Selvia.
• If Selvia becomes aware of a personal data breach affecting this data, Selvia notifies the customer without undue delay.
• At the end of the relevant service, Selvia deletes or returns this personal data, except data Selvia or the customer is required by law to keep — see "Deletion and retention" below.
• Selvia makes available the information reasonably necessary to show it meets these obligations, and allows for and contributes to an audit, including an inspection, conducted by the customer or an auditor the customer mandates, on reasonable prior notice and during normal business hours. This is reasonably satisfied by existing documentation — this DPA and the Security & Data page — except where that is genuinely insufficient for the specific question raised.

Selvia uses the subprocessors on the Subprocessor List to provide the service — for example database hosting, file storage and document-text extraction. By using Selvia's services, the customer authorises Selvia's use of the subprocessors currently on that list. Selvia imposes data-protection obligations on each subprocessor equivalent to this DPA, and remains responsible to the customer for a subprocessor's performance of them.

For a new subprocessor that will process this category of personal data, Selvia updates the Subprocessor List and, where Selvia holds a current contact email for the customer, emails notice of the change. A customer who objects on reasonable data-protection grounds can raise it at support@selvia.fi before the change takes effect; if the objection cannot be resolved, the customer may end the affected service.

Some subprocessors are based outside the EU/EEA, or may process data there — the Subprocessor List states this where currently known. Where personal data is transferred outside the EEA, Selvia relies on a safeguard the GDPR allows: an adequacy decision of the European Commission (including the EU–US Data Privacy Framework, for a subprocessor currently certified to it), the Commission's Standard Contractual Clauses, or the subprocessor's own data-processing terms incorporating one of these.

When the relevant service ends, Selvia deletes or anonymises personal data processed only for that service and not needed for another purpose, following the process described on the Account Deletion page.

Selvia keeps accounting, VAT and other records Finnish law requires it to keep, for the periods that law sets, even after a service or account ends. This is a legal obligation on Selvia, not a choice — the same retention the customer's own bookkeeping is subject to under Finnish accounting law.

The customer is responsible for having a lawful basis to give Selvia the personal data it provides, for the accuracy of its instructions, and for its own obligations as controller — including responding to a data-subject request Selvia cannot answer alone, and any notification obligation the law places on the controller rather than the processor.

This DPA is incorporated into, and forms part of, the agreement between Selvia and a business customer from the point the customer accepts the Terms of Service — the same way the Payment Terms are incorporated for a subscription. It applies automatically to the processing it covers; no separate signature is required. A customer who needs a separately countersigned copy for its own records can request one at support@selvia.fi — a signed copy restates these terms rather than creating different ones.

This DPA supplements the Terms of Service and Payment Terms. Where this DPA and those documents conflict on a data-protection point this DPA covers, this DPA applies for that point.

Selvia may update this DPA when the processing it covers, the law, or the subprocessors used change. A material change is notified the same way as other significant changes to Selvia's terms.

Questions about this DPA, or a request for a signed copy: support@selvia.fi.