Data Processing Agreement

Processor

Eric Melin trading as Webem (the maintlead service), Business ID 3463147-6, address Kyläsaarenkuja 7 A35, 00580 HELSINKI, email eric@maintlead.com

(hereinafter the "Processor")

Controller

The customer company that has subscribed to the Processor's maintlead service, whose name, Business ID and contact details were given when registering for the service

(hereinafter the "Controller")

Definitions

The Processor and the Controller have entered into the maintlead service's Terms of Service and any order or pilot agreement (hereinafter the "Main Agreement"). To achieve the purposes of the Main Agreement, it is necessary for the Processor to process the personal data defined below that the Controller collects and submits. This agreement sets out the terms under which that personal data must be processed.

"Personal data" means any information relating to an identified or identifiable natural person (hereinafter a "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

"Processing of personal data" means an operation or set of operations performed on personal data or on sets of personal data, whether by automated means or not, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

In the contractual relationship referred to in this agreement, the Controller is the party that determines the purposes and means of the processing of personal data, and the Processor is the technical party that processes personal data on the Controller's behalf as part of the Main Agreement.

"Applicable law" means the European Union's General Data Protection Regulation (EU) 2016/679 and the Finnish Data Protection Act (1050/2018), together with any other legislation applicable to the processing of personal data.

General rights and obligations of the Controller

The Controller

a) is responsible for the collection of personal data;

b) processes personal data lawfully, carefully and in accordance with good data processing practice, and otherwise acts so that data subjects' right to privacy and other fundamental rights protecting their privacy are not restricted without a basis provided for in law;

c) determines the purposes and means of the processing of personal data and gives the Processor written instructions on the processing of personal data. The purpose of the processing must show what kind of tasks the personal data is processed for. This agreement, the Main Agreement, and instructions the Controller gives through its use of the maintlead service's features are considered the Controller's instructions;

d) is responsible for providing data subjects with all notices and information concerning the processing of personal data that the law requires;

e) is responsible for the fulfilment of data subjects' rights;

f) ensures that transferring personal data to the Processor, and the processing of personal data under this agreement, is lawful for the entire duration of the agreement;

g) warrants that, if it represents its group companies or third parties under this agreement, it has the right to enter into this agreement and to give the Processor the right to process personal data in accordance with this agreement and the Main Agreement;

h) confirms and is responsible for ensuring that the processing of personal data under this agreement complies with the requirements set out in law, including information security requirements;

i) confirms that it has given the Processor all the information the Processor needs in order to fulfil the obligations placed on it under this agreement in accordance with data protection law;

j) is responsible for ensuring that corrections, deletions and changes to personal data are submitted to the Processor without delay; and

k) is responsible for having a legal basis, as required by law, for the contact with data subjects carried out through the maintlead service (such as service reminders and service notices), and for not storing special categories of personal data or personal identity numbers in the service.

General rights and obligations of the Processor

The Processor

a) processes personal data only for the purposes defined in the Main Agreement and this agreement, only to the extent necessary to achieve the purpose of the Main Agreement, and only for the term of this agreement, unless mandatory law requires otherwise. The Processor has no right to use the personal data it receives in its own business, to disclose it, to process it, or to combine it with other material in its possession, other than to the extent set out in the Main Agreement and while performing the tasks it covers;

b) processes personal data lawfully, carefully and in accordance with good data processing practice, and otherwise acts so that data subjects' right to privacy and other fundamental rights protecting their privacy are not restricted without a basis provided for in law;

c) processes, and ensures that any person under its authority with access to personal data processes, personal data only in accordance with the Controller's documented, lawful and reasonable instructions. This may be departed from if required by applicable mandatory law, in which case the Processor must inform the Controller of the exception without delay, provided that the applicable law does not prohibit such information;

d) ensures that personal data is processed only by persons whose job duties require it, and that those persons have committed to confidentiality or are bound by an appropriate statutory duty of confidentiality;

e) implements all security measures required of processors by law, as more specifically agreed in this agreement;

f) assists the Controller, to the extent possible and taking into account the nature of the processing, with appropriate technical and organisational measures in fulfilling the Controller's obligation to respond to requests concerning the exercise of data subjects' rights;

g) assists the Controller, taking into account the nature of the processing and the information available to the Processor, in ensuring compliance with the obligations placed on the Controller by law, such as security measures, impact assessments and prior consultation. The Processor is only obliged to assist the Controller within the scope of the obligations placed on the Processor by applicable law;

h) takes into account, without undue delay, any corrections, deletions and changes to data submitted by the Controller when processing personal data;

i) during or at the end of this agreement, either destroys or returns to the Controller, as the customer chooses and instructs, all personal data, and deletes existing copies, unless mandatory law requires otherwise. The practices for destruction and return may be agreed in more detail separately between the parties;

j) maintains any necessary records of processing activities and makes available to the Controller all information showing that the Processor complies with the obligations placed on it in this agreement and under applicable law;

k) permits, and participates in, audits carried out by the Controller or an auditor authorised by the Controller, as more specifically agreed in this agreement;

l) notifies the Controller if the Processor considers that an instruction given by the Controller infringes applicable law;

m) notifies the Controller if the Processor considers that there are deficiencies in the Controller's practices, and assists the Controller, where necessary, in correcting those practices.

The Processor is entitled to invoice separately for the assistance, correction and request-handling activities described above, for support with audits, and for work arising from changes to the Controller's instructions, and for its costs for these.

Notwithstanding point a) above, the Processor is entitled to produce anonymised, aggregated statistical data from personal data, from which no individual data subject or the Controller can be identified, for the purpose of developing and reporting on the service.

Subprocessors

The Processor may generally use subprocessors in the processing of personal data on the basis of this agreement. A "Subprocessor" means a processor that processes personal data under this agreement, in whole or in part, on behalf of and under instructions from the Processor.

The subprocessors used in the processing have been disclosed to the Controller before this agreement was signed. The Processor must inform the Controller of all planned changes concerning the addition or replacement of subprocessors, thereby giving the Controller the opportunity to object to such changes.

The Processor enters into a written processing agreement with each subprocessor and requires every subprocessor to comply with the data protection obligations placed on the Processor in this agreement, or obligations guaranteeing an equivalent level of data protection. A subprocessor processes personal data only in accordance with the written agreement. The Processor is responsible for the actions of the subprocessors it uses as if they were its own.

The subprocessors in use at the time this agreement is accepted (see also the more detailed, maintained list of subprocessors with links at the end of this page):

Geographic location of the processing of personal data

The Processor is entitled to transfer personal data outside the European Union, the European Economic Area, or other countries that the European Commission has found to guarantee an adequate level of data protection, only with the Controller's prior written consent. By accepting this agreement, the Controller gives its consent to the use of the subprocessors listed in the Subprocessors section to the extent that their processing requires a transfer outside the areas mentioned above, provided that the transfer relies on a transfer mechanism referred to in the following paragraph.

If data is transferred outside the areas mentioned above, the Processor enters into an agreement on the transfer of personal data, meeting the requirements of applicable law, with the necessary parties. The agreement on the transfer of personal data is drawn up in accordance with the standard contractual clauses approved by the European Commission. As an alternative to using the standard contractual clauses, the transfer may take place relying on other transfer mechanisms approved by applicable law.

If there is a conflict between the standard contractual clauses, or any other lawful transfer mechanism, and this agreement or the Main Agreement, the standard contractual clauses and the alternative transfer mechanisms always take precedence over this agreement and the Main Agreement.

Audit

The Controller has the right to audit the Processor's data processing activities under this agreement. The Processor must assist with, and participate in, the audit to the best of its ability.

The Controller may authorise an external auditor to carry out the audit, but such auditors must not be competitors of the Processor. The parties shall agree on the timing and other details of the audit well in advance of it being carried out. The audit must be carried out in a manner that does not interfere with the Processor's commitments to third parties. All representatives of the Controller, and any external auditors taking part in the audit, must sign a customary confidentiality agreement in favour of the Processor.

The Controller is responsible for all costs arising from the audit. The Processor is also entitled to invoice the Controller for assisting with the audit and for other additional work arising from it.

Confidentiality

The Processor undertakes to

a) keep confidential all personal data it receives from the Controller;

b) ensure that persons entitled to process personal data have committed to confidentiality; and

c) ensure that personal data is not transferred to third parties (other than the subprocessors covered by this agreement) without the Controller's prior written consent, unless the Processor is required to disclose the data under mandatory law or an order from an authority.

If a data subject or an authority makes a request concerning personal data, the Processor must, as soon as is reasonably possible, notify the Controller of such a request before responding to it or carrying out any other measures concerning the personal data. If a competent authority requires an immediate response, the Processor shall notify the Controller of the request as soon as possible after responding to it, unless mandatory law requires otherwise.

Personal data processed

The purpose of the processing of personal data is to provide the Controller with the maintlead service, which the Controller uses to manage its equipment register and service history and to send its end customers service reminders and post-service follow-up messages. The nature of the processing is the storage, retention, modification and display of personal data to the Controller's users and on a machine-specific page, sending it by email, backing it up, and deleting it. The duration of the processing is the same as the term of the service agreement, unless otherwise provided in the section on the term of the agreement and the duration of the processing of personal data.

The categories of personal data processed are as follows:

a) Contact details of the Controller's end customers: the name of the company or person, the name of the contact person, email address, phone number and the machine's location address.

b) Information relating to machines and services, to the extent it can be linked to an identifiable person: machine identifiers and serial number, service history, service entries, service intervals, next service date, and photos and attachments linked to a service. (confirm whether location data is used for photos)

c) Information about the Controller's users: name, email address, role (owner, administrator, technician), login-related data, and activity logs.

d) Email sending data: recipient's email address, time of sending, message type, delivery status, and data relating to opting out of messages (unsubscribing).

The categories of data subjects are the Controller's customers and their contact persons, as well as the Controller's employees and other users of the service.

There is no intention to process special categories of personal data (GDPR Article 9) or data relating to criminal convictions and offences. The Controller undertakes not to store such data in the service, including in service entries and free-text fields.

The list in this section is exhaustive and may only be amended by written agreement between the parties.

Information security of the processing of personal data

The Processor implements appropriate technical and organisational measures to protect personal data, taking into account the nature, scope and risks of the processing. The measures are at least as follows:

a) Data transfer is encrypted (TLS), and data is stored encrypted at rest in the services provided by the Subprocessors.

b) Access to data is restricted by user role (owner, administrator, technician), and each Controller's data is separated from the others at the database level (customer-specific data separation).

c) Users are identified with personal credentials.

d) Personal data is processed only by Processor personnel whose duties require it and who have committed to confidentiality.

e) Automatic backups are taken of the production database, and recovery from an incident has been planned.

f) Email messages are sent from a verified domain (SPF, DKIM and DMARC), and every message includes an unsubscribe link.

g) The service's public machine pages (QR code) are protected with an unguessable identifier and do not contain personal data that is unnecessary for the maintenance of the machine.

h) Passwords and access keys are not stored in the source code, and access rights to the Subprocessors' services are limited to those who need them.

i) Information security breaches are detected and recorded, and handled in accordance with the Processor's internal procedure.

The Processor notifies the Controller of a personal data breach without undue delay and no later than 48 hours after becoming aware of the breach. As far as possible, the notification describes the nature of the breach, the data and data subjects affected, the likely consequences, and the corrective measures taken and planned.

The Processor regularly assesses the adequacy of its security measures and updates them as needed. Material changes are notified to the Controller.

Term of the agreement and duration of the processing of personal data

This agreement enters into force when the Controller has accepted it as part of the Service Agreement, and remains in force for as long as the Processor processes personal data on behalf of the Controller, including during any pilot period.

When the Service Agreement ends, the Processor shall, at the Controller's request, return the Controller's data in a commonly used, machine-readable format (CSV), and shall thereafter delete the personal data from the service within 30 days of the agreement ending, unless the law requires the data to be retained for longer. Data contained in backups is removed within 35 days as part of the normal backup rotation.

On request, the Processor confirms in writing that the personal data has been deleted.

The provisions of this agreement that, by their nature, are intended to remain in force after the agreement ends (including confidentiality and liability) remain in force even after the agreement ends.

Acceptance of the agreement

The Controller accepts this agreement electronically by indicating its acceptance when logging into the maintlead service, at the same time as it accepts the terms of the Service Agreement. The person accepting it warrants that they are authorised to accept the agreement on behalf of the Controller.

The Processor records the time of acceptance, the person who accepted it, the Controller company's details, and the accepted version of the agreement. Electronic acceptance binds the parties in the same way as a signed agreement. On request, the Controller receives a copy of the accepted agreement and the acceptance details.

If the Processor materially amends this agreement, the Controller is asked for a new acceptance before the amended version is put into use.