Privacy Policy

Data Controller: Iotera Oy Business ID: 3454475-1 Address: Tanhuankatu 63b, 33560 Tampere, Finland Email: tuki@veronavi.fi Data Protection Officer: Janne Kaikkonen Email: tuki@veronavi.fi

We process personal data for the following purposes: • Aggregating and displaying tax data for accounting firm clients — letters, VAT returns, prepayments, income register filings, and tax summaries are retrieved from the Finnish Tax Administration APIs and presented in a centralized view. • User account management and authentication — registration, sign-in, multi-factor authentication, and organization management. • Enabling Suomi.fi authorization management — transmitting authorization data between the accounting firm and the Tax Administration. • Service maintenance, security, and auditing — collecting usage logs, resolving incidents, and fulfilling statutory record-keeping requirements. • Complying with legal obligations — Accounting Act, tax procedure, and GDPR requirements.

Personal data processing is based on the following GDPR legal bases: • Contract (Article 6(1)(b)) — Processing user data is necessary for the performance of the service agreement. Processing accounting firm client data is based on the service agreement between the firm and VeroNavi. Use of the payment service and subscription billing is also based on this agreement. • Legal obligation (Article 6(1)(c)) — Collecting and retaining audit logs is required by Suomi.fi authorization terms and the Accounting Act. Retaining invoices and payment receipts is likewise required by the Accounting Act (1336/1997). • Legitimate interest (Article 6(1)(f)) — Ensuring service security, preventing misuse — including misuse of the free trial — and improving the service. A legitimate interest balancing test has been conducted. • Consent (Article 6(1)(a)) — Use of cookies for analytics purposes (if applicable). Consent can be withdrawn at any time.

User data (accounting firm employees): • Name (first name, last name) • Email address • Password hash; the password is not stored in plain text • Organization name, business ID, and address • User role within the organization • Login history and IP addresses Billing data (organization subscription and payment): • Organization name and business ID • Billing contact email address • Billing address • Payment method details — card data is handled and stored exclusively by our payment processor, Stripe; VeroNavi never sees or stores card numbers • Free trial usage date — retained together with the business ID even after the organization is deleted, to prevent misuse of the free trial (see Data Retention Periods) Client data (accounting firm clients): • Company name and business ID • Contact person name and details • Suomi.fi authorization data and validity Tax data (from Tax Administration APIs): • Tax letters and notices • VAT returns and decisions • Prepayment decisions and payment status • Income register filings • Tax summaries and decisions Technical data: • IP address, browser type, operating system • Audit logs (who viewed whose data, when) • Session data and cookies

Tax data is financially sensitive, although it does not fall under GDPR Article 9 special categories. The Finnish personal identity code is specially protected under Section 29 of the Finnish Data Protection Act. VeroNavi does not store personal identity codes. Clients are added and tax data is retrieved using the business ID alone. If a personal identity code is entered by mistake as a client's details, the system rejects it and it is not stored. Income recipient identifiers in income register data (dataset 312) and personal identity codes entered in the name register are processed only transiently in memory to calculate the pseudonymised identifier, and are not stored or written to logs.

When an accounting firm retrieves its client's income register data (dataset 312), the controller is the employer, i.e. the accounting firm's client company. The accounting firm processes the data on the employer's behalf, and VeroNavi acts as the accounting firm's sub-processor. VeroNavi processes the data only on the accounting firm's instructions and does not use it for its own purposes. Data processed: • payment-date totals and the employer's monthly summaries (separate notifications) • per-recipient income items and amounts • a pseudonymised recipient identifier — a keyed hash is computed from the recipient's identifier (personal identity code or a foreign identifier) using an organization-specific key; the identifier itself is not stored or written to logs. For recipients with no identifier at all, the date of birth is retained but is never shown in the user interface. • recipient names — names come from the name register the accounting firm enters itself (CSV import or manual entry) Retention: per-recipient rows 3 months, totals and summaries 12 months, fetch jobs 30 days (the client's latest fetch and latest successful fetch are kept for the duration of the client relationship) and notifications 90 days. Names are retained for the duration of the client relationship. All income register data is deleted when a client or an organization is deleted, and at the latest within 90 days after the agreement under the Terms ends. When an organization is deleted, the identifier key is also destroyed, so identifiers can no longer be linked to individuals. Viewing, retrievals and name register changes are recorded in the audit log and appear in the client's access log. Only users who can see the client in question have access to the data. A person who is a recipient of income can direct a data subject request primarily to their employer or the employer's accounting firm. Where needed, VeroNavi assists in handling the request; contact tuki@veronavi.fi.

Personal data is disclosed or transferred to the following parties: • Finnish Tax Administration — retrieving tax data through secured APIs • Suomi.fi / Digital and Population Data Services Agency — authorization management • Hetzner Online GmbH — server infrastructure. The servers are located in Finland. • Elestio Limited (Ireland) — server operations service. • Amazon Web Services EMEA SARL (Luxembourg) — storage of encrypted backups in the EU (Sweden). Backups are encrypted before transfer, and AWS has no access to their content. • Stripe Payments Europe, Limited (Dublin, Ireland) — payment processing and subscription billing provider. Stripe receives the organization's name, business ID, billing contact email address, billing address, and payment method details. Stripe processes and stores card data; VeroNavi never stores it. The Service's emails are sent from our own server, not through an external email service. A GDPR Article 28 compliant Data Processing Agreement (DPA) has been signed with all processors; for Stripe, the DPA is incorporated into its Services Agreement.

Tax data, client data, and user data are processed and stored on servers located in Finland. Encrypted backups are stored in the EU (Sweden) with Amazon Web Services EMEA SARL (AWS). Backups are encrypted before transfer, and AWS has no access to the encryption key or the content. AWS is a subsidiary of the US-based Amazon.com, Inc.; AWS's data processing addendum (AWS GDPR DPA), which is part of the AWS Service Terms, includes the EU Standard Contractual Clauses for any transfer. Tax data and personal identity codes are not transferred outside the EU/EEA — personal identity codes are in any case never stored by VeroNavi. Our payment processor, Stripe, may transfer billing data (organization name, business ID, billing contact email address, billing address, payment method details) outside the EU/EEA, for example to the United States. These transfers are based on the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. If the legal basis for transfers changes, we will update this policy and notify users accordingly.

• User data — retained as long as the user account is active and deleted at the latest within 30 days after account deletion. • Billing data — when an organization is deleted, its payment-processor customer record and saved payment methods are deleted. Invoices and payment receipts are retained for the current year + 6 years as a statutory obligation under the Finnish Accounting Act (1336/1997). Stripe may retain some data as an independent controller under its own legal obligations (e.g. fraud prevention, anti-money laundering). • Business ID for trial misuse prevention — when an organization is deleted, its business ID (Y-tunnus) and the date the free trial was used are retained indefinitely, so the same business ID cannot be used to claim a new free trial. An internal reference to the deleted organization is also retained (not personal data). No other data about the organization or its users is retained for this purpose. • Client data — retained as long as the client relationship is active. Deleted client data is anonymized within 90 days. Client data is deleted at the latest within 90 days after the agreement under the Terms ends. • Tax data — retained for the duration of the client relationship. The data is deleted at the latest within 90 days after the client is deleted or after the agreement under the Terms ends. • Income register data — per-recipient rows 3 months, totals and summaries 12 months, fetch jobs 30 days (the client's latest fetch and latest successful fetch are kept for the duration of the client relationship), notifications 90 days, and names in the name register for the duration of the client relationship. Data is deleted when a client or organization is deleted and at the latest within 90 days after the agreement under the Terms ends (see section Income register data). • Audit logs — retained for 10 years per Suomi.fi authorization terms and the Accounting Act. • Technical logs — retained for 90 days. • Backups — encrypted daily backups are retained for at most 6 months. Deleted data disappears from backups as they rotate, and backups are used only to restore the Service after an incident. After the retention period, data is automatically deleted or irreversibly anonymized.

Under the GDPR, you have the following rights: • Right of access (Article 15) — You can request a copy of all personal data concerning you. • Right to rectification (Article 16) — You can request correction of inaccurate data. • Right to erasure (Article 17) — You can request deletion of your data, unless there is a legal basis for retention. • Right to restriction (Article 18) — You can request restriction of processing in certain situations. • Right to data portability (Article 20) — You can receive your data in a machine-readable format. • Right to object (Article 21) — You can object to processing based on legitimate interest. • Right to withdraw consent — If processing is based on consent, you can withdraw it at any time. Requests should be sent to tuki@veronavi.fi. We respond to requests within 30 days. Identity is verified before data is disclosed. If you believe your data is processed in violation of data protection legislation, you have the right to file a complaint with the Data Protection Ombudsman: Office of the Data Protection Ombudsman tietosuoja.fi tietosuoja@om.fi

We protect personal data with the following technical and organizational measures: • Encryption of data in transit • Certificate-based authentication for Tax Administration API connections • Role-based access control — users can only see their own organization's data • Comprehensive audit log of all data access and modifications • Servers located in Finland with restricted access • Passwords stored as hashes, not in plain text • Automatic session expiration • Regular security audits and vulnerability scanning • Backups encrypted and stored in a separate location

VeroNavi uses the following cookies: Essential cookies (no consent required): • Session cookie — user identification after login • Language preference — remembering selected language • CSRF protection — form security Essential cookies are necessary for the service to function and cannot be disabled. Analytics cookies are not currently in use. If analytics cookies are introduced, separate consent will be requested.

We reserve the right to update this Privacy Policy. Users will be notified of material changes via email or through the service at least 30 days before the changes take effect. We recommend reviewing this policy regularly.

For data protection inquiries and requests: Iotera Oy Email: tuki@veronavi.fi Address: Tanhuankatu 63b, 33560 Tampere, Finland We respond to all data protection requests within 30 days.