Annex 1 to the Terms of Service: Data Processing Agreement

The parties to this Agreement are Iotera Oy (business ID 3454475-1, Tanhuankatu 63b, 33560 Tampere, Finland; the "Service Provider") and the Organization that has registered for the Service. This Agreement is an annex to the Terms. The Organization accepts it together with the Terms when the Organization is created in the Service or when a representative of the Organization accepts the Terms in the Service. If this Agreement and the Terms conflict in matters concerning the processing of personal data, this Agreement prevails. This Agreement applies to personal data that the Service Provider processes on behalf of the Organization in providing the Service. The roles are as follows: • For tax data retrieved from the Finnish Tax Administration's interfaces and client data that the Organization stores in the Service, the Organization is the controller or, where it processes data on behalf of its client, that client's processor. The Service Provider is a processor or, in the latter case, a sub-processor. • For income register data (dataset 312), the controller is the employer, i.e. the Organization's client company, the Organization is the employer's processor, and the Service Provider is the Organization's sub-processor. In this Agreement, "controller" means, in each situation, the party on whose behalf the Organization acts. Where the Organization acts as a processor, it warrants that it has the controller's authorization to use the Service Provider as a sub-processor on the terms of this Agreement, and that the instructions it gives to the Service Provider correspond to the controller's instructions. This Agreement does not apply to data for which the Service Provider is an independent controller. This includes Users' account and billing data, which are processed in accordance with the privacy policy.

Subject matter and purpose: the Service Provider processes personal data only to the extent necessary to provide the Service to the Organization in accordance with the Terms. The Service retrieves data on the Organization's clients from the Finnish Tax Administration's interfaces on the basis of the authorization the client has given to the Organization in Suomi.fi authorizations, and presents it in a single view. Income register data is retrieved from the income register with the Organization's own certificate on the basis of the same authorization. The Service only reads data and does not submit data to the Tax Administration. Nature of processing: receiving, storing, organizing, presenting, retrieving, modifying in accordance with the Organization's instructions, transferring at the Organization's request (e.g. export), deleting, and securing and backing up data. Duration: this Agreement remains in force for as long as the Service Provider processes personal data on behalf of the Organization and, as regards obligations that apply after processing, for as long as those obligations remain in force (section 10).

Data subjects: • representatives and contact persons of companies and organizations that are clients of the Organization • sole traders and other natural persons who are clients of the Organization and whose tax data is processed in the Service • income recipients of employer clients (e.g. employees, managing directors, shareholders) • the Organization's Users Categories of personal data: • tax data retrieved from the Finnish Tax Administration's interfaces: tax letters and returns, VAT returns and decisions, prepayment decisions and payment status, tax summaries and decisions • client data: name, business ID, contact person's name and contact details, Suomi.fi authorization data and its validity • income register data (dataset 312): totals by payment date and by month, and income items and amounts per income recipient. Each income recipient is identified by a pseudonymised identifier calculated from the recipient's identifier (personal identity code or a foreign identifier) with an organization-specific key; the identifier itself is not stored or written to logs. The recipient's name is stored only if the Organization has entered it in the name register. The date of birth is retained only for income recipients with no identifier at all. • data on Users processed by the Service on the Organization's behalf: name, email address, role, and audit logs generated by use of the Service (who viewed whose data and when) Personal identity codes (hetu) are processed only transiently in memory to calculate the pseudonymised identifier (income register data and entry into the name register); they are not stored or written to logs. Special categories of personal data (GDPR Art. 9) and data relating to criminal convictions (Art. 10) are not knowingly processed, and the Organization must not enter them into the Service.

The Service Provider processes personal data only on the Organization's documented instructions, unless required to do otherwise by Union or Member State law. In that case the Service Provider will inform the Organization of that legal requirement before processing, unless the law prohibits this. The Organization's documented instructions are this Agreement, the Terms, and the instructions given by the Organization and its Users through the Service's functions and settings (for example adding a client, retrieving data and deleting data). Additional instructions are given in writing to tuki@veronavi.fi. The Service Provider does not process personal data for its own purposes, does not combine it with other data sets, and does not disclose it to anyone other than the sub-processors permitted under this Agreement, except on the Organization's instructions (for example data queries to the Tax Administration and emails sent through the Service) or where required by law. If the Service Provider considers that an instruction infringes the GDPR or other data protection law, it will inform the Organization without delay. The Service Provider is then entitled to suspend compliance with the instruction until the Organization has confirmed or amended it.

The Service Provider ensures that persons processing personal data are bound by a confidentiality obligation or are under a statutory duty of confidentiality, and that they have access to the data only to the extent their tasks require. The confidentiality obligation continues after this Agreement ends.

The Service Provider implements technical and organizational measures under Article 32 GDPR appropriate to the risks of the processing. At the time of this Agreement, the measures include: • encryption of data in transit and certificate-based mutual authentication for connections to the Finnish Tax Administration's interfaces • encryption of Tax Administration authorization tokens and other secrets with a dedicated key management service; secrets are not kept in source code • pseudonymisation of income register recipient identifiers with an organization-specific key; the key is destroyed when the Organization is deleted, after which the identifiers can no longer be linked to individuals • logical separation of the data of different Organizations: all database queries are scoped by the Organization's identifier • role-based access control and client-level visibility restrictions • an audit log of data viewing and modification • servers located in Finland (EU) with restricted access • daily database backups that are encrypted before transfer and stored apart from the production server in a separate storage location within the EU (see Annex A); the storage provider has no access to the encryption key The Service Provider maintains and improves the measures as technology develops. The measures will not be materially weakened during the term of this Agreement. The Service Provider does not claim that the Service or its security is certified unless a certification has been separately announced.

The Organization gives the Service Provider general prior authorization to use sub-processors. The sub-processors approved at the time of this Agreement are listed in Annex A. The Service Provider will notify the Organization of intended changes to sub-processors (a new sub-processor or a replacement) in the Service or by email at least 30 days before the change is put into effect. The Organization has the right to object to the change on reasonable data protection grounds, in writing to tuki@veronavi.fi within 30 days of the notice. If the parties cannot find a solution within a reasonable time that addresses the objection, the Organization may terminate the agreement under the Terms with effect before the change takes effect. The termination does not give rise to additional charges, but prepaid fees are as a rule not refunded; the Service Provider may consider a refund case by case. The Service Provider imposes on each sub-processor, by written contract, the same data protection obligations as are set out in this Agreement for the Service Provider, in particular sufficient guarantees to implement appropriate technical and organizational measures. The Service Provider remains fully liable to the Organization for the performance of the sub-processor's obligations as for its own.

Data subject rights: the Service Provider assists the Organization, by appropriate technical and organizational measures, in fulfilling the Organization's obligation to respond to requests to exercise data subject rights (GDPR Chapter III). If a data subject makes a request directly to the Service Provider concerning data for which the Service Provider acts as a processor, the Service Provider will refer the data subject to the Organization and will not respond to the request itself without the Organization's instruction. Income register data: an income recipient makes a data request primarily to their employer or the employer's accounting firm. The recipient's data is identified by a pseudonymised identifier. The Organization can identify the person's rows by adding the person to the client's name register with their personal identity code, after which the Organization can provide the data or delete the name entry. This procedure covers only the rows visible on the client card, which shows at most the client's 500 newest recipient rows. For a truncated card or older retained history, and for recipients without a personal identity code (foreign identifier, date of birth only, or no identifier), the Service Provider assists with a case-by-case manual search on the Organization's instruction. Rows with no identifier can only be matched by payment date and amounts; if the match is not unambiguous, the data is not disclosed and the controller is informed. The Service Provider assists as needed in handling the request, for example by providing guidance or deleting data as instructed by the Organization. GDPR Articles 32 to 36: the Service Provider assists the Organization in ensuring compliance with the obligations on security, notification of personal data breaches and communication to data subjects, data protection impact assessment, and prior consultation with the supervisory authority, taking into account the nature of the processing and the information available to the Service Provider. Assistance is included in the Service to the extent it is reasonable and minor. For assistance that is exceptionally extensive or relates to the Organization's own operations, the Service Provider may charge at its hourly rate in force from time to time. The Service Provider will notify the Organization of any such charge in advance.

The Service Provider will notify the Organization of a personal data breach affecting data processed under this Agreement without undue delay and no later than 48 hours after becoming aware of the breach. The notification will include, to the extent known to the Service Provider, the information required by Article 33(3) GDPR: • the nature of the breach, including where possible the categories and approximate numbers of data subjects and records concerned • a contact point where more information can be obtained • the likely consequences of the breach • the measures taken or proposed by the Service Provider to address the breach and mitigate its possible adverse effects If not all information is available at the time of notification, it may be provided in phases without further undue delay. The Service Provider assists the Organization in investigating and containing the breach and in preparing notifications to authorities and data subjects. The controller is responsible for notifications to the supervisory authority and data subjects unless the law provides otherwise. The Service Provider documents breaches.

The Organization can delete client and organization data in the Service and request an export of its data at tuki@veronavi.fi. The Service Provider delivers the requested data in a machine-readable format within 30 days of the request. If the Organization's only member deletes their account in the Service, the Organization and the personal data processed on its behalf are deleted immediately and cannot be restored afterwards. The Organization must therefore request and receive its data before deleting the account. When the Organization's agreement under the Terms ends by written termination, the Organization may, within 30 days after the end, request the return of the personal data processed on its behalf in a machine-readable format, and the Service Provider deletes this personal data at the latest within 90 days after the end. When the Organization is deleted, the key for the income register identifiers is also destroyed. Data deleted from the live system disappears from backups as the backups rotate. Backups are retained for at most 6 months and are used only to restore the Service after an incident. The Service Provider may retain data beyond that if required by Union law or Finnish law (for example audit logs and accounting records in accordance with the Terms and the privacy policy). In that case the data is processed only for that purpose and with the safeguards of this Agreement.

At the Organization's request, the Service Provider will make available the information necessary to demonstrate compliance with the obligations set out in this Agreement, such as descriptions of security measures and answers to reasonable security questionnaires. If this information is not sufficient, the Organization, or an independent auditor bound by confidentiality and authorized by it, may audit the Service Provider, and the Service Provider will allow and contribute to the audit. The audit is conducted on the following terms: • The Organization gives written notice of the audit at least 30 days in advance, and the scope and timing are agreed together with the Service Provider. • The audit takes place during the Service Provider's normal working hours and does not unreasonably disrupt its operations. • The audit is at the Organization's expense. • An audit may be conducted at most once a year, unless it concerns a personal data breach or a requirement of a supervisory authority. • The audit may cover only processing under this Agreement. Other customers' data and the Service Provider's trade secrets are not disclosed. • The auditor and the Organization undertake to keep the information obtained in the audit confidential. At the premises of the Service Provider's sub-processors, audits are carried out primarily on the basis of reports provided by the sub-processor.

The Service Provider and its sub-processors process personal data within the scope of this Agreement only within the EU/EEA, and the data is not transferred outside the EU/EEA. A transfer to a third country is possible only with the Organization's prior written consent and where the conditions of Chapter V GDPR are met. Billing data is processed by the Service Provider as controller in accordance with the privacy policy, and the payment service provider Stripe processes it as the Service Provider's processor. Billing data is outside the scope of this Agreement. Encrypted backups are stored with AWS (Amazon Web Services EMEA SARL) in the EU (Sweden). Backups are encrypted before transfer, and AWS has no access to the encryption key or the content. AWS is a subsidiary of the US-based Amazon.com, Inc., and for any transfer AWS's data processing addendum includes the EU Standard Contractual Clauses.

The parties' liability for obligations under this Agreement is determined in accordance with the "Limitation of Liability" section of the Terms, unless mandatory law (including Article 82 GDPR on the data subject's right to compensation) provides otherwise. This Agreement enters into force when the Organization accepts the Terms and remains in force for as long as the Service Provider processes personal data on behalf of the Organization. The provisions on confidentiality, deletion of data and liability remain in force after this Agreement ends for as long as necessary. This Agreement is amended in accordance with the "Changes to Terms" section of the Terms. This Agreement is governed by Finnish law, and disputes are resolved in accordance with the Terms. Contact: tuki@veronavi.fi.

The Organization approves the following sub-processors: • Hetzner Online GmbH (Germany) — server infrastructure. The servers are located in Finland. Data processed: all data described in section 3. • Elestio Limited (Ireland, company number 755058) — server operations service. Data processed: all data described in section 3, to the extent required by the operations tasks. • Amazon Web Services EMEA SARL (Luxembourg, 38 Avenue John F. Kennedy, L-1855 Luxembourg) — storage of encrypted backups in the EU (Sweden). Data processed: encrypted backups of all data described in section 3; AWS has no access to the content, because backups are encrypted before transfer. AWS is a subsidiary of the US-based Amazon.com, Inc.; AWS's data processing addendum (AWS GDPR DPA) is part of the AWS Service Terms and includes the EU Standard Contractual Clauses. Not sub-processors: • The Finnish Tax Administration and the Digital and Population Data Services Agency (Suomi.fi) are data sources and authorities, not sub-processors of the Service Provider. • The Service's emails are sent from the Service Provider's own server; no external email service is used. • Billing data is processed by the Service Provider as controller in accordance with the privacy policy and by Stripe as the Service Provider's processor; billing data is outside the scope of this Agreement (see section 12).