Data processing agreement

1.Purpose and parties

This data processing agreement (DPA) is part of Tuumo's terms of service, and it applies when Tuumo processes personal data on the customer's behalf to provide the service.

The customer is the controller of the personal data and Tuumo Oy (business ID 3361053-4, Kuopio, Finland; Tuumo) is its processor. In a conflict, this agreement takes precedence over the other terms in matters of personal data.

Tuumo is the controller, not the processor, of the data it needs to run the service and the customer relationship itself, such as members' accounts (name, email address and sign-in methods), their sign-ins, the service's emails and invoicing. The privacy policy describes that processing.

2.Definitions

In this agreement, controller, processor, personal data, processing, data subject, personal data breach and sub-processor have the meanings given in the EU General Data Protection Regulation (GDPR, 2016/679).

3.Subject, duration, nature and purpose

Tuumo processes personal data on the customer's behalf and only on the customer's documented instructions as described in section 4. The only purpose of the processing is providing the service: storing the events the customer's product sends and answering the queries of the customer's members, keys and connected AI tools. Tuumo does not decide the purposes or the means of the processing and does not use the data for purposes of its own.

Subject

The personal data in the events the customer sends and in the customer's workspace

Duration

While the agreement is in force, and until the deletion schedule of section 12 has ended

Nature

Receiving, storing, organising, querying, exporting and deleting events; keeping query results and the query history

Data subjects

The users of the customer's product, and the customer's members as far as their activity in the workspace goes

Categories of data

The identifiers the customer's product sends (such as user and session identifiers), event names and timestamps, the properties the customer chooses to send, and query results derived from them; for members, the queries they run (the query history)

Special categories of personal data: the service is not designed for data covered by Article 9 or 10 of the GDPR, or for government identifiers, and the customer undertakes not to send them in events. The customer decides which properties its product sends, and is responsible for keeping them to what its purpose needs; we recommend pseudonymous identifiers instead of names or email addresses.

4.Processing on instructions

Tuumo processes personal data only on the customer's documented instructions, which include this agreement and the customer's use of the service, such as the events it sends, the retention it sets, the queries its members run and the deletions it requests. Tuumo informs the customer immediately if, in its opinion, an instruction infringes data protection law. If Union or Member State law requires Tuumo to process the data otherwise, Tuumo informs the customer of that requirement before the processing, unless that law prohibits it.

The customer is responsible for the processing having a lawful basis and for its instructions complying with data protection law.

AI tools. When a member of the customer connects an AI tool and asks a question, Tuumo returns the query's result to that tool on the customer's instruction. From then on the result is processed by the AI tool's provider under the customer's own agreement with that provider; the provider is not Tuumo's sub-processor.

5.Confidentiality

Tuumo ensures that the people who process personal data are bound by confidentiality and that access to the data is limited to those who need it for their work.

6.Security

Tuumo implements appropriate technical and organisational measures under Article 32 of the GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and risks of the processing. The measures include at least:

• Isolation: every workspace has its own data store, its own storage bucket and its own read-only database credentials, so one workspace cannot read another's events
• Encryption in transit: every public connection uses TLS; inside the service, database and storage connections use TLS and verify the server's certificate and host name
• Secrets: API keys are stored only as hashes and shown once, and workspaces' storage credentials are stored encrypted
• Least privilege: role-based permissions per member; a connected AI tool has its member's permissions and never more; queries are read-only; ingest keys can send events but never read them
• Logging: every query is kept in the workspace's history with who ran it, from which tool or key, and what it returned; sign-ins and admin actions are kept in an audit log
• Fast revocation: a revoked key, a changed role or a removed member takes effect across the service within a minute
• Recovery: continuous backups of the database (accounts, settings, the event catalog, the query history with result previews, and the most recently loaded events) to a second location in the EU, so the service can be restored after an incident; the stored event files themselves are kept in Helsinki only
• Testing: the security measures are covered by automated tests that run on every change

Tuumo may change individual measures as the service develops, but not in a way that lowers the level of protection. The service's security is also described on the security and privacy page.

7.Sub-processors

The customer gives Tuumo a general authorisation to use sub-processors. Tuumo has an agreement with each sub-processor that includes data protection obligations equivalent to this agreement, and is responsible for their performance as for its own. Tuumo uses these sub-processors:

Tuumo announces a planned addition or replacement of a sub-processor by email to the workspace's owner at least 30 days in advance, and the customer may object to the change on reasonable grounds. If the parties cannot agree, the customer may terminate the agreement to end before the change takes effect.

8.Transfers outside the EU and EEA

Tuumo does not transfer personal data outside the EU or the EEA. The data is stored and processed in Finland, with off-site backups in Germany, and the email of the service is sent from France. The one exception is on the customer's own instruction: when a member connects an AI tool, the results of that member's questions go to that tool and its provider, which may be outside the EU; that transfer is the customer's (section 4).

9.Assistance and data subjects' rights

Tuumo assists the customer with appropriate technical and organisational measures so that the customer can answer data subjects' requests (access, rectification, erasure, portability, restriction and objection). The service has these tools for it:

• Export: a member with the analyst, admin or owner role can export the events of one session, or the whole workspace, as a machine-readable file; an export can be downloaded for 7 days
• Erasure: an admin files a deletion request for a user identifier, a session identifier or a property value, in the app or from an AI tool. The request runs at the next maintenance run, normally within an hour, after which the events no longer appear in ordinary queries; the deleted rows are removed from storage within about ten days. Until then, a query that explicitly reads an earlier version of the data can see them for up to 7 days, and query results and exports made before the request are kept until they expire (at most 90 days) unless they are deleted sooner. The query history keeps each query's statement and a preview of up to 200 result rows until the workspace is deleted; a deletion request does not change them. A request covers the events stored when it runs: events of the same identifier that arrive later need a new request
• Retention: the customer sets how many days events are kept (three years unless changed); older events are deleted every night
• Retention table: the app's Privacy page shows how long each kind of data is kept

If a data subject contacts Tuumo directly, Tuumo does not answer the request itself but refers it to the customer. Tuumo also informs the customer without undue delay of any inquiry from a supervisory authority that concerns the customer's personal data.

Tuumo also assists the customer with the obligations of Articles 32–36 of the GDPR, such as security, data protection impact assessments (DPIA) and prior consultation.

The assistance of this section is included in the service fee as far as it is provided by the service's standard features and Tuumo's existing documentation: the export, the deletion tools, the retention table, this agreement and the information about the service needed for a DPIA. If the customer asks for exceptionally extensive separate work, such as a custom data extraction or taking part in the customer's own audit or assessment project, the work and its price are agreed in writing in advance. Tuumo may not refuse to assist because a price has not been agreed if the assistance is needed for the customer to meet a statutory deadline.

10.Personal data breaches

Tuumo notifies the customer of a personal data breach by email to the workspace's owner and admins without undue delay, and no later than 72 hours after becoming aware of it. The notification includes the relevant information available, such as:

• the nature of the breach, the categories of data concerned and the approximate number of data subjects
• a contact person who can give more information
• the likely consequences of the breach
• the measures taken and proposed to address the breach and mitigate its effects

Tuumo takes immediate action to contain the breach, documents breaches and assists the customer in meeting its own notification obligations.

The first notification is made as soon as the breach is confirmed, even if not all the information above is known yet, and it is supplemented as the investigation proceeds. Tuumo does not delay the first notification to wait for a complete picture. The customer's own 72 hours to notify the supervisory authority start when the customer becomes aware of the breach, so the 72 hours of this section are an absolute limit, not a target.

11.Audits

Tuumo makes available to the customer the information needed to demonstrate compliance with this agreement and allows audits by the customer or an auditor it appoints.

Tuumo meets this obligation primarily by giving a description of its measures and the security and audit reports available. If these are not enough to demonstrate the customer's compliance, the customer has the right to carry out or commission an audit.

The auditor must be bound by confidentiality and must not run a business competing with Tuumo. An audit is carried out on reasonable terms during normal working hours and announced at least 30 days in advance. It must not disturb the production of the service unnecessarily, nor give access to other customers' data or to Tuumo's trade secrets beyond what is needed to demonstrate the customer's compliance.

An audit is carried out at most once a year, unless data protection law or a supervisory authority requires more, or a material deficiency was found in the previous audit. Each party bears its own costs of an audit. For work beyond the yearly audit, Tuumo may charge a reasonable fee announced in advance, except when the audit is caused by Tuumo's breach of the agreement or a confirmed personal data breach, in which case Tuumo bears its own costs.

12.End of processing

Before the agreement ends, the customer can export its workspace's data with the service's export (section 9). When the agreement ends, Tuumo deletes the personal data and its existing copies as described below, unless the law requires the data to be kept.

Deleting a workspace ends all access at once: keys, tokens and connected AI tools stop working within a minute. The workspace's data is destroyed permanently 30 days later; until then, the deletion can be undone on the customer's request. If the agreement ends in another way, Tuumo deletes the workspace in the same way within 30 days of the end, and confirms the deletion on request.

Backups. Database backups taken before the deletion are kept until they rotate out, within about 15 days. Backups are encrypted in transit and stored in the EU, and they are used only to restore the service after an incident.

Members. When a member leaves a workspace, their name stays on the workspace's query history for 90 days and then reads "former member". A deleted account can be restored for 30 days, after which it is removed.

13.Liability and governing law

This agreement is governed by the laws of Finland. The parties' liability is determined by the terms of service. The parties first try to settle disputes by negotiation, and otherwise as the terms of service say (governing law and disputes).

Questions about this agreement or data protection: support@tuumo.fi.