Data Processing Agreement

This Data Processing Agreement ("Agreement") forms part of the agreement between Turvix Oy and the customer for use of the Turvix application (the "Service"). It governs the processing of personal data that Turvix Oy ("Turvix", "Processor") performs on behalf of the customer ("Customer", "Controller") to provide the Service.

Customer accepts this Agreement by accepting the Terms of Service, which incorporate this Agreement by reference, or as otherwise described in the agreement.

1. Definitions

Personal data, data subject, processing, controller, processor, and personal data breach have the meanings given in Regulation (EU) 2016/679 ("GDPR").

Customer Content means personal data and other content submitted, uploaded, or otherwise provided to the Service by Customer or a user.

Subprocessor means a third party used by Turvix to process Customer Content.

2. Subject Matter, Nature, and Duration

Turvix processes Customer Content only on Customer's instructions to provide, maintain, secure, and support the Service and to comply with the agreement.

Processing continues for as long as the agreement is in force and afterwards only as required to perform deletion or return under this Agreement, the Privacy Notice, or applicable law.

3. Purpose, Types of Personal Data, and Data Subjects

The purpose of processing is to provide Customer with a digital security and privacy management tool, including guidance, checks, scoring, recommendations, alerts, templates, and generated documents.

Types of personal data may include:

  • name, email address, and organization-related roles
  • work and contact email addresses, domains, and questionnaire answers provided by Customer
  • check results, notification history, and technical logs that may include person-related identifiers
  • support and feedback messages

Data subjects may include Customer's employees, contractors, invited users, and other individuals whose data Customer adds to the Service.

4. Customer Instructions and Responsibilities

Customer is the controller and is responsible for having an appropriate lawful basis and all necessary rights to provide Customer Content and issue processing instructions.

Customer's use of the Service and the data entered into it constitute Customer's general processing instructions. Turvix is not obliged to follow an instruction that would require changing the Service.

Customer must not instruct Turvix to process special-category personal data or other exceptionally sensitive data unless that processing is necessary for the agreed use of the Service and has been appropriately agreed.

Turvix will inform Customer if Turvix considers an instruction to infringe applicable data protection law.

5. Turvix Obligations

Turvix will:

  • process Customer Content only on documented instructions unless EU or Member State law requires otherwise
  • ensure that persons authorized to process Customer Content are bound by confidentiality or an appropriate statutory duty of confidentiality
  • implement appropriate technical and organizational security measures
  • not use subprocessors without Customer's general authorization under this Agreement
  • assist Customer, to a reasonable extent and as applicable, with data-subject rights and obligations under GDPR Articles 32–36
  • delete or return Customer Content as provided in this Agreement
  • make available to Customer information necessary to demonstrate compliance with this Agreement

6. Subprocessors

Customer generally authorizes Turvix to use subprocessors required to provide the Service. A current list is on the subprocessors page.

The general authorization applies only to subprocessors whose expertise, reliability, resources, security, and contractual commitments Turvix has assessed as providing sufficient guarantees of compliance with applicable data-protection law.

Turvix will give written notice of an intended addition or replacement to the email address associated with Customer's account at least 30 days before the change takes effect and will update the subprocessor list. The notice will identify the subprocessor, its processing function and location, and the safeguard for any transfer outside the EEA. Customer is responsible for keeping its contact details current.

Customer may object on reasonable data-protection grounds before the stated effective date. The parties will seek to resolve the objection reasonably. If no resolution is reached and the change is necessary to provide the Service, Customer may terminate the agreement before the change takes effect.

Turvix engages subprocessors under written terms that impose data-protection obligations consistent with this Agreement. Turvix remains responsible to Customer for their performance as required by applicable data protection law.

Turvix keeps information about the identity of actors processing personal data on Customer's behalf and their processing functions up to date and provides that information to Customer on request.

7. Transfers Outside the EEA

Turvix may use subprocessors that process data outside the EEA. Transfers rely on a European Commission adequacy decision, Standard Contractual Clauses, or another lawful transfer mechanism. Provider-specific information is on the subprocessors page.

Customer may request further information and a copy of the applicable safeguards from support@turvix.fi. Trade secrets or other confidential information may be redacted where that does not prevent assessment of the safeguards.

8. Security

Turvix implements appropriate technical and organizational measures, taking into account the nature, scope, context, and risks of processing. Measures may include access controls, encryption in transit, backup, logging, and vulnerability management.

Turvix reviews measures regularly and improves them as needed.

9. Assistance with Data Subject Rights and Compliance

Turvix will assist Customer to a reasonable extent with:

  • responding to data-subject requests relating to Customer Content
  • preparing for security, personal data breaches, impact assessments, and notifications

Customer remains primarily responsible for responding to data subjects and supervisory authorities.

10. Personal Data Breaches

Turvix will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Content. The notification will include at least the information required by GDPR Article 33 that Turvix can reasonably provide.

Turvix will assist Customer with necessary follow-up, such as impact assessment and authority or data-subject notifications.

11. Deletion and Return

When the agreement ends, Turvix will delete Customer Content from live systems within a reasonable period or, if Customer requests return before deletion, return it, unless EU or Member State law requires storage. Copies in backups are deleted according to backup rotation. If Customer does not request return, Turvix will delete Customer Content as described above.

12. Demonstration of Compliance

Turvix will make available to Customer the information necessary to demonstrate compliance with this Agreement, taking into account the nature of the Service. This Agreement, the Privacy Notice, the subprocessor list, and other documentation Turvix reasonably provides satisfy Customer's rights to information and to audits and inspections, except where mandatory law requires more. If an audit is then required, it will be conducted remotely where possible, and so as not to disrupt operations or disclose other customers' confidential information.

13. Order of Precedence and Changes

This Agreement prevails over the Terms of Service only for the processing of personal data. Otherwise, including for confidentiality and liability, the Terms apply.

If the Finnish and English versions conflict, the Finnish version prevails.

Turvix may update this Agreement. The current version is published on the DPA page. Turvix may require acceptance of an updated Agreement in the Service. Use of the Service after an update, or acceptance in the Service, constitutes agreement to the updated Agreement.

14. Contact

Privacy contact: support@turvix.fi

Processor: Turvix Oy, Business ID 3573062-8
Last updated: 14 September 2026