TuntiTassu Soolo – data processing agreement
Version 1.1, effective from 1 September 2026
This is a translation of the Finnish data processing agreement, version 1.1, which is Annex 3 to the terms of service. If the language versions conflict, the interpretation more favourable to the customer applies; in all other respects, the Finnish version applies (terms of service, section 24).
This annex forms part of the TuntiTassu Soolo terms of service. It is the agreement referred to in Article 28(3) of the General Data Protection Regulation (EU) 2016/679 (GDPR).
Why this annex exists
When you log only your own working hours in the service, we process your personal data and are its controller. In that case, the privacy notice applies, and this annex is not needed.
The situation changes when you write information about another person in a task description or a project name – for example, the name of your own client. In that case, you are processing a third party’s personal data for your own business purposes, and you become the controller of that data. We process it on your behalf, which means that we are the processor.
The General Data Protection Regulation requires a written agreement between the controller and the processor. This annex is that agreement. You do not need to sign anything separately: the annex takes effect automatically as part of the terms of service.
1. Parties
Controller: the customer who has entered into a TuntiTassu Soolo subscription agreement.
Processor: Digitahti Oy, Business ID 3514735-2, Metsäkulmankatu 38, 48910 Kotka, Finland, telephone +358 41 327 4360, tuki@tuntitassu.fi.
2. Description of the processing
| Subject matter | Personal data that the controller stores in the service in the task descriptions of time entries, in project names or in other free-text fields |
|---|---|
| Duration | The term of the subscription agreement and the retention period after its end in accordance with the terms of service |
| Nature and purpose | Storing, retaining, organising, retrieving and deleting data in order to provide the time tracking service to the controller |
| Types of personal data | Names, names of companies and organisations, and other data that the controller records voluntarily. The service does not require any data concerning third parties to be recorded. |
| Categories of data subjects | The controller’s clients, business partners and other persons to whom the controller’s work relates |
Special categories of personal data. The service is not designed for processing the special categories of personal data referred to in Article 9 of the General Data Protection Regulation or the criminal offence data referred to in Article 10, and such data must not be stored in the service.
3. Obligations of the processor
The processor undertakes the following.
3.1 Processing in accordance with instructions. The processor processes personal data only in accordance with the controller’s instructions. Use of the service in accordance with the terms of service constitutes the controller’s documented instructions. Further instructions may be sent to tuki@tuntitassu.fi, and the processor will carry them out if they are technically feasible and reasonable.
If the processor considers that an instruction infringes the General Data Protection Regulation or other data protection legislation, it will inform the controller without delay.
The processor does not process personal data for its own purposes, does not sell it, does not disclose it for marketing purposes and does not use it to train AI models.
3.2 Confidentiality. The processor ensures that the persons who process personal data have committed themselves to confidentiality or are under a statutory obligation of confidentiality. Access to the data is limited to those persons who need it in their duties.
3.3 Security. The processor implements the appropriate technical and organisational measures referred to in Article 32 of the General Data Protection Regulation. The measures are described in Appendix A.
3.4 Subprocessors. The controller gives the processor a general authorisation to use subprocessors. The subprocessors in use are listed in Appendix B.
The processor ensures that each subprocessor is bound by data protection obligations equivalent to those that bind the processor itself. The processor is liable for the subprocessor’s actions as for its own.
The processor will notify the controller by email of the addition or replacement of a subprocessor at least 30 days before the change. The controller may object to the change on justified grounds relating to data protection. If the parties cannot reach a solution, the controller may end their subscription before the change takes effect, in which case the unused part of the paid period is refunded.
3.5 Assistance with data subjects’ rights. The service is built so that the controller can themselves retrieve, modify, delete and download the data they have stored. In practice, this covers giving effect to the rights of data subjects.
If the controller needs further assistance, the processor will assist them to a reasonable extent. If a data subject contacts the processor directly, the processor refers the data subject to the controller and does not respond to the request itself.
3.6 Assistance with other obligations. The processor assists the controller with the obligations under Articles 32–36 of the General Data Protection Regulation, taking into account the nature of the processing and the information available to the processor.
3.7 Personal data breaches. The processor notifies the controller of a personal data breach without undue delay and at the latest within 48 hours of becoming aware of it. The notification contains the available information on the nature of the breach, its estimated consequences and the measures taken.
3.8 Deletion and return of data. The controller may download their data in a machine-readable format from the service settings at any time, including after the subscription has ended and the account has been locked. No charge is made for the download.
When the controller deletes their account, the data is deleted immediately from the production database. For backups, the procedure described in section 8 of the privacy notice is followed.
If the controller does not delete their account, the data is deleted in accordance with section 9 of the terms of service.
3.9 Demonstrating compliance and audits. On request, the processor provides the controller with the information necessary to demonstrate compliance with the obligations under Article 28.
The controller has the right to audit the processing or to have it audited by an independent auditor authorised by the controller. Notice of an audit must be given at least 30 days in advance, and the audit is carried out during normal working hours. The audit must not unnecessarily disrupt the processor’s operations. An audit may be carried out no more than once a year, unless a personal data breach or a requirement of an authority calls for more frequent audits. The controller bears the costs of the audit.
The processor may fulfil this obligation by providing an up-to-date description of its security measures and the certificates and audit reports of its subprocessors, if they meet the controller’s needs.
4. Obligations of the controller
The controller is responsible for ensuring that:
- they have a lawful basis for processing the personal data of third parties that they store in the service;
- data subjects have been informed of the processing as required by Articles 13 and 14 of the General Data Protection Regulation;
- no special categories of personal data or criminal offence data are stored in the service;
- only data that is necessary for their purpose is stored in the service.
The controller should be aware that the task description is free text and that the service does not check its content. The practical recommendation is to record only what invoicing and bookkeeping require.
5. Transfers outside the EU and the EEA
Personal data within the scope of this annex is processed exclusively in the EU. Time-tracking data is not passed to Stripe, so processing in the United States in connection with payment handling does not concern this data.
Should the processor later transfer data within the scope of this annex outside the EU or the EEA, the transfer will be made only on the basis of a safeguard under Chapter V of the General Data Protection Regulation, and the controller will be notified in accordance with clause 3.4.
6. Term and other provisions
This annex remains in force for as long as the processor processes personal data on behalf of the controller.
In the event of a conflict between this annex and the terms of service, this annex takes precedence insofar as the processing of personal data on behalf of the controller is concerned.
Section 16 of the terms of service applies to the limitation of liability. The limitation of liability does not limit the data subject’s right to compensation under Article 82 of the General Data Protection Regulation.
This annex is governed by Finnish law.
Each version is numbered and dated. Previous versions are available on request from tuki@tuntitassu.fi.
| Version | Date | Change |
|---|---|---|
| 1.1 | 1 September 2026 | Added the processor’s telephone number and email address to section 1. No other changes to the content. |
| 1.0 | 21 August 2026 | First published version |
Appendix A: Technical and organisational measures
| Area | Measure |
|---|---|
| Encryption in transit | All connections encrypted (TLS) |
| Encryption at rest | Database and backups encrypted at disk level |
| Access control | Row-level security policies in the database: a user can access only their own data. Restriction at database level, not in the user interface |
| Authentication | One-time, short-lived sign-in link or code. There are no passwords. Sessions expire automatically and can be revoked on request |
| Administrator role | Does not give read access to the time entries in a personal workspace |
| Administrator database access | Limited to named persons, used only for troubleshooting and backups, use is logged |
| Backups | Automatic, rotating cycle, maximum length 7 days. Used only to restore the service |
| Handling of restores | After a restore, deletions made after the backup was taken are carried out again |
| Logging | Technical logs for security and troubleshooting, retention period no more than 30 days (Vercel 30 days, Supabase 7 days). Stripe falls outside the scope of this annex, see Appendix B |
| Abuse prevention | Detection of automated traffic and a limit on the number of submissions on the page for starting a subscription |
| Separation | Customers’ data separated from each other at database level |
| Selection of subcontractors | Only subcontractors that offer a data processing agreement under Article 28 and an EU region |
| Personnel | Confidentiality undertaking. Access limited to what the task requires |
The measures may be developed further. Changes will not lower the level of protection.
Appendix B: Subprocessors
| Subprocessor | Task | Location | Basis for transfer |
|---|---|---|---|
| Supabase | Database and authentication | EU (Stockholm) | – |
| Vercel Inc. | Provision of the service and server functions | EU (Stockholm) | – |
| Resend | Sending of email messages | EU (Ireland) | – |
The current list is published at tuntitassu.fi/en/subprocessors.
Sub-subprocessors. The subprocessors listed above use their own subcontractors, for example for data centre services. The current list of subcontractors of each subprocessor is available on its own website. The processor has undertaken to receive notifications of changes concerning these subcontractors and to pass them on to the controller in accordance with clause 3.4 if the change is relevant to the data within the scope of this annex.
Stripe is not a subprocessor within the meaning of this annex, because no time-tracking data or other personal data within the scope of this annex is passed to it. Stripe’s role is described in sections 6 and 7 of the privacy notice.
Digitahti Oy · Business ID 3514735-2 · Metsäkulmankatu 38, 48910 Kotka, Finland · +358 41 327 4360 · tuki@tuntitassu.fi