Subprocessors
Current list · last updated 24 September 2026
This is a translation of the Finnish list, last updated 24 September 2026. It is provided for information. If the versions differ, the Finnish version prevails.
This page lists the subcontractors that process data on behalf of TuntiTassu Soolo. The list forms part of Appendix B to the data processing agreement, and it also describes the processors referred to in section 6 of the privacy notice.
A data processing agreement in accordance with Article 28 of the General Data Protection Regulation (EU) 2016/679 (GDPR) has been concluded with each of them.
Subprocessors
These also process the personal data that the customer themselves enters in free-text fields – that is, data within the scope of the data processing agreement.
| Subprocessor | Task | Location | Transfer outside the EU | In use since |
|---|---|---|---|---|
| Supabase data processing agreement |
Database and authentication | EU (Stockholm) | no | 21 August 2026 |
| Vercel Inc. data processing agreement |
Provision of the service, server functions and detection of automated traffic (BotID) | EU (Stockholm) and the United States | no for time-tracking data; yes for other data – EU-US Data Privacy Framework (Decision (EU) 2023/1795), plus standard contractual clauses | 21 August 2026 |
| Resend subprocessors |
Sending of email messages: sign-in links, email address confirmation, confirmation that the trial has started and trial reminders, contract confirmation, confirmation of withdrawal, and notices of breaks, deletion and changes to prices and terms | EU (Ireland) | no | 21 August 2026 |
No time-tracking data passes through Resend.
Vercel’s server functions are locked to Stockholm, and time-tracking data is not processed in the United States. The US portion concerns bot detection on the subscription page and the platform’s management and logging interfaces. Vercel Inc. is certified under the EU-US Data Privacy Framework; the basis for the transfer is described in section 7 of the privacy notice.
Support email has a different status
Domainhotelli (Planeetta Internet Oy) provides the mailbox for the support address tuki@tuntitassu.fi and relays its messages in the EU (Finland). No time-tracking data passes through it, so it is not a subprocessor within the meaning of the data processing agreement. Its role is described in section 6 of the privacy notice.
Stripe has a different status
Stripe Payments Europe, Ltd. handles payments and manages subscriptions. It is not a subprocessor within the meaning of the data processing agreement, because no time-tracking data is passed to it, nor any other personal data within the scope of the agreement. The following subscription data is passed to Stripe: the email address, the subscription status, transaction identifiers and, if the customer so wishes, the company name and Business ID.
Stripe’s role is twofold. It acts as a processor to the extent that it processes data on our behalf, and as an independent controller with regard to the processing of payment transactions, the prevention of misuse and its own legal obligations.
| Company | Task | Location | Transfer outside the EU | In use since |
|---|---|---|---|---|
| Stripe Payments Europe, Ltd. service providers |
Payment processing and subscription management | EU and the United States | yes: EU-US Data Privacy Framework (Decision (EU) 2023/1795), plus standard contractual clauses | 21 August 2026 |
The basis for the transfer is described in more detail in section 7 of the privacy notice. Stripe’s own processing is governed by Stripe’s privacy policy.
Sub-subprocessors
The companies listed above use their own subcontractors, for example for data centre services. An up-to-date list of each company’s subcontractors is available on its own website via the links above.
We have undertaken to receive notices of changes concerning these subcontractors and to pass them on if a change is relevant to data within the scope of the data processing agreement.
How changes are notified
If a subprocessor is added or replaced, customers are notified by email at least 30 days before the change. This page is updated at the same time as the notice is sent.
The customer may object to the change on justified grounds relating to data protection. If no solution is found, the customer may end their subscription before the change takes effect, in which case the unused part of the paid period is refunded. The procedure is described in clause 3.4 of the data processing agreement.
Objections and questions should be sent to tuki@tuntitassu.fi.
Change history
| Date | Change |
|---|---|
| 24 September 2026 | Messages relating to the free trial added to the description of the purposes for which Resend is used. No subprocessors were added, and the nature of the data processed did not change. |
| 22 August 2026 | Vercel’s location and transfer information clarified: bot detection on the subscription page and the platform’s management and logging interfaces may also process data in the United States (Data Privacy Framework and standard contractual clauses). The processing of time-tracking data did not change, and no subprocessors were added. Added a description of the support email service provider (Domainhotelli), which is not a subprocessor. |
| 21 August 2026 | List published for the first time |
Digitahti Oy · Business ID 3514735-2 · Metsäkulmankatu 38, 48910 Kotka, Finland · +358 41 327 4360 · tuki@tuntitassu.fi