Data Processing Agreement | Erppi ERP

Between:
JPu Engineering (J. Puska, sole proprietorship)
Muinaistie 33, 96460 Rovaniemi, Finland
Business ID: 3581353-8
("Processor", "we")

And:
The Customer organization using the Erppi ERP service ("Controller", "you")

This Data Processing Agreement ("DPA") supplements the Terms of Service and applies to the extent that the Processor processes personal data on behalf of the Controller in connection with providing the Erppi ERP service ("Service").

1. Definitions

Personal Data: Any information relating to an identified or identifiable natural person, as defined in GDPR Article 4(1).
Processing: Any operation performed on personal data, as defined in GDPR Article 4(2).
Data Subject: The identified or identifiable natural person whose personal data is processed.
Sub-Processor: Any third party engaged by the Processor to process personal data on behalf of the Controller.
GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council.
Supervisory Authority: The Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) or the relevant authority in the Controller's EU member state.

2. Scope and Purpose of Processing

2.1 Purpose

The Processor processes personal data solely for the purpose of providing the Erppi ERP service to the Controller, including:

Storing and managing business data (transactions, customers, invoices, projects)
User account management and authentication
Generating reports and documents
Providing AI assistant functionality (when enabled by the Controller)
Sending emails on behalf of the Controller (when configured)

2.2 Categories of Data Subjects

Controller's employees and users
Controller's customers and contacts
Controller's suppliers and business partners
Any other individuals whose data the Controller enters into the Service

2.3 Types of Personal Data

Contact information (name, email, phone, address)
Business identifiers (business ID, VAT number)
Financial data (transactions, invoices, salary data)
Employment data (job title, department, contract details)
Sensitive data (SSN, bank account — encrypted at rest)
Time tracking data
Authentication data (email, hashed password)

2.4 Duration

Processing continues for the duration of the Controller's subscription plus 30 days after termination, during which the Controller may export their data. After this period, all Customer Data will be permanently deleted.

3. Obligations of the Processor

The Processor shall:

3.1 Instructions

Process personal data only on the documented instructions of the Controller, including as set out in the Terms of Service and this DPA, unless required to do so by EU or Finnish law (in which case the Processor shall inform the Controller of that legal requirement before processing, unless prohibited by law).

3.2 Confidentiality

Ensure that persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3.3 Security (Article 32)

Implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

Encryption in transit: TLS 1.2+ for all data transmission
Encryption at rest: AES-256-GCM for sensitive data (SSN, salary, bank account, API keys)
Password security: bcrypt hashing with cost factor 12
Access control: Role-based access with 140+ granular permissions
Multi-factor authentication: TOTP and WebAuthn support
Audit logging: All user actions logged with timestamps, IP addresses
Network security: Firewall rules, DDoS protection, security headers
Backup: Daily encrypted backups with 30-day retention
Infrastructure: Hosting within the EU/EEA with appropriate physical and network security controls
Vulnerability management: Regular security updates and patching

3.4 Sub-Processors

Not engage another processor without prior written authorization from the Controller (see Section 5)
Where another processor is engaged, impose the same data protection obligations by contract

3.5 Data Subject Rights

Assist the Controller by appropriate technical and organizational measures in fulfilling the Controller's obligation to respond to data subject requests. The Service provides built-in tools for:

Data inventory and access requests
Data export (Article 20 portability)
Data erasure and anonymization (Article 17)
Configurable retention policies

3.6 Breach Notification

Notify the Controller without undue delay, and no later than 48 hours, after becoming aware of a personal data breach. The notification shall include:

Description of the nature of the breach
Categories and approximate number of data subjects affected
Likely consequences of the breach
Measures taken or proposed to address the breach

3.7 Data Protection Impact Assessment

Provide reasonable assistance to the Controller with data protection impact assessments and prior consultations with supervisory authorities, where required.

3.8 Deletion and Return

At the Controller's choice, delete or return all personal data after the end of the provision of services, and delete existing copies unless EU or Finnish law requires storage.

3.9 Audits

Make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller. The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes GDPR or other EU/Finnish data protection law.

4. Obligations of the Controller

The Controller shall:

Ensure that it has a valid legal basis for the processing of personal data entered into the Service
Ensure that data subjects have been informed about the processing in accordance with GDPR Articles 13 and 14
Be responsible for the accuracy and legality of personal data provided to the Processor
Comply with all applicable data protection laws
Promptly notify the Processor of any data subject requests that require the Processor's assistance
Not instruct the Processor to process personal data in violation of GDPR

5. Sub-Processors

5.1 Authorized Sub-Processors

The Controller hereby provides general written authorization for the Processor to engage the following sub-processors:

Sub-Processor	Purpose	Location	Data Processed
Cloudflare, Inc.	Network tunnel, DDoS protection, DNS	EU (traffic routed through EU data centers); USA (EU-US DPF certified)	Network traffic metadata, IP addresses
Stripe, Inc.	Payment processing	USA (EU-US DPF certified)	Customer email, name, payment data

5.2 Changes to Sub-Processors

The Processor shall inform the Controller at least 30 days in advance of any intended changes to the list of sub-processors. The Controller may object to the change within 14 days. If the Controller objects and the parties cannot resolve the objection, the Controller may terminate the Service with immediate effect.

5.3 Sub-Processor Obligations

The Processor shall ensure that each sub-processor is bound by data protection obligations no less protective than those in this DPA.

6. International Data Transfers

6.1 Primary Processing

All primary data processing occurs within the EU/EEA.

6.2 Transfers Outside EU/EEA

Where personal data is transferred to a sub-processor outside the EU/EEA, the Processor ensures that appropriate safeguards are in place:

EU-US Data Privacy Framework certification (Stripe)
Standard Contractual Clauses (SCCs) approved by the European Commission
Adequacy decisions by the European Commission

6.3 Notification

The Processor shall inform the Controller if it becomes aware that a transfer safeguard is invalidated or may no longer be relied upon.

7. Data Protection Contact

The Processor is not required to appoint a Data Protection Officer under GDPR Article 37, given the nature and scale of processing activities. The Processor's contact for data protection matters:

Email: [email protected]

8. Liability

Liability under this DPA is subject to the limitations set out in the Terms of Service, except that these limitations do not apply to breaches of this DPA resulting from the Processor's:

Processing outside of the Controller's instructions
Failure to notify of a data breach as required
Unauthorized engagement of sub-processors

9. Term and Termination

This DPA enters into force when the Controller begins using the Service and remains in effect for the duration of the service relationship. Provisions that by their nature should survive termination will survive, including obligations regarding data deletion, confidentiality, and cooperation with audits.

10. Governing Law

This DPA is governed by the laws of Finland. Any disputes shall be resolved in accordance with the dispute resolution provisions of the Terms of Service.

11. Amendments

This DPA may be updated to reflect changes in applicable law or our processing activities. The Controller will be notified of material changes at least 30 days in advance.

Signatures

Processor: JPu Engineering

Name: Jani Puska
Title: Yrittaja

Controller: [Customer Organization]

Name: [Name]
Title: [Title]

For SaaS customers, this DPA is accepted electronically upon acceptance of the Terms of Service.