Privacy Policy | Erppi ERP - JPu Engineering

1. Data Controller

JPu Engineering
J. Puska, yksityinen elinkeinonharjoittaja (sole proprietorship)
Muinaistie 33, 96460 Rovaniemi, Finland
Business ID: 3581353-8
Email: [email protected]
Website: https://jpu.fi

2. What This Policy Covers

This Privacy Policy explains how JPu Engineering ("we", "us", "our") collects, uses, stores, and protects personal data when you use the Erppi ERP service ("Service"), available at https://erppi.jpu.fi and related domains.

This policy applies to:

Users who create accounts and use the Service (SaaS)
Visitors to our website at jpu.fi and erppi.jpu.fi
Individuals whose data is stored within the Service by our customers

3. Legal Basis for Processing (GDPR Article 6)

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act (Tietosuojalaki 1050/2018). The legal grounds for processing are:

Purpose	Legal Basis
Providing the Service	Performance of a contract (Art. 6(1)(b))
Account authentication and security	Performance of a contract; Legitimate interest (Art. 6(1)(b), (f))
Billing and payments	Performance of a contract; Legal obligation (Art. 6(1)(b), (c))
Customer support	Performance of a contract (Art. 6(1)(b))
Service improvement and analytics	Legitimate interest (Art. 6(1)(f))
Legal compliance (accounting, tax)	Legal obligation (Art. 6(1)(c))
Marketing communications	Consent (Art. 6(1)(a))

4. Personal Data We Collect

4.1 Account Data

Full name
Email address
Organization name and business ID
Role within the organization
Password (stored as a bcrypt hash, never in plain text)

4.2 Service Usage Data

Financial transactions (income, expenses, invoices)
Customer records (names, contact information, business IDs)
Product catalog entries
Project and task information
Time tracking entries
HR data (if HR module is used)

4.3 Sensitive HR Data (if applicable)

When the HR module is used, the following data may be stored. This data is encrypted at rest using AES-256-GCM encryption:

Social security number (SSN / henkilotunnus)
Bank account number (IBAN)
Salary information
Tax percentage
Employment contract details

4.4 Technical Data

IP address (logged for security and audit purposes)
Browser user agent string
Login timestamps
API request logs (retained for 30 days)

4.5 Payment Data

Payment processing is handled by Stripe, Inc. We do not store credit card numbers or payment method details. We store:

Stripe customer ID
Subscription plan and status
Payment history (amounts, dates, invoice IDs)

5. How We Use Your Data

We use personal data exclusively for:

Providing and maintaining the Erppi ERP service
Authenticating users and managing access
Processing subscription payments
Sending transactional emails (invoices, password resets, service notifications)
Providing customer support
Complying with legal obligations (Finnish accounting law, EU tax regulations)
Improving the Service based on aggregated, anonymized usage patterns
Security monitoring and fraud prevention

We do not:

Sell personal data to third parties
Use personal data for advertising or profiling
Share data with third parties for their marketing purposes
Make automated decisions that produce legal effects

6. Data Storage and Security

6.1 Location

All Service data is stored on servers located within the European Union (Finland). The infrastructure provider may change over time; any changes will be reflected in the sub-processor list and notified in accordance with our Data Processing Agreement.

6.2 Security Measures

All data in transit is encrypted using TLS 1.2+
Sensitive HR data (SSN, salary, bank account) is encrypted at rest using AES-256-GCM
Passwords are hashed using bcrypt with a cost factor of 12
API keys are hashed using bcrypt before storage
Multi-factor authentication (TOTP, WebAuthn) is available for all accounts
Role-based access control with 140+ granular permissions
All user actions are logged in an immutable audit trail
Regular backups with encrypted storage

6.3 Access Control

Access to production systems and data is limited to authorized personnel. We follow the principle of least privilege.

7. Data Sharing and Sub-Processors

We share personal data with the following third-party service providers (sub-processors) who process data on our behalf:

Sub-Processor	Purpose	Location	Data Shared
Cloudflare, Inc.	Network tunnel, DDoS protection, DNS	EU / USA (EU-US Data Privacy Framework)	Network traffic metadata, IP addresses
Stripe, Inc.	Payment processing	USA (EU-US Data Privacy Framework)	Email, name, payment data

We require all sub-processors to:

Process data only on our documented instructions
Ensure appropriate security measures
Comply with GDPR requirements
Notify us of any data breaches

8. Data Retention

Data Type	Retention Period	Basis
Account data	Duration of account + 30 days after deletion	Contract performance
Customer business data (transactions, invoices, HR, etc.)	Duration of subscription + 30 days	Contract performance
Technical logs (IP, user agent)	30 days	Legitimate interest (security)
Backup data	90 days (rolling)	Legitimate interest (disaster recovery)

After the retention period expires, data is permanently deleted. The Customer is responsible for exporting and retaining any data required for their own legal obligations (e.g., Finnish Accounting Act) before the deletion deadline.

9. Your Rights Under GDPR

As a data subject, you have the following rights:

9.1 Right of Access (Article 15)

You may request a copy of all personal data we hold about you.

9.2 Right to Rectification (Article 16)

You may request correction of inaccurate personal data. Most data can be corrected directly in the Service.

9.3 Right to Erasure (Article 17)

You may request deletion of your personal data. We will process erasure requests in accordance with GDPR Article 17. Some data may be anonymized rather than deleted where necessary to maintain system integrity.

9.4 Right to Data Portability (Article 20)

You may request an export of your data in a structured, machine-readable format (ZIP archive).

9.5 Right to Restrict Processing (Article 18)

You may request that we limit how we process your data in certain circumstances.

9.6 Right to Object (Article 21)

You may object to processing based on legitimate interest. If you object to direct marketing, we will stop immediately.

9.7 Right to Withdraw Consent (Article 7)

Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

How to Exercise Your Rights

Send your request to: [email protected]

We will respond within 30 days. We may ask you to verify your identity before processing the request. Requests are free of charge unless manifestly unfounded or excessive.

The Erppi Service includes built-in GDPR tools for data inventory, export, and erasure that organization administrators can use directly.

10. Data Processing on Behalf of Customers

When organizations use Erppi to store their own customers' and employees' data, we act as a Data Processor under GDPR. The organization is the Data Controller for that data.

In this capacity:

We process data only according to the organization's instructions
We do not access or use that data for our own purposes
The organization is responsible for obtaining appropriate legal basis for storing their data
A Data Processing Agreement (DPA) governs this relationship

11. International Data Transfers

All primary data processing occurs within the EU/EEA. If any sub-processor operates outside the EU/EEA (e.g., Stripe), we ensure appropriate safeguards are in place, including:

EU-US Data Privacy Framework certification
Standard Contractual Clauses (SCCs) approved by the European Commission
Adequacy decisions by the European Commission

12. Cookies and Tracking

The Erppi Service uses:

Session cookies: Required for authentication. These are strictly necessary and do not require consent.
Local storage: Used to store authentication tokens (JWT) on the client side.

We do not use:

Third-party tracking cookies
Analytics cookies (Google Analytics, etc.)
Advertising cookies or pixels

13. Children's Data

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a minor, we will delete it promptly.

14. Data Breach Notification

In the event of a personal data breach that poses a risk to the rights and freedoms of data subjects:

We will notify the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu) within 72 hours of becoming aware of the breach
We will notify affected data subjects without undue delay if the breach is likely to result in a high risk to their rights
We will document all breaches in our internal breach register

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via email or in-app notification at least 30 days before the changes take effect.

16. Supervisory Authority

If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with:

Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
Lintulahdenkuja 4, 00530 Helsinki
Phone: +358 29 566 6700
Email: [email protected]
Website: https://tietosuoja.fi

17. Contact

For questions about this Privacy Policy or to exercise your data rights:

JPu Engineering
J. Puska, yksityinen elinkeinonharjoittaja (sole proprietorship)
Muinaistie 33, 96460 Rovaniemi, Finland
Business ID: 3581353-8
Email: [email protected]
Website: https://jpu.fi