Data Processing Agreement

Provider

Ankrito Oy, a limited company (osakeyhtiö), formerly Selvia

Business ID

3658630-6

Domicile

Helsinki, Finland

Address

Konalantie 7, 00370 Helsinki, Finland

Email

support@ankrito.com

This DPA is between Ankrito Oy (Business ID 3658630-6, Helsinki, formerly Selvia; “Ankrito”) and the business customer that uses Ankrito’s software or services (“the customer”).

This DPA applies wherever Ankrito processes personal data on the customer's behalf and on the customer's instructions — most commonly, personal data about the customer's own customers, suppliers, employees or other contacts that appears in accounting, business or professional-service material the customer provides to Ankrito (for example, names on invoices and receipts, or identity details in a document submitted for an Immigration Services engagement). For that data, the customer is the controller and Ankrito is the processor.

This DPA does not cover personal data for which Ankrito is itself the controller — the customer's own account and contact details, Ankrito's own billing records, the customer's communications with Ankrito's support team, or data Ankrito must process under its own legal obligations, such as know-your-customer checks under anti-money-laundering law. The Privacy Policy covers that data.

Subject matter

Processing of personal data contained in accounting, business and professional-service material the customer provides to Ankrito.

Duration

For as long as the relevant service agreement is in effect, and afterwards only as described in "Deletion and retention" below.

Nature and purpose

Processing only to provide the agreed software and professional services — bookkeeping, VAT preparation and filing, invoicing, document capture and storage, and the other services described in the Terms of Service and Payment Terms — for no other purpose.

Types of personal data

Names, contact details, and other identifying or transactional information appearing in the customer's accounting material — for example on invoices, receipts, bank statements and supporting documents — and, for an Immigration Services engagement, identity and application-related information the customer or the relevant individual provides for that engagement. For payroll: employees' pay, tax card, bank account and personal identity code details. For Ankrito POS: the venue's staff user accounts and the sales recorded at the till.

Special categories

Ankrito does not ask for special categories of personal data. Payroll and immigration material can nevertheless contain them (for example a union-fee deduction or a health detail in a document). Ankrito processes such data only as far as the agreed service requires.

Categories of data subjects

The customer's own customers, suppliers, employees (including the venue's POS users) and other individuals named in the material the customer submits; for Immigration Services, the individual the engagement concerns.

• Ankrito processes this personal data only on the customer's documented instructions — given by using the service as described in the Terms of Service, Payment Terms and the relevant service agreement — unless Finnish or EU law requires otherwise, in which case Ankrito tells the customer before processing, unless the law prohibits this. If Ankrito thinks an instruction breaks data-protection law, it tells the customer immediately.
• Anyone Ankrito allows to process this data is bound by an obligation of confidentiality.
• Ankrito applies the technical and organisational measures described on the Security & Data page.
• Ankrito helps the customer respond to a data-subject rights request concerning this data, to the extent Ankrito is able to given the nature of the processing.
• Ankrito helps the customer meet its obligations under GDPR Articles 32–36 (security, breach notification, impact assessments and prior consultation), as far as reasonably possible given the nature of the processing and the information available to Ankrito.
• If Ankrito becomes aware of a personal data breach affecting this data, Ankrito notifies the customer without undue delay.
• At the end of the relevant service, Ankrito deletes this personal data or returns it, at the customer's choice, except data Ankrito or the customer is required by law to keep — see "Deletion and retention" below.
• Ankrito makes available the information reasonably necessary to show it meets these obligations, and allows for and contributes to an audit, including an inspection, conducted by the customer or an auditor the customer mandates, on reasonable prior notice and during normal business hours. This is reasonably satisfied by existing documentation — this DPA and the Security & Data page — except where that is genuinely insufficient for the specific question raised.

Ankrito uses the subprocessors on the Subprocessor List to provide the service — for example database hosting, file storage and document-text extraction. By using Ankrito's services, the customer authorises Ankrito's use of the subprocessors currently on that list. Ankrito imposes data-protection obligations on each subprocessor equivalent to this DPA, and remains responsible to the customer for a subprocessor's performance of them.

For a new subprocessor that will process this category of personal data, Ankrito updates the Subprocessor List and, where Ankrito holds a current contact email for the customer, emails notice of the change. A customer who objects on reasonable data-protection grounds can raise it at support@ankrito.com before the change takes effect; if the objection cannot be resolved, the customer may end the affected service.

Some subprocessors are based outside the EU/EEA, or may process data there — the Subprocessor List states this where currently known. Where personal data is transferred outside the EEA, Ankrito relies on a safeguard the GDPR allows: an adequacy decision of the European Commission (including the EU–US Data Privacy Framework, for a subprocessor currently certified to it), the Commission's Standard Contractual Clauses, or the subprocessor's own data-processing terms incorporating one of these.

When the relevant service ends, Ankrito deletes or anonymises personal data processed only for that service and not needed for another purpose, following the process described on the Account Deletion page. If the customer wants the material returned, Ankrito hands it over to the customer, or to the accountant the customer names, as set out in the Terms of Service.

Ankrito keeps accounting, VAT and other records Finnish law requires it to keep, for the periods that law sets, even after a service or account ends. This is a legal obligation on Ankrito, not a choice — the same retention the customer's own bookkeeping is subject to under Finnish accounting law.

The customer is responsible for having a lawful basis to give Ankrito the personal data it provides, for the accuracy of its instructions, and for its own obligations as controller — including responding to a data-subject request Ankrito cannot answer alone, and any notification obligation the law places on the controller rather than the processor.

This DPA is incorporated into, and forms part of, the agreement between Ankrito and a business customer from the point the customer accepts the Terms of Service — the same way the Payment Terms are incorporated for a subscription. It applies automatically to the processing it covers; no separate signature is required. A customer who needs a separately countersigned copy for its own records can request one at support@ankrito.com — a signed copy restates these terms rather than creating different ones.

This DPA supplements the Terms of Service and Payment Terms. Where this DPA and those documents conflict on a data-protection point this DPA covers, this DPA applies for that point.

Ankrito may update this DPA when the processing it covers, the law, or the subprocessors used change. Changes are notified at least 30 days before they take effect, in the app or by email, as for the Terms of Service; changes required by law can take effect sooner.

Questions about this DPA, or a request for a signed copy: support@ankrito.com.