Data processing agreement

What the agreement is

The data processing agreement covers the personal data you put into Weik.io Cloud, in your installations. It’s the agreement Article 28 of the GDPR requires between you, the controller of that data, and Adafy Oy, which processes it for you. The agreement is signed with the order, and it lasts as long as the agreement on the service does.

This page sets out what the agreement covers.

The parties

• Controller: you, the organisation that has the Weik.io Cloud account.
• Processor: Adafy Oy, business ID 2480016-8, Lutakonaukio 1, 40100 Jyväskylä, Finland.

Subject matter and duration

Adafy processes personal data only to provide the installations you order, and only on your documented instructions. The instructions are the agreement itself and what you configure in your installations. Processing lasts for the term of the service and the 30 days after it ends during which your data stays available for export.

Categories of data and people

You decide what personal data goes into the service. It typically includes the names, e-mail addresses and other contact details of your employees, customers and partners in the messages and files your integrations move, the user names and sign-in records of the people who use your installations, and the IP addresses in the logs of your gateways. The service isn’t meant for special categories of personal data under Article 9 of the GDPR unless you’ve agreed otherwise with Adafy in writing.

Security measures

Adafy protects the data with the technical and organisational measures listed in the agreement. They include:

• TLS 1.2 or 1.3 for every connection to an installation
• Secrets sealed with AES-256-GCM in each installation
• Separate installations for each customer, each with its own sign-in, roles and audit log
• Staff access only through your installation’s own sign-in, with every action in its audit log
• Backups every 6 hours, kept in Helsinki
• Servers in an ISO/IEC 27001 certified data centre in Helsinki

The controls of the Weik.io software are described in more detail on the Weik.io security page.

Subprocessors

Adafy uses the subprocessors on the subprocessors page, each bound by a data processing agreement under the GDPR to process personal data only on Adafy’s instructions, and a subprocessor outside the EEA processes it under the European Commission’s standard contractual clauses in that agreement. Adafy announces a new subprocessor to the account’s e-mail address at least 30 days before it starts processing your data, and you can object to it or end the agreement before then.

Confidentiality

Everyone at Adafy who can access your data is bound by confidentiality, and Adafy gives access only to the people who need it to run the service or answer your support case.

Assistance with requests

Adafy helps you answer the requests of the people whose data you process, such as a request to see, correct or delete their data, and helps you with data protection impact assessments and consultations with a supervisory authority as far as the service is concerned.

Personal data breaches

Adafy notifies you without undue delay, and within 48 hours of becoming aware of it, of a personal data breach that affects your data, with what is known of its nature, the data and people concerned, its likely consequences and the measures taken.

Audits

Adafy makes available the information you need to show that the agreement is kept, and allows audits by you or an auditor you appoint, with 30 days’ notice and at your cost.

Deletion at the end

When the agreement ends, your data stays available for export for 30 days. Adafy then deletes it from the installations and lets the backups that still contain it expire within a further 30 days, unless the law requires it to be kept.

Location and transfers

Your data is stored and processed in Finland. What you send in a support case goes to the companies named for support on the subprocessors page.