1. Payment Processors
| Party name and jurisdiction | Purpose | Data disclosed | Safeguards when transferring data to 3rd countries |
|---|---|---|---|
| Bank of Lithuania payment system CENTROlink (LT) | SEPA payment processing (SDD and SCT) | Sender and receiver details as part of SEPA payment transactions transmitted in the inter-PSP within the SCT and SDD schemes | |
| Banking Circle S.A. (LU) | Cross-border payment and foreign exchange processing (Swift) | Sender and receiver details included in Swift payment messages exchanged between participating financial institutions via the Swift network | |
| Bankverlag GmbH (DE) | Banking file exchange for the German market (C Record format) | First/last name, date of birth, address, tax number, IBAN | |
| Bottomline Technologies (UK) | SWIFT message transport | All SWIFT message content in transit | Adequacy Decision |
| DiXiO (UAE) | Swift connectivity and smart messaging for payments data | Sender and receiver details included in payment messages | Data stored and processed exclusively within the EEA (Ireland) |
| Emerchantpay Ltd (UK) | Card payments acquiring for webshop | Transaction and payment data | Adequacy Decision |
| Enable Banking (FI) | Open banking data aggregation | External bank account data, transactions, consent tokens | |
| Global Processing Services Ltd (UK) | Processing of Mastercard payment transactions | Cardholder name and address | Adequacy Decision |
| MeaWallet AS (NO) | Card tokenization and provisioning for mobile wallets | Card data, mobile device data and card transaction data on the cardholder | |
| Paytrail Oy (FI) | Online banking e-payments acquiring as a payment facilitator | Transaction and payment data | |
| Tag Systems (PL) | Card bureau for personalizing and issuing customer debit/credit cards | Cardholder name, address | |
| Thames Card Technology Ltd (UK) | Card bureau for personalizing and issuing customer debit/credit cards | Cardholder name, company name, PAN number, security code, contact information | Adequacy Decision |
2. Auditing
| Party name and jurisdiction | Purpose | Data disclosed | Safeguards when transferring data to 3rd countries |
|---|---|---|---|
| ECOVIS ProventusLaw (LT) | Independent AML/KYC control testing and compliance auditing | For a sample of individual customer accounts: name, Holvi account number (Customer ID), total amount received on the Holvi account, total amount sent from the Holvi account, type of Holvi account, and, as the case may be, any other relevant account information. | |
| KPMG Helsinki Oy (FI) | Statutory financial audit of corporate accounts | Partner names, account numbers, transaction information |
3. Customer Service Outsourcing
| Party name and jurisdiction | Purpose | Data disclosed | Safeguards when transferring data to 3rd countries |
|---|---|---|---|
| Heimo Community Oy (FI) | Holvi Community discussion forum hosting | Full name, email | |
| Hotjar Ltd (MT) | Surveys and session recording | Email, survey responses, session recordings, heatmaps | |
| HubSpot, Inc. (US) | Service and marketing messages, direct marketing campaign assistance and analysis, and administration of data from piloting customers | Full name, contact information, avatar image, IP address | European Commission Model Contract (Standard Contractual Clauses) |
| IRO Research Oy (FI) | Customer interviews for product research | Full name, email, phone number | |
| Solvemate GmbH (DE) | Chatbot on the customer support chat | Information received from the data subject (contents of the chat messages) | |
| SurveyMonkey Inc. (US) | Surveys | Email, survey responses | European Commission Model Contract (Standard Contractual Clauses) |
| Zendesk, Inc (US) | Customer support via email or phone, including AI-assisted email automation | Full name, contact information | Binding Corporate Rules ("BCRs") |
4. Identity and Fraud Agencies
| Party name and jurisdiction | Purpose | Data disclosed | Safeguards when transferring data to 3rd countries |
|---|---|---|---|
| Arena Interactive (FI) | SMS/OTP delivery for strong customer authentication | Customer phone number | |
| Compass-Verlag GmbH (AT) | Business identity and credit checks | Name, business name | |
| Comply Advantage (UK) | Monitoring, PEP, sanctions, and adverse media checks and analysis | Full name, transaction data | Adequacy decision |
| CRIF Bürgel GmbH (DE) | Identity verification and checks for the prevention and detection of crime including fraud and/or money laundering | Name, address, date of birth and telephone number | |
| Fusionbase GmbH (DE) | Business registry lookups for verification checks | Business registration data, name, address | |
| IDnow GmbH (DE) | Identity verification, including eID verification, and checks for the prevention and detection of financial crime via video based authentication services | Name, address, phone number, proof of identity, location | |
| PRH/Virre (FI) | Business registry lookups for verification checks | Business name, registration number, company officer details | |
| SCHUFA Holding AG (DE) | Business information for risk assessment and compliance with anti-money laundering requirements and credit data for natural persons | Company registration number, name and address of business, name, address, date of birth of directors | |
| Signicat AS (NO) | Electronic identification of Finnish customers | Name, national ID | |
| Suomen Asiakastieto Oy (FI) | Identification and credit data for natural and legal persons in Finland, and company profile enrichment | Name, date of birth, residential address, nationality and company financials | |
| Transactionlink (PL) | Onboarding and verification interface for customer onboarding | Applicant identity data | |
| YTJ (FI) | Business registry lookups for verification checks | Business name, registration number, company details |
5. Commercial Partners
| Party name and jurisdiction | Purpose | Data disclosed | Safeguards when transferring data to 3rd countries |
|---|---|---|---|
| Apix Messaging Oy (FI) | Invoice digitisation enablement | Full name, contact information, financial information | |
| Azets Insight Oy (FI) | Accounting services for customers | Contact information, financial information, identification information | |
| Basware Oy (FI) | Invoice creation enablement | Full name, email, postal address, phone number | |
| DG Ezy Oy (FI) | Accounting services for customers | Contact information, financial information, identification information | |
| Kitsas (FI) | Accounting integration | Transactions, counterparty details, business ID | |
| lemon.markets brokerage GmbH (DE) | Investment services for customers | Contact information, financial information, identification information, verification information | |
| Lexoffice (Haufe-Lexware GmbH) (DE) | Accounting integration | Transactions, counterparty names, IBANs, tax data | |
| MAESN (DE) | German accounting connections provisioning | Customer transaction, VAT, and receipt data | |
| Salaxy (FI) | Invoice management | Invoice data, owner ID, tax ID, IBAN | |
| Tilitoimisto Lemon Tree Oy (FI) | Accounting services for customers | Contact information, financial information, identification information |
6. Marketing
| Party name and jurisdiction | Purpose | Data disclosed | Safeguards when transferring data to 3rd countries |
|---|---|---|---|
| Everflow (US) | Tracking, management, and payment of partners and affiliates within online marketing and partnership programs | Email address | European Commission Model Contract (Standard Contractual Clauses) |
| Facebook Inc (US), Facebook Ireland Limited (IE), Facebook Business Manager (SE) | Prospecting and retargeting campaigns for personalised advertising, customer acquisition and lead generation | Encrypted email address, full name, country of Holvi users, advertising/mobile advertiser ID, device ID, IP address, and cookie-based anonymous IDs | European Commission Model Contract (Standard Contractual Clauses) |
| FinanceAds (DE) | Affiliate marketing tracking | Tracking UUID, campaign user ID, conversion events | |
| Google Ads, Google Play Store (US) | Prospecting and retargeting campaigns for personalised advertising, customer acquisition and lead generation | Encrypted email address, full name, country of Holvi users, advertising/mobile advertiser ID, device ID, IP address, and cookie-based anonymous IDs | European Commission Model Contract (Standard Contractual Clauses) |
| Microsoft Deutschland GmbH (DE) | Prospecting and retargeting campaigns for personalised advertising, customer acquisition and lead generation | Encrypted email address, full name, country of Holvi users, advertising/mobile advertiser ID, device ID, IP address, and cookie-based anonymous IDs | |
| Reddit (US) | Prospecting and retargeting campaigns for personalised advertising, customer acquisition and lead generation | Encrypted email address, full name, country of Holvi users, advertising/mobile advertiser ID, device ID, IP address, and cookie-based anonymous IDs | European Commission Model Contract (Standard Contractual Clauses) |
| Stape.io (US) | Website analytics tracking | Website visitor IP address and other online identifiers | European Commission Model Contract (Standard Contractual Clauses) |
| TikTok (IE) | Prospecting and retargeting campaigns for personalised advertising, customer acquisition and lead generation | Encrypted email address, full name, country of Holvi users, advertising/mobile advertiser ID, device ID, IP address, and cookie-based anonymous IDs | |
| Twilio Inc. (US) | IVR / voice services | Phone number and call scripts | European Commission Model Contract (Standard Contractual Clauses) |
| Twilio Segment (US) | Customer data platform capturing customer/visitor behavioral and tracking events | Behavioral and tracking event data associated with customer/visitor use of Holvi digital properties | European Commission Model Contract (Standard Contractual Clauses) |
| Vainu (FI) | Prospect and customer contact data enrichment | Contact information |
7. Operational Services
| Party name and jurisdiction | Purpose | Data disclosed | Safeguards when transferring data to 3rd countries |
|---|---|---|---|
| Adobe Systems Inc. (US) | Agreement signing | Full name, email address | European Commission Model Contract (Standard Contractual Clauses) |
| Apple Inc. (US) | Push notification delivery (APNs) | Device token, notification content | European Commission Model Contract (Standard Contractual Clauses) |
| Auth0 (Okta, Inc.) (US) | Authentication and login infrastructure | Email, user ID, login metadata (IP, device) | European Commission Model Contract (Standard Contractual Clauses) |
| DataDog Inc. (US) | Monitoring of cloud-scale applications | Contact information, browsing information, PII | European Commission Model Contract (Standard Contractual Clauses) |
| Dropbox, Inc. (US) | File storage | Stored files (may contain PII), file metadata | European Commission Model Contract (Standard Contractual Clauses) |
| E-Fax Inc. (j2 Global, Inc) (US) | Receiving and sending of faxes | Fax number | European Commission Model Contract (Standard Contractual Clauses) |
| Functional Software Inc. (Sentry) (US) | Real-time monitoring and fixing of crashes | IP address | European Commission Model Contract (Standard Contractual Clauses) |
| Google, LLC (US), Amazon Web Services Inc. (US) | Cloud-based hosting, storage and processing services to assist and/or enable management of users' account information and data generated through their use of Holvi, delivery, analysis and improvement of Holvi Services, and log monitoring, storage, and access | All account information, data generated through the use, and/or necessary for the provision of Holvi Services | European Commission Model Contract (Standard Contractual Clauses) |
| Lovable Technologies Inc. (US) | AI-assisted web application development and hosting platform used to build and run internal Holvi tools | Depending on the application: full name, email address, phone number, business ID, company name, contact address, accounting software credentials, financial statement data, IP address, and browser metadata. | European Commission Model Contract (Standard Contractual Clauses) |
| Magic Cloud (FI) | Secure messaging service | Name, email | |
| Mailgun (US) | Customer-facing transactional email delivery, including forwarded receipts/invoices | Customer email address, financial data contained in receipts/invoices | European Commission Model Contract (Standard Contractual Clauses) |
| Microsoft Corporation (US) | Artificial intelligence services assisting and enhancing the provision of the Holvi account | Personal data generated through the use of and/or necessary for the provision of Holvi Services | European Commission Model Contract (Standard Contractual Clauses) |
| mtCaptcha (US) | Bot detection | IP address, browser fingerprint, interaction patterns | |
| Nexmo (Vonage Limited) (US) | SMS delivery to customers | Phone number | European Commission Model Contract (Standard Contractual Clauses) |
| OneTrust LLC (US) | Responding to data subject right requests and data subject control over the cookies placed on their browser | Full name, email address, country, IP address | European Commission Model Contract (Standard Contractual Clauses) |
| REISSWOLF (AT) | Scanning of incoming post | Customer and regulatory correspondence contents | |
| Senzum AB (SE) | Support and management of customer relationships | Information received from the data subject (contents of the calls and chat messages) | |
| Supabase Inc. (US) | Cloud-hosted PostgreSQL database, authentication, edge-function runtime (Deno), and file storage services underpinning the Holvi Lovable applications | Depending on the application: full name, email address, phone number, business ID, company name and address, contact details, accounting software credentials, financial statement data, IP address, application session data, and audit log events | European Commission Model Contract (Standard Contractual Clauses) |
| Taktile GmbH (DE) | Support for credit underwriting decisioning processes | Business ID | |
| Teamtailor AB (SE) | Recruitment | Full name, email address, headline for the application, phone number, photograph, information on education, information on work experience, summary, resume, cover letter, and answers to questions of their achievements, why they would like to work at Holvi, whether they know anyone working at Holvi, and whether the applicant is already a Holvi user | |
| Typeform SL (ES) | Research platform | Contact information, demographics | |
| Usercentrics A/S (DK) | AI gateway interface for AI agents and internal systems | Personal data, financial data, and potentially special-category data transiting via connected systems, |