| Party name and jurisdiction | Purpose | Data disclosed | Safeguards when transferring data to 3rd countries | |
| 1. Payment Processors | ||||
Bank of Lithuania payment system CENTROlink | SEPA payment processing (SDD and SCT) | Sender and receiver details as part of SEPA payment transactions transmitted in the inter-PSP within the SCT and SDD schemes | ||
| Thames Card Technology Ltd (UK) | Card bureau | Cardholder name, company name, PAN number, security code, contact information | European Commission Model Contract (Standard Contractual Clauses) | |
| Global Processing Services Ltd (UK) | Processing of Mastercard payment transaction | Cardholder name and address | European Commission Model Contract (Standard Contractual Clauses) | |
| Paytrail Oy (FI) | Online banking e-payments acquiring as a payment facilitator | Transaction and payment data | ||
| Emerchantpay Ltd (UK) | Card payments acquiring for webshop | Transaction and payment data | Adequacy decision | |
| MeaWallet AS (NO) | Enabling digital payments | Card data, mobile device data and card transaction data on the cardholder | ||
| Banking Circle S.A. (LU) | Cross-border payment and foreign exchange processing (Swift) | Sender and receiver details included in Swift payment messages exchanged between participating financial institutions via the Swift network | ||
| 2. Auditing | ||||
| KPMG Helsinki Oy (FI) | Financial audits | Partner names, account numbers, transaction information | ||
| ECOVIS ProventusLaw (LT) | To test Holvi's Anti Money Laundering (AML) and Know Your Customer (KYC) controls and to carry out professional auditing services for Holvi | For a sample of individual customer accounts: name, Holvi account number (Customer ID), total amount received on the Holvi account, total amount sent from the Holvi account, type of Holvi account, and, as the case may be, any other relevant account information. | ||
| 3. Customer Service Outsourcing | ||||
| Zendesk, Inc (US) | To provide customer support through email or phone | Full name, contact information | Zendesk has obtained regulatory authorization of its controller and processor Binding Corporate Rules (“BCRs”) for its customers’ data | |
| Solvemate GmbH (DE) | To provide a chatbot on the customer support chat | Information received from the data subject (contents of the chat messages) | ||
| HubSpot, Inc. (US) | To send service and marketing messages, assist in direct marketing campaigns and analysis. Administer data from piloting customers | Full name, contact information, avatar image, IP address | European Commission Model Contract (Standard Contractual Clauses) | |
| Heimo Community Oy (FI) | Holvi Community discussion forum | Full name, email | ||
| IRO Research Oy (FI) | To develope Holvi product in line with customer interviews in Finland | Full name, email, phone number | ||
| 4. Identity and Fraud Agencies | ||||
| Comply Advantage (UK) | Monitoring, PEP, sanctions and adverse media checks, analysis | Full name, transaction data | Adequacy decision | |
| IDnow GmbH (DE) | Video based authentication service. To verify identity and carry out checks for the prevention and detection of financial crime | Name, address, phone number, proof of identity, location | ||
| CRIF Bürgel GmbH (DE) | To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering | Name, address, date of birth and telephone number | ||
| Compass-Verlag GmbH (AT) | Identification and credit data for legal persons in Austria | Name, business name | ||
| SCHUFA Holding AG (DE) | To receive business information for risk assessment, and compliance with anti-money laundering requirements, such as establishing the corporate structure and beneficial ownership, get credit data for natural persons | Company registration number, name and address of business, name, address, date of birth of directors | ||
| Suomen Asiakastieto Oy (FI) | To identify and get credit data for natural and legal persons in Finland and enrich company profiles | Name, date of birth and company financials | ||
| Signicat AS (NO) | Electronic identification of Finnish customers | Name, national ID | ||
| 5. Commercial Partners | ||||
| Basware Oy (FI) | To enable creating invoices | Full name, email, postal address, phone number | ||
| Apix Messaging Oy (FI) | Invoice digitisation | Full name, contact information, financial information | ||
| DG Ezy Oy (FI) | To provide accounting service for our customers | Contact information, financial information, identification information | ||
| Tilitoimisto Lemon Tree Oy (FI) | To provide accounting service for our customers | Contact information, financial information, identification information | ||
| lemon.markets brokerage GmbH (DE) | To provide investment services for our customers | Contact information, financial information, identification information, verification information | ||
| 6. Marketing | ||||
| Facebook Inc (US), Facebook Ireland Limited (IE), Facebook Business Manager (SE) | To run prospecting and retargeting campaigns for personalised advertising, customer acquisition and lead generation | Advertising ID and device ID to segment user groups based on app behaviour, encrypted e-mail address, full name, and country associated with Holvi users (without indicating account relationship), IP Address, Anonymous ID generated by cookies or similar technologies embedded in webpages, ads and emails delivered to users. Mobile advertiser ID, IP Address and other metadata | European Commission Model Contract
(Standard Contractual Clauses) | |
| Google Ads, Google Play Store (US) | To run prospecting and retargeting campaigns for personalised advertising, customer acquisition and lead generation | Advertising ID and device ID to segment user groups based on app behaviour, encrypted e-mail address, full name, and country associated with Holvi users (without indicating account relationship), IP Address, Anonymous ID generated by cookies or similar technologies embedded in webpages, ads and emails delivered to users. Mobile advertiser ID, IP Address and other metadata | European Commission Model Contract
(Standard Contractual Clauses) | |
| Microsoft Deutschland GmbH (DE) | To run prospecting and retargeting campaigns for personalised advertising, customer acquisition and lead generation | Advertising ID and device ID to segment user groups based on app behaviour, encrypted e-mail address associated with Holvi users (without indicating account relationship), IP Address, Anonymous ID generated by cookies or similar technologies embedded in webpages, ads and emails delivered to users. Mobile advertiser ID, IP Address and other metadata | ||
| Reddit (US) | To run prospecting and retargeting campaigns for personalised advertising, customer acquisition and lead generation | Advertising ID and device ID to segment user groups based on app behaviour, encrypted e-mail address associated with Holvi users (without indicating account relationship), IP Address, Anonymous ID generated by cookies or similar technologies embedded in webpages, ads and emails delivered to users. Mobile advertiser ID, IP Address and other metadata | European Commission Model Contract
(Standard Contractual Clauses) | |
| TikTok (IE) | To run prospecting and retargeting campaigns for personalised advertising, customer acquisition and lead generation | Advertising ID and device ID to segment user groups based on app behaviour, encrypted e-mail address associated with Holvi users (without indicating account relationship), IP Address, Anonymous ID generated by cookies or similar technologies embedded in webpages, ads and emails delivered to users. Mobile advertiser ID, IP Address and other metadata | ||
| Everflow (US) | To track, manage, and pay partners and affiliates within our online marketing and partnership programs | Email address | European Commission Model Contract
(Standard Contractual Clauses) | |
| 7. Operational Services | ||||
| Teamtailor AB (SE) | Recruiting | Full name, email address, headline for the application, phone number, photograph, information on education, information on work experience, summary, resume, cover letter, and answers to questions of their achievements, why they would like to work at Holvi, whether they know anyone working at Holvi, and whether the applicant is already a Holvi user | ||
| Adobe Systems Inc. (US) | To sign agreements | Full name, email address | European Commission Model Contract (Standard Contractual Clauses) | |
Google, LLC (US), Amazon Web Services Inc. (US) | To provide cloud-based hosting, storage and processing services to assist and/or enable Holvi to manage users’ Account Information as well as data generated through their use of Holvi and deliver, analyse and improve Holvi Services. To monitor, store, and access log files | All account information, data generated through the use, and/or necessary for the provision of Holvi Services | European Commission Model Contract (Standard Contractual Clauses) | |
| Functional Software Inc. (Sentry) (US) | To monitor and fix crashes in real time | IP address | European Commission Model Contract (Standard Contractual Clauses) | |
| OneTrust LLC (US) | Respond to data subject right requests, give data subjects a control over the cookies placed on their browser | Full name, email address, country, IP address | European Commission Model Contract (Standard Contractual Clauses) | |
| DataDog Inc. (US) | To monitor cloud-scale applications | Contact information, browsing information, PII | European Commission Model Contract (Standard Contractual Clauses) | |
| Nexmo (Vonage Limited) (US) | To send SMS to customers | Phone number | European Commission Model Contract (Standard Contractual Clauses) | |
| E-Fax Inc. (j2 Global, Inc) (US) | Enabling to receive and send faxes | Fax number | ||
| Magic Cloud (FI) | Secure messaging service | Name, email | ||
| Typeform SL (ES) | Research platform | Contact information, demographics, | ||
| Taktile GmbH (DE) | To support credit underwriting decisioning processes | Business ID | ||
| Microsoft Corporation (US) | To provide artificial intelligence services assisting and enhancing the provision of the Holvi account | Personal data generated through the use of and/or necessary for the provision of Holvi Services | European Commission Model Contract (Standard Contractual Clauses) | |
| Senzum AB (SE) | To support and manage customer relationships | Information received from the data subject (contents of the calls and chat messages) |
| |
| Lovable Technologies Inc. (US) | To provide an AI-assisted web application development and hosting platform used to build and run internal Holvi tools | Depending on the application: full name, email address, phone number, business ID, company name, contact address, accounting software credentials, financial statement data, IP address, and browser metadata. | European Commission Model Contract (Standard Contractual Clauses) | |
| Supabase Inc. (US) | To provide cloud-hosted PostgreSQL database, authentication, edge-function runtime (Deno), and file storage services underpinning the Holvi Lovable applications | Depending on the application: full name, email address, phone number, business ID, company name and address, contact details, accounting software credentials, financial statement data, IP address, application session data, and audit log events | European Commission Model Contract (Standard Contractual Clauses) | |