Holvi Payment Services Oy
Published: 4 February 2021
Updated: 10 September 2026
Version 3.0
Scope
This Data Processing Agreement ("DPA") is part of Holvi's Terms of Service between you (the "Customer") and Holvi Payment Services Oy ("Holvi"), or any other agreement governing your use of Holvi's services where Holvi processes personal data on your behalf. We have put this DPA in place to meet the requirements of the General Data Protection Regulation ("GDPR") and to protect data subjects' rights between you as Data Controller and Holvi as Data Processor.
The DPA has been designed to ensure both parties' compliance with Article 28(3) of the GDPR, sets out our respective rights and obligations when Holvi processes personal data on your behalf, and stays in force for as long as you continue to use these services.
In the context of providing the agreed services, Holvi will process personal data on your behalf in accordance with the DPA. Where the DPA and any similar provisions in other agreements between us overlap, the DPA takes priority. Note that the DPA does not exempt Holvi from any obligations we are subject to under the GDPR or other legislation.
Definitions
Data Controller: A natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Data Processor: A natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.
Data Subject: A natural person about whom a controller holds personal data and who can be identified, directly or indirectly, by reference to that personal data.
Data Transfer: An intentional sending of personal data to another party or making the data accessible by it, where neither sender nor recipient is a data subject.
EU: European Union.
EEA: European Economic Area.
General Data Protection Regulation: Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC ("GDPR").
Member State: A state that is a member of the European Union.
Personal Data: Any information relating to an identified or identifiable natural person ("Data Subject").
Personal Data Breach: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed.
Sub-Processor: A natural or legal person, public authority, agency, or body other than the data subject, controller, processor, and persons who, under the direct authority of the controller or processor, is authorised to process personal data.
Supervisory Authority: An independent public authority established by a Member State.
Terms of Service: The terms of service of Holvi Payment Services Oy.
Your rights and obligations as Data Controller
You are responsible for ensuring that any processing of personal data complies with the GDPR, including your accountability obligations under Article 24, as well as with applicable EU, EEA, or Member State data protection law and this DPA. As the controller, you retain the right and the obligation to determine the purposes and means of the processing. This includes ensuring that any processing you instruct Holvi to carry out has a valid legal basis.
Basis for processing and processing according to instructions
Holvi will always process personal data (including your customers' data) in accordance with the GDPR, applicable EU, EEA, or Member State data protection law, and the agreements between us. Holvi will process personal data only on your instructions, unless EU, EEA, or Member State law to which Holvi is subject requires otherwise. You may issue further instructions throughout the processing relationship, but any such instructions must be documented in writing, including electronically, and referenced to this DPA. If, in Holvi's view, an instruction you give would contravene the GDPR or applicable EU, EEA, or Member State data protection law, we will notify you immediately and may suspend performance of that instruction until the matter is resolved.
Categories of personal data processed
The personal data Holvi processes on your behalf includes the information you transfer to us and the information we collect on your behalf (including your customers' data); data types may be further specified in the respective service descriptions. We process this personal data so that you can make appropriate use of the services described in the agreement between Holvi as supplier and you as Customer, and to make Holvi's services and related value-added services available to your data subjects. The relevant category of data subject is your customers who use Holvi's value-added services; typically, these data subjects engage with you via Holvi's value-added services (e.g., invoicing, Dropbox delivery, web shop). Personal data that Holvi processes for any purpose under this DPA will not be kept for longer than necessary for that purpose.
Separately, to develop our product in line with users' needs, keep usage safe and non-abusive, maintain the technical performance and security of the product, and bill customers correctly based on their usage, Holvi needs to track certain usage information about how users navigate the product. Because Holvi determines the scope and purpose of this usage information, Holvi is the Data Controller for it, and the individual user is the data subject; this processing is governed by Holvi's Privacy Notice, and the user retains all their rights under the GDPR. Both parties further acknowledge that Holvi is the Data Controller for other processing activities described in Holvi's Privacy Notice and Terms of Service, including, but not limited to, transmitting communications, detecting and handling faults and errors, security, developing the service, providing customer support, billing, user activation and engagement, and Holvi's own marketing and sales activities.
Security and confidentiality
Article 32 of the GDPR requires that, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, both you and Holvi implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. You should evaluate the risks to the rights and freedoms of natural persons inherent in the processing and implement measures to mitigate those risks. Depending on their relevance, these measures may include:
- Pseudonymisation and encryption of personal data
- The ability to ensure ongoing confidentiality, integrity, availability, and resilience of processing systems and services
- The ability to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident
- A process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing
Under Article 32 of the GDPR, Holvi will also, independently of you, evaluate the risks to the rights and freedoms of natural persons inherent in the processing and implement measures to mitigate those risks; to help us do this, you shall provide us with all the information we need to identify and evaluate such risks. Holvi helps you comply with your obligations under Article 32 by, among other things, giving you information on the technical and organisational measures Holvi has already put in place under Article 32, and any other information you reasonably need, taking into account the information available to us and the fact that you are unable to carry out those measures without our assistance.
Holvi will only grant access to personal data processed on your behalf to people under our authority who have committed to confidentiality or are under an appropriate statutory obligation of confidentiality, and only on a need-to-know basis. Holvi's employees are committed to confidentiality when processing your data, and we have taken appropriate technical and organisational measures to keep that processing secure. These measures include, at a minimum, designing our service and internal routines to maintain a high level of security and prevent breaches; testing is built into our development process, and we run a continuous deployment system with automated tests before every deployment.
Use of sub-processors
To provide Holvi's services and related value-added services to you, you accept that Holvi may engage sub-processors. From the start of this DPA, you authorise the engagement of the sub-processors listed here, and Holvi assumes your general authorisation to engage further sub-processors going forward. We will notify you in writing of any intended changes concerning the addition or replacement of sub-processors at least two (2) months in advance, giving you the opportunity to object to such changes and terminate the DPA before the sub-processor in question is engaged, provided you have substantial and documented reasons for the objection.
Where Holvi engages a sub-processor to carry out specific processing activities on your behalf, we will impose the same data protection obligations set out in this DPA on that sub-processor, by way of a contract or other legal act under EU, EEA, or Member State law, in particular obligations that provide sufficient guarantees to implement appropriate technical and organisational measures so that the processing meets the requirements of this DPA and the GDPR. At your request, we will share a copy of the relevant sub-processor agreement clause and any subsequent amendments, so you can confirm that the same data protection obligations set out in this DPA are imposed on the sub-processor; we do not, however, need to share provisions on business matters that do not affect the legal data protection content of the sub-processor agreement.
If a sub-processor fails to fulfil its data protection obligations, Holvi remains liable to you for the fulfilment of those obligations. This does not affect data subjects' rights under the GDPR, in particular those set out in Articles 79 and 82, against you and against Holvi, including the sub-processor.
Co-operation
Taking into account the nature of the processing, Holvi will help you, through appropriate technical and organisational measures and insofar as this is possible, fulfil your obligations to respond to requests for data subjects to exercise their rights under Chapter 3 of the GDPR. This means that, insofar as possible, we will help you comply with:
- The right to be informed when collecting personal data from the data subject
- The right to be informed when personal data hasn't been obtained from the data subject
- The right of access by the data subject
- The right to rectification
- The right to erasure ("the right to be forgotten")
- The right to restriction of processing
- The notification obligation regarding rectification or erasure of personal data, or restriction of processing
- The right to data portability
- The right to object
- The right not to be subject to a decision based solely on automated processing, including profiling
In addition to our obligation to assist you under Section 6, and taking into account the nature of the processing and the information available to us, Holvi will also help you comply with:
- Your obligation to notify a Personal Data Breach to the competent Supervisory Authority (the Finnish Data Protection Authority) without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons
- Your obligation to communicate a Personal Data Breach to the data subject without undue delay, where the breach is likely to result in a high risk to the rights and freedoms of natural persons
- Your obligation to carry out a data protection impact assessment of the envisaged processing operations
- Your obligation to consult the competent Supervisory Authority (the Finnish Data Protection Authority) before processing, where a data protection impact assessment indicates the processing would result in a high risk in the absence of measures you take to mitigate it
Deletion and return of data
Once Holvi stops providing personal data processing services to you, we will delete all personal data processed on your behalf, unless otherwise required by law. At that point, we will, at your choice, return all personal data to you and delete any existing copies, unless EU, EEA, or Member State law requires us to keep storing it. You acknowledge and accept that Holvi also processes some data in the capacity of Data Controller, and that we retain that data in accordance with Holvi's Privacy Notice.
Transfer of data
Holvi will only transfer personal data to third countries or international organisations based on your documented instructions, and always in compliance with Chapter 5 of the GDPR. If EU, EEA, or Member State law requires Holvi to make a transfer to a third country or international organisation that you have not instructed us to perform, we will notify you of that legal requirement before processing, unless the law prohibits this on important grounds of public interest. This DPA is not to be confused with standard data protection clauses within the meaning of Article 46(2)(c) and (d) of the GDPR, and neither party may rely on it as a transfer tool under Chapter 5 of the GDPR.
Notification of a personal data breach
If a Personal Data Breach occurs, Holvi will notify you without undue delay after becoming aware of and confirming it, and no later than 72 hours where feasible, so that you can comply with your obligation to notify the competent Supervisory Authority under Article 33 of the GDPR. In line with our undertaking above to help you notify a Personal Data Breach to the competent Supervisory Authority, Holvi will assist you in obtaining the information below, which Article 33(3) of the GDPR requires your notification to state:
- The nature of the personal data, including, where possible, the categories and approximate number of data subjects concerned, and the categories and approximate number of personal data records concerned
- The likely consequences of the Personal Data Breach
- The measures you've taken or propose to take to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects
Audit and inspection
Holvi will make available to you all information necessary to demonstrate compliance with the obligations set out in Article 28 of the GDPR and in this DPA, and will allow for and contribute to audits, including inspections, carried out by you or another auditor you have mandated. Each party covers its own costs for any such audit; if you would like to use an external auditor, you will cover the costs of that auditor and any related costs.
Amendments
Holvi may amend this DPA and any supplemental documentation whenever we consider it necessary, and will notify you of amendments electronically; such amendments take effect on the date set out in the notice, but no earlier than two (2) months from the date of notification. Where the law requires an amendment to this DPA or any supplemental documentation, however, we may make it without prior notice to you, and it will take effect immediately.
If any provision of this DPA is found to be invalid, illegal, or unenforceable, Holvi will not rely on that provision and will make adequate changes as soon as reasonably practicable to remain fully compliant; the corresponding term(s) will be amended accordingly.
Other provisions
For clarity, what is agreed on limitations of liability, communication, and governing law and venue in the Terms of Service also applies to this DPA. The parties may agree on other clauses covering the provision of personal data processing services, for example, specifying liability, provided they do not directly or indirectly contradict this DPA, or prejudice data subjects' fundamental rights, freedoms, or the protections the GDPR affords them; any such clauses must be agreed separately and in writing. This DPA applies for as long as Holvi provides personal data processing services to you and may not be terminated unless another DPA governing that provision has been agreed between the parties.