Holvi Payment Services Oy
Last Update: 10 June 2026
Version 1.0
Introduction
Holvi Payment Services Oy ("Holvi") operates the Holvi Affiliate Programme ("Programme"), which allows individuals and businesses to earn commissions by referring new customers to Holvi.
Your privacy is important to us at Holvi, and maintaining your trust and confidence is one of our highest priorities. With this intention, Holvi has created this Affiliate Privacy Notice ("Notice") to inform you of the nature, scope, and purpose of the personal data Holvi processes in connection with the Programme, and to inform you of the rights to which you are entitled under applicable data protection regulations.
Holvi has committed to processing personal data in line with the General Data Protection Regulation 2016/679 ("GDPR"). Holvi acts as a data controller for the processing of personal data as described in this Notice.
Name and address of the data controller
Controller:
Holvi Payment Services Oy Business ID 2193756-4 Kaikukatu 2 C 00530 Helsinki Finland
The Data Protection Officer (DPO):
The Holvi Data Protection Officer can be contacted by email at privacy@holvi.com. For information on how to use your rights, please see the section "Your rights as a data subject" below.
What personal data we collect about you
In connection with your participation in the Affiliate Programme, Holvi collects and processes the following personal data:
- Personal details such as your name and email address
- Contact details such as your email address and phone number
- Banking details such as your IBAN and bank account information
- Payment history and commission records relating to your participation in the Programme
- Tracking link performance data, including clicks, leads, and conversions attributed to your affiliate links
- Correspondence records between you and Holvi, including emails and support exchanges
- Communications sent to you in connection with the Programme
How we use your personal data
In order to fulfil our contract with you:
- Create and manage your affiliate account
- Calculate and process commission payments
- Measure Programme performance and calculate your commissions
- Manage and resolve disputes relating to commission payments
To fulfil our legal obligations:
- Retain payment and financial records in accordance with applicable accounting legislation
Where it is in our legitimate interests:
- Maintain accurate records of Programme activity and correspondence for the purposes of Programme management and defending legal claims
- Send you operational communications and updates relating to the Programme via our CRM platform
With your consent:
- Send you promotional communications where your consent is required by law
Automated decision-making
Holvi does not make solely automated decisions about you in connection with the Affiliate Programme that produce legal or similarly significant effects.
Who we share your personal data with
We share your personal data with the following recipients:
- Everflow Technologies Inc.: our affiliate platform provider (holvi.everflowclient.io), which processes your account data, tracking data, and commission records on our behalf as a data processor. Everflow is based in the United States; transfers are covered by Standard Contractual Clauses.
- HubSpot Inc.: our CRM and communications platform, used to manage your affiliate account records and send Programme communications on our behalf as a data processor. HubSpot is based in the United States; transfers are covered by Standard Contractual Clauses.
- Payment service providers and banks: solely for the purpose of executing commission payments to your IBAN.
- Accounting and legal service providers: where required to meet our financial record-keeping obligations or to defend legal claims.
- Authorities: where required by law.
We do not sell your personal data or share it for advertising purposes.
For data transfers outside the EEA
Where personal data is transferred outside of the European Economic Area, Holvi uses appropriate safeguards as required under the GDPR, such as Standard Contractual Clauses issued by the European Commission.
How long we keep your data
Holvi retains personal data for the period of time Holvi has legal or regulatory obligations, has legitimate business purposes, or for the duration of the contract with the affiliate.
Holvi retains personal data as follows:
- Affiliate account data (name, email address, phone number) are retained for the duration of the affiliate relationship, plus three years after termination
- IBAN and payment records are retained for ten years from the date of payment, in line with Finnish accounting legislation
- Commission and invoice records are retained for ten years from the date of the transaction
- Correspondence and CRM records are retained for three years after termination of the affiliate relationship
- Tracking and performance data are retained for the duration of the affiliate relationship, plus one year after termination
After termination of your affiliate agreement, your personal data will be deleted or anonymised once the applicable retention period has expired.
Your rights as a data subject
The right to be informed
Holvi will inform you about the purpose, lawful basis, and retention period of your personal data, as well as the sources and recipients of the data. If data is processed based on consent, you can withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.
The right to access
You can request a copy of the personal data Holvi holds about you. Requests are typically fulfilled within one month and are free of charge, unless they are repetitive, unfounded, or excessive.
The right to data portability
You have the right to receive personal data you have provided to Holvi in a structured, commonly used, and machine-readable format, and to request its transfer to another controller where processing is based on contract or consent.
The right to rectification
If you find your personal data to be inaccurate or incomplete, you can request that it be corrected. Holvi will respond within one month.
The right to erasure
You have the right to request the deletion of your personal data under certain circumstances. Legal retention requirements or legitimate interests may justify retaining the data for longer. Holvi will respond within one month, informing you of any such justifications.
The right to restrict processing
You can request that Holvi restricts the processing of your personal data in certain circumstances, for example where you contest the accuracy of the data or believe the processing is unlawful.
The right to object
You can object to the processing of your personal data based on your specific situation where processing is based on legitimate interests. Holvi will cease processing unless compelling grounds exist.
Using your rights
To exercise any of the above rights, please contact privacy@holvi.com. We will respond as soon as possible and no later than within one month.
You also have the right to lodge a complaint with a supervisory authority. Holvi's lead supervisory authority is the Office of the Data Protection Ombudsman (Finland), whose contact details can be found at tietosuoja.fi.
Changes to this Notice
Holvi will publish the newest version of this Notice on the Holvi Affiliate Programme page and will inform affiliates directly of any material changes.