TERMS AND CONDITIONS FOR CONFIDENTIALITY AND THE PROCESSING OF PERSONAL DATA

GENERAL TERMS AND CONDITIONS

These terms and conditions constitute a Non-Disclosure Agreement (NDA) and a Data Processing Agreement (DPA) regarding the services provided by Yritysmeil.

1. The Contracting Parties

Service Provider

Yritysmeili

Business ID: 3383964-6

Address: Haarlankatu 4 B, 33230 Tampere

Hereinafter referred to as “Yritysmeili” or, with respect to the processing of personal data, “processor.”

Customer

"Customer" refers to a company or other entity that orders a service from Yritysmeili and accepts this agreement as part of the order.

The customer is identified based on the company information, business ID, contact information, and other customer details provided at the time of the order.

Hereinafter referred to as “Customer” or, with respect to the processing of personal data, “data controller.”

The Company and the Customer are hereinafter collectively referred to as the “Parties.”

2. Purpose of the Agreement and Relationship to Other Terms and Conditions

This Agreement applies to all services ordered by the Customer from Yritysmeili to the extent that Yritysmeili processes personal data on behalf of the Customer or processes the Customer’s confidential information for the purpose of providing the service.

The agreement constitutes between the parties:

  1. a confidentiality agreement, or NDA; and
  2. A data processing agreement (DPA) pursuant to Article 28 of the EU General Data Protection Regulation (EU) 2016/679, hereinafter referred to as the “GDPR.”

This agreement supplements the Customer’s order, Yritysmeili’s General Terms and Conditions, and any customer-specific terms and conditions separately agreed upon by the parties.

In the event of any conflict between these documents, this agreement shall take precedence in matters concerning the processing of personal data, confidentiality, data security, and the retention and destruction of documents. In all other respects, Yritysmeili’s general terms and conditions and any customer-specific terms separately agreed upon by the parties shall apply.

3. The Parties’ Roles Regarding Data Protection

To the extent that Yritysmeili processes personal data on behalf of the Customer in order to provide the service ordered by the Customer:

  • The customer acts as the data controller; and
  • Yritysmeili acts as a processor of personal data.

The customer is responsible for ensuring that the processing of personal data complies with the law, for establishing the legal basis for processing, and for providing data protection information to data subjects.

Yritysmeili processes personal data solely in accordance with this agreement, the Customer’s order, and the documented instructions regarding the processing of personal data provided within the scope of the ordered service, unless otherwise required by applicable law. Instructions provided by the Customer do not alter the content of the ordered service or oblige Yritysmeili to provide a service not included in the service agreement without a separate agreement.

If Yritysmeili is required by law to process personal data in a manner that deviates from the Customer’s instructions, Yritysmeili will notify the Customer of this prior to processing, unless the law prohibits such notification.

Yritysmeili acts as an independent data controller with respect to the personal data it processes, for example, for the purposes of its own contract management, customer service, billing, accounting, or statutory obligations. This type of processing is described in Yritysmeili’s Privacy Policy.

4. Confidentiality

Business Mail handles all mail and documents received by the Customer, as well as the information they contain, in a confidential manner.

Mail and its contents are processed only to the extent necessary to provide the service.

The data will not be used for Yritysmeili’s own purposes, nor will it be disclosed to third parties without the Customer’s consent, unless such disclosure is required by law, ordered by a competent authority, or necessary for the provision of the service through a subprocessor in accordance with this Agreement.

Only Yritysmeili employees, as well as other individuals acting under Yritysmeili’s direct control and who are appropriately authorized and whose duties include the processing of such information, may access the customer’s mail, documents, and the personal data contained therein.

Yritysmeili ensures that individuals authorized to process personal data have agreed to maintain confidentiality or are subject to an appropriate statutory duty of confidentiality.

The duty of confidentiality shall continue even after the termination of the customer relationship and this agreement.

5. Scope of Personal Data Processing

Subject and Purpose of the Processing

The processing covers messages received by the Customer at their corporate email address, as well as the personal data contained therein.

The purpose of this processing is to receive mail addressed to the Customer, deliver its contents to the Customer as agreed, and dispose of, store, make available for pickup, or forward the original item in accordance with the agreed terms.

Nature of Processing and Processing Activities

Processing may include, among other things:

  • receiving and sorting mail;
  • opening the envelope;
  • reviewing the document to the extent required for digitization;
  • scanning a document;
  • temporary storage of an electronic file;
  • sending the file via email, WhatsApp, or another agreed-upon method;
  • verifying the technical success of the delivery;
  • resubmitting the file if necessary;
  • deletion of electronic files;
  • shredding of paper documents; and
  • temporary storage of a physical shipment, release for pickup, or onward shipment, if so agreed.

Duration of processing

Personal data is processed for the duration of the Customer's service agreement.

Personal data contained in an individual document will be processed only for as long as is necessary to provide the service, ensure delivery, correct any technical errors, or comply with the retention period specified in this agreement.

Types of Personal Data

The email may include, for example:

  • name and contact information;
  • address and identification information;
  • billing, payment, and account information;
  • contract and customer information;
  • accounting and tax information;
  • information regarding employees and employment relationships;
  • information related to dealing with government agencies; and
  • other personal data contained in mail delivered to the Customer.

The mail may also occasionally contain personal data falling within the special categories of personal data referred to in Article 9 of the GDPR, personal data related to criminal convictions or offenses, or other particularly sensitive information.

Business Email does not determine the content of emails sent to the Customer.

Groups of Registered Users

Personal information may include, for example:

  • Customer representatives;
  • The client's employees;
  • The client's customers;
  • journalists and partners;
  • creditors and debtors; and
  • other natural persons whose personal data is contained in mail addressed to the Customer.

6. The customer's documented instructions

This Agreement, the Customer’s order, the information provided in connection with the order, and any matters subsequently agreed upon by the parties via email or by other verifiable means constitute the Customer’s documented processing instructions.

The Customer authorizes Yritysmeili to perform the processing activities described in this agreement in order to provide the service.

Yritysmeili will immediately notify the Customer if it determines that an instruction provided by the Customer violates the GDPR or other applicable data protection laws. Yritysmeili may refrain from carrying out an instruction that is clearly unlawful.

7. Opening, Delivering, and Disposing of Mail

To the extent that the service ordered by the Customer includes receiving, opening, or scanning mail, the Customer authorizes Yritysmeili to perform such actions in order to provide the service.

The scanned document will be sent to the email address, WhatsApp number, or other agreed-upon delivery channel provided by the Customer at the time of the order or subsequently approved by the Customer.

Paper mail can be safely disposed of by shredding it after:

  • The document has been scanned;
  • the legibility of the scan has been verified;
  • the document has been sent to the Customer; and
  • The technical success of the broadcast has been reasonably ensured.

Once shredded, the original paper document cannot be returned to the customer.

Items that, due to their nature, cannot be scanned or safely disposed of in the usual manner will not be automatically disposed of. These may include, for example, bank and credit cards, keys, identification documents, physical objects, and other shipments where the original item may be of particular importance. In these situations, Yritysmeili will notify the Customer of the shipment and arrange for its pickup, storage, or forwarding in accordance with Yritysmeili’s General Terms and Conditions.

If the Customer wishes to have a specific paper document retained or forwarded, the Customer must notify Yritysmeili of this before the document is destroyed.

8. Retention of Electronic Documents

Corporate email does not serve as a long-term document archive for customers.

Scanned documents are retained by Yritysmeili only for as long as is necessary to provide the service, ensure delivery, and correct any technical errors.

Documents stored in the local storage of a scanner or other device used to provide the service will be deleted on a regular basis, but no later than sixty (60) days after the document has been processed.

Documents sent via email are deleted from the email account managed by Yritysmeil on a regular basis, but no later than sixty (60) days after they are sent.

By default, messages in WhatsApp conversations managed by Yritysmeili are automatically deleted after 90 days. At the customer’s request, a different deletion period supported by WhatsApp’s technical capabilities may be used.

Automatically deleting messages on WhatsApp may not delete copies stored on the Customer’s device, in the Customer’s backups, in forwarded messages, or in other systems controlled by the Customer.

The Customer is responsible for storing, backing up, legally archiving, and long-term retention of the documents provided to the Customer by Yritysmeili on its own systems.

9. Information Security

Yritysmeili implements appropriate technical and organizational measures commensurate with the risks associated with the processing of personal data to protect such data.

These measures are specifically intended to:

  • to prevent unauthorized access to physical mail and electronic documents;
  • limit access rights to those individuals necessary for the provision of the service;
  • to protect the devices, user accounts, and systems used to provide the service;
  • to prevent the unnecessary copying and retention of data;
  • to ensure that documents are properly removed and destroyed;
  • to maintain the confidentiality, integrity, and availability of personal data, taking into account the risks associated with its processing; and
  • to maintain appropriate information security for the systems used in the provision of the service.

Documents sent via email are protected during transmission using TLS encryption supported by the email service, provided that the receiving email service also supports TLS encryption.

When using an end-to-end encrypted messaging service, such as WhatsApp, the content of messages and shared documents is protected by the end-to-end encryption provided by that service.

The company will reassess its information security measures as necessary and may modify individual technical or organizational measures, provided that the change does not significantly compromise the level of protection of personal data.

10. Subcontractors and Distribution Channels

The Customer grants Yritysmeili general written permission to use subprocessors and technical service providers necessary for the provision of the service.

These may include, in particular, providers of email, messaging, telecommunications, and other technical services used in the delivery of the service.

Yritysmeili ensures that the subprocessor is contractually bound by the same obligations regarding the protection of personal data as those imposed on Yritysmeili under this agreement, including the obligation to implement appropriate technical and organizational security measures.

The Company is responsible to the Customer for ensuring that any subprocessor it uses complies with the data protection obligations set forth in this Agreement, in accordance with applicable data protection laws.

Yritysmeili maintains an up-to-date list of the subprocessors used in the provision of the service and makes this information available to the Customer.

The Company shall notify the Customer of the introduction of a new subprocessor or the replacement of an existing subprocessor before implementing the change, so that the Customer has the opportunity to object to the change on justified grounds related to data protection or data security.

If the parties are unable to reasonably resolve the Customer’s justified objection, the parties may agree on an alternative method of implementation or on terminating the service with respect to the processing in question.

11. Processing of Personal Data Outside the EU and the EEA

Yritysmeili processes the Customer’s email and the electronic documents generated from it as part of its own operations within the EU and the EEA.

However, the email and messaging services used to provide the service may process personal data outside the EU or the EEA. Any international transfers of personal data will be carried out in accordance with applicable data protection laws.

12. Rights of Data Subjects and Assistance to the Customer

If Yritysmeili receives a request from a data subject regarding personal data processed on behalf of the Customer, Yritysmeili will forward the request to the Customer without undue delay.

The company will not respond to a request on its own behalf on the Customer’s behalf unless the Customer has provided documented instructions to that effect or applicable law requires it.

Yritysmeili will assist the Customer to a reasonable extent, taking into account the nature of the matter and the information available to Yritysmeili:

  • in processing requests regarding the rights of data subjects;
  • in fulfilling obligations regarding the security of personal data;
  • in investigating data security breaches and fulfilling the related obligations;
  • in preparing data protection impact assessments; and
  • in fulfilling obligations related to a possible preliminary hearing or other dealings with regulatory authorities.

A reasonable fee, to be agreed upon separately, may be charged for assistance that is exceptionally extensive or falls outside the scope of Yritysmeili’s standard service, unless the need for such assistance arises from Yritysmeili’s actions that violate this agreement or applicable law.

13. Data Breaches Involving Personal Information

The Company shall notify the Customer without undue delay of any personal data breach that comes to its attention and that involves personal data processed on the Customer’s behalf.

Yritysmeili shall, without undue delay, provide the Customer with the information at its disposal that the Customer needs to assess the incident and fulfill any statutory reporting obligations.

The information may include, to the extent available, for example:

  • a description of the nature of the data breach;
  • the estimated groups and numbers of data subjects and personal data affected by the breach;
  • the likely consequences of the offense; and
  • Measures implemented or planned by the company to contain the breach and mitigate its harmful effects.

Yritysmeili will take reasonable measures to contain the breach, remedy it, and prevent further damage.

As the data controller, the customer is responsible for any necessary notifications to the supervisory authority and data subjects, unless otherwise agreed between the parties.

14. Disclosure of Information and Audits

The Company shall provide the Customer with reasonably available information necessary to demonstrate compliance with this Agreement and the obligations under Article 28 of the GDPR.

The Customer or an independent auditor authorized by the Customer has the right to audit the processing of personal data under this Agreement to the extent required by applicable data protection laws.

Yritysmeili must be notified of the audit in advance within a reasonable time, unless the urgency of the matter or applicable law requires otherwise.

The audit must be conducted to a reasonable extent and in such a way that it does not unnecessarily interfere with Yritysmeili’s operations or jeopardize the information security, trade secrets, or confidentiality of Yritysmeili’s other customers.

The customer is responsible for the costs associated with the audit, both for itself and for the auditor it has authorized. Yritysmeili has the right to charge a reasonable fee for work arising from the audit that exceeds the scope of normal service, unless the audit reveals any material conduct by Yritysmeili that violates this Agreement or applicable data protection laws. This provision regarding costs does not limit the Customer’s right to an audit under applicable data protection laws.

15. Data Processing Upon Termination of the Service and Access Rights to the Address

As long as the Customer has a valid right to use the Yritysmeil email address, messages sent to the Customer will be processed in accordance with the service the Customer has subscribed to, this Agreement, Yritysmeil’s General Terms and Conditions, and any separately agreed terms.

Upon termination of the customer relationship or the right to use an address, Yritysmeili will cease processing personal data on behalf of the Customer to the extent that such processing is no longer necessary for carrying out measures related to the termination of the service or is not required by applicable law.

By accepting this agreement, the Customer instructs Yritysmeili in writing to delete, upon termination of the service, the electronic documents processed on the Customer’s behalf that are under Yritysmeili’s control. Any remaining electronic documents will be deleted no later than sixty (60) days after the termination of the service.

Messages received before the service or access to the address expires will be processed in accordance with the service the Customer has subscribed to.

Once the Customer’s right to use a Business Email address has expired, any mail sent to that address after that time will not be processed as part of the Business Email service. Such mail may be handed over to the postal service for redelivery, return to the sender, or other processing in accordance with the postal service’s terms and conditions.

A company may retain personal data that it is required to retain based on its own legal obligations. Such personal data will thereafter be processed solely for the purpose of fulfilling that obligation.

16. Responsibilities of the Parties

The customer is responsible for ensuring that:

  • There is a legal basis for the processing of personal data for which the customer is responsible;
  • The documented instructions provided to corporate email accounts are in compliance with the law;
  • The recipients, contact information, and delivery channels provided by the customer are accurate and up to date;
  • The customer has the right to use the delivery channels of their choice to receive such information; and
  • Documents provided by Yritysmeili are stored and archived, as necessary, in the Customer’s own systems.

The company email is responsible for:

  • Customer correspondence and the information it contains are treated confidentially;
  • Personal data is processed in accordance with the Customer's documented instructions;
  • agreed-upon storage and disposal practices are followed; and
  • Personal data is protected through appropriate technical and organizational measures.

The parties’ liability for damages shall be determined in accordance with applicable law, Yritysmeili’s General Terms and Conditions, and any terms and conditions that the parties may have agreed upon separately.

No provision of this Agreement shall limit a party’s liability to the extent that such liability cannot be limited under applicable mandatory law.

17. Entry into Force and Term of the Agreement

The customer is given the opportunity to review this agreement before ordering the service.

This Agreement becomes effective for the Customer when the Customer places an order for the service on the Yritysmeili website and accepts this Agreement as part of the order. By ordering the service, the Customer confirms that they have read this Agreement and accepts it as part of the service agreement between the Customer and Yritysmeili. The agreement does not require a separate handwritten or electronic signature when it is accepted electronically as part of an order placed on the website.

The customer’s order, together with the version of this agreement in effect at the time of the order, constitutes documented evidence of acceptance of the agreement.

This Agreement remains in effect for as long as Yritysmeili processes personal data on behalf of the Customer.

The obligations regarding confidentiality, data protection, data deletion, and the responsibilities of the parties shall remain in effect even after the termination of the agreement, to the extent required by their nature or applicable law.

18. Amending the Agreement

The Company may update this agreement, particularly in the event of changes in legislation, regulatory guidelines, the technical implementation of the service, or information security policies.

The Company will notify the Customer of any material changes that affect the processing of the Customer’s personal data, or the Customer’s rights or obligations.

The changes must not substantially weaken the level of protection of personal data without a basis under applicable law.

19. Governing Law and Dispute Resolution

This agreement is governed by Finnish law.

Any disputes arising from this agreement shall, as a matter of priority, be resolved through negotiations between the parties.

If the dispute cannot be resolved through negotiation, the matter shall be resolved in the first instance by the Pirkanmaa District Court, unless otherwise provided by mandatory law.