Data Processing Agreement
Versie 2026-11-01
Dit document is alleen in het Engels beschikbaar. De Engelse versie is van toepassing; vertalingen volgen.
This Data Processing Agreement ("DPA") is between the customer organisation using Nutcracker (the "Customer", controller) and Pähkinänsärkijä Oy, business ID 2800792-5 ("Processor"). It forms part of the Terms of Service and is accepted together with them, at sign-up or in Checkout. If they conflict on the processing of personal data, this DPA prevails.
1. Subject matter and duration
The Processor processes personal data on behalf of the Customer to provide the Service under the Terms. The DPA applies for as long as the Processor processes Customer personal data and ends when that data has been deleted or returned (section 10).
2. Nature, purpose and categories
| Nature and purpose | Hosting, storage, search, sharing within the organisation, AI-assisted drafting and analysis, document generation, notifications and support, as instructed through the Service |
|---|---|
| Data subjects | The Customer's members and employees, and people named in Customer Content (e.g. staff proposed for a bid, references and contact persons, partner contacts) |
| Categories of data | Names, contact details, job titles, CVs (education, work history, skills, certifications, languages), day rates where entered, references, documents in the vault, comments, tasks, bid texts, end-to-end encrypted messages |
| Special categories | Not intended. The Customer must not upload special categories of data (Art. 9) or data on criminal convictions unless strictly necessary and lawful |
3. Instructions
The Processor processes the personal data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's use and configuration of the Service, unless EU or Member State law requires otherwise; in that case the Processor informs the Customer first unless the law forbids it. The Processor tells the Customer if it believes an instruction infringes data protection law.
The Customer is responsible for the lawfulness of the data it uploads and for informing the data subjects.
4. Confidentiality
Persons authorised to process the personal data are bound by confidentiality and have access only as far as needed for their tasks.
5. Security measures
The Processor implements appropriate technical and organisational measures (Art. 32), in summary:
- Hosting in the EU (Google Cloud europe-north1, Finland); backups in the EU.
- Encryption in transit (TLS) and at rest; documents in private storage, available only through short-lived signed links.
- Access control: organisation roles (owner, admin, member) enforced on the server and by database security rules; staff access limited to what is needed and logged.
- End-to-end encryption of messages between members; the Processor cannot read them.
- Secrets in a managed secret store, least-privilege service accounts, rate limiting and attack protection.
- Daily database backups with point-in-time recovery, monitoring and alerting, logging of administrative operations.
6. AI processing
When the Customer uses AI features, relevant Customer Content is sent to Google's Gemini models through Vertex AI on the EU endpoint. Under Google Cloud's terms the data is not used to train the models and is not retained beyond what is needed to process the request.
7. Subprocessors
The Customer gives a general authorisation to use subprocessors. The current list is at Subprocessors. The Processor imposes data protection obligations on each subprocessor that are no less protective than this DPA and remains responsible for them.
The Processor gives at least 30 days' notice of a new or replaced subprocessor by updating the list and e-mailing organisation owners. The Customer may object on reasonable data protection grounds within that period; if no solution is found, the Customer may terminate the affected subscription and receive a refund of prepaid fees for the remaining period.
8. International transfers
Transfers of personal data outside the EU/EEA take place only under Chapter V GDPR, in particular on the basis of an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses, which are incorporated by reference where needed.
9. Assistance and breaches
Taking into account the nature of the processing, the Processor assists the Customer with data subject requests (the Service lets members download and delete their data and admins manage content), with security, and with data protection impact assessments and prior consultations.
The Processor notifies the Customer of a personal data breach affecting Customer data without undue delay, with the aim of doing so within 48 hours of becoming aware of it, and provides the information the Customer needs for its own notifications.
10. Deletion and return
During the subscription the Customer can export its content (data export, bid exports, document downloads). When the organisation is deleted, or within 30 days after the end of the Service, the Processor deletes the Customer personal data from its live systems, unless the law requires it to be kept. Backups are overwritten in their normal cycle, within a further 35 days.
11. Audits
The Processor makes available the information needed to demonstrate compliance with Art. 28 and allows audits by the Customer or an auditor it mandates, at the Customer's cost, with at least 30 days' notice, during business hours and subject to confidentiality. Certifications and reports of the subprocessors (for example Google Cloud's ISO 27001 and SOC reports) may be used to meet this obligation where they cover the request.
12. Liability and law
Liability under this DPA follows the Terms of Service, within the limits allowed by Art. 82 GDPR. This DPA is governed by the laws of Finland. Contact for data protection matters: support@pahkinansarkija.fi.