Suomeksi · Terms of service · Data processing agreement · Privacy notice
Version of 13 November 2026. The Finnish text prevails.
This agreement under article 28 of the General Data Protection Regulation ("GDPR") covers the personal data of a household group ("the group") in the Payroll app's online service ("the service"). It is part of the terms of service ("the terms"). Each household accepts it in the app, which is the written form, in electronic form, that article 28(9) requires. Where this agreement and the terms differ on personal data, this agreement applies.
Annex 1 lists the personal data and the data subjects.
The processor processes the personal data only on the controllers' documented instructions, including for any transfer outside the European Economic Area (section 7). The instructions are this agreement with its annexes, the terms, and what the group's administrators and members do in the app within its functions (for example entering hours, confirming a month, inviting a person or deleting the group). An instruction outside the app's functions is given in writing by an administrator to info@puikula.tours. The processor tells the group's administrators at once if it thinks an instruction infringes the GDPR or other data protection law, and may hold that instruction until it is confirmed or changed. If Union or Finnish law requires the processor to process the data in another way, it tells the controllers of that requirement before processing, unless the law forbids it.
The processor does not use the group's personal data for any other purpose: not for marketing, not for profiling, not to train or improve any artificial intelligence model, and not to sell. Counts and timings that carry no personal data (for example how long a request took or how many groups exist) are the processor's own. For accounts and sign-in, and for the diagnostics that keep the service secure and working, the processor is a controller in its own right (network and information security, recital 49 of the GDPR); its privacy notice describes them, and Annex 1 says where the line runs.
The controllers are responsible for the processing they instruct: that they have a legal basis for the payroll data and for the sick days (Annex 1); that the data they enter is correct and needed; that the employee and the members are told how their data is processed (terms, section 6; the app shows the employee a short notice when they join); that only people who should have access have it; and that the employer's records are kept (section 11). The controllers may change or add instructions within the service's functions, and may ask for the group's data to be returned or deleted at any time (section 11).
Only the processor's people who need access to run, secure or repair the service have it. Each has given a written commitment to confidentiality, and each processes the data only on the processor's instructions under this agreement (article 29 of the GDPR). Development and testing of the service use made-up data only. The processor's development tools, including any AI coding assistant, are never given access to a group's data.
The processor takes the measures required by article 32 of the GDPR as described in Annex 2, and keeps them up to date. It may add to them or replace them with measures that give at least the same protection, and does not lower the level of protection without the notice of section 12. It tests the measures regularly: automated tests run on every change to the service, and the processor reviews Annex 2 at least once a year and after every personal data breach. It helps the controllers meet their own duty under article 32 by giving them Annex 2 and answering their questions (section 10).
The controllers give general written authorisation for the sub-processors in Annex 3, for the processing and in the places it states. The processor tells the group's administrators at least 30 days before adding or replacing a sub-processor, in the app and by email, with the new sub-processor's name, what it does and where. A controller may object during those 30 days on reasonable grounds related to data protection; the processor then tries to resolve the objection with it. If it cannot be resolved, the controllers may download the group's records and delete the group before the change takes effect. The processor binds each sub-processor by a written contract to the same data protection obligations as this agreement for the processing it does, in particular the security of article 32, and checks that it keeps them. The processor remains fully liable to the controllers for its sub-processors. The data protection terms of each sub-processor are available on request (public terms, or a copy with business secrets removed).
The group's data is stored and processed in Microsoft Azure in Sweden, and the service's email is sent through Azure Communication Services with its data location set to Europe. The processor does not transfer the group's data outside the European Economic Area except as this section and Annex 3 describe, and the controllers instruct those transfers by accepting this agreement:
Any other transfer needs the controllers' prior instruction and a transfer tool under chapter V of the GDPR. If a transfer tool the processor relies on stops being valid, the processor tells the controllers and agrees with them how to continue.
Sign in with Apple and Microsoft account sign-in are not transfers by the processor. Each person signs in with their own account with Apple or Microsoft, which process that sign-in as controllers in their own right under their own privacy policies. The service receives the sign-in token (a user identifier, an email address, and from Microsoft a name) and sends them nothing of the group's data.
The app lets the controllers answer most requests themselves: each member sees their own data, the employee sees their pay and payslips, administrators correct entries and remove people, anyone can delete their own account, and an administrator can download the group's records. For anything the app cannot do, the processor helps within 14 days of a request from an administrator, free of charge. A request that reaches the processor directly from a data subject about the group's data is passed to the group's administrators within 5 working days, and the processor does not answer it itself except to say that it was passed on. A request about an account itself the processor answers as a controller, under its privacy notice.
The processor makes available the information needed to show that it meets article 28 and this agreement: the agreement itself, Annexes 2 and 3 kept current, its record of processing under article 30(2) of the GDPR, and a written answer to a controller's questions within 30 days. The controllers, or an independent auditor bound by confidentiality whom they mandate, may audit the processing, including an inspection, once in 12 months with 30 days' written notice, and at any time after a breach that affected the group or when the supervisory authority asks. The audit covers the processor's own systems and records; for the hosting and the other sub-processors it relies on their published audit reports and certifications. Each party bears its own costs. The processor may answer the audits of several groups with one audit report for the same period. The results are available to the supervisory authority on request.
When the group is deleted, by an administrator, for lack of use, or at the end of the agreement or of the service (terms, section 11), the processor deletes the group's data from the service at once (the employee's identity code is deleted and purged from Azure Key Vault at the same time) and from backups within 30 days, and confirms the deletion to the group's last administrators on request. Before the group is deleted, the app offers the download of its records (the payslips still in the archive, the months and the hours, as PDF and JSON); this is how the data is returned to the controllers. One exception, which the controllers instruct by accepting this agreement (terms, section 9): each paid payslip stays in the service's archive for six months from its payday, also after the group is deleted, so that a former administrator can still ask for the last six months' payslips; it is then deleted.
After that, the processor keeps nothing of the group except what Union or Finnish law requires the processor itself to keep, for that time only; it tells the controllers what and for how long if they ask. The processor's own data as a controller (accounts, diagnostics) follows its privacy notice.
The employer's duty to keep records stays with the controllers. The processor does not keep the payroll records for the employer's statutory retention periods; the emailed payslips and the download are how the households keep them (terms, section 10).
Towards the people whose data is processed, each party is liable under article 82 of the GDPR, and nothing in this agreement or the terms limits that. Between the parties: the processor is liable for damage caused by processing only where it has not met the obligations of the GDPR that address processors, or has acted outside or against the controllers' lawful instructions (article 82(2)); a party that has paid full compensation to a data subject may claim back from the other the part that corresponds to the other's responsibility (article 82(5)); and an administrative fine is borne by the party whose conduct caused it. Within those rules, the liability limits of the terms (section 12) apply between the parties. Finnish law applies, and disputes are settled as the terms say (section 14).
Notices to the controllers go to the group's administrators in the app and by email (terms, section 15); notices to the processor go to info@puikula.tours.
The processor may change this agreement to follow changes in the law or in official guidance, in the service or in its sub-processors, with the notice and the acceptance the terms give for changes (section 13), each household accepting as in section 1; a change required by law or by the supervisory authority may take effect sooner. Annexes 2 and 3 are updated as sections 5 and 6 say. This agreement is published in Finnish and English; if the two differ, the Finnish text prevails (terms, section 15).
---
Data subjects: the group's employee; the members of each household who use the app (administrators and household members); and the people named in the group's data.
| Data | About | How long it is kept |
|---|---|---|
| The group: its name, the households (names, cost shares, administrators), the payday, the holiday model chosen (holiday year January to December or April to March; a six-day week with 30 days or a five-day week with 25 days), who created it and when | Households | Until the group is deleted |
| Members: account, household and role; invite codes (stored as a one-way hash, valid 14 days, one use); devices for notifications (at most five per account) | Members | Until removed, used, expired, or the group is deleted |
| Each household's acceptance of the terms and of this agreement, and the administrators' confirmations (age, power of attorney) | Members | Until the group is deleted |
| The employee and the contract: name, start date, monthly salary or hourly wage, standard hours, the tax card as entered (base rate, additional rate, income limit) | Employee | Until the group is deleted |
| The employee's personal identity code, entered by the employee or an administrator; kept apart from the other data in Azure Key Vault, and printed in full on each payslip as the law requires, so it is also in the payslip copies emailed to the employee and to each household and stays in their mailboxes | Employee | In Key Vault until the group is deleted; then deleted and purged |
| Hours, extra hours, sick days (dates only, never a reason or a diagnosis), vacations | Employee | Until the group is deleted |
| Each month: salary, withholding, pension and unemployment insurance contributions, health insurance contribution, net pay, each household's share, whether paid | Employee, households | Until the group is deleted |
| Payslips (PDF), emailed to the employee with a copy to each household; each paid payslip is kept in the archive exactly as sent, the identity code included | Employee | Six months from the payday, also after the group is deleted |
| Who changed what: the account and the time of each change | Members | Until the group is deleted |
| Email addresses for payslips and notices: each household's chosen address and each member's sign-in address; payslips go only to a real address, never to an Apple relay address | Members | Until changed, or the group is deleted; the households' payslip copy addresses are kept after that with the payslip archive, only to send archived payslips a former administrator asks for, and deleted with the last of them (section 11) |
Health data: sick-day dates are data concerning health under article 9 of the GDPR. Only the dates are kept, never a reason or a certificate. By default the app shows them only to the group's administrators and the employee; other household members see the paid hours and pay, not which days were sick days. An administrator may choose, for the group, to show the dates to every member, so that co-employers can know of and agree on sick leave between them; that choice is the controllers' instruction (section 3) and designates the members who handle the dates. The controllers' basis is article 9(2)(b) of the GDPR with Finnish law: the employer's duties under employment law (pay during sick leave), the Act on the Protection of Privacy in Working Life (759/2004), section 5, which also limits who may handle health data, and the Data Protection Act (1050/2018), section 6, with its safeguards. The processor's safeguards are in Annex 2.
The identity code: the controllers keep the employee's personal identity code because an employer must keep it with the pay records, for the reports to the Incomes Register, the pension insurance and the withholding records. The basis is article 6(1)(c) of the GDPR with the Data Protection Act (1050/2018), section 29, which allows an identity code to be processed where the law provides for it or the controller's statutory duties require it, and not to be put on documents without need. The payslip carries it because the law requires it there (the controllers' instruction, section 3). The processor's safeguards are in Annex 2.
Not processed for the group: the identity codes of the households, bank account transactions, a tax card fetched from the Tax Administration, and reports to the Incomes Register. If any of these is offered later, Annexes 1 and 3 are updated first, with the notice of section 6.
The processor's own data as a controller, not processed for the group: accounts and sign-in (who signs in, and the limits that stop misuse), and the diagnostics that keep the service secure and working: errors the app or the service met (screen, message, app version, with email addresses, account numbers and identity codes masked), kept 30 days, and how long requests took, kept 100 days. The processor's privacy notice describes them.
| Sub-processor | What it does | Data | Where |
|---|---|---|---|
| Microsoft Ireland Operations Ltd (Microsoft Azure) | Hosts the service, its storage, key vault and logs; sends the service's email through Azure Communication Services | All of Annex 1 | Sweden; email data location Europe; support and operation also from outside the EEA under Microsoft's data protection terms (section 7) |
| Apple Inc. (Apple Push Notification service) | Delivers the service's push notifications to members' devices | Device token and a short notice without amounts or names | Apple's services, which may include the United States (section 7) |
Services that are not sub-processors: Sign in with Apple and Microsoft account sign-in, which Apple and Microsoft run as controllers in their own right (section 7). If a member signs in with Apple and hides their email address, notices to that relay address pass through Apple's relay on its way to them; payslips are never sent to a relay address, and the app asks for a real address for them. Messages typed in the app's chat are understood on the phone itself and are not sent to the service; dictation may be recognised by Apple under the phone's own settings.
The service does not use Microsoft OneDrive, a bank connection or the Tax Administration's interfaces for the group.
Version of 13 November 2026.