Effective starting: 20 October 2026
This Data Processing Addendum (“DPA”) forms part of the Terms between Service Provider and Customer.
Definitions
In this DPA, the following definitions apply.
“Applicable Data Protection Law” means all laws applicable to the Processing of Personal Data under the Terms such as GDPR Regulation (EU) 2016/679.
“Customer” means the entity on behalf of which these Terms are accepted or, if that does not apply, the individual accepting these Terms.
“Customer Personal Data” means Personal Data processed by Service Provider on behalf of Customer in connection with the Services.
“Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing”, “Processor” and “Controller” have the meanings given to them under Applicable Data Protection Law.
“Service Provider” means the XMLdation Oy entity that provides the XMLdation Service.
“Subprocessor” means another processor engaged by Service Provider to process Customer Personal Data.
1. Role of the Parties
Customer is the Controller of Customer Personal Data and Service Provider is the Processor acting on behalf of Customer.
2. Details of the Processing
The subject matter and duration of the Processing, the nature and purpose of the Processing, the categories of Personal Data and the categories of Data Subjects are set out in Schedule 1.
3. Processing Instructions
Service Provider shall:
a. process Customer Personal Data only to provide, secure, support and administer the Services and in accordance with Customer’s documented instructions;
b. not process Customer Personal Data for its own independent purposes, including advertising, profiling or selling Personal Data;
c. immediately inform Customer if, in Service Provider’s reasonable opinion, an instruction infringes Applicable Data Protection Law; and
d. inform Customer before processing Customer Personal Data where Service Provider is required to do so by applicable law, unless the law prohibits such notification.
The Terms and Customer’s use and configuration of the Services constitute Customer’s documented instructions to Service Provider.
4. Confidentiality
Service Provider shall ensure that persons authorised to process Customer Personal Data:
a. are subject to appropriate confidentiality obligations;
b. receive appropriate data protection and security training; and
c. access Customer Personal Data only where necessary to perform their duties.
5. Security Measures
Service Provider has implemented and shall maintain appropriate technical and organizational measures designed to protect the security, confidentiality, integrity and availability of Customer Personal Data and protect against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Service Provider may update its security measures during the term of the Terms, provided that the overall level of protection is not materially reduced.
6. Personal Data Breaches
Service Provider shall notify Customer without undue delay, and, where feasible, no later than seventy-two (72) hours after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data.
The notification shall include, to the extent known:
a. the nature of the Personal Data Breach;
b. the categories of Personal Data and Data Subjects affected;
c. the likely consequences of the Personal Data Breach;
d. the measures taken or proposed to address it; and
e. a contact point for further information.
Service Provider shall take reasonable steps to contain, investigate and remediate the Personal Data Breach and shall reasonably assist Customer in meeting its notification obligations. Service Provider’s notification of a Personal Data Breach shall not be interpreted as an admission of fault or liability.
7. Data Subject Requests
Taking account of the nature of the Processing, Service Provider shall provide reasonable assistance to Customer in responding to requests from Data Subjects exercising their rights under Applicable Data Protection Law.
If Service Provider receives a request directly from a Data Subject relating to Customer Personal Data, Service Provider shall:
a. promptly notify Customer, unless prohibited by law; and
b. not respond to the request except on Customer’s documented instructions or where required by law.
8. Compliance Assistance
Upon Customer’s reasonable request, and taking into account the nature of the Processing, Service Provider shall provide reasonable assistance to Customer in fulfilling Customer’s obligations under Applicable Data Protection Law (including data protection impact assessments and consultations with regulatory authorities), provided that Customer cannot reasonably fulfil such obligations independently with help of available Documentation.
Service Provider may charge reasonable fees for assistance that requires material work beyond the ordinary provision of the Services, unless the assistance is required because Service Provider has breached this DPA.
9. Subprocessors
Customer provides Service Provider with general authorisation to engage Subprocessors.
Service Provider shall maintain a current list of Subprocessors used to process Customer Personal Data, enter into a written agreement with each Sub-processor imposing data protection terms that require the Sub-processor to protect Customer Personal Data to the standard required by Applicable Data Protection Law and to the same standard provided by this DPA, notify Customer of any intended addition or replacement of a Subprocessor, provide Customer with a reasonable opportunity to object on legitimate data-protection grounds.
Service Provider remains responsible for the performance of its Subprocessors’ data-protection obligations to the extent required by Applicable Data Protection Law.
If Customer reasonably objects to a new Subprocessor and the parties cannot resolve the objection, Service Provider may provide an alternative solution or Customer may terminate the affected Services.
10. International Transfers
During the term of the Terms, Service Provider shall not transfer Customer Personal Data to a different jurisdiction unless the transfer is made in accordance with Applicable Data Protection Law.
11. Return and Deletion
During the term of the Terms, Customer may access or export Customer Personal Data using the functionality made available through the Services, where applicable.
Following termination or expiry of the Terms, Service Provider shall delete Customer Personal Data, unless Service Provider is required by law to retain it.
Service Provider may retain Customer Personal Data in security audit logs for security investigation purposes, and in backup systems for a limited period in accordance with its normal backup-retention processes, provided that the data remains protected and is not used for any other purpose.
12. Information and Audits
Service Provider is regularly audited by independent third-party auditors and/or internal auditors, including as described in Service Provider Trust Centre. Upon request, and on the condition that Customer has entered into an applicable non-disclosure agreement with Service Provider, Service Provider shall supply a summary copy of relevant audit report(s) to Customer, so Customer can verify Service Provider’s compliance with the audit standards against which it has been assessed, and this DPA. If Customer cannot reasonably verify Service Provider’s compliance with the terms of this DPA, Service Provider shall provide written responses (on a confidential basis) to all reasonable requests for information made by Customer related to Service Provider’s Processing of Customer Personal Data, provided that such right may be exercised no more than once every twelve (12) months.
Where such information is not reasonably sufficient, Customer may conduct an audit subject to the following conditions: the audit must relate only to Service Provider’s Processing of Customer Personal Data; Customer must provide reasonable advance written notice; the audit must take place during normal business hours; the audit must not unreasonably disrupt Service Provider’s operations or compromise the security or confidentiality of other customers; the auditor must be independent and subject to confidentiality obligations; and Customer shall bear the reasonable costs of the audit unless it identifies a material breach of this DPA by Service Provider
Audits shall normally be limited to once per year, except following a confirmed Personal Data Breach or where required by a supervisory authority.
13. Liability
The liability of each party arising from this DPA is subject to the exclusions and limitations of liability in the Terms, except to the extent that such exclusions or limitations are prohibited by Applicable Data Protection Law.
14. Order of Precedence
If there is any conflict or inconsistency among the following documents, the order of precedence from highest to lowest shall be: (1) Schedule 1 (Description of Processing); (2) the main body of this DPA; and (3) the Terms.
15. Term
This DPA takes effect on the effective date of the Terms and remains in force for as long as Service Provider processes Customer Personal Data on behalf of Customer.
16. Governing Law
This DPA is governed by the governing law and jurisdiction specified in the Terms, unless Applicable Data Protection Law requires otherwise.
Schedule 1 Description of Processing
1. Subject Matter
Processing of limited Personal Data relating to Customer employees and other authorised Users for the purpose of providing, administering, securing and supporting the Services.
2. Duration
For the duration of the Terms and any limited period following termination during which Customer Personal Data is retained in accordance with the Terms, this DPA or applicable law.
3. Nature and purpose of the Processing
Service Provider shall process Customer Personal Data for the purposes of providing the Service and Support to Customer in accordance with the Terms, including this Addendum.
4. Categories of Personal Data
User name, business email address and IP address associated with a user’s access to the Services.
5. Data Subjects
Customer employees and other individuals authorized by Customer to access the Services.