Scope
This agreement applies where the customer ("controller") uses Koukku.ai's services in a manner that causes Koukku Kapital Oy to process personal data of the customer's customers or other third parties ("processor").
If you are a private individual using our services for personal purposes, this agreement does not apply to you — please read our Privacy Policy.
Definitions
Processor obligations
Koukku Kapital Oy commits to:
- Processing personal data only on the controller's documented written instructions
- Ensuring that persons authorised to process personal data have committed to confidentiality
- Implementing appropriate technical and organisational measures pursuant to GDPR art. 32
- Assisting the controller in fulfilling data subject rights
- Notifying the controller of any data breach without undue delay (within 72 hours)
- Deleting or returning all personal data upon termination of the agreement
Sub-processors
We use the following approved sub-processors. All have a DPA in force with Koukku Kapital Oy:
We will notify you in writing of any changes to sub-processors at least 14 days in advance.
Security measures
- HTTPS encryption for all data transmission (TLS 1.3)
- Bcrypt password hashing (cost factor 12)
- Encrypted database connections (Cloud SQL + TLS)
- Access to production systems restricted to authorised personnel only
- Regular security audits and vulnerability assessments
Data subject rights
We assist the controller in responding to requests from data subjects (access, rectification, erasure, portability). We undertake to provide the necessary information within 5 business days of receiving a request from the controller.
Termination
Upon termination of the service agreement, we will delete or return all personal data processed on the controller's behalf within 30 days, unless retention is required by law.