Suunta.ai Data Processing Agreement (DPA)

Parties

Controller (the Customer): the entity that has accepted the Suunta.ai Terms of Service and uses the Services. If the Customer processes personal data in the Services on behalf of its own clients, the Customer acts as processor with respect to that data and Suunta.ai as the Customer's sub-processor, and this Agreement applies accordingly.

Processor (Suunta.ai): Y4 Works Oy, business ID 2978296-6, Kanavaranta 9, 00160 Helsinki, Finland, privacy@suunta.ai.

Definitions

This Agreement uses the definitions of the Terms of Service. In addition, "personal data", "processing", "data subject", "controller" and "processor" have the meanings given in the GDPR, and:

"Sub-processor" means a third party engaged by Suunta.ai to process personal data contained in Customer Data.

"GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation).

"Standard Contractual Clauses" means the standard contractual clauses approved by the European Commission for the transfer of personal data outside the EU/EEA.

"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data contained in Customer Data.

Scope and Purpose

2.1 Scope. The Services are intended for processing an organisation's business information, such as strategies, goals and decisions. Customer Data may nevertheless contain personal data, such as individuals' names, roles and responsibilities. This Agreement applies to the processing of such personal data by Suunta.ai on behalf of the Customer in connection with the Services.

2.2 Roles. With respect to personal data contained in Customer Data, the Customer is the controller and Suunta.ai is the processor. Suunta.ai is an independent controller of the personal data it processes for its own purposes, such as managing user accounts and sign-in, invoicing, managing the customer relationship, information security, product analytics and service-related communications. This Agreement does not apply to such processing, which is described in Suunta.ai's Privacy Notice.

2.3 Subject Matter and Purpose of Processing. Suunta.ai processes personal data contained in Customer Data to provide the Services in accordance with the Terms of Service, in particular for:

• storing and processing data submitted to the Services by the Customer and its Users
• providing strategic planning, monitoring and decision-making functionality
• generating AI-assisted analyses, suggestions and other Output
• providing support requested by the Customer and carrying out the Customer's instructions
• securing and backing up data.

2.4 Duration of Processing. Processing continues for the term of the agreement under the Terms of Service and thereafter until the data has been returned or deleted in accordance with Section 4.6.

Data Subjects and Categories of Personal Data

3.1 Categories of Data Subjects. Customer Data may contain personal data relating to the following groups:

• the Customer's Users, such as employees, elected officials, contractors and consultants
• other persons whose data the Customer or Users submit to the Services, for example representatives of the Customer's clients, partners and stakeholders.

3.2 Categories of Personal Data. The personal data processed depends on what the Customer and Users submit to the Services. It typically includes:

Suunta.ai processes data relating to user accounts, sign-in, invoicing, security logs and product analytics as a controller in accordance with Section 2.2.

3.3 Special Categories of Personal Data. The Customer may not submit to the Services special categories of personal data referred to in Article 9 of the GDPR or personal data relating to criminal convictions and offences referred to in Article 10 of the GDPR without Suunta.ai's prior written consent. If such data nevertheless enters the Services, Suunta.ai processes it in accordance with this Agreement and assists the Customer in deleting it.

Processor Obligations

4.1 Instructions. Suunta.ai processes personal data contained in Customer Data only on the Customer's documented instructions. This Agreement, the Terms of Service and use of the Services in accordance with their functionality constitute the Customer's instructions. If Union or Member State law requires Suunta.ai to process the data otherwise, Suunta.ai will inform the Customer before processing, unless the law prohibits such information. Suunta.ai will inform the Customer if, in its opinion, an instruction infringes the GDPR.

4.2 Confidentiality. Suunta.ai ensures that persons authorised to process the data are bound by confidentiality obligations.

4.3 Security Measures. Suunta.ai implements technical and organisational security measures appropriate to the risk in accordance with Article 32 of the GDPR, described at a general level in Annex B. Suunta.ai may change the security measures as technology and threats evolve, provided that the overall level of protection is not materially reduced.

4.4 Sub-processing. Suunta.ai may engage sub-processors in accordance with Section 6.

4.5 Assistance. Taking into account the nature of the processing, Suunta.ai assists the Customer to a reasonable extent in responding to data subject requests, in fulfilling its obligations under Articles 32 to 36 of the GDPR and in demonstrating compliance. Suunta.ai may charge a reasonable fee, notified in advance, for assistance that materially exceeds the ordinary.

4.6 Return and Deletion. Upon termination of the agreement: (a) the Customer may request an export of its data in accordance with Section 15.5 of the Terms of Service, and the export is delivered in a commonly used machine-readable format; and (b) Suunta.ai deletes or anonymises personal data contained in Customer Data within a reasonable time, unless the law requires its retention. Data is removed from backups in their ordinary rotation.

AI-Related Processing

5.1 AI Processing. When AI features are used, prompts and related context based on Customer Data are transmitted to a Third-Party AI Provider to generate a response. Inputs may be screened automatically for misuse, in which case they are transmitted to a screening service. The providers' material retention practices are set out in the subprocessor list. Suunta.ai stores content of the AI features, such as conversation history, to the extent required for the Services to function.

5.2 Derived Data. The Services may generate data derived from Customer Data, such as summaries, insights, decision records and organisational memory, which are used in the operation of the Services. Conversations held in a workspace may be summarised into the workspace's shared memory, which the AI features of the workspace's members use. Derived data is Customer Data and is subject to this Agreement, including return and deletion under Section 4.6. Content private to an individual User, such as private conversations, personal memory and personal goals, is excluded from the organisation's self-service export. This exclusion does not limit the Customer's right to have personal data contained in Customer Data returned or deleted, nor Suunta.ai's obligation to assist with data subject requests; such requests are handled case by case in accordance with Sections 4.6 and 7. As controller, the Customer is responsible for having a basis for the sharing of information within its organisation in the Services, such as the workspace's shared memory.

5.3 No Training on Customer Data. Suunta.ai does not use Customer Data to train general-purpose AI models without the Customer's consent, and selects Third-Party AI Providers and their settings in accordance with this principle.

5.4 Document Processing. A search index is created from documents uploaded to the Services. When the Customer deletes a document from the Services, the document is no longer used in the Services and the index created from it is deleted. For seven days after deletion, the document can be restored at the Customer's request. The original file is permanently deleted within 30 days of deletion at the latest. Records made in the Services on the basis of the document, such as decisions and approved changes, remain Customer Data. Data is removed from backups as part of their normal rotation.

Sub-processors

6.1 General Authorisation. The Customer grants Suunta.ai a general authorisation to engage sub-processors. The sub-processors in use from time to time are listed in the list referred to in Annex A.

6.2 Sub-processor Obligations. Suunta.ai selects sub-processors with care and enters into written agreements with them whose data protection obligations protect personal data contained in Customer Data at least to the level of this Agreement. Suunta.ai remains liable to the Customer for its sub-processors as for its own actions.

6.3 Notice of Changes. Suunta.ai maintains an up-to-date sub-processor list at https://work.suunta.ai/legal/subprocessors and notifies the Customer of any new sub-processor by email or in the Services at least 14 days before it is engaged. The notice period may be shorter if a sub-processor must be replaced urgently for reasons of security or continuity of the Services.

6.4 Objection. The Customer may object to a new sub-processor on reasonable data protection grounds within the notice period, in which case the parties will seek a resolution. If no resolution is found within 30 days, the Customer may terminate the affected Services without penalty and receive a refund for the prepaid, unused period. This is the Customer's sole remedy in respect of an objection to a sub-processor.

Data Subject Rights

7.1 Assistance. Suunta.ai assists the Customer in responding to data subject requests in accordance with Section 4.5.

7.2 Data Subject Requests. If Suunta.ai receives a request from a data subject concerning personal data contained in Customer Data, it will forward the request to the Customer without undue delay and will not respond to it itself, unless authorised by the Customer or required by law. Suunta.ai handles requests concerning user accounts and other data it processes as a controller itself, in accordance with its Privacy Notice.

7.3 Self-Service Features. The Services may include features that allow Users and the Customer's administrators to handle requests themselves, for example to view, correct, export and delete data, and to request the export or deletion of the organisation's data.

Personal Data Breaches

8.1 Notification. Suunta.ai will notify the Customer of a Personal Data Breach without undue delay after becoming aware of it. The notification will include the information referred to in Article 33(3) of the GDPR to the extent available at the time, and will be supplemented as the investigation progresses.

8.2 Cooperation. Suunta.ai will take reasonable measures to mitigate the effects of the breach and will assist the Customer to a reasonable extent in investigating the breach and in notifications to the supervisory authority and data subjects.

8.3 Records. Suunta.ai keeps records of Personal Data Breaches and the measures taken in response to them.

8.4 No Admission of Liability. Notification of, or cooperation in connection with, a Personal Data Breach does not constitute an acknowledgement by Suunta.ai of fault or liability for the breach.

International Transfers

9.1 Processing Locations. Data is processed primarily within the EU/EEA. Some processing, in particular AI processing, may take place outside the EU/EEA. The processing locations are listed in the sub-processor list.

9.2 Transfer Mechanisms. Transfers outside the EU/EEA are based on an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework, or on the Standard Contractual Clauses, together with supplementary measures where necessary. If a transfer mechanism in use ceases to be valid, Suunta.ai will rely on another transfer mechanism compliant with the GDPR.

9.3 Transfer Assessment. Before a transfer, Suunta.ai assesses the nature of the data transferred, the available safeguards, the legislation of the destination country and the contractual safeguards agreed with the sub-processor.

Audit Rights

10.1 Information. Upon the Customer's written request, no more than once a year, Suunta.ai will provide within a reasonable time the information necessary to demonstrate compliance with this Agreement, such as a description of the security measures and information on Personal Data Breaches affecting Customer Data. The once-a-year limit does not apply where information is needed to investigate a Personal Data Breach affecting Customer Data or a reasonably suspected breach of this Agreement, nor to the Customer's statutory right to information.

10.2 Audits. If the information under Section 10.1 is not sufficient, the Customer may conduct or commission an audit no more than once a year. The Customer must give 30 days' written notice of the audit, which is carried out during business hours, without compromising the Services or other customers' data, at the Customer's expense and subject to confidentiality undertakings. The auditor may not be a competitor of Suunta.ai. The audit is limited to compliance with this Agreement. The once-a-year limit and the notice period do not apply to an audit that is necessary because of a serious Personal Data Breach affecting Customer Data or a reasonably suspected breach of this Agreement; such an audit is agreed without delay. The limitations in this section do not apply to statutory audits by a supervisory authority.

10.3 Certifications. Upon request, Suunta.ai will provide information on any information security certifications and assessments it holds.

Data Retention

11.1 Retention Periods. Customer Data is retained for the term of the agreement until the Customer or a User deletes it in the Services or it is deleted in accordance with Section 4.6. Section 5.4 applies to deleted documents. Data is removed from backups as part of their normal rotation within a limited period. If data is restored from a backup, Suunta.ai deletes again from the restored data anything that had been deleted before the restore, before the Services are reopened for use. The retention of data that Suunta.ai processes as a controller is described in the Privacy Notice.

11.2 Deletion of an Organisation. Deletion of an organisation is initiated at the request of the Customer's administrator or after the agreement has ended in accordance with Section 4.6. Deletion requested by an administrator may be preceded by a transition period during which the request can be cancelled. The organisation's data is then deleted, and a log entry of the deletion is retained. User accounts are retained, but their access to the organisation ends.

Liability

The parties' liability under this Agreement is determined in accordance with the limitations of liability in the Terms of Service. This does not limit the rights of data subjects under the GDPR.

Term

This Agreement remains in force for as long as Suunta.ai processes personal data contained in Customer Data, including after the agreement under the Terms of Service has ended.

Governing Law and Dispute Resolution

This Agreement is governed by the laws of Finland. Disputes are resolved in accordance with the dispute resolution provisions of the Terms of Service.

Contact Details

Y4 Works Oy (Suunta.ai), Kanavaranta 9, 00160 Helsinki, Finland, privacy@suunta.ai.

Sub-processors

An up-to-date list of sub-processors, their tasks and processing locations is available at https://work.suunta.ai/legal/subprocessors.

Technical and Organisational Security Measures

1. Location: data is stored primarily in the EU/EEA. Exceptions are listed in the subprocessor list.
2. Access control: role-based permissions, separation of organisations' data, personal credentials, session timeouts and sign-in protection.
3. Encryption: data is encrypted at rest and in transit, and passwords are stored securely.
4. Backups and recovery: regular automated backups and a documented restore procedure. On restore, previously deleted data is deleted again before the service is taken back into use.
5. Logging and monitoring: user actions, AI usage and security events are logged and monitored.
6. Incidents: there is a procedure for handling incidents, and Personal Data Breaches are notified in accordance with Section 8.
7. Personnel: confidentiality obligations, security guidelines and only the access required for the task.
8. Suppliers: subprocessors are selected carefully and are bound by written data protection obligations.
9. Testing and evaluation: the effectiveness of the security measures is tested and evaluated regularly.