Go to content

DPA

Data Processing Agreement (DPA)

This English version is a translation of the Finnish original. In the event of any discrepancy between the language versions, the Finnish version prevails.

Contents

1 Parties and definitions

This Data Processing Agreement (hereinafter the Agreement or the DPA) forms an integral part of the Johku Ecosystem Agreement (hereinafter the Ecosystem Agreement or the Main Agreement) concerning the Johku Service (hereinafter the Johku Service or the Service) of Aptual Commerce Oy (business ID 2735384-2, hereinafter the Supplier), concluded between the Supplier and the customer acquiring the Johku Service (hereinafter the Customer). The Customer and the Supplier together are the parties to this agreement (hereinafter the Parties).

Controller (hereinafter the Controller) means the entity that determines the purposes and means of the processing of personal data. Processor of personal data (hereinafter the Processor) means the entity that processes personal data on behalf of the Controller. Sub-processor means a contractual partner of the Processor that may process personal data as separately agreed and to the extent necessary for providing the Service. When the Johku Service is used under a valid Main Agreement, the Supplier acts as Processor on behalf of the Customer. The Customer acts as the Controller of the customer register containing the personal data of Users.

A User of the Johku Service is a natural or legal person who acts as the other party to a legal transaction made by the Customer using the Service (hereinafter the User).

Personal data means information relating to a person by which the person can be identified directly or indirectly. In this DPA, personal data means in particular information relating to a person that is sent to the Supplier, to which the Supplier has access, or which the Supplier otherwise processes on behalf of the Customer in the Johku Service. When a User uses the Johku Service, their personal data may be stored in the Customer's customer register. A User whose personal data is stored in the Controller's register is the Data Subject referred to in this Agreement.

During the processing and after it has ended, the Supplier stores Anonymised data on the use of the Service and on the commercial transaction process. Anonymisation of data means modifying User data in such a way that persons can no longer be identified from it by any means.

2 Background and purpose

This Agreement is an annex to the Main Agreement concluded between the Supplier and the Customer, under which the Parties have agreed that the Supplier provides the Service to the Customer in accordance with the Main Agreement. The term and content of the cooperation between the Parties, and the responsibilities and obligations of the Parties, are defined in the Main Agreement.

This DPA concerns the processing of personal data carried out by the Processor on behalf of the Controller and defines how the Processor, for its part, ensures the privacy of the Controller and its Data Subjects through technical and organisational measures. The Parties do not intend this DPA to transfer any of the Controller's statutory obligations to the Processor. The purpose of the processing of personal data carried out by the Processor on behalf of the Controller is compliance with the Main Agreement and this DPA.

Neither this DPA nor its Main Agreement transfers, in any respect, responsibilities or obligations belonging to the Controller to the Supplier acting as the Processor of personal data.

3 Term

This DPA enters into force when the Main Agreement enters into force and remains in force for the term of the Main Agreement or for as long as is necessary to complete the processing of personal data under the Agreement.

The Supplier acts as Processor on behalf of the Customer acting as Controller only when and to the extent that a valid Ecosystem Agreement is in force between the Supplier and the Customer.

This agreement replaces any previous agreements between the Supplier and the Customer on the processing of personal data concerning or relating to the Johku Service.

4 Obligations of the Controller

When a User orders products or services from a shop using the Johku Service, the personal data entered by the User through the Service during the purchase process may be stored in the Customer's customer register. The Customer acts as the Controller of its customer register.

By committing to this DPA, the Controller confirms that it processes personal data in accordance with applicable data protection regulation when using the services provided by the Processor under the Agreement. The Controller confirms that it has made all mandatory notifications to authorities relating to the processing of personal data, has fulfilled the obligations and requirements relating to obtaining consents, and has fulfilled its obligation to provide Data Subjects with relevant information on the processing of their personal data in accordance with applicable data protection regulation.

If the Controller collects more extensive tracking data during the User's purchase process and/or uses its own customer register in third-party systems by deploying third-party services and/or applications connected to the Johku Service, or by transferring data as raw data outside the Johku Service, the Controller is fully responsible for processing personal data in its operations in accordance with legislation and the regulations of the authorities. The Controller confirms that it has fulfilled its obligation to provide Data Subjects with relevant information on the processing of their personal data in accordance with applicable mandatory data protection regulation.

The Controller must have an appropriate and up-to-date privacy policy on the processing of Users' personal data and the related principles. The Controller's obligations include, for example but not limited to, compliance with the rules on the collection, use, disclosure and retention of personal data. The Controller confirms that the technical and organisational security measures within its responsibility that are required for the Data Subject's privacy protection and the adequate protection of personal data are sufficient.

5 Obligations of the Processor

The Supplier processes personal data on behalf of the Controller only to the extent covered by the Main Agreement and the DPA and in the manner defined in them, acting as the Processor of the personal data in the Controller's customer register. The Processor processes personal data in compliance with the provisions of applicable legislation.

The Processor maintains a valid record of processing activities. The record is an internal document of the Processor's organisation that supports the Processor in demonstrating the lawfulness of its processing activities.

The Processor gives authorities access to the personal data processed under this DPA when the authority's right to obtain the data is based on legislation, a court decision or another comparable order.

Unless otherwise separately agreed in writing between the Processor and the Controller, the Processor does not in any way manage, and is not in any way responsible for, how the Controller uses the API provided by the Processor or a similar third-party software integration with the service provided by the Processor.

6 Sub-processors

The Processor may use Sub-processors to provide services to the Controller under the Main Agreement and this DPA. Such Sub-processors may be located within or outside the EU.

Sub-processors may take part in the processing of personal data. The Processor is responsible for ensuring that Sub-processors undertake to comply with obligations corresponding to the data protection obligations under this Agreement. Sub-processors process personal data relating to the provision of the service under the Main Agreement and this DPA only on the basis of a valid agreement between the Processor and the Sub-processor.

Annex A to this Agreement lists the Processor's Sub-processors that may process personal data. The Processor has the right to replace, reduce or add Sub-processors during the term of the Agreement. The Processor updates Annex A to the Agreement within a reasonable time of a change in Sub-processors and keeps an up-to-date Annex available to the Controller.

If a change materially affects the legal position of the Controller, or the Controller has another justified reason to object to the change, the Controller must notify its objection without undue delay after receiving information about the matter from the Processor. If no mutual understanding is reached on a change concerning a Sub-processor, the Controller has the right to terminate the Main Agreement on the terms agreed therein.

By accepting this DPA, the Controller accepts the Processor's use of Sub-processors as described.

7 Transfers of personal data

For the purpose of providing the service, the Processor has the right to transfer personal data within the EU, the European Economic Area (EEA) or other countries that the European Commission has found to ensure an adequate level of data protection. To provide the Service, the Processor also has the right to transfer personal data outside the EU and the EEA in accordance with data protection legislation. If personal data is processed outside the EU or the EEA, each party, for its part, ensures compliance with data protection legislation with regard to the processing of personal data.

8 Confidentiality

Each Party undertakes to keep confidential the other Party's trade secrets and other confidential information that it has obtained, as well as the data processed in the Service. They may not be used for any purpose other than the performance of the Agreement. The confidentiality obligation continues after the Agreement has ended. The Parties ensure that their personnel and subcontractors also undertake to maintain confidentiality.

9 Personal data processed

On behalf of the Controller, the Processor collects only data that is relevant for establishing, analysing and developing a successful commercial transaction process and for managing the customer and contractual relationship. The following data on Users is collected and processed:

  • first and last name
  • email address
  • source page of the order
  • IP address
  • opt-in acceptance of the terms
  • opt-in consent to electronic marketing

Where the products or services ordered so require, the data processed may additionally include:

  • street address, postal code, city
  • country
  • telephone number

For corporate and organisational customers, the following is also collected:

  • company name
  • business ID
  • e-invoicing address
  • e-invoicing operator ID, reference and marking

In addition, other data relating to the ordering process is collected and processed.

The above data is collected and processed for the following purposes:

  • handling commercial transactions in accordance with laws and regulations
  • enabling the fulfilment of responsibilities and obligations between the merchant and the customer, and communication between them
  • management of electronic marketing permissions
  • prevention and investigation of misuse
  • other similar purposes

As part of the Service, the Customer can use customisable forms through which it can require the Supplier to collect more extensive data on the User and their order in addition to the data listed above. As a rule, the Supplier does not collect or process personal data classified as sensitive, such as data concerning health, beliefs or other similar data. If the Customer requires the Supplier to process sensitive personal data on the Customer's behalf as part of the Service under the Main Agreement, the Customer must notify the Supplier of this and agree on it with the Supplier separately in writing.

The legal basis for processing the data of all users is the contract formed when products and/or services are ordered from the merchant. To the extent that the data is used for electronic marketing not related to the contract, the legal basis for processing is consent.

Personal data concerning Data Subjects is collected from the Data Subjects themselves by electronic means when they transact by means of Johku.

10 Data retention period

The Supplier acts as Processor of the Customer's customer register only if the Supplier and the Customer have a valid Ecosystem Agreement. While the Ecosystem Agreement is in force, personal data stored in the Service is retained for the period based on the contract, consent or legal justification between the Controller and the Data Subject, or for the period required to fulfil an obligation imposed by legislation or another regulation. The Controller must ensure that the retention period of personal data is defined in accordance with the principle of data minimisation, which includes keeping the retention period as short as possible. The Controller must plan, justify and document the retention period of personal data. The lawfulness of agreed or otherwise defined retention periods is the responsibility of the Customer acting as Controller.

The termination of the Ecosystem Agreement between the Supplier and the Customer results in the termination of this Agreement. The Supplier deletes the stored personal data at the time the agreement ends, unless otherwise required for special reasons, such as by law or by order of an authority. The Customer is responsible for having, before this, the necessary and appropriate backups and other records of all the data that it considers necessary for fulfilling its own obligations. The termination of the Main Agreement and the deletion of the Customer's Material are agreed in the Main Agreement.

11 Security, protection and risks

The Processor ensures appropriate security by means of organisational, technical and physical security measures in line with established industry practice, corresponding to the security measures required under the General Data Protection Regulation. On request and where necessary, the Processor provides the Controller with sufficient information on the server environment, confidentiality and other relevant matters relating to the implementation of information security.

Each Party is responsible for the appropriate and sufficient information security of the necessary equipment and IT environment within its own responsibility.

12 Personal data breaches

The Supplier notifies the Customer without delay of any personal data breach that comes to its knowledge, so that the Customer can fulfil the notification obligations set out in the General Data Protection Regulation within the prescribed time limit. Within the reasonable limits of the resources available to it, the Supplier endeavours to assist the Customer in fulfilling the information obligations imposed on the Customer. Where it is not reasonably possible to provide all information at the same time, the initial notification will include the information available. Further information will be provided afterwards without undue delay as soon as it becomes available.

The Supplier takes the necessary follow-up measures to minimise the adverse effects of the data breach and to prevent possible future breaches.

If the Supplier assists the Customer in a data breach under the General Data Protection Regulation that was caused by the Customer or otherwise falls within the Customer's responsibility, in fulfilling data subject rights in a manner that departs from ordinary handling, or in another comparable measure, the Supplier has the right to invoice the working hours spent on this at its standard hourly rate. The Supplier provides an estimate of the time required and the invoicing in advance for the Customer's approval.

13 Data protection impact assessment

An impact assessment must be carried out when planning processing of personal data that is likely to result in a high risk to the rights and freedoms of individuals. The impact assessment helps the Controller comply with the requirements of data protection legislation and document and demonstrate that compliance.

The impact assessment must be updated when the operating environment, legislation or the risks arising from processing activities change. In addition, the Supplier recommends that the Customer regularly assesses the need for an update, for example every two years.

Where necessary, the Supplier assists the Customer in carrying out the impact assessment. The Supplier has the right to invoice the working hours spent on this at its standard hourly rate. The Supplier provides an estimate of the time required and the invoicing in advance for the Customer's approval.

14 Fulfilment of data subject rights

As a rule, the Supplier does not respond directly to requests from Data Subjects.

When the Controller processes personal data, it must implement appropriate measures to give effect to the data protection rights of Data Subjects. It must also facilitate the exercise of the Data Subject's rights.

In the Service, the Customer has a customer register management tool with which the Customer can fulfil its obligation to respond to requests concerning the exercise of data subject rights under the General Data Protection Regulation. Such rights may include, among others and as defined in the General Data Protection Regulation, the data subject's right of access to data, the right to have data rectified, the right to object to processing, the right to erasure (the so-called "right to be forgotten"), the right to restriction of processing and the right to data portability.

The Supplier forwards to the Customer without delay any data requests it receives from Users. As a rule, the Supplier does not respond to data requests.

15 Audits

The Controller may, at its own expense, audit the Processor's compliance with this DPA or with data protection legislation on the processing of personal data no more than once a year. The Controller may request that an audit be carried out more often if the legislation applicable to the Controller so requires.

Where necessary, the Processor makes available to the Controller the information necessary to demonstrate compliance with the obligations laid down in this Agreement and in data protection legislation. The Processor allows audits carried out by the Controller or by an auditor authorised by the Controller of those parts of the Johku Service purchase process that concern the Controller.

When requesting an audit, the Controller must present the Processor with an audit plan setting out the planned scope, duration and start date of the audit at least 30 days before the planned start of the audit. If the audit is carried out by a third party, the auditor must sign a confidentiality agreement. If the data is processed in an environment used by other customers of the Processor or by other third parties, the Processor may, for justified security reasons, require that the audit be carried out by an objective third party selected or approved by the Processor.

The audit is carried out within the Supplier's normal working hours and must not unreasonably disrupt the Supplier's business. The Customer bears the costs of audits initiated by the Customer.

16 Liability for damages

The Parties are liable for damage caused to the other party to this Agreement by the processing of personal data.

The Supplier is liable for damage caused by the processing of personal data only if it has not complied with the mandatory statutory obligations specifically directed at processors of personal data. The Supplier is not liable to the Customer for indirect damage caused by breaches of contract or for claims made by third parties. The Supplier's liability for damages for breaches of contract is limited, as an aggregate maximum, to the amount defined in the Johku Ecosystem Agreement.

If a Data Subject suffers damage as a result of a breach of the provisions of mandatory data protection legislation on personal data, the Supplier is in no event liable for damage caused by the Customer or otherwise falling within the Customer's sphere of responsibility.

17 Amendments to the Agreement

The Supplier may amend the terms of this Agreement on the same terms and conditions as defined in the Main Agreement under which it may amend the terms of the Main Agreement.

Annex A Sub-processors

The following is a list of the subcontractors used by Johku in processing data:

Sub-processors involved in processing customer registers

UpCloud Oy

Purpose: technical server platform, cloud service
Physical location of servers: Finland (EU)
Transfer of data outside the EU or EEA: no transfer
Privacy policy: Privacy Policy
DPA: UpCloud DPA
Registers concerned: merchants' customer registers, Johku's merchant register, Johku customer register
Updated: 29 June 2026

Active Campaign, LLC (AC PM LLC, Postmarkapp)

Purpose: email delivery
Physical location of servers: Chicago, USA
Transfer of data outside the EU or EEA: yes
Personal data transferred: name, address, email, telephone number, any data requested on the merchant's forms
Privacy policy: Privacy Policy
EU-U.S. Data Privacy Framework (DPF): active
Standard contractual clauses approved by the Commission: Postmark DPA
Registers concerned: merchants' customer registers
Updated: 29 June 2026

LINK Mobility Poland Sp. z o.o. (SMSAPI)

Purpose: text message services within Johku, when enabled by the merchant
Physical location of servers: Poland (EU)
Transfer of data outside the EU or EEA: possible
Personal data transferred: telephone number
Privacy policy: Privacy Policy
Standard contractual clauses approved by the Commission: SMSAPI General Terms and DPA
Registers concerned: merchants' customer registers
Updated: 29 June 2026

Signicat AS

Purpose: strong electronic identification services
Physical location of servers: EU
Transfer of data outside the EU or EEA: no
Personal data transferred: name, date of birth, identifier
Privacy policy: Privacy Policy
Standard contractual clauses approved by the Commission: Signicat DPA
Registers concerned: merchants' customer registers
Updated: 29 June 2026

buuqit.com Ltd. (Channex)

Purpose: synchronisation of availability, prices and orders between OTA channels and Johku
Physical location of servers: multiple locations, EU and USA
Transfer of data outside the EU or EEA: yes
Personal data transferred: name, email, telephone number, address, country, booked accommodation units
Privacy policy: Privacy Policy
Standard contractual clauses approved by the Commission: Channex DPA
Registers concerned: merchants' customer registers
Updated: 25 June 2026

Seam Labs Inc.

Purpose: management of smart devices, smart locks and access rights
Physical location of servers: USA
Transfer of data outside the EU or EEA: yes
Personal data transferred: PIN code
Privacy policy: Privacy Policy
EU-U.S. Data Privacy Framework (DPF): active
Standard contractual clauses approved by the Commission: Seam Trust Center
Registers concerned: merchants' customer registers
Updated: 29 June 2026

Google Inc.

Purpose: use of fonts, reCAPTCHA, Google Workspace
Physical location of servers: Google has data centres around the world, Data Center Locations
Transfer of data outside the EU or EEA: possible
Personal data transferred: name, email, telephone number
Privacy policy: Privacy Policy
EU-U.S. Data Privacy Framework (DPF): active
Standard contractual clauses approved by the Commission: Google Cloud DPA
Registers concerned: merchants' customer registers, Johku's customer register
Updated: 29 June 2026

Anthropic (Claude)

Purpose: development and analysis of the Johku system, development of merchants' operations management, Johku's customer relationship management and marketing
Physical location of servers: USA
Transfer of data outside the EU or EEA: yes
Personal data transferred: name, email, telephone number
Privacy policy: Privacy Policy
Standard contractual clauses approved by the Commission: Anthropic DPA
Registers concerned: Johku's customer register, merchant registers (only if the merchant's assignment requires processing of order data)
Updated: 2 October 2026

MPZMail Limited (Transpond)

Purpose: Johku's customer relationship management and marketing
Physical location of servers: USA (AWS, Digital Ocean)
Transfer of data outside the EU or EEA: yes
Personal data transferred: name, email, telephone number
Privacy policy: Privacy Policy
Standard contractual clauses approved by the Commission: Transpond DPA
Registers concerned: Johku's customer register
Updated: 29 June 2026

Zestia Limited (Capsule CRM)

Purpose: Johku's customer relationship management
Physical location of servers: USA (AWS, Digital Ocean)
Transfer of data outside the EU or EEA: yes
Personal data transferred: name, email, telephone number
Privacy policy: Privacy Policy
Standard contractual clauses approved by the Commission: Capsule DPA
Registers concerned: Johku's customer register
Updated: 25 June 2026

Zapier, Inc.

Purpose: Johku's customer relationship management
Physical location of servers: USA
Transfer of data outside the EU or EEA: yes
Personal data transferred: name, email, telephone number
Privacy policy: Privacy Policy
EU-U.S. Data Privacy Framework (DPF): active
Standard contractual clauses approved by the Commission: Zapier DPA
Registers concerned: Johku's customer register
Updated: 29 June 2026