Data processing agreement

What the agreement is

The data processing agreement covers the personal data you put into Weik.io Cloud, in your workspaces, SFTP servers, MQTT brokers, buckets and calls to AI models. It’s the agreement Article 28 of the GDPR requires between you, the controller of that data, and Adafy Oy, which processes it for you. The agreement is signed with the order: you accept it in the console when you create your account, and it lasts as long as the agreement on the service does.

The console keeps the version you accepted under Billing, with the date and the name of the person who accepted it. This page sets out what the agreement covers.

The parties

• Controller: you, the organisation that has the Weik.io Cloud account.
• Processor: Adafy Oy, business ID 2480016-8, Lutakonaukio 1, 40100 Jyväskylä, Finland.

Subject matter and duration

Adafy processes personal data only to provide the workspaces and services you order, and only on your documented instructions. The instructions are the agreement itself and what you configure in the console and in your workspaces. Processing lasts for the term of the service and the 30 days after it ends during which your data stays available for export.

Categories of data and people

You decide what personal data goes into the service. It typically includes the names, e-mail addresses and other contact details of your employees, customers and partners in the messages and files your integrations move, the user names and sign-in records of the people who use your workspaces, and the IP addresses in the logs of your gateways and SFTP servers. The service isn’t meant for special categories of personal data under Article 9 of the GDPR unless you’ve agreed otherwise with Adafy in writing.

Security measures

Adafy protects the data with the technical and organisational measures listed in the agreement. They include:

• TLS 1.2 or 1.3 for every connection to a workspace and a service
• Secrets sealed with AES-256-GCM in each workspace
• Separate workspaces for each customer, each with its own sign-in, roles and audit log
• Staff access only through your workspace’s own sign-in, with every action in its audit log
• Backups every 6 hours, kept in Helsinki
• Servers in an ISO/IEC 27001 certified data centre in Helsinki

The controls of the Weik.io software are described in more detail on the Weik.io security page.

Subprocessors

Adafy uses the subprocessors on the subprocessors page and binds each of them by an agreement with the same data protection duties. Adafy announces a new subprocessor to the account’s e-mail address at least 30 days before it starts processing your data, and you can object to it or end the agreement before then.

Confidentiality

Everyone at Adafy who can access your data is bound by confidentiality, and Adafy gives access only to the people who need it to run the service or answer your support case.

Assistance with requests

Adafy helps you answer the requests of the people whose data you process, such as a request to see, correct or delete their data, and helps you with data protection impact assessments and consultations with a supervisory authority as far as the service is concerned.

Personal data breaches

Adafy notifies you without undue delay, and within 48 hours of becoming aware of it, of a personal data breach that affects your data, with what is known of its nature, the data and people concerned, its likely consequences and the measures taken.

Audits

Adafy makes available the information you need to show that the agreement is kept, and allows audits by you or an auditor you appoint, with 30 days’ notice and at your cost.

Deletion at the end

When the agreement ends, your data stays available for export for 30 days. Adafy then deletes it from the workspaces and services and lets the backups that still contain it expire within a further 30 days, unless the law requires it to be kept.

Location and transfers

Your data is stored and processed in Finland. The one exception is the AI models service: the prompts and answers of its calls are processed by Google Cloud through Vertex AI, as the subprocessors page says, and only when you use that service.