Financial and operational software for renovation and construction firms.

This Privacy Policy explains how Nexioris ("Nexioris", "we", "us", "our") collects, uses, stores and shares personal data when you use our software-as-a-service platform at nexioris.com and any associated subdomains (the "Service").

We take privacy seriously. If anything here is unclear, please contact us at matias@nexioris.com and we will help.

---

1. Who we are

Nexioris is operated by Nexioris Oy, a limited liability company incorporated in Finland with business identity code (Y-tunnus) 3635865-3, with its registered office in Helsinki.

For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), we are the data controller for personal data of:

• People who visit our website
• People who sign up for an account
• People who contact us directly

We act as a data processor for personal data that our customers (renovation and construction firms) upload into the Service about their own clients, employees, subcontractors and suppliers. The customer firm is the controller of that data; we process it on their behalf under our Data Processing Agreement.

Our lead supervisory authority is the Finnish Office of the Data Protection Ombudsman (Tietosuojavaltuutettu), accessible at tietosuoja.fi.

---

2. What personal data we collect

2.1 Data you give us when signing up

• Your name and email address
• Your password (stored hashed, never in plain text)
• Your firm's name, address and trading details
• Optional: phone number, role within the firm
• Optional: profile photo

2.2 Data you give us when paying

• Billing address and contact name
• VAT number, where applicable
• Payment processing integration is coming soon. Currently invoiced manually.
• We retain transaction records (amount, date, invoice number) for accounting and tax purposes.

2.3 Data you create or upload while using the Service

This includes, but is not limited to:

• Information about your jobs, clients, suppliers, subcontractors and employees
• Estimates, invoices, purchase orders, supplier invoices, labour entries
• Photos, videos and documents uploaded to job records
• Schedule and assignment data
• Notes, comments and activity logs

Where this data describes other people (your clients, employees, suppliers, etc.), you are the controller and remain responsible for ensuring you have a lawful basis under the GDPR to upload it to us. We process it strictly on your instructions.

2.4 Data we collect automatically

• Technical data: IP address, browser type and version, operating system, device type, time zone, the pages you visit, the actions you take in the Service.
• Cookies and similar technologies: see Section 9 below.
• Error and performance data: when something breaks, we record the error and the steps that led to it, so we can fix it.

2.5 Data we do not collect

• We do not collect special categories of personal data under Article 9 GDPR (health, ethnicity, religion, sexual orientation, political opinions, biometric or genetic data, trade union membership) unless you choose to upload such information as part of a job record. We strongly recommend you do not.
• We do not collect data about you from third-party data brokers.
• We do not track you across other websites.
• We do not currently use analytics on nexioris.com. If we add analytics in future, we will update this policy and ask for your consent first.

---

3. How we use your data, and our lawful basis

We use personal data only for the purposes listed below. Each purpose has a lawful basis under Article 6 GDPR.

| Purpose | Lawful basis |

|---|---|

| Providing the Service to you (account creation, hosting your data, running the features) | Art. 6(1)(b) — performance of our contract with you |

| Sending essential service emails (password resets, billing receipts, security notices, service announcements) | Art. 6(1)(b) — contract / Art. 6(1)(f) — legitimate interest |

| Sending product update and marketing emails | Art. 6(1)(a) — consent. You can withdraw at any time via the unsubscribe link in every marketing email |

| Improving the Service (bug fixing, performance) | Art. 6(1)(f) — legitimate interest in running and improving our product |

| Customer support | Art. 6(1)(b) — contract / Art. 6(1)(f) — legitimate interest |

| Fraud prevention and security | Art. 6(1)(f) — legitimate interest in protecting our service and users |

| Accounting and tax record-keeping | Art. 6(1)(c) — legal obligation |

| Responding to legal requests | Art. 6(1)(c) — legal obligation |

We do not sell personal data to anyone, ever. We do not share personal data with advertising networks. We do not use personal data for automated decision-making that produces legal or similarly significant effects on you.

---

4. Who we share data with

We share personal data only with the following categories of recipient, and only as needed to run the Service:

4.1 Sub-processors

We use a small number of trusted service providers ("sub-processors") to operate the Service. Each is bound by a written data processing agreement that meets the requirements of Article 28 GDPR, and each processes data only on our instructions.

| Sub-processor | Purpose | Location |

|---|---|---|

| Railway | Hosting and database infrastructure | United States (transfer governed by Standard Contractual Clauses — see Section 5) |

| Google Workspace | Business email | EU and United States (transfer governed by Standard Contractual Clauses) |

| Netlify | Marketing website hosting | United States (transfer governed by Standard Contractual Clauses) |

Payment processing integration is coming soon. We will update this policy when a payment provider is added.

We may add further sub-processors as the Service evolves — for example, transactional email providers, document text-extraction services, or error monitoring tools. We will update this policy and notify customers at least 30 days in advance of any new sub-processor being added, with the right to object. A current and complete list of sub-processors is available on request.

4.2 Professional advisors

Our accountants, auditors and lawyers, where strictly necessary and bound by confidentiality.

4.3 Legal authorities

Where required to comply with a valid legal request (court order, regulatory request, etc.). We will narrow the scope of what we share to the minimum required and will notify you wherever lawfully possible.

4.4 In the event of a sale

If Nexioris is acquired by or merged with another company, personal data may be transferred as part of that transaction. We would notify you in advance and you would retain your GDPR rights, including the right to object to the transfer of your account.

---

5. International data transfers

Some of our sub-processors are based outside the European Economic Area (EEA), primarily in the United States. Where personal data is transferred outside the EEA, the transfer is protected by:

• An adequacy decision from the European Commission under Article 45 GDPR, where one applies, or
• Standard Contractual Clauses (SCCs) adopted by the European Commission under Article 46 GDPR, with appropriate supplementary measures where required.

We do not transfer personal data to countries without an adequate level of protection unless one of the above safeguards is in place. You can request a copy of the relevant safeguards by contacting us at matias@nexioris.com.

---

6. How long we keep data

We keep personal data only for as long as needed for the purpose we collected it.

| Data | Retention period |

|---|---|

| Account data while your account is active | For the duration of your account |

| Account data after you close your account | 30 days, then deleted (you can request immediate deletion) |

| Customer-uploaded business data (jobs, estimates, invoices, etc.) | For the duration of your account, then 30 days, then deleted |

| Backups | 30 days, then automatically discarded |

| Billing and transaction records | As required by Finnish accounting law (currently 6 years) |

| Support correspondence | 3 years from last interaction |

| Marketing email subscribers | Until you unsubscribe |

| Server logs | 90 days |

You can request earlier deletion at any time (see Section 8, "Your rights"). Where we are legally required to retain something longer (typically billing records for tax purposes), we will tell you which records we have kept and why.

---

7. How we protect your data

We use technical and organisational measures appropriate to the risk under Article 32 GDPR, including:

• All data in transit encrypted with TLS 1.2 or higher
• All data at rest encrypted on disk
• Passwords stored using strong one-way hashing
• Strict access controls — only personnel who need access have it
• Two-factor authentication on internal admin accounts
• Regular security updates to our infrastructure
• Daily database backups, encrypted
• Activity logging so we can detect unusual access patterns
• Regular review of our security posture

No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours as required by Article 33 GDPR, and we will notify you without undue delay where Article 34 applies.

---

8. Your rights under the GDPR

You have the following rights regarding your personal data, free of charge in most cases:

• Right of access (Art. 15) — get a copy of the personal data we hold about you
• Right to rectification (Art. 16) — correct inaccurate or incomplete data
• Right to erasure (Art. 17) — have your data deleted ("right to be forgotten"), subject to legal retention obligations
• Right to restriction (Art. 18) — limit how we process your data in certain circumstances
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format and transfer it elsewhere
• Right to object (Art. 21) — object to processing based on legitimate interest, including profiling
• Right to withdraw consent (Art. 7) — for processing based on consent, you can withdraw at any time
• Right not to be subject to automated decision-making (Art. 22) — we do not make such decisions, but you retain this right
• Right to lodge a complaint — with the Finnish Office of the Data Protection Ombudsman (tietosuoja.fi) or with the supervisory authority of your habitual residence

To exercise any of these rights, email us at matias@nexioris.com. We will respond within one month, extendable by two further months for complex requests (we will tell you if this is the case).

For account holders, many of these rights can also be exercised directly within the Service:

• View and edit your profile data in Settings
• Export your data via Settings → Export
• Delete your account via Settings → Delete account

---

9. Cookies and tracking

We use a minimal set of cookies. We do not use third-party advertising cookies or cross-site tracking. We do not run analytics on our marketing website (nexioris.com).

9.1 Strictly necessary cookies

Required for the Service to function (e.g. keeping you logged in, remembering your preferences). These do not require consent under the ePrivacy Directive.

9.2 Other cookies

We do not currently use any other categories of cookies. If we add any (for example, for embedded video, chat support, or product analytics), we will update this policy and ask for your consent first via a cookie banner.

You can disable cookies through your browser settings, though doing so may break parts of the Service.

---

10. Children

The Service is intended for use by businesses and is not directed at people under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

---

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to the Service, our practices or applicable law. The "Last updated" date at the top of this policy indicates when it was last changed.

For material changes (those that meaningfully expand how we use your data), we will notify account holders by email at least 30 days before the change takes effect, and you will have the opportunity to close your account before the new terms apply.

---

12. Contact us

For any privacy question, request, or concern:

Email: matias@nexioris.com

We aim to respond to all privacy enquiries within 7 working days and to formal data subject requests within one month as required by the GDPR.

If you are not satisfied with our response, you have the right to lodge a complaint with the Finnish Office of the Data Protection Ombudsman (Tietosuojavaltuutettu) at tietosuoja.fi, or with the supervisory authority of your habitual residence in the EU.

Tämä tietosuojaseloste selittää, miten Nexioris ("Nexioris", "me", "meidän") kerää, käyttää, tallentaa ja jakaa henkilötietoja, kun käytät ohjelmistopalveluamme osoitteessa nexioris.com ja siihen liittyvillä aliverkkotunnuksilla ("Palvelu"). Suhtaudumme yksityisyyteen vakavasti. Jos jokin tässä on epäselvää, ota yhteyttä osoitteeseen matias@nexioris.com.

---

1. Keitä olemme

Nexioris Oy (Y-tunnus 3635865-3), suomalainen osakeyhtiö, kotipaikka Helsinki. EU:n yleisen tietosuoja-asetuksen (asetus (EU) 2016/679, "GDPR") tarkoittamana rekisterinpitäjänä toimimme seuraavien henkilötietojen osalta: verkkosivustomme vierailijat, tilin luoneet henkilöt sekä meihin suoraan yhteyttä ottaneet henkilöt. Toimimme tietojenkäsittelijänä asiakkaidemme (remontti- ja rakennusyritysten) Palveluun lataamien henkilötietojen osalta. Asiakasyritys on kyseisten tietojen rekisterinpitäjä ja me käsittelemme niitä heidän puolestaan tietojenkäsittelysopimuksemme mukaisesti. Johtava valvontaviranomainen on Suomen tietosuojavaltuutetun toimisto, joka on tavoitettavissa osoitteessa tietosuoja.fi.

---

2. Mitä henkilötietoja keräämme

2.1 Rekisteröitymisen yhteydessä antamasi tiedot

Nimesi ja sähköpostiosoitteesi, salasanasi (tallennettu hajautettuna, ei koskaan selkotekstinä), yrityksesi nimi, osoite ja kauppatiedot, valinnainen: puhelinnumero, rooli yrityksessä, valinnainen: profiilikuva.

2.2 Maksun yhteydessä antamasi tiedot

Laskutusosoite ja yhteyshenkilön nimi, ALV-numero tarvittaessa. Maksujen käsittely tapahtuu manuaalisesti toistaiseksi. Säilytämme tapahtumatiedot (summa, päivämäärä, laskunumero) kirjanpito- ja verotarkoituksia varten.

2.3 Palvelun käytön aikana luomasi tai lataamasi tiedot

Tämä sisältää muun muassa tiedot töistäsi, asiakkaistasi, toimittajistasi, alihankkijoistasi ja työntekijöistäsi, arviot, laskut, ostotilaukset, toimittajalaskut ja työtunnit, työmaille ladatut valokuvat, videot ja asiakirjat, aikataulu- ja tehtävätiedot sekä muistiinpanot, kommentit ja toimintalokit. Kun nämä tiedot koskevat muita henkilöitä, toimit rekisterinpitäjänä ja olet vastuussa siitä, että sinulla on lainmukainen käsittelyperuste.

2.4 Automaattisesti keräämämme tiedot

Tekniset tiedot: IP-osoite, selaimen tyyppi ja versio, käyttöjärjestelmä, laitetyyppi, aikavyöhyke, vierailemasi sivut ja Palvelussa tekemäsi toiminnot. Evästeet ja vastaavat teknologiat: katso kohta 9. Virhe- ja suoritustiedot: kun jokin menee pieleen, kirjaamme virheen ja siihen johtaneet vaiheet korjataksemme sen.

2.5 Tietoja, joita emme kerää

Emme kerää GDPR:n 9 artiklan mukaisia erityisiä henkilötietoja. Emme kerää tietoja kolmansilta osapuolilta. Emme seuraa sinua muilla verkkosivustoilla. Emme tällä hetkellä käytä analytiikkaa nexioris.com-sivustolla.

---

3. Miten käytämme tietojasi ja oikeudellinen perustamme

Käytämme henkilötietoja vain alla lueteltuihin tarkoituksiin. Kullakin tarkoituksella on GDPR:n 6 artiklan mukainen oikeudellinen peruste.

Palvelun tarjoaminen → Art. 6(1)(b) — sopimuksen täytäntöönpano

Välttämättömien palveluviestien lähettäminen → Art. 6(1)(b) — sopimus / Art. 6(1)(f) — oikeutettu etu

Tuotepäivitys- ja markkinointiviestien lähettäminen → Art. 6(1)(a) — suostumus

Palvelun parantaminen → Art. 6(1)(f) — oikeutettu etu

Asiakastuki → Art. 6(1)(b) — sopimus / Art. 6(1)(f) — oikeutettu etu

Petostentorjunta ja turvallisuus → Art. 6(1)(f) — oikeutettu etu

Kirjanpito ja veroasiakirjat → Art. 6(1)(c) — lakisääteinen velvollisuus

Oikeudellisiin pyyntöihin vastaaminen → Art. 6(1)(c) — lakisääteinen velvollisuus

Emme myy henkilötietoja kenellekään. Emme jaa henkilötietoja mainosverkostoille.

---

4. Kenen kanssa jaamme tietoja

4.1 Alikäsittelijät

Railway — Hosting ja tietokantainfrastruktuuri — Yhdysvallat (siirto vakiosopimuslausekkeiden nojalla)

Netlify — Markkinointisivuston hosting — Yhdysvallat (siirto vakiosopimuslausekkeiden nojalla)

Google Workspace — Yrityssähköposti — EU ja Yhdysvallat (siirto vakiosopimuslausekkeiden nojalla)

Saatamme lisätä alikäsittelijöitä palvelun kehittyessä. Ilmoitamme uusista alikäsittelijöistä vähintään 30 päivää etukäteen.

4.2 Ammattineuvojat

Kirjanpitäjämme, tilintarkastajamme ja lakimiehemme, siltä osin kuin se on ehdottomasti tarpeen ja he ovat salassapitovelvollisuuden alaisia.

4.3 Viranomaiset

Kun voimassa olevan oikeudellisen pyynnön noudattaminen sitä edellyttää.

4.4 Yrityskaupan yhteydessä

Jos Nexioris hankitaan tai se sulautuu toiseen yritykseen, henkilötietoja voidaan siirtää osana kyseistä transaktiota. Ilmoitamme sinulle etukäteen.

---

5. Kansainväliset tiedonsiirrot

Jotkin alikäsittelijämme sijaitsevat Euroopan talousalueen (ETA) ulkopuolella, pääasiassa Yhdysvalloissa. Tällaiset siirrot suojataan Euroopan komission vahvistamilla vakiosopimuslausekkeilla (SCC) GDPR:n 46 artiklan mukaisesti.

---

6. Kuinka kauan säilytämme tietoja

Tilitiedot tilin ollessa aktiivinen — Tilin voimassaoloajan

Tilitiedot tilin sulkemisen jälkeen — 30 päivää, sitten poistetaan

Asiakkaan lataamat liiketoimintatiedot — Tilin voimassaoloajan, sitten 30 päivää

Varmuuskopiot — 30 päivää

Laskutus- ja tapahtumatiedot — Suomen kirjanpitolain mukaisesti (tällä hetkellä 6 vuotta)

Tukiviestit — 3 vuotta viimeisestä vuorovaikutuksesta

Markkinointisähköpostin tilaajat — Peruutukseen asti

Palvelinlokit — 90 päivää

---

7. Miten suojaamme tietojasi

Käytämme GDPR:n 32 artiklan mukaisia teknisiä ja organisatorisia toimenpiteitä, mukaan lukien: kaikki siirrettävä tieto salattu TLS 1.2:lla tai uudemmalla, kaikki tallennettava tieto salattu levyllä, salasanat tallennettu vahvalla yksisuuntaisella hajautuksella, tiukat pääsynhallintakontrollit, kaksivaiheinen todennus sisäisissä järjestelmänvalvojan tileissä, säännölliset tietoturvapäivitykset, päivittäiset salatut tietokantavarmuuskopiot ja toimintalokit.

Jos tietoturvaloukkaus tapahtuu, ilmoitamme toimivaltaiselle valvontaviranomaiselle 72 tunnin kuluessa GDPR:n 33 artiklan mukaisesti.

---

8. Oikeutesi GDPR:n nojalla

Sinulla on seuraavat oikeudet henkilötietojesi osalta: oikeus saada pääsy tietoihin (15 art.), oikeus oikaista tiedot (16 art.), oikeus tietojen poistamiseen (17 art.), oikeus käsittelyn rajoittamiseen (18 art.), oikeus tietojen siirrettävyyteen (20 art.), oikeus vastustaa käsittelyä (21 art.), oikeus peruuttaa suostumus (7 art.), oikeus olla joutumatta automaattisen päätöksenteon kohteeksi (22 art.) sekä oikeus tehdä valitus Suomen tietosuojavaltuutetun toimistolle (tietosuoja.fi).

Voit käyttää näitä oikeuksia lähettämällä sähköpostia osoitteeseen matias@nexioris.com. Vastaamme kuukauden kuluessa.

---

9. Evästeet ja seuranta

Käytämme minimaalista määrää evästeitä. Emme käytä kolmannen osapuolen mainosevästeitä tai sivustojen välistä seurantaa.

9.1 Välttämättömät evästeet

Vaaditaan Palvelun toimintaan. Nämä eivät vaadi suostumusta sähköisen viestinnän tietosuojadirektiivin nojalla.

9.2 Muut evästeet

Emme tällä hetkellä käytä muita evästeluokkia. Jos lisäämme niitä, päivitämme tätä käytäntöä ja pyydämme suostumuksesi ensin.

---

10. Lapset

Palvelu on tarkoitettu yrityskäyttöön eikä se ole suunnattu alle 16-vuotiaille.

---

11. Muutokset tähän käytäntöön

Saatamme päivittää tätä tietosuojaselostetta ajoittain. Ilmoitamme olennaisista muutoksista sähköpostitse vähintään 30 päivää ennen muutosten voimaantuloa.

---

12. Ota yhteyttä

Tietosuojakysymyksissä: matias@nexioris.com. Pyrimme vastaamaan kaikkiin tietosuojakyselyihin 7 arkipäivän kuluessa.

These Terms of Service ("Terms") form a binding agreement between you ("you", "your", "Customer") and Nexioris Oy (Y-tunnus 3635865-3), a limited liability company incorporated in Finland ("Nexioris", "we", "us", "our"), the operator of the Nexioris software-as-a-service platform.

By signing up for an account, accessing or using the Service, you agree to these Terms. If you are agreeing on behalf of a company or organisation, you confirm that you have authority to bind that organisation to these Terms.

If you do not agree, do not use the Service.

---

1. Definitions

• "Service" means the Nexioris software-as-a-service platform available at nexioris.com and any associated subdomains, including all features, modules, APIs and documentation.
• "Account" means the account created when you sign up for the Service.
• "Customer Data" means all data, content and information that you or your Users upload to, generate within, or transmit through the Service.
• "User" means any individual authorised by you to access the Service through your Account, including employees, contractors and other team members.
• "Subscription" means the paid plan you have selected, as described on our pricing page.
• "Subscription Term" means the period for which you have paid (monthly or annual).
• "Fees" means the amounts payable for the Subscription as set out on our pricing page or in an order form.

---

2. The Service

2.1 What we provide

We grant you a non-exclusive, non-transferable, revocable right to access and use the Service during the Subscription Term, solely for your internal business purposes, subject to these Terms.

The Service is provided "as a service" — we host, maintain and update it. You do not receive a copy of the software and we retain all intellectual property rights in the Service.

2.2 Updates and changes

We may update, improve, modify or remove features of the Service from time to time. We will give you reasonable advance notice of material reductions in functionality. Routine improvements, bug fixes and security updates may be deployed without notice.

2.3 Beta features

We may make experimental or pre-release features available, labelled "beta," "preview" or similar. Beta features are provided as-is, may change or be discontinued at any time, and the warranties and service levels in these Terms do not apply to them.

---

3. Your account

3.1 Account creation

To use the Service you must create an Account. You must provide accurate, current and complete information, and keep it up to date.

3.2 Eligibility

You confirm that you are at least 18 years old, legally able to enter into binding contracts, and that the Service is not prohibited by the laws applicable to you.

3.3 Security of your Account

You are responsible for keeping your Account credentials confidential and for all activity that occurs under your Account. Notify us immediately at our customer relations email, matias@nexioris.com, if you suspect any unauthorised access.

3.4 Users

You may add Users to your Account up to the limit allowed by your Subscription. You are responsible for your Users' compliance with these Terms. Each User must use their own credentials — sharing logins is not permitted.

---

4. Fees, payment and renewal

4.1 Fees

Fees for the Service are based on a per-firm platform fee plus a per-user fee. The standard rates are:

• Platform fee: 149€ per firm per month, including one Editor seat
• Additional Editor seat: 99€ per user per month (full access including creating, editing and approving)
• Viewer seat: 29€ per user per month (read-only access)

Fees are in euros and are exclusive of VAT, the reverse charge mechanism applies when applicable. Current Fees and any updates are also published on our website (Nexioris.com).

We may offer annual prepayment or custom pricing to specific customers under a separate order form. Where an order form is in place, its pricing terms prevail over the rates above for that Account.

4.2 Payment

• Subscriptions are billed monthly in advance, on the anniversary of your sign-up date.
• The total monthly Fee is calculated based on the number of editor and viewer seats configured on your Account at the start of each billing period, plus the platform fee.
• Annual prepayment may be available under a separate order form.
• Payment is currently processed manually by invoice. Payment processing integration is coming soon.

4.3 Trial and Early Partner access

We do not offer a standard self-serve trial. However, select customers may be admitted to the Early Partner Programme, which provides access for a limited period in exchange for honest feedback about the Service.

4.4 Automatic renewal

Subscriptions renew automatically each month at the then-current Fees, unless you cancel before the renewal date. You can cancel at any time from within your Account settings.

4.4a Adding and removing seats

You can add editor or viewer seats at any time from within your Account settings. Added seats are pro-rated for the remainder of the current billing period and charged on your next invoice. Removed seats remain available until the end of the current billing period; you will not be refunded for the unused remainder.

4.5 Price changes

We may change our Fees. For existing Subscriptions:

• Price increases take effect at the start of the next Subscription Term following at least 30 days' notice by email.
• If you do not agree to a price increase, you may cancel before it takes effect.

4.6 Refunds

Fees are non-refundable except where required by applicable consumer law or where we have materially breached these Terms and failed to remedy the breach after notice. We will not issue refunds for unused time on a Subscription, downgrades, or feature changes.

4.7 Late payment

If a payment fails or is overdue:

• We may suspend access to the Service after 7 days' notice.
• We may close the Account after 30 days of continued non-payment.
• Interest may accrue on overdue amounts.

4.8 Taxes

You are responsible for all taxes other than our income taxes. Where we are required to charge VAT, it will appear separately on invoices.

---

5. Your data and how we use it

5.1 Ownership

You retain all rights, title and interest in your Customer Data. We do not claim ownership of it.

5.2 Licence to us

You grant us a worldwide, non-exclusive, royalty-free licence to host, copy, transmit, display, process and back up Customer Data solely as needed to:

• Provide the Service to you
• Prevent or address technical or security issues
• Comply with legal obligations
• Improve the Service in aggregated and de-identified form

This licence ends when you delete the relevant data or close your Account, subject to our retention periods set out in our Privacy Policy.

5.3 Your responsibilities for Customer Data

You confirm that:

• You have all necessary rights and lawful basis to upload and process the Customer Data through the Service
• The Customer Data does not infringe any third party's rights
• You have obtained any consents required for personal data about third parties (e.g. your clients, employees, suppliers)
• Customer Data complies with all applicable laws

5.4 Data processing

Where you upload personal data about other individuals through the Service, you act as the controller and we act as the processor under the GDPR. Our processing is governed by our Data Processing Agreement, available at Nexioris.com/dpa, which forms part of these Terms.

5.5 Privacy

Our handling of personal data is described in our Privacy Policy at Nexioris.com/privacy, which forms part of these Terms.

5.6 Data export and deletion

At any time during your Subscription you can export your Customer Data through the Service. On termination of your Account:

• You will have 30 days to export your data.
• After 30 days, we will delete Customer Data from active systems within a reasonable period.
• Backups containing Customer Data are retained for up to 30 days after deletion.
• Some data may be retained longer where required by law (e.g. billing records for accounting purposes).

---

6. Acceptable use

You agree not to, and not to allow your Users or anyone else to:

• Use the Service for any unlawful, fraudulent, deceptive or harmful purpose
• Upload or transmit content that is unlawful, infringing, defamatory, obscene or hateful
• Use the Service to send spam or unsolicited communications
• Attempt to gain unauthorised access to the Service, other accounts, or our systems
• Probe, scan, reverse-engineer, decompile, disassemble or otherwise attempt to derive source code from the Service
• Use the Service to build a competing product or service
• Resell, sublicense, rent, lease, or otherwise commercially exploit access to the Service to third parties (except providing access to your own Users)
• Bypass or interfere with security or access controls
• Use bots, scrapers or automated tools to access the Service beyond reasonable business automation
• Submit malware, viruses or other harmful code
• Use the Service in violation of any applicable export control or sanctions law

We may suspend or terminate your Account if you breach this section, without notice in serious cases.

---

7. Intellectual property

7.1 Our IP

The Service, including all software, design, text, images, logos, documentation and any feedback or suggestions you give us, is owned by Nexioris or our licensors and is protected by intellectual property laws. Except for the limited rights granted in these Terms, nothing transfers ownership to you.

7.2 Your feedback

If you give us suggestions, feedback or ideas about the Service, you grant us a perpetual, irrevocable, royalty-free licence to use them without obligation to you. We are not required to act on any feedback.

---

8. Availability and support

8.1 Availability

We aim to keep the Service available 24/7. We do not guarantee uninterrupted availability and the Service may be unavailable during:

• Scheduled maintenance (we will give reasonable advance notice where possible)
• Unscheduled maintenance to address urgent issues
• Outages caused by factors beyond our reasonable control (force majeure, infrastructure provider failure, denial-of-service attack, etc.)

8.2 Support

We provide standard customer support by email at matias@nexioris.com during normal business hours in Europe. We aim to respond to support requests within 2 business days but do not guarantee response times unless a separate service level agreement is in place.

8.3 No service level commitment

Unless we have separately agreed a written service level agreement (SLA) with you, we make no specific uptime or response time commitments.

---

9. Termination

9.1 Termination by you

You can cancel your Subscription at any time from within your Account settings. Cancellation takes effect at the end of the current Subscription Term. You will continue to have access until then; you will not be refunded for the remaining time.

You can request immediate termination and Account deletion by emailing matias@nexioris.com.

9.2 Termination by us for cause

We may suspend or terminate your Account immediately, with notice where reasonable, if:

• You materially breach these Terms and do not remedy the breach within 14 days of being notified
• You fail to pay Fees and do not pay within 30 days of becoming overdue
• You use the Service in a way that we reasonably believe risks legal liability for us or other users
• You become insolvent, enter administration, or cease trading
• We are required to do so by law

9.3 Termination for convenience

Either party may terminate these Terms at the end of any Subscription Term by giving notice before the renewal date.

9.4 Effect of termination

On termination:

• Your right to use the Service ends immediately
• You will have 30 days to export your Customer Data (see Section 5.6)
• Any Fees already paid are non-refundable except as required by law
• Any Fees accrued but unpaid become immediately due
• Sections that by their nature should survive termination will survive (e.g. confidentiality, indemnity, limitation of liability, governing law)

---

10. Disclaimers

To the maximum extent permitted by applicable law:

The Service is provided "as is" and "as available." We do not warrant that:

• The Service will be uninterrupted, error-free or completely secure
• The Service will meet your specific requirements
• Any errors or defects will be corrected
• The results obtained from use of the Service will be accurate or reliable

The Service is a business tool. It is not a substitute for professional financial, legal, accounting or tax advice. You are responsible for the decisions you make based on information in the Service.

Nothing in these Terms excludes or limits any warranty or right that cannot lawfully be excluded or limited, including any rights you may have as a consumer under applicable EU consumer law.

---

11. Limitation of liability

To the maximum extent permitted by applicable law:

11.1 Excluded losses

Neither party will be liable to the other for any:

• Loss of profits, revenue, anticipated savings or business opportunity
• Loss of goodwill or reputation
• Loss or corruption of data (except as expressly set out in our backup commitments)
• Indirect, consequential, special or punitive damages
• Any losses not reasonably foreseeable at the time these Terms were entered into

11.2 Cap on liability

Each party's total aggregate liability arising out of or in connection with these Terms in any 12-month period is limited to the greater of:

• The Fees paid by you to us in the 12 months preceding the event giving rise to the claim, or
• 1000€

11.3 Exceptions

The limits in this Section 11 do not apply to:

• Death or personal injury caused by negligence
• Fraud or fraudulent misrepresentation
• Either party's indemnity obligations under Section 12
• Either party's breach of Section 6 (acceptable use) or Section 7 (intellectual property)
• Any liability that cannot lawfully be limited

11.4 Basis of allocation

You acknowledge that the Fees reflect the allocation of risk in these Terms and that we would not provide the Service on these Fees without these limits.

---

12. Indemnity

12.1 By you

You will indemnify and hold us harmless against any third-party claims, losses, damages and reasonable costs (including legal fees) arising from:

• Your Customer Data
• Your or your Users' use of the Service in breach of these Terms
• Your violation of any law or third-party right

12.2 By us

We will indemnify and hold you harmless against any third-party claims that the Service, used by you in accordance with these Terms, infringes the intellectual property rights of that third party. This does not apply where the claim arises from:

• Your Customer Data
• Use of the Service in combination with anything we did not provide
• Modifications to the Service not made by us
• Your continued use of an allegedly infringing version after we have provided a non-infringing alternative

If we receive an infringement claim, we may at our option: (a) procure the right for you to keep using the Service, (b) modify the Service to be non-infringing, or (c) terminate your Subscription and refund any pre-paid Fees for the unused portion.

This Section is your sole remedy and our sole liability for any infringement claim.

---

13. Confidentiality

Each party may receive confidential information from the other. "Confidential information" means non-public information disclosed by one party to the other that is identified as confidential or that a reasonable person would understand to be confidential.

Each party agrees to:

• Use confidential information only to perform under these Terms
• Protect it with the same care as its own confidential information (and at minimum reasonable care)
• Not disclose it to third parties except to employees and contractors with a need to know who are under written confidentiality obligations
• Return or delete it on request after termination

This does not apply to information that is or becomes publicly known through no fault of the receiving party, is already known to the receiver, is independently developed, or must be disclosed by law (with notice to the disclosing party where possible).

---

14. Force majeure

Neither party is liable for failure to perform (other than payment obligations) caused by events beyond reasonable control, including natural disasters, war, terrorism, civil unrest, government action, labour disputes, internet or telecommunications failures, denial-of-service attacks, or failure of third-party service providers. The affected party must notify the other promptly and use reasonable efforts to mitigate.

---

15. Changes to these Terms

We may update these Terms from time to time. The "Last updated" date at the top reflects when they were last changed.

For material changes (those that materially reduce your rights or increase your obligations), we will give at least 30 days' notice by email before the changes take effect. If you do not agree, you may terminate your Subscription before the changes take effect and we will refund any pre-paid Fees for the unused portion of your then-current Subscription Term.

Continued use of the Service after the effective date constitutes acceptance of the updated Terms.

For non-material changes (such as clarifications, formatting, or changes that benefit you), we may update the Terms without prior notice.

---

16. General

16.1 Entire agreement

These Terms, together with our Privacy Policy, Data Processing Agreement and any order form, form the entire agreement between you and us regarding the Service, and supersede any prior agreements or communications.

16.2 Order of precedence

If there is a conflict between documents, the order of precedence is: (1) a signed order form, (2) the Data Processing Agreement, (3) these Terms, (4) the Privacy Policy.

16.3 Assignment

You may not assign or transfer these Terms or your Account without our prior written consent. We may assign these Terms to an affiliate or in connection with a merger, acquisition or sale of assets, with notice to you.

16.4 Subcontracting

We may subcontract performance of the Service to sub-processors as listed in our Data Processing Agreement. We remain responsible for their performance.

16.5 No waiver

Failure to enforce any provision of these Terms is not a waiver of that provision. A waiver is only effective if made in writing.

16.6 Severability

If any provision is found unenforceable, the rest remains in effect, and the unenforceable provision will be modified to the minimum extent necessary to make it enforceable while preserving its intent.

16.7 No partnership

Nothing in these Terms creates a partnership, joint venture, agency, employment or franchise relationship between the parties.

16.8 Notices

Notices to us should be sent to matias@nexioris.com. Notices to you will be sent to the email address associated with your Account. Notices are deemed received on the next business day after sending.

16.9 Language

These Terms are written in English. If we provide a translation, the English version prevails in case of conflict, except where local law requires otherwise.

---

17. Governing law and disputes

17.1 Governing law

These Terms are governed by the laws of Finland, without regard to its conflict of laws principles.

17.2 Jurisdiction

The courts of Finland have exclusive jurisdiction to resolve any dispute arising from these Terms, except where applicable consumer protection law gives you the right to bring proceedings in your country of residence.

17.3 Informal resolution

Before starting any formal proceedings, the parties agree to attempt to resolve disputes informally by email. If not resolved within 30 days, either party may proceed to litigation.

17.4 Online dispute resolution

Customers based in the European Union may also use the European Commission's online dispute resolution platform at https://ec.europa.eu/consumers/odr/ where applicable.

Nämä käyttöehdot ("Ehdot") muodostavat sitovan sopimuksen sinun ("sinä", "asiakas") ja Nexioris Oy:n ("Nexioris", "me") välillä. Nexioris Oy (Y-tunnus 3635865-3), suomalainen osakeyhtiö, kotipaikka Helsinki. Hyväksymällä tilin, käyttämällä tai pääsemällä Palveluun hyväksyt nämä Ehdot.

---

1. Määritelmät

"Palvelu" tarkoittaa Nexioris-ohjelmistopalvelua osoitteessa nexioris.com. "Tili" tarkoittaa rekisteröitymisen yhteydessä luotua tiliä. "Asiakasdata" tarkoittaa kaikkia tietoja, sisältöä ja tietoja, jotka lataat tai luot Palveluun. "Käyttäjä" tarkoittaa henkilöä, jonka olet valtuuttanut käyttämään Palvelua tilisi kautta. "Tilaus" tarkoittaa valitsemaasi maksullista pakettia. "Tilauskausi" tarkoittaa maksettua ajanjaksoa. "Maksut" tarkoittaa Tilauksesta maksettavia summia.

---

2. Palvelu

2.1 Mitä tarjoamme

Myönnämme sinulle ei-yksinoikeudellisen, ei-siirrettävän, peruutettavissa olevan oikeuden käyttää Palvelua Tilauskauden aikana sisäisiin liiketoimintatarkoituksiisi.

2.2 Päivitykset ja muutokset

Saatamme päivittää, parantaa tai muokata Palvelun ominaisuuksia. Ilmoitamme olennaisista toiminnallisuuden vähennyksistä kohtuullisessa ajassa etukäteen.

2.3 Beta-ominaisuudet

Saatamme tarjota kokeellisia ominaisuuksia "beta"- tai "esiversio"-merkinnällä. Beta-ominaisuudet tarjotaan sellaisenaan ja ne voivat muuttua tai poistua koska tahansa.

---

3. Tilisi

3.1 Tilin luominen

Sinun on annettava tarkkoja, ajantasaisia ja täydellisiä tietoja ja pidettävä ne ajan tasalla.

3.2 Kelpoisuus

Vahvistat olevasi vähintään 18-vuotias ja olevasi oikeustoimikelpoinen.

3.3 Tilisi turvallisuus

Olet vastuussa tilisi tunnistetietojen salassapidosta. Ilmoita meille välittömästi osoitteeseen matias@nexioris.com, jos epäilet luvattoman pääsyn.

3.4 Käyttäjät

Olet vastuussa käyttäjiesi Ehtojen noudattamisesta. Tunnistetietojen jakaminen ei ole sallittua.

---

4. Maksut, maksaminen ja uusiminen

4.1 Maksut

Platform-maksu: 149€ yritystä kohti kuukaudessa, sisältäen yhden Muokkaaja-lisenssin. Lisämuokkaaja: 99€ käyttäjää kohti kuukaudessa. Katsoja-lisenssi: 29€ käyttäjää kohti kuukaudessa. Hinnat ovat euroissa ja sisältävät ALV:n soveltuvissa tapauksissa.

4.2 Maksaminen

Tilaukset laskutetaan kuukausittain etukäteen. Maksujen käsittely tapahtuu manuaalisesti toistaiseksi.

4.3 Kokeilukäyttö ja Early Partner -käyttö

Emme tarjoa vakiomuotoista itsepalvelukokeilua. Valitut asiakkaat voivat kuitenkin liittyä Early Partner -ohjelmaan, joka tarjoaa käyttöoikeuden rajoitetuksi ajaksi rehellisen palautteen vastineeksi.

4.4 Automaattinen uusiminen

Tilaukset uusitaan automaattisesti kuukausittain voimassa olevilla hinnoilla, ellei peruuta ennen uusimispäivää.

4.5 Hinnanmuutokset

Saatamme muuttaa hintojamme. Olemassa olevien tilausten kohdalla hinnankorotukset astuvat voimaan seuraavan Tilauskauden alussa vähintään 30 päivän sähköposti-ilmoituksen jälkeen.

4.6 Hyvitykset

Maksut ovat palautuskelvottomia lukuun ottamatta tilanteita, joissa sovellettava laki sitä edellyttää.

4.7 Myöhästynyt maksu

Jos maksu epäonnistuu tai on myöhässä, saatamme keskeyttää Palvelun käytön 7 päivän ilmoituksen jälkeen ja sulkea Tilin 30 päivän jatkuvan maksamattomuuden jälkeen.

---

5. Datasi ja sen käyttö

5.1 Omistajuus

Säilytät kaikki oikeudet Asiakasdata-tietoihisi.

5.2 Lisenssi meille

Myönnät meille maailmanlaajuisen, ei-yksinoikeudellisen, rojaltivapaan lisenssin isännöidä, kopioida, siirtää ja käsitellä Asiakasdata-tietoja ainoastaan Palvelun tarjoamiseksi.

5.3 Vastuusi Asiakasdata-tiedoista

Vahvistat, että sinulla on kaikki tarvittavat oikeudet ladata ja käsitellä Asiakasdata-tietoja Palvelun kautta.

5.4 Tietojenkäsittely

Käsittelemme henkilötietoja tietojenkäsittelysopimuksemme mukaisesti.

5.5 Tietosuoja

Henkilötietojen käsittely on kuvattu tietosuojaselosteessamme.

5.6 Datan vienti ja poistaminen

Voit viedä Asiakasdata-tietosi Palvelun kautta milloin tahansa. Tilin lopettamisen jälkeen sinulla on 30 päivää viedä tietosi. Sen jälkeen poistamme Asiakasdata-tiedot aktiivisista järjestelmistä.

---

6. Hyväksyttävä käyttö

Sitoudut olemaan käyttämättä Palvelua laittomiin tarkoituksiin, lataamatta lainvastaista sisältöä, yrittämättä saada luvatonta pääsyä järjestelmiin, rakentamatta kilpailevaa tuotetta tai palvelua, jälleenmyymättä pääsyä Palveluun kolmansille osapuolille tai lähettämättä haittaohjelmia.

---

7. Immateriaalioikeudet

7.1 Meidän IP-oikeutemme

Palvelu ja kaikki siihen liittyvä ohjelmisto, suunnittelu ja dokumentaatio on Nexioriksen omaisuutta.

7.2 Palautteesi

Jos annat meille ehdotuksia tai palautetta, myönnät meille ikuisen, peruuttamattoman, rojaltivapaan lisenssin käyttää niitä.

---

8. Saatavuus ja tuki

8.1 Saatavuus

Pyrimme pitämään Palvelun saatavilla 24/7. Emme takaa keskeytymätöntä saatavuutta.

8.2 Tuki

Tarjoamme asiakastukea sähköpostitse osoitteessa matias@nexioris.com. Pyrimme vastaamaan 2 arkipäivän kuluessa.

8.3 Ei palvelutasositoumusta

Ellei erillistä kirjallista palvelutasosopimusta ole tehty, emme sitoudu tiettyyn käytettävyys- tai vastausaikaan.

---

9. Sopimuksen päättäminen

9.1 Sinun toimestasi

Voit peruuttaa Tilauksesi milloin tahansa Tilin asetuksista. Peruutus astuu voimaan nykyisen Tilauskauden lopussa.

9.2 Meidän toimestamme syyn perusteella

Saatamme keskeyttää tai lopettaa Tilisi välittömästi, jos rikot näitä Ehtoja olennaisesti eikä rikkoa korjata 14 päivän kuluessa ilmoituksesta.

9.3 Päättäminen ilman syytä

Kumpikin osapuoli voi irtisanoa nämä Ehdot minkä tahansa Tilauskauden lopussa ilmoittamalla siitä ennen uusimispäivää.

9.4 Päättämisen vaikutukset

Päättämisen jälkeen oikeutesi käyttää Palvelua päättyy välittömästi. Sinulla on 30 päivää viedä Asiakasdata-tietosi.

---

10. Vastuuvapauslausekkeet

Palvelu tarjotaan "sellaisenaan". Emme takaa, että Palvelu on keskeytymätön tai virheetön. Palvelu on liiketoimintatyökalu eikä korvaa ammatillista taloudellista, oikeudellista tai verotuksellista neuvontaa.

---

11. Vastuunrajoitus

11.1 Poissuljetut vahingot

Kumpikaan osapuoli ei ole vastuussa toiselle osapuolelle aiheutuneista voittojen, tuottojen tai liikearvon menetyksistä tai välillisistä vahingoista.

11.2 Vastuun enimmäismäärä

Kummankin osapuolen kokonaisvastuu on rajoitettu suurempaan seuraavista: edeltävien 12 kuukauden aikana maksetut Maksut tai 1 000 €.

---

12. Korvausvelvollisuus

12.1 Sinun puoleltasi

Korvaat meille kolmansien osapuolten vaateet, jotka johtuvat Asiakasdata-tiedoistasi tai Ehtojen vastaisesta käytöstä.

12.2 Meidän puoleltamme

Korvaamme sinulle kolmansien osapuolten vaateet, jotka johtuvat siitä, että Palvelu loukkaa kyseisen kolmannen osapuolen immateriaalioikeuksia.

---

13. Luottamuksellisuus

Kumpikin osapuoli sitoutuu käyttämään toisen osapuolen luottamuksellisia tietoja vain näiden Ehtojen täyttämiseksi ja suojaamaan niitä vähintään omien luottamuksellisten tietojensa tasoisella huolella.

---

14. Ylivoimainen este

Kumpikaan osapuoli ei ole vastuussa suorituksen laiminlyönnistä, jos se johtuu heidän kohtuullisen vaikutuspiirinsä ulkopuolisista tapahtumista.

---

15. Muutokset näihin ehtoihin

Saatamme päivittää näitä Ehtoja. Olennaisista muutoksista ilmoitamme vähintään 30 päivää etukäteen sähköpostitse.

---

16. Yleiset ehdot

16.1 Koko sopimus

Nämä Ehdot yhdessä Tietosuojaselosteen, Tietojenkäsittelysopimuksen ja mahdollisen tilauslomakkeen kanssa muodostavat täydellisen sopimuksen.

16.2 Etusijajärjestys

Ristiriitatilanteessa asiakirjojen etusijajärjestys on: 1) allekirjoitettu tilauslomake, 2) Tietojenkäsittelysopimus, 3) nämä Ehdot, 4) Tietosuojaseloste.

16.9 Kieli

Nämä Ehdot on laadittu englanniksi. Jos tarjoamme käännöksen, englanninkielinen versio on ensisijainen ristiriitatilanteissa.

---

17. Sovellettava laki ja riitojen ratkaisu

17.1 Sovellettava laki

Näihin Ehtoihin sovelletaan Suomen lakia.

17.2 Toimivalta

Suomen tuomioistuimilla on yksinomainen toimivalta näistä Ehdoista johtuvien riitojen ratkaisemiseen.

17.3 Epävirallinen ratkaisu

Ennen virallisten menettelyjen aloittamista osapuolet sitoutuvat yrittämään ratkaista riidat epävirallisesti sähköpostitse 30 päivän kuluessa.

17.4 Verkkovälitteinen riidanratkaisu

EU:ssa asuvat asiakkaat voivat myös käyttää Euroopan komission verkkovälitteistä riidanratkaisualustaa osoitteessa https://ec.europa.eu/consumers/odr/

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Nexioris Oy (Y-tunnus 3635865-3), a limited liability company incorporated in Finland ("Nexioris", "Processor", "we") and the customer identified in the Account or order form ("Customer", "Controller", "you").

This DPA governs the processing of personal data by Nexioris on behalf of the Customer in connection with the Service, in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR").

In case of conflict between this DPA and the Terms of Service, this DPA prevails on matters relating to the processing of personal data.

---

1. Definitions

Terms not defined here have the meaning given in the GDPR or the Terms of Service.

• "Personal Data" means any information relating to an identified or identifiable natural person that the Customer (or its Users) submits to the Service.
• "Data Subject" means an identified or identifiable natural person to whom Personal Data relates.
• "Processing" means any operation performed on Personal Data, as defined in Article 4(2) GDPR.
• "Sub-processor" means any third party engaged by Nexioris to process Personal Data on behalf of the Customer.
• "Supervisory Authority" means an independent public authority established under Article 51 GDPR.
• "Data Subject Request" means a request by a Data Subject to exercise their rights under the GDPR.
• "Personal Data Breach" has the meaning given in Article 4(12) GDPR.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses adopted by the European Commission for the transfer of personal data to third countries under Article 46 GDPR.

---

2. Roles and responsibilities

2.1 Roles

• The Customer is the Controller of the Personal Data processed through the Service.
• Nexioris Oy (Y-tunnus 3635865-3) is the Processor, acting on the Customer's documented instructions.

2.2 Customer obligations

The Customer:

• Determines the purposes and means of processing
• Has a valid lawful basis under Article 6 GDPR (and, where applicable, Article 9 GDPR) for the Personal Data it submits to the Service
• Has provided any notices and obtained any consents required from Data Subjects under applicable law
• Will not submit any special categories of Personal Data (Article 9 GDPR) to the Service except where strictly necessary, and accepts that the Service is not specifically designed to process such data
• Is responsible for the accuracy, quality and legality of Personal Data, and the means by which it was acquired
• Will respond directly to Data Subject Requests, with reasonable assistance from Nexioris as set out in Section 8

2.3 Nexioris obligations

Nexioris will:

• Process Personal Data only on the documented instructions of the Customer (the instructions being the Terms of Service, this DPA, and any reasonable written instructions given by the Customer)
• Notify the Customer if, in its opinion, an instruction infringes the GDPR or other EU or member-state data protection law
• Ensure that persons authorised to process Personal Data are bound by appropriate confidentiality obligations
• Implement appropriate technical and organisational measures as set out in Annex 2
• Assist the Customer in fulfilling its GDPR obligations, as set out in Sections 7 and 8
• Make available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR

---

3. Scope and purpose of processing

The details of the processing carried out by Nexioris on behalf of the Customer are set out in Annex 1 (Details of processing).

In summary:

• Subject matter: Provision of the Nexioris Service
• Duration: For the term of the Customer's Subscription, plus any retention period described in Section 9
• Nature and purpose: Hosting, processing, storing, transmitting, backing up and otherwise making available Personal Data through the Service so the Customer can manage its business operations
• Types of Personal Data: Set out in Annex 1
• Categories of Data Subjects: Set out in Annex 1

---

4. Sub-processors

4.1 General authorisation

The Customer grants Nexioris general written authorisation to engage Sub-processors to assist with providing the Service, subject to this Section 4.

4.2 Current Sub-processors

Nexioris maintains a current list of Sub-processors available on request.

4.3 Sub-processor obligations

Where Nexioris engages a Sub-processor, it will:

• Enter into a written contract that imposes data protection obligations substantially equivalent to those in this DPA
• Remain fully liable to the Customer for the Sub-processor's performance

---

5. International transfers

5.1 Primary location

Personal Data is primarily stored and processed within the European Economic Area (EEA).

5.2 Transfers outside the EEA

Where Personal Data is transferred to a Sub-processor or any other recipient outside the EEA, Nexioris will ensure that the transfer is protected by one of the following:

• An adequacy decision adopted by the European Commission under Article 45 GDPR, or
• Standard Contractual Clauses (SCCs) adopted by the European Commission under Article 46 GDPR, with appropriate supplementary measures where required following a transfer impact assessment, or
• Another lawful transfer mechanism under Chapter V GDPR

5.3 SCC incorporation

Where SCCs apply, Module 2 (Controller-to-Processor) is incorporated into this DPA by reference, with:

• The Customer as data exporter
• Nexioris as data importer
• Option 1 of Clause 9(a): general written authorisation for Sub-processors per Section 4 above
• Option 1 of Clause 17: governing law as the law of Finland
• Clause 18: the courts of Finland

Where the Customer engages Sub-processors itself and Nexioris acts as an intermediary, Module 3 (Processor-to-Sub-processor) applies on the same basis.

5.4 Documentation

On request, Nexioris will provide the Customer with reasonable information about the transfer mechanisms used.

---

6. Security

6.1 Technical and organisational measures

Nexioris will implement and maintain the technical and organisational measures set out in Annex 2 to ensure a level of security appropriate to the risk.

6.2 Updates

Nexioris may update its security measures from time to time, provided that the updated measures do not materially decrease the overall protection of Personal Data.

6.3 Personnel

Nexioris will ensure that:

• Access to Personal Data is restricted to personnel who need it to perform their duties
• All such personnel are subject to written confidentiality obligations
• All such personnel receive appropriate data protection training

---

7. Personal Data Breach

7.1 Notification to Customer

Nexioris will notify the Customer without undue delay, and in any event within 72 hours of becoming aware of a confirmed Personal Data Breach affecting the Customer's Personal Data.

7.2 Content of notification

The notification will include, to the extent known at the time:

• A description of the nature of the breach (categories and approximate numbers of Data Subjects and records affected)
• The likely consequences of the breach
• The measures taken or proposed to address the breach and mitigate its effects
• Contact details for further information

7.3 Updates

Where not all information is available at the time of initial notification, Nexioris will provide further information as it becomes available.

7.4 Customer obligations

The Customer is responsible for notifying its Supervisory Authority and affected Data Subjects, where required by Articles 33 and 34 GDPR. Nexioris will reasonably assist the Customer in doing so.

7.5 No admission of liability

Notification of a Personal Data Breach is not an admission of fault or liability by Nexioris.

---

8. Data Subject Requests and assistance

8.1 Forwarding requests

If Nexioris receives a Data Subject Request relating to Personal Data processed on behalf of the Customer, it will, without undue delay:

• Inform the Data Subject that the request should be directed to the Customer, and
• Forward the request to the Customer where possible

Nexioris will not respond to Data Subject Requests directly, except on the Customer's documented instructions or where required by law.

8.2 Assistance with Data Subject Requests

Nexioris will provide reasonable assistance to the Customer to enable the Customer to respond to Data Subject Requests, taking into account the nature of the processing. Standard assistance is provided through the self-service features of the Service (data export, deletion, correction). Additional assistance not available through the Service may be subject to a reasonable fee where the assistance requires substantial effort.

8.3 Other Customer obligations

Nexioris will provide reasonable assistance to the Customer in meeting its obligations under:

• Articles 32–36 GDPR (security, breach notification, data protection impact assessments, prior consultation with Supervisory Authorities)
• Other applicable GDPR obligations relating to the processing carried out by Nexioris

---

9. Return and deletion of Personal Data

9.1 During the Subscription

The Customer can export Personal Data from the Service at any time using the export features available in the Service.

9.2 On termination

On termination or expiry of the Subscription:

• The Customer will have 30 days to export Personal Data using the Service's export features
• After this 30-day period, Nexioris will delete Personal Data from active systems within a reasonable period
• Backups containing Personal Data will be retained for up to 30 days after deletion from active systems, then deleted in the ordinary backup rotation
• Where Nexioris is required by law to retain certain Personal Data (e.g. billing records under accounting law), it will retain only the minimum required and will continue to protect it in accordance with this DPA

9.3 Certification of deletion

Nexioris will provide written certification of deletion on request.

---

10. Audits and inspections

10.1 Information and audit rights

Nexioris will make available to the Customer all information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA.

10.2 Audits

The Customer (or an independent auditor mandated by the Customer and reasonably acceptable to Nexioris) may audit Nexioris's compliance with this DPA, subject to the following:

• Audits may take place no more than once per calendar year, except where required following a Personal Data Breach or by a Supervisory Authority
• The Customer must give at least 30 days' written notice
• Audits will be conducted during normal business hours
• Audits must not unreasonably disrupt Nexioris's operations
• The auditor must be bound by appropriate confidentiality obligations
• The Customer bears the cost of the audit

10.3 Audit reports

In place of an on-site audit, Nexioris may satisfy the Customer's audit rights by providing:

Detailed responses to a reasonable Customer security questionnaire. Nexioris does not currently hold ISO 27001 or SOC 2 certifications.

Most Customer audit requirements can be satisfied through these means without an on-site audit.

10.4 Supervisory Authority audits

Nexioris will cooperate with audits and inspections conducted by a competent Supervisory Authority.

---

11. Liability

The liability of each party under or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service. For clarity, the liability cap in the Terms of Service applies cumulatively to all claims under the Terms of Service and this DPA combined.

---

12. Term and termination

12.1 Term

This DPA takes effect when the Customer accepts the Terms of Service or otherwise enters into a binding agreement with Nexioris for the Service, and continues for as long as Nexioris processes Personal Data on behalf of the Customer.

12.2 Survival

Sections that by their nature should survive termination (including obligations relating to confidentiality, return and deletion of Personal Data, audit cooperation for past processing, and liability) will survive.

---

13. General

13.1 Order of precedence

In case of conflict between documents, the order of precedence is: (1) a signed order form addressing data protection, (2) this DPA, (3) the Terms of Service, (4) the Privacy Policy.

13.2 Changes to this DPA

Nexioris may update this DPA to reflect changes in applicable law, the Service, or our Sub-processors. Material changes will be communicated to the Customer with at least 30 days' notice. Continued use of the Service after the effective date constitutes acceptance.

13.3 Governing law

This DPA is governed by the laws of Finland, and the courts of Finland have exclusive jurisdiction over any dispute arising from it, except where mandatory law provides otherwise.

13.4 Severability

If any provision of this DPA is found unenforceable, the rest remains in effect.

13.5 Notices

Notices to Nexioris under this DPA should be sent to matias@nexioris.com.

---

1.1 Subject matter

The processing of Personal Data by Nexioris on behalf of the Customer in connection with the Service.

1.2 Duration

For the duration of the Customer's Subscription, plus the retention period described in Section 9 of the DPA.

1.3 Nature and purpose

Hosting, processing, storing, transmitting, displaying, backing up, and otherwise making Personal Data available through the Service so that the Customer can use the Service to manage its renovation contracting business, including estimating, scheduling, job management, costs, billing, reporting and related activities.

1.4 Types of Personal Data

The Personal Data processed may include, depending on the Customer's use of the Service:

• Customer's Users: name, email, phone, role, profile photo, login credentials, activity logs within the Service
• Customer's clients (people the Customer does business with): name, contact details (address, email, phone), business identifiers, billing details
• Customer's suppliers and subcontractors: name, contact details, trading details, payment terms, insurance and compliance documentation, banking details (where added by the Customer)
• Photos and media uploaded to job records: which may incidentally include images of identifiable individuals (e.g. team members on site)
• Notes, comments and activity logs: which may contain references to identifiable individuals

The Customer is responsible for ensuring that any Personal Data submitted to the Service is appropriate and minimised in line with Article 5 GDPR. The Service is not designed to process special categories of Personal Data (Article 9 GDPR) and the Customer agrees not to submit such data except where strictly necessary.

1.5 Categories of Data Subjects

• The Customer's Users
• The Customer's clients (and the clients' representatives where applicable)
• The Customer's suppliers, subcontractors and their representatives
• Other natural persons whose Personal Data the Customer chooses to submit to the Service (e.g. site visitors named in activity notes)

1.6 Frequency

Continuous, for the duration of the Subscription.

---

Nexioris implements the following technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR.

2.1 Pseudonymisation and encryption

• All Personal Data transmitted between the Customer and the Service is encrypted using TLS 1.2 or higher
• Personal Data at rest is encrypted on disk
• Passwords are stored using strong one-way hashing (bcrypt, Argon2 or equivalent)
• Backups are encrypted both in transit and at rest

2.2 Confidentiality

• Access to Personal Data is restricted to authorised personnel on a strict need-to-know basis
• All personnel with access are bound by written confidentiality obligations
• Internal admin accounts require two-factor authentication
• Strong password policies are enforced for all internal accounts
• Access rights are reviewed periodically and revoked promptly on personnel changes

2.3 Integrity

• Application and infrastructure changes go through code review before deployment
• Production deployments are logged and traceable
• Data validation is enforced at the application layer to prevent corruption

2.4 Availability and resilience

• Production infrastructure is hosted with established cloud providers within the EEA (see Annex 3)
• Daily encrypted database backups, stored in a separate geographic region within the EEA
• Backup restore tests are performed periodically
• Application monitoring and alerting is in place for critical issues
• Documented incident response procedures

2.5 Restoring availability

• Database backups enable point-in-time restoration within the retention window
• Documented recovery procedures with internal target recovery times
• Critical infrastructure components are managed by service providers with built-in redundancy

2.6 Testing and evaluation

• Security posture is reviewed at least annually
• Software dependencies are monitored for known vulnerabilities and updated when needed
• Web application security best practices are followed (input validation, output encoding, parameterised queries, CSRF protection, secure session management)

2.7 Personnel security

• Access to production systems is restricted to founding team members who are bound by written confidentiality obligations.
• All personnel receive data protection awareness training
• Departing personnel have access revoked promptly

2.8 Physical security

• All Personal Data is hosted in data centres operated by reputable cloud providers (see Annex 3)
• Physical security at these data centres is the responsibility of the cloud provider and meets recognised industry standards (e.g. ISO 27001 certification)
• Nexioris does not operate its own data centres
• Personnel working with Personal Data are required to use up-to-date and properly secured devices

2.9 Sub-processor management

• All Sub-processors are bound by written contracts requiring substantially equivalent data protection obligations
• Sub-processors are reviewed for security and data protection before engagement

2.10 Updates

These measures may evolve over time as the Service and threat landscape change. Nexioris will not materially decrease the overall level of protection without notice to the Customer.

---

The Sub-processors authorised at the date of this DPA are listed below. The current list is maintained available on demand.

Sub-processor	Purpose	Location
Railway	Hosting and database infrastructure	United States (SCCs in place)
Netlify	Marketing website hosting	United States (SCCs in place)
Google Workspace	Business email	EU and United States (SCCs in place)

Payment processing integration coming soon. Sub-processor list will be updated when new providers are added.

For each Sub-processor, Nexioris ensures the transfer mechanism described in Section 5 of the DPA is in place where data is processed outside the EEA.

Tämä tietojenkäsittelysopimus ("TKS") on osa Nexioris Oy:n ja asiakkaan välisiä käyttöehtoja. Nexioris Oy (Y-tunnus 3635865-3), suomalainen osakeyhtiö, kotipaikka Helsinki. Tämä TKS koskee Nexioriksen suorittamaa henkilötietojen käsittelyä asiakkaan puolesta GDPR:n mukaisesti.

---

1. Määritelmät

"Henkilötieto" tarkoittaa kaikkia tietoja, jotka liittyvät tunnistettuun tai tunnistettavissa olevaan luonnolliseen henkilöön. "Rekisteröity" tarkoittaa luonnollista henkilöä, johon Henkilötieto liittyy. "Käsittely" tarkoittaa Henkilötiedoille suoritettavia operaatioita. "Alikäsittelijä" tarkoittaa kolmatta osapuolta, jonka Nexioris valtuuttaa käsittelemään Henkilötietoja asiakkaan puolesta. "Tietoturvaloukkaus" tarkoittaa GDPR:n 4 artiklan 12 kohdassa tarkoitettua henkilötietojen tietoturvaloukkausta.

---

2. Roolit ja vastuut

2.1 Roolit

Asiakas on Henkilötietojen rekisterinpitäjä. Nexioris Oy (Y-tunnus 3635865-3) on tietojenkäsittelijä, joka toimii asiakkaan dokumentoitujen ohjeiden mukaisesti.

2.2 Asiakkaan velvollisuudet

Asiakas määrittää käsittelyn tarkoitukset ja keinot, varmistaa lainmukaisen käsittelyperusteen, on hankkinut tarvittavat suostumukset rekisteröidyiltä ja vastaa Henkilötietojen tarkkuudesta ja lainmukaisuudesta.

2.3 Nexioriksen velvollisuudet

Nexioris käsittelee Henkilötietoja vain asiakkaan dokumentoitujen ohjeiden mukaisesti, ilmoittaa asiakkaalle jos ohje rikkoo GDPR:ää, varmistaa asianmukaiset salassapitovelvoitteet ja toteuttaa asianmukaiset tekniset ja organisatoriset toimenpiteet.

---

3. Käsittelyn laajuus ja tarkoitus

Aihe: Nexioris-palvelun tarjoaminen. Kesto: Asiakkaan Tilauskauden ajaksi. Luonne ja tarkoitus: Henkilötietojen isännöinti, käsittely, tallennus, siirto ja varmuuskopiointi. Henkilötietotyypit ja rekisteröityjen ryhmät on kuvattu liitteessä 1.

---

4. Alikäsittelijät

4.1 Yleinen valtuutus

Asiakas antaa Nexiorisille yleisen kirjallisen valtuutuksen käyttää Palvelun tarjoamisessa avustavia Alikäsittelijöitä.

4.2 Nykyiset Alikäsittelijät

Railway — Hosting ja tietokantainfrastruktuuri — Yhdysvallat (vakiosopimuslausekkeet)

Netlify — Markkinointisivuston hosting — Yhdysvallat (vakiosopimuslausekkeet)

Google Workspace — Yrityssähköposti — EU ja Yhdysvallat (vakiosopimuslausekkeet)

---

5. Kansainväliset siirrot

Henkilötiedot tallennetaan ja käsitellään ensisijaisesti Euroopan talousalueella. Siirrot ETA:n ulkopuolelle suojataan Euroopan komission vahvistamilla vakiosopimuslausekkeilla.

---

6. Turvallisuus

Nexioris toteuttaa ja ylläpitää liitteessä 2 kuvatut tekniset ja organisatoriset toimenpiteet varmistaakseen riskiin nähden asianmukaisen turvallisuustason.

---

7. Henkilötietojen tietoturvaloukkaukset

7.1 Ilmoitus asiakkaalle

Nexioris ilmoittaa asiakkaalle ilman aiheetonta viivytystä ja joka tapauksessa 72 tunnin kuluessa siitä, kun se on tullut tietoiseksi vahvistetusta Tietoturvaloukkauksesta.

7.2 Ilmoituksen sisältö

Ilmoitus sisältää kuvauksen loukkauksen luonteesta, todennäköiset seuraukset sekä toteutetut tai ehdotetut toimenpiteet.

---

8. Rekisteröityjen pyynnöt ja avustaminen

8.1 Pyyntöjen välittäminen

Jos Nexioris vastaanottaa Rekisteröidyn pyynnön, se ilmoittaa rekisteröidylle, että pyyntö tulee ohjata asiakkaalle.

8.2 Avustaminen

Nexioris avustaa asiakasta kohtuullisesti rekisteröityjen pyyntöihin vastaamisessa Palvelun itsepalveluominaisuuksien kautta.

---

9. Henkilötietojen palauttaminen ja poistaminen

9.1 Tilauksen aikana

Asiakas voi viedä Henkilötiedot Palvelusta milloin tahansa.

9.2 Päättymisen yhteydessä

Tilauksen päättymisen jälkeen asiakkaalla on 30 päivää viedä Henkilötiedot. Sen jälkeen Nexioris poistaa Henkilötiedot aktiivisista järjestelmistä. Varmuuskopiot poistetaan 30 päivän kuluessa.

9.3 Poistamisen todistaminen

Nexioris toimittaa kirjallisen todistuksen poistamisesta pyynnöstä.

---

10. Tarkastukset

Nexioris asettaa asiakkaan saataville kaikki tiedot, jotka ovat kohtuullisesti tarpeen GDPR:n 28 artiklan noudattamisen osoittamiseksi. Tarkastuksia voidaan tehdä enintään kerran kalenterivuodessa vähintään 30 päivän kirjallisella ilmoituksella.

---

11. Vastuu

Kummankin osapuolen vastuu tämän TKS:n nojalla on käyttöehtojen vastuunrajoitusten alainen.

---

12. Voimassaolo ja päättyminen

Tämä TKS tulee voimaan, kun asiakas hyväksyy Käyttöehdot, ja jatkuu niin kauan kuin Nexioris käsittelee Henkilötietoja asiakkaan puolesta.

---

13. Yleiset ehdot

13.1 Etusijajärjestys

Ristiriitatilanteessa: 1) allekirjoitettu tilauslomake, 2) tämä TKS, 3) Käyttöehdot, 4) Tietosuojaseloste.

13.2 Muutokset

Nexioris voi päivittää tätä TKS:ää. Olennaisista muutoksista ilmoitetaan vähintään 30 päivää etukäteen.

13.3 Sovellettava laki

Tähän TKS:ään sovelletaan Suomen lakia.

---

LIITE 1 – Käsittelyn tiedot

1.1 Aihe

Henkilötietojen käsittely Nexioriksen toimesta asiakkaan puolesta Palvelun yhteydessä.

1.2 Kesto

Asiakkaan Tilauskauden ajan sekä kohdassa 9 kuvatun säilytysajan.

1.3 Luonne ja tarkoitus

Henkilötietojen isännöinti, käsittely, tallennus, siirto ja varmuuskopiointi, jotta asiakas voi hallita liiketoimintaansa.

1.4 Henkilötietotyypit

Asiakkaan käyttäjät: nimi, sähköposti, puhelin, rooli, profiilikuva, toimintalokit. Asiakkaan asiakkaat: nimi, yhteystiedot, laskutustiedot. Toimittajat ja alihankkijat: nimi, yhteystiedot, kauppatiedot. Valokuvat ja media: jotka voivat sisältää tunnistettavien henkilöiden kuvia. Muistiinpanot ja lokit: jotka voivat sisältää viittauksia tunnistettaviin henkilöihin.

1.5 Rekisteröityjen ryhmät

Asiakkaan käyttäjät, asiakkaan asiakkaat, toimittajat ja alihankkijat sekä muut luonnolliset henkilöt, joiden tietoja asiakas lataa Palveluun.

---

LIITE 2 – Tekniset ja organisatoriset toimenpiteet

2.1 Pseudonymisaatio ja salaus

Kaikki Henkilötietojen siirto salataan TLS 1.2:lla tai uudemmalla. Levossa olevat tiedot salataan. Salasanat tallennetaan vahvalla yksisuuntaisella hajautuksella. Varmuuskopiot salataan.

2.2 Luottamuksellisuus

Pääsy Henkilötietoihin on rajoitettu valtuutetulle henkilöstölle. Kaikki henkilöstö on salassapitovelvollisuuden alainen. Sisäiset järjestelmänvalvojan tilit vaativat kaksivaiheisen todennuksen.

2.3 Eheys

Sovellus- ja infrastruktuurimuutokset tarkistetaan ennen käyttöönottoa.

2.4 Saatavuus ja palautumiskyky

Päivittäiset salatut tietokantavarmuuskopiot. Dokumentoidut palautumismenettelyt. Sovelluksen valvonta ja hälytykset kriittisille ongelmille.

2.5 Testaus ja arviointi

Tietoturva-asemaa arvioidaan vähintään vuosittain. Ohjelmistoriippuvuuksia seurataan tunnettujen haavoittuvuuksien varalta.

2.6 Henkilöstön turvallisuus

Pääsy tuotantojärjestelmiin on rajoitettu perustaviin tiimin jäseniin, jotka ovat salassapitovelvollisuuden alaisia. Henkilöstö saa tietosuojakoulutusta.