Data Processing Agreement (DPA)

Tietojenkäsittelysopimus · Effective from 1 May 2025 · Big Qwerty Oy

This Data Processing Agreement supplements the main agreement between Big Qwerty Oy and the Customer. It describes how Big Qwerty Oy processes personal data on behalf of the Customer in accordance with the EU General Data Protection Regulation (GDPR, 2016/679).

1. Parties and Roles

Role	Party	Responsibility
Controller	Customer (subscribing organisation)	Determines the purpose and means of processing
Processor	Big Qwerty Oy, Business ID 2844734-9, Apteekkarinkatu 3, FI-00790 Helsinki, Finland	Processes data solely on the Controller's instructions

2. Subject-matter, Nature and Purpose

Big Qwerty Oy processes personal data solely for the purpose of providing the Kotka Cost Estimate service to the Controller.

Processing operations: storage, retrieval, modification, deletion, anonymisation
Categories of personal data: name, email, organisation details, login events, project data
Categories of data subjects: users designated by the Controller
Duration: term of the main agreement + statutory retention periods

3. Obligations of the Processor

Big Qwerty Oy undertakes to process data only on documented Controller instructions, ensure least-privilege access, implement GDPR Art. 32 security measures, assist with data subject rights (Art. 15–22), and notify of breaches within 72 hours.

4. Sub-processors

Sub-processors are listed in the Sub-processors List. Controllers will be notified of new sub-processors at least 14 days in advance.

5. International Data Transfers

All transfers are based on EU Standard Contractual Clauses (SCC, 2021/914), the EU–US Data Privacy Framework (DPF), or an EC adequacy decision.

6. Technical and Organisational Security Measures

Measure	Implementation
Access control	Role-based access control (MASTER/ADMIN/USER)
Authentication	bcrypt password hashing (cost factor 12)
Data in transit	TLS 1.2+ (HTTPS)
Database security	PostgreSQL — encrypted connections
Data isolation	Organisation-level data isolation

7. Assistance with Data Subject Rights

Access (Art. 15), Rectification (Art. 16), Erasure (Art. 17), Portability (Art. 20). Requests: info@bigqwerty.fi

8. Personal Data Breaches

Big Qwerty Oy will notify the Controller without undue delay and within 72 hours of becoming aware of a breach.

9. Term and Termination

This DPA remains in force for the duration of the main agreement. Upon termination, Big Qwerty Oy will delete or return all personal data within 30 days.

10. Contact

Big Qwerty Oy
Data Protection contact: info@bigqwerty.fi
Apteekkarinkatu 3, FI-00790 Helsinki
Phone: +358 40 758 9091

Supervisory authority: Office of the Data Protection Ombudsman