Data Processing Agreement
Summary
When your organisation uses Ahti, we process its business data on its behalf. This agreement says how: only on your instructions, kept confidential and secure, with the subprocessors on our subprocessors page, and deleted or returned when you leave. It is part of our terms of service.
This section is a plain-language summary. The legally binding part starts below.
1. Parties and roles
This agreement is between the organisation that uses Ahti (the "Customer", controller) and Always Human-first Technological Improvement Oy, VAT number FI36366506, Finland ("Ahti", processor). It applies to personal data Ahti processes on the Customer's behalf when providing Ahti, as required by Article 28 of the General Data Protection Regulation (GDPR).
2. Subject, duration, nature and purpose
- Subject: personal data in the Customer's business data, such as products, customers, suppliers, orders, files, messages and chat.
- Duration: as long as the Customer uses Ahti, and until the data is deleted or returned under section 10.
- Nature and purpose: storing, reading, transforming and sending data to run the work the Customer asks Ahti to do.
- Data subjects: the Customer's users, and the Customer's customers, suppliers and other business contacts.
- Categories of data: names, business contact details, order and delivery details, and any other personal data the Customer puts into Ahti. The Customer should not put special categories of personal data into Ahti.
3. Instructions
Ahti processes the data only on the Customer's documented instructions. The terms, this agreement and the Customer's use of Ahti's features are those instructions. Ahti tells the Customer if it believes an instruction breaks data protection law.
4. Confidentiality
Everyone at Ahti who can access the data is bound to keep it confidential.
5. Security
Ahti protects the data with appropriate technical and organisational measures, including encryption in transit and at rest, access limited to those who need it, separation of each organisation's data, and logging of access to systems.
6. Subprocessors
The Customer authorises Ahti to use the subprocessors on the subprocessors page. Ahti tells the Customer's admins by email when it adds or removes a subprocessor. The Customer may object on reasonable data protection grounds within 30 days of the notice; if the parties cannot resolve the objection, the Customer may end its use of Ahti. Ahti binds each subprocessor to data protection obligations no weaker than these and remains responsible for it.
Systems the Customer connects to Ahti itself, such as its ERP, store or product information system, are not Ahti's subprocessors. They process data for the Customer.
7. Transfers outside the EU and EEA
Where a subprocessor processes data outside the EU or EEA, the transfer is covered by the European Commission's Standard Contractual Clauses or another safeguard under Chapter V of the GDPR, as named on the subprocessors page.
8. Helping the Customer
Ahti helps the Customer, as far as it reasonably can, to answer requests from data subjects, and with security, breach notification, data protection impact assessments and prior consultation.
9. Personal data breaches
Ahti tells the Customer without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting the Customer's data, with the information the Customer needs to meet its own obligations.
10. End of processing
When the Customer stops using Ahti, the Customer can export its data. Ahti then deletes the Customer's data within 90 days, unless law requires Ahti to keep it.
11. Audits
Ahti makes available the information needed to show that it meets this agreement, and allows and contributes to reasonable audits, with reasonable notice and at the Customer's cost.
12. Contact
Questions about this agreement: hello@ahti.at