Data Processing Agreement (DPA)

Last updated: 22 October 2026

Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Tahvo Solutions (business ID 2415227-9, Tiporaitti 9, 33250 Tampere, Finland; "Processor", "we") and the business that uses the Service ("Controller", "you"). It applies to personal data that we process on your behalf and fulfils the requirements of Article 28 of the GDPR. By accepting the Terms of Service you accept this DPA; no separate signature is needed.

1. Roles

For personal data of your website visitors and customers that the chat assistant handles (messages, contact details, quote, booking and order information), you are the controller and Tahvo Solutions is the processor. For your own account data (the people who log in to the dashboard) and billing data, Tahvo Solutions is a controller in its own right, as described in the Privacy Policy.

2. Subject matter, duration and purpose

We process the data solely to provide the Service as described in the Terms: answering visitors, capturing requests, notifying you and making the data available to you in the dashboard. Processing lasts as long as you have an account. When your plan ends, conversations are kept for 30 days so you can export them; the account is deleted when you delete it or, if it has no plan, after 90 days without use and an email warning. Data is kept longer only where the law requires it.

3. Data subjects and categories of data

Data subjects: visitors and customers of your website, and your own team members. Categories of data: chat messages and their content, name, email address, phone number, free-text details a visitor chooses to give, order and booking details, language, a one-way hash of the IP address, and technical identifiers needed for the chat (see the Annex). We do not intentionally process special categories of data; the assistant is instructed not to ask for them, and you should tell your visitors not to share them.

4. Your instructions

We process personal data only on your documented instructions, which are these Terms, this DPA and how you configure and use the Service. If we believe an instruction breaches data protection law we will tell you.

5. Confidentiality

Everyone at Tahvo Solutions who can access the data is bound by confidentiality. Platform administrators can see your data only for support and security, and every administrator action is recorded in an audit log.

6. Security measures

We apply technical and organisational measures appropriate to the risk, including: encryption in transit (TLS) and at rest; logical isolation of each business's data; role-based access inside your account (owner, admin, agent); optional two-factor authentication (authenticator app) for every account; hashing of IP addresses; rate limiting and input protection against abuse and prompt injection; access logging and security monitoring; an audit log of platform-administrator actions; and secrets kept out of the browser and out of logs. We review these measures regularly.

7. Sub-processors

You give us general authorisation to use the sub-processors below. We have a data processing agreement with each of them. We will tell you at least 30 days before adding or replacing a sub-processor (by email or a notice in the dashboard); if you object on reasonable data-protection grounds you may terminate the subscription.

8. International transfers

Where a sub-processor is outside the EU/EEA (the United States), the transfer relies on the EU–US Data Privacy Framework where the sub-processor is certified, or on the EU Standard Contractual Clauses included in its data processing agreement. The United Kingdom is covered by an EU adequacy decision.

9. Helping you with data-subject requests

The dashboard lets you view, export and delete conversations. If a data subject contacts us directly, we pass the request to you without undue delay unless we are the controller. Requests from visitors who do not know which business they chatted with can be sent to asiakaspalvelu@tahvosolutions.fi.

10. Personal data breaches

If we become aware of a personal data breach affecting your data we will notify you without undue delay, and give you the information you reasonably need to meet your own notification duties (including the 72-hour deadline towards the supervisory authority).

11. Information and audits

We will provide the information needed to show compliance with this DPA. You may audit our compliance once a year with reasonable notice, at your own cost and under confidentiality, or rely on the documentation we provide.

12. Return and deletion

You can export your data from the dashboard at any time. When you delete your account, its data is deleted at once and backups are overwritten within 14 days. Otherwise data is deleted as described in section 2 and in the retention times of the Privacy Policy, except where the law requires us to keep it (for example accounting records).

13. Liability and governing law

Liability is governed by the Terms of Service. This DPA is governed by the laws of Finland; disputes are resolved in the Pirkanmaa District Court. If the English and Finnish versions differ, the Finnish version prevails.

Annex — Chat widget storage

When the chat widget is on your website it stores in the visitor's browser: a random conversation ID, a random anonymous visitor ID, and (for the session) whether the greeting teaser has been shown. These are needed for the chat to continue across pages and are not used to track visitors across other sites. Because the visitor asked for the chat, this functional storage is generally exempt from consent, but mention it in your own cookie and privacy information.

Contact

Questions about this DPA: asiakaspalvelu@tahvosolutions.fi