1. General 

 

1.1 These terms and conditions shall apply between Plussal Oy (“Plussal”) and the Customer (the “Customer”) (the “Parties”) when the Customer orders services (a “Service” or the “Services”) from Plussal, giving rise to an agreement (the “Agreement”). These terms and conditions shall apply to all written and oral orders for Services, order confirmations, and other agreements concerning Services, unless otherwise agreed in writing.

 

2. General obligations of the Parties  

 

2.1 In their activities related to the Agreement, the Parties undertake to comply with the applicable legislation and official regulations, good business practice, and the generally accepted practices applying to specific services, such as good debt collection practices.

 

3. Inception and assignment of the Agreement

 

3.1 An Agreement for the service shall arise when the Customer places an order with Plussal. An order may be placed in writing or orally. The Customer shall receive a separate order confirmation from Plussal based on the order. The Customer shall not be required to sign or return the order confirmation.

 

3.2 The Customer shall not be entitled to assign the Agreement to a third party without Plussal’s written consent.

 

3.3 However, Plussal shall be entitled to assign the Agreement and all the rights and obligations under the Agreement in whole or in part to a third party without the Customer’s consent if it is essential with regard to Plussal’s business. Plussal shall notify the Customer of the assignment well in advance. 

 

3.4 For the avoidance of doubt, Plussal shall always be entitled to assign the Agreement in connection with any outsourcing of its activities, a business transaction, or any other corporate arrangement. Plussal shall be entitled to assign its receivables based on the Agreement to a third party. After the assignment of receivables has been communicated, payments shall only be valid if they are paid to the assignee.

 

4. Pricing, payment, price changes, and terms of payment

 

4.1 The prices shall be based on Plussal’s pricing, which shall be included in the order confirmation between the Customer and Plussal. The applicable rate of value-added tax shall be added to the prices. Plussal shall invoice the entire Service price in accordance with the Agreement and provide the Service as agreed after payment.

 

4.2 Plussal reserves the right to change the pricing. Service invoices shall be delivered primarily as e-invoices and by email or post if necessary. Invoices must be paid by the due date stated on the invoice.

 

4.3 Complaints about invoices must be made before the due date on the invoice. Plussal shall be entitled to charge penalty interest on late payments in accordance with the Interest Act as of the due date. Plussal shall also be entitled to charge all of the debt collection costs it incurs. Plussal shall be entitled to check the Customer’s credit records before the inception of the Agreement and while the Agreement is valid. If any defaults appear in the credit records, Plussal shall be entitled to rescind the Agreement.

 

4.4 Plussal shall be entitled to charge a higher invoicing fee in accordance with its pricing if the Customer’s actions give rise to additional work that has been agreed upon. Plussal shall not be entitled to claim compensation for any additional work resulting from delays considered to be Plussal’s fault.

 

4.5 The Customer shall be liable for the costs of the systems, platforms and applications used by Plussal to provide the Service, unless otherwise agreed in writing. After the Agreement ends, the Customer shall assume possession of and liability for the Service provided.

 

4.6 After this, the Customer shall be liable for the costs incurred in using the Service (such as advertising, maintenance and update costs). If the Customer does not wish to continue using the third-party services that were used, the Customer shall be obliged to terminate the services generating costs on its own initiative.

 

4.7 If a third-party service that is used contains a balance that is topped up in the service, the Customer shall be responsible for ensuring that the balance is topped up to prevent the suspension of service. Plussal shall not be liable for any outages or problems in providing the Service due to the balance running out.

 

4.8 If a third-party service uses a separate loadable balance and it is billed through Plussal, Plussal has the right to bill the balance in advance from the customer. When the balance is invoiced through Plussal, a processing fee is added to the invoices according to the valid price list. The processing fee is a minimum of 50 €. If all the paid balance isn’t used, it will not be carried over to the next season. Unused balance of more than 50 € can be returned to the customer if the customer so specifically requests. The request must be submitted (within two months from the end of the contract) to Plussal’s customer service with the account information that the balance will be returned to.

 

4.9 Any breaks or outages that may be taken during the provision of the Service shall not release the Party from liability for the fees incurred for using third-party services, nor shall Plussal expressly suspend or terminate the services for the duration of the break or outage.

 

5. Right of cancellation

 

5.1 The Customer shall be entitled to cancel an order at no cost within seven (7) days of the date of the order confirmation by notifying Plussal’s customer service team in writing at info@plussal.com. If an order is cancelled after this deadline, Plussal shall be entitled to charge the Customer for fifty per cent (50%) of the total outstanding value of the Service in cancellation costs, as well as any extra costs that may be incurred in providing the Service, such as design and implementation, work and materials. The total amount of cancellation costs, including extra costs, may not exceed the total cost specified in the order for the service.

 

6. General obligations of the Parties

 

6.1 The Parties shall operate in compliance with the applicable legislation and rules applying to advertising, as adopted in Finland. The Customer shall be liable for the accuracy of the information it provides. Plussal shall be liable for ensuring that the advertising it designs complies with legislation and good practice.

 

6.2 The Customer must notify Plussal in writing of any changes materially affecting the content or scope of the cooperation as soon as it becomes aware of them. Such changes may include, for example, a change in the Customer’s contact person, billing details, or business ID.

 

7. Plussal’s responsibilities 

 

7.1 Plussal shall not be liable for indirect or consequential damage, such as the reduction or suspension of the Customer’s turnover or production, loss of profit or income, loss of data or the costs incurred in recreating data, loss or damage incurred by the Customer’s contractual partner, or any other unforeseeable damage or damage due to force majeure.

 

7.2 Plussal shall not pay compensation for loss or damage due to a matter for which the Customer or a third party is liable. Plussal shall not be liable for any loss or damage incurred due to the disruption or operation of third-party services or systems.

 

7.3 Plussal’s liability for any errors of its own shall be limited to Plussal’s fee with regard to the resolution of the error, or the product or action, and the foregoing liability shall only apply to direct loss or damage.

 

7.4 Plussal shall not be liable for delays, errors, damages, or non-publication for reasons not attributable to Plussal, such as delayed material or claims caused by the inadequate quality of the material. Plussal shall only be liable for media reservations it makes itself.

 

7.5 Plussal shall be entitled to consider the Service to be rendered or the work obligation to be fulfilled if:

• the Customer fails to fulfil its obligation to provide information or to deliver material related to the Service;

• the Customer cannot be contacted by email or telephone for three (3) months;

• the Customer fails to fulfil its contractual obligations despite receiving reminders;

• the Customer is subject to a ban on business operations;

• the Customer is declared bankrupt, placed into corporate restructuring or liquidation, or otherwise declared insolvent;

• the Customer has lost or failed to obtain the necessary permits from the authorities or other bodies;

• the Customer uses services, applications, or systems in violation of the law or good practice; or

• the Customer’s actions cause Plussal to suffer a force majeure event.

 

7.6 In the foregoing circumstances, Plussal shall not be obliged to compensate the Customer for any work or Services that are not provided.

 

8. Intellectual property rights to the Service

 

8.1 The Service provided by Plussal to the Customer may include material protected by copyright, trademark law and other intellectual property rights. The Service shall be protected as-is by copyright in accordance with the Copyright Act applying in Finland. The Customer shall not be entitled to distribute, publish, copy, make available to the public, or otherwise commercially exploit protected material without the express written consent of the author, right holder or Plussal or unless expressly stated in the Service, except in the specific cases permitted by legislation. Among other things, consent shall be considered to include various types of functionality for sharing in social media and the various sharing methods offered by Plussal. However, in such cases, the name of the author or right holder shall be specified in accordance with good market practice.

 

8.2 The outcomes of actions performed by Plussal for the Customer or other Services provided by Plussal must not be used for the purposes of information services without Plussal’s written agreement. The outcomes of the foregoing actions or other Services provided by Plussal must not be resold or otherwise offered to third parties.

 

8.3 The ownership and intellectual property rights (including, but not limited to, copyrights and the rights of modification and transfer) of actions included in the Service, the content produced by Plussal, and the software used to maintain the actions, including updates and equivalent replacement software shall belong exclusively to Plussal or the licensing party of the software concerned. The Customer shall only receive a limited right of use required to use the Service and its content.

 

8.4 The Customer shall grant Plussal and its partners, without payment, the right to edit, copy, publish, or otherwise make available to the public the content that the Customer makes available to Plussal as part of Plussal’s Services to the Customer.

 

9. Customer’s liabilities

 

9.1 The Customer shall be liable for compliance with the law, good practice, and the rules of ethical advertising with regard to the content (including the Customer’s services) it delivers for the provision of the Services. The Customer shall be liable for any intellectual property rights, rights of use, and other permits it may require from third parties for the contents it delivers and produces for Plussal.

 

9.2 The Customer shall be liable for ensuring that the content it delivers to Plussal does not infringe any third-party copyrights, trademarks, or any other intellectual property rights. Plussal shall not be liable for any of the foregoing. If a third party makes a claim against Plussal in relation to the foregoing, the Customer undertakes to respond to the claim on Plussal’s behalf and defend Plussal and take all necessary action to ensure, at its own expense, that Plussal does not incur any liability for damages or other liability towards the said third party.

 

9.3 Plussal shall not have the right or possibility in every case to monitor whether the Customer’s activities or content comply with the law or good practice. If Plussal has reasonable grounds to believe that the Customer has acted in breach of sections 9.1 or 9.2, Plussal shall be entitled, but not obliged, to remove the content or part thereof to the extent necessary to stop the action or circumstances referred to in sections 9.1 or 9.2.  

 

9.4 The Customer shall not be entitled to a price reduction or any other recompense for the action referred to in section 9.3. The Customer shall be liable for all costs and damages incurred by Plussal due to the Customer’s actions in breach of sections 9.1 and 9.2.

 

9.5 The Customer shall be liable, at its own expense, for the purchase and maintenance of hardware, software, and telecommunications connections required by Plussal’s Services, as well as for other costs incurred due to the use of Plussal’s Services. The Customer shall also be liable for ensuring that its hardware, software, and telecommunications connections do not cause loss or damage to Plussal, its partners, or other users of Plussal’s Services. The Customer shall be liable, at its own expense, for the compatibility of the hardware, software, and telecommunications connections it uses with the actions taken by Plussal.

 

10. Confidentiality

 

10.1 The Parties shall uphold the confidentiality of all matters considered to be the other Party’s business and professional secrets of which they gain knowledge during the contractual relationship and for three (3) years thereafter.

 

10.2 Each Party pledges to refrain from disclosing the other Party’s confidential information to a third party without written consent. Confidential information shall be considered to include the contents of the Service before they are published and all other service information and technical usage rights related to the agreement if the information was marked in writing as confidential when it was disclosed.

 

10.3 Confidential information shall not include information that is publicly available without a breach by either Party or information that:

a) was developed independently without using the other Party’s confidential information;

b) a third party has lawfully provided to a Party;

c) must be disclosed to the judicial or state authorities.

 

10.4 If Plussal prepares content for the Service in accordance with this Agreement on behalf of the Customer and/or manages the operation of this Service, the Customer shall grant Plussal the right to disclose information related to the content covered by this Agreement to all of its partners related to the foregoing activities, including, for example, external service providers.

 

11. End of the agreement

 

11.1 The Agreement shall be valid for the term agreed upon in connection with the order confirmation, until the Service agreed upon in the order confirmation has been provided or indefinitely. Indefinite agreements must be terminated in writing. Termination shall take effect one (1) month from the date of notice of termination, whereupon Plussal’s responsibility to provide the Service shall also end. If the term of the Agreement is specified, Plussal shall be entitled to collect the fees for the provision of the Service until the end of the current contractual term. An Agreement with a fixed term must be terminated one (1) month before the end of the said contractual term; otherwise, the Agreement shall continue with a new contractual term of the previously specified length. An Agreement with a fixed term shall end automatically at the end of the specified contractual term without separate notice. The service packages for digital marketing (S), (M), and (L) are 6-month fixed-term contracts, after which the agreement continues indefinitely with a one (1) month notice period for termination.

 

11.2 Plussal shall be entitled to terminate the Agreement with immediate effect if the continuation of the Agreement would cause undue harm to Plussal or if the provision of the Service causes Plussal to incur unreasonable costs. If Plussal terminates the Agreement, the price of any Services that have been paid for in advance but not provided shall be returned in cash without interest or used to cover a payment obligation incurred by the Customer due to a breach of contract, if applicable. If the Customer terminates the Agreement before the provision of the Service agreed upon in the order, the cancellation terms specified in section 6 shall apply. Plussal shall be entitled to rescind the Agreement with immediate effect if the Customer commits a material breach of contract.

 

11.3 A material breach of contract shall be considered to have occurred if the Customer:

a) fails to fulfil its contractual obligations despite receiving a reminder;

b) is subject to a ban on business operations;

c) is declared bankrupt, placed into corporate restructuring or liquidation, or otherwise declared insolvent;

d) has lost or failed to obtain the necessary permits from the authorities or other bodies;

e) acts in contravention of the law or good practice; f) has acted in a manner that causes Plussal to suffer a force majeure event. 

 

12. Force majeure

 

12.1 Force majeure is considered to be an abnormal and relevant event that prevents the fulfilment of the Agreement, that occurs after the inception of the Agreement, that the Parties had no reason to take into consideration when making the Agreement, and that is beyond the control of the contractual Parties or that has impacts that cannot reasonably be avoided or eliminated. Examples of force majeure may include war in Finland, uprising, requisition or confiscation for the public good, import or export embargo, natural disaster, suspension of public transport, public telecommunications or energy supply, disruption to telecommunications and/or internet traffic, industrial action, fire, or any other abnormal cause of equal impact that is beyond the control of the contractual Parties.

 

12.2 Each Party shall immediately notify the other Party of the onset of force majeure and its impact on the fulfilment of the Agreement. The Party shall be released from its obligations and its obligation to pay damages if the breach of contractual obligations or failure to fulfil contractual obligations is due to force majeure.                

 

13. Amendments of the Agreement and the terms and conditions

 

13.1 Amendments to the Agreement shall be made in writing. Plussal shall be entitled to change the pricing and pricing models by notifying the Customer of the change in writing no later than one (1) month before the change is to take effect. Plussal may alter the content of the Services if it is necessary to keep the Services legal, up-to-date, and appropriate by notifying the Customer of the change in writing. Plussal reserves the right to update these general terms and conditions. Plussal shall notify the Customer by email of updates and amendments to the terms and conditions and their impact on existing agreements.

 

13.2 If the Customer does not accept Plussal’s changes to the pricing, the Service content or the terms and conditions, the Customer shall be entitled to terminate the Agreement, effective as per section 8.

 

14. Notifications

 

14.1 Plussal’s notifications to the Customer may be delivered by post, on the website, or by email. Messages sent by email and on the website shall be considered to have arrived when the recipient’s device receives the other Party’s message sent to the email address or website address. The Customer should notify Plussal’s customer service team in writing of changes in the company’s details (business ID, company name, address, contact details, contact persons) without delay at info@plussal.com.

 

15. Permission for references  

 

15.1 Plussal shall be entitled to use the Customer as a reference when it offers its services to other customers unless the Customer specifically prohibits it in writing. The prohibition of references should be sent to Plussal’s customer service team at info@plussal.com.

 

15.2 Plussal may use the Customer’s company logo on its website and in its presentation materials when providing information about references while the Service is provided and after the provision of the Service or the end of the Agreement. Reference information must not include any information that the Customer expressly specifies as business secrets.  

 

16. Applicable law and place of jurisdiction

 

16.1 Finnish law shall apply to this Agreement.

 

16.2 Any disputes arising from this Agreement shall be conclusively settled at arbitration in accordance with the Arbitration Rules of the Finland Chamber of Commerce. The number of arbitrators shall be one. The seat of arbitration shall be Helsinki. The language of arbitration shall be Finnish.      

 

17. Special terms and conditions related to designated services

 

17.1 Paid advertising services (e.g., Google, Microsoft, Facebook, Instagram, LinkedIn, Twitter, VK, Yandex, TikTok) Plussal shall place the Customer’s advertisements on the sites owned by the service provider and its partners’ content pages, partners’ search pages, or other systems belonging to its partners. Plussal shall not guarantee the timing of the advertisement impressions or clicks nor the number of advertisement impressions, placements, or clicks. Plussal shall be entitled to remove an advertisement if the service provider requires it. Plussal shall be entitled to alter an advertisement at any time according to the service provider’s advertising rules. Plussal shall not be liable for non-functional advertisements if the service does not work. The Customer shall be obliged to familiarise itself with the terms and conditions of use of the services and monitor compliance with the terms and conditions of use in the Customer’s contents, materials, and operations.

Plussal shall decide on the placement of advertisements on the foregoing sites. Plussal may offer the same site to several advertisers. The Customer’s advertisements may not be shown if there are more advertisers or advertisements on a particular site than the available number of display places or if the Customer’s advertisements do not surpass the agreed number of clicks or budget threshold.

Plussal shall be responsible for designing the Customer’s advertising. However, Plussal shall not be liable for the contents of the target sites reached by clicking on the URLs of advertisements, nor for the advertised services and products.

 

17.2 Services including proofing material (e.g., display advertising, website design, video advertisements, newsletters)

If a service includes a proofing round, Plussal shall send the proofing material to the Customer’s specified email address for review and approval. In such a case, the Customer shall have the time specified in the email (the general practice is 5 business days) to comment on the proof and request corrections. The proof shall be approved or changes shall be requested by responding to the email address from which the proof was sent. If it is necessary to conduct more proofing rounds than the default number included in the service, Plussal shall be entitled to charge for the additional proofing and commenting rounds. If a proof is not approved by the stated deadline, Plussal shall be entitled to consider the proof approved and continue providing the service with the content in the proof. If it becomes necessary to produce new material at a later stage, Plussal shall be entitled to charge for it separately. Any incorrect content (spelling errors) shall not be considered grounds for rescinding the Agreement, but Plussal shall be obliged to remedy the error in published material.

If the Customer has unusual quality requirements or is dissatisfied with the quality, it shall not be considered a breach of contract or grounds for rescinding the Agreement. Plussal shall comply with high quality standards in the material it produces, taking into consideration the constraints and rules related to the third-party service being used.

 

17.3 Services including reporting

If the service includes reporting, Plussal shall deliver reports related to the service level to the Customer by email or via a separate reporting system at the agreed intervals. If the Customer requires reports to be submitted to the Customer’s reporting system, Plussal shall have the option of invoicing separately for the implementation of the interface required to submit reports or transfer data. Plussal shall also have the option of declining to submit reports to the Customer’s system if there is a technical impediment or if the submission of the information would cause Plussal to incur undue costs.

 

17.4 Domain, hosting, and system services

Plussal shall provide the Service after the order. The provision of areas related to the Service (such as the registration or transfer of domain names) may be delayed for reasons beyond Plussal’s control. Plussal shall endeavour to notify the Customer of any delays insofar as is possible.

 

After the publishing of an online service implemented by Plussal, the Customer shall have 1 month to comment on any errors and omissions within the scope of the original agreement. Such corrections shall be carried out under warranty. If more than 1 month has elapsed since publication or if the requested changes or development work were not included in the original agreement, Plussal shall invoice for the changes at the agreed hourly rate. Plussal may provide the Service in accordance with the Agreement in the manner of its choosing. Plussal reserves the right to change the content of the Service, although it must communicate the change in advance. The normal fee shall be charged for changes made at the Customer’s request in accordance with the applicable price list. Plussal shall also be entitled to change the content of the Service by announcing the change in advance if it is necessary for information security reasons or other reasons. In such a case, efforts shall be made to communicate the change as quickly as possible after the fact. Plussal shall register the Customer’s domain name using third-party registration services. Plussal shall not be liable for the functionality of domain name registers, nor for the maintenance of registers or registration information.

 

Plussal may provide the Service in accordance with the Agreement in the manner of its choosing. Plussal […] the right to change the content of the Service, although it must communicate the change in advance. The normal fee shall be charged for changes made at the Customer’s request in accordance with the applicable price list. Plussal shall also be entitled to change the content of the Service by announcing the change in advance if it is necessary for information security reasons or other reasons. In such a case, efforts shall be made to communicate the change as quickly as possible after the fact. Plussal shall register the Customer’s domain name using third-party registration services. Plussal shall not be liable for the functionality of domain name registers, nor for the maintenance of registers or registration information.

 

The content of the Service shall be determined in accordance with the service description and any appendices that may accompany it. The Customer shall be entitled to use the internet address only for the internet use (hereinafter the “website”) of company/organisation or personal material. The resale of the internet address is prohibited. The website to which the internet address is directed must not offend anybody or violate Finnish law or good practice. Plussal reserves the right to disable the internet address if it considers the website material to be in breach of these provisions.

 

Plussal shall not be liable for any material that the Customer can access via the internet address. The Customer shall be obliged to ensure that the software (such as antivirus software) it uses is up to date.

 

The Customer shall be fully liable for material provided to other users, Plussal or third-party servers via the internet address. The Customer shall be liable for ensuring that the material does not disrupt internet traffic, infringe third-party copyrights, or violate the law, official regulations, or good practice. Plussal reserves the right to remove an internet address if the website or service behind it breaches the terms and conditions. The Customer shall store all material in the service at its own risk.

 

The Customer shall indemnify Plussal and third parties for any investigation, correction and/or other expenses incurred from any misuse. The Customer shall release Plussal and its employees of all possible sanctions that may be caused by the Customer’s actions or activities online or otherwise on the basis of this Service. The Customer shall be liable for ensuring that its online activities comply with the law and good practice. The unauthorised use or attempted use of the servers, services, or internet addresses of Plussal or third parties is prohibited.

The Customer shall be strictly prohibited from searching for and exploiting any information security vulnerabilities, and any such action shall lead to the immediate termination of the Agreement and possible compensation. The Customer must not use the internet address for direct marketing by email in violation of the law or good practice, nor shall it advertise its services in newsgroups, discussion forums, or other places in which this is forbidden.

 

Plussal’s liability for providing the Services shall be limited to no more than the amount stated in section 6 of these terms and conditions concerning the limitation of Plussal’s liabilities. Plussal shall not be liable for any indirect loss or damage that the Customer may incur for technical or other reasons. Plussal reserves the right to use technical means to prevent activities in breach of the Agreement. Plussal shall notify the Customer of any necessary changes that require the Customer’s intervention in relation to data protection or the technical functionality of the Service by email or another equivalent form of communication. The Customer shall be obliged to act in accordance with the communications to avoid potential data breaches, data protection issues and technical problems.

 

Plussal shall act as an intermediary in the registration of the domain name, completing the application forms on the Customer’s behalf. The domain name shall be registered with the information provided by the Customer (the party ordering the Service), and the Customer shall act as the administrative contact (owner) of the domain name.

 

Plussal shall take care of renewing the domain name if the domain name was originally registered through Plussal or transferred to the register used by Plussal and the related service charges have been paid by the due date. When registering international domain names, it should also be noted that the contact details of the domain name applicant (the party ordering the Service) are saved in the international WHOIS database, which lists the owners of all domain names. This is based on ICANN requirements that all registrars must follow. Plussal shall not be responsible for maintaining the registration details of domain names, nor for the functionality of the domain name registers.

 

The Service shall be considered defective if it materially differs from the specification in the service description and the deviation materially impedes the use of the Service. The Customer shall be obliged to report the defect as soon as it becomes apparent. The operation of the Service shall be monitored, and any defects shall be rectified as quickly as possible. However, any special terms and conditions in the service description concerning the rectification schedule shall apply. Urgent rectification work outside office hours shall be subject to separate agreement.

 

Plussal reserves the right to suspend the provision of the Service temporarily if necessitated by rectification, maintenance, or other work. Plussal shall endeavour to minimise the duration of the outage and notify the Customer thereof in advance whenever possible. Plussal reserves the right to decline to rectify an error caused by the Customer’s actions, such as abuse or improper use of the Service.                            

 

18. Data protection and processing of personal data     

 

18.1 The terms and conditions for the processing of personal data, which are included in these general terms and conditions, shall apply to this Agreement with respect to data protection and the processing of personal data.

 

19. Validity of the terms and conditions           

 

19.1 Plussal’s general terms and conditions shall apply as of 11 November 2023.

 

 

 

 

TERMS AND CONDITIONS FOR PROCESSING PERSONAL DATA

 

1. OBJECT AND APPLICATION OF THE AGREEMENT

​​

1. OBJECT AND APPLICATION OF THE AGREEMENT

   1. This agreement on the processing of personal data (the “Processing Agreement”) is an integral part of the service agreement (the “Service Agreement”) between Plussal Oy (the “Service Provider”) and its customer (the “Customer”) consisting of the order confirmation for the service and the general terms and conditions.

   2. For the purposes of this Processing Agreement, the Service Provider shall be considered the processor of personal data (the “Processor”), and the Customer shall be considered the controller (the “Controller”). Hereinafter, the Controller or Processor may be referred to as a “Party”, and both together may be referred to as the “Parties”.

   3. The Service Provider shall process personal data in accordance with this Processing Agreement on assignment from the Customer. The Service Provider shall be entitled to process personal data to provide the Service to the Customer in accordance with the Service Agreement. This Processing Agreement shall be valid for the term of the Service Agreement.

2. DEFINITIONS

   1. “Personal Data” shall refer to all data related to an identified or identifiable natural person or other personal data specified in the data protection legislation.

   2. “Processing” shall refer to one or more actions performed on Personal Data or datasets containing Personal Data, either through automatic data processing or manually, such as data collection, storage, organisation, structuring, retention, modification or alteration, retrieval, querying, use, disclosure of data by transfer, dissemination or otherwise being made available, data coordination or consolidation, restriction, erasure or destruction.

   3. “Data Subject” shall refer to a natural person whose Personal Data is processed in accordance with this Processing Agreement.

   4. “Data Protection Legislation” shall refer to the Finnish Data Protection Act (1050/2018, as amended), the European General Data Protection Regulation (EU 2016/679, as amended, known as the “GDPR”) and any other applicable national or EU data protection legislation and the instructions and rulings of the competent data protection authorities.

   5. “Data Breach” shall refer to an incident resulting in the Personal Data processed by the Processor on the Controller’s behalf being destroyed, lost, modified, disclosed without authorisation, or accessed by a party who is not entitled to process it, and any event that has or could have jeopardised the information security of the Personal Data from the Processor’s point of view.

3. PROCESSING OF PERSONAL DATA

   1. The Parties undertake to comply with the applicable Data Protection Legislation.

   2. The Controller shall specify the purposes and means of processing the Personal Data. The Controller shall be responsible for ensuring that it possesses the rights and consent necessary to process the Personal Data in accordance with the Service Agreement. The Processor shall process the Personal Data on the Controller’s behalf.

   3. The purpose and nature of the Processing of Personal Data, the categories of Personal Data processed, the categories of Data Subjects, the applicable information security measures, and the duration of Processing are described in more detail in Appendix B.

   4. The Personal Data processed in the Service shall be processed in the environment belonging to the Processor or its sub-processor on the basis of an agreement between the Processor and sub-processor.

   5. The Processor shall process the Personal Data in accordance with its data protection practices, information security guidelines, and the applicable Information Security Legislation during the term of the Service Agreement.

4. GENERAL OBLIGATIONS

   1. The Controller shall be entitled to provide the Processor with written instructions on the processing of Personal Data. The Processor must notify the Controller if it considers the instructions in breach of the Data Protection Legislation. 

   2. The Processor shall be responsible for ensuring that it processes the Personal Data (including transfers to third countries) only in accordance with this Processing Agreement, the Data Protection Legislation, and the Controller’s written instructions.

   3. The Processor must assist the Controller in fulfilling its obligations under the Data Protection Legislation. The Processor may invoice the Controller for such assistance in accordance with the applicable price list. In particular, the Processor must:

      1. take the requisite technical and organisational measures to ensure that the Controller can effectively implement the rights of data subjects under the Data Protection Legislation (access to data, rectification of data, objection to processing, restriction of processing, transfer of data) with respect to the Service;

      2. provide the Controller upon request with all such information that is necessary to implement the rights of data subjects or respond to requests for information from the authorities;

      3. notify the Controller of all enquiries received from data subjects or the authorities and, at the Controller’s request, assist in responding to them; and

      4. upon the Controller’s request and at the Controller’s expense, assist in impact assessments concerning the processing of Personal Data and/or prior consultations by the supervisory authority.

5. SUBCONTRACTORS

   1. The Controller shall be entitled to use subcontractors to process the Controller’s Personal Data without the express written consent of the Controller. The subcontractors and other technology partners used by the Controller at the inception of the Agreement are listed in Appendix A. Plussal shall be entitled to update the content of this appendix.

   2. The Processor shall be responsible for ensuring that its subcontractors undertake to comply with terms and conditions that are at least equivalent to this Processing Agreement. The Processor shall notify the Controller without delay if it discovers that a subcontractor is not fulfilling its contractual obligations.

   3. The Processor shall be liable for the actions and negligence of its subcontractors as if they were its own.

6. LOCATION OF PERSONAL DATA 

   1. The Processor or its subcontractors shall endeavour to process the Personal data inside the EU/EEA, but it may be necessary to process the Personal Data outside the EU/EEA to provide the Services.

   2. If the Processor or its subcontractors transfer or process the Personal Data outside the EU/EEA, the Processor shall ensure compliance with the Personal Data Legislation before transferring or Processing the data by undertaking to conclude an agreement containing the European Commission’s standard contractual clauses on the transfer or Processing of Personal Data (the “Standard Contractual Clauses”), or otherwise ensuring that the transfer or Processing meets the requirements of the Data Protection Legislation.

   3. The Service Provider undertakes to conclude data processing agreements with its subcontractors to fulfil its obligations in accordance with the Service Agreement. If the subcontractors are based outside the EU/EEA, the Parties shall agree that the Service Provider is entitled to ensure the transfer of the Personal Data outside the EU/EEA on the Customer’s behalf in an appropriate manner, such as by using the Standard Contractual Clauses. The Customer shall authorise the Service Provider to act in the foregoing manner, such as using the Standard Contractual Clauses on the Customer’s behalf.

7. INFORMATION SECURITY MEASURES

   1. The Processor shall take appropriate technical and organisational precautions to ensure the secure Processing of the Controller’s Personal Data, especially to prevent and protect the Personal Data from accidental loss, modification, destruction or damage. When assessing the appropriate level of such information security measures, the Processor must take into account the risks related to Processing the Personal Data, the level of technology, the implementation costs, the nature, scope, context, and purposes of the Processing, and the risks affecting the rights and freedoms of natural persons, which vary in likelihood and severity. At a minimum, the Processor undertakes to:

      1. pseudonymise and encrypt the Personal Data to uphold their confidentiality, if necessary;

      2. guarantee the continuous confidentiality, integrity, availability and fault-tolerance of the processing systems and services;

      3. ensure the capability to restore availability and access to the Personal Data within a reasonable time in the event of a physical or technical failure;

      4. create an operating model for testing, investigating and regularly assessing the effectiveness of the technical and organisational measures to ensure secure data processing; and

      5. conduct information security audits on the Personal Data processing functions.

   2. The Processor understands that the Personal Data is confidential and should be treated accordingly. The Processor shall ensure that the Personal Data is only processed by persons who are entitled to process them to provide the Service agreed upon in the Service Agreement. The Processor shall ensure that the persons entitled to process the Personal Data have undertaken to comply with a confidentiality obligation or are covered by an appropriate statutory confidentiality obligation.

8. PERSONAL DATA BREACHES

   1. The Processor shall notify the Controller in writing without undue delay if it becomes aware of a Data Breach affecting the Personal Data. Whenever the Processor notifies the Controller of a Data Breach, the Processor must provide at least the following information about the Data Breach:

      1. A description of the Data Breach;

      2. A description of the categories of Data Subjects and categories of Personal Data affected by the breach, along with the estimated numbers of each;

      3. A description of the likely or realised consequences of the Data Breach and the measures that the Processor has taken to mitigate any adverse effects; and

      4. A description of the corrective measures that the Processor has taken or intends to take in response to the Data Breach.

      5. The Processor must document all Data Breaches and the reasons for and impacts of them, as well as the corrective measures.

      6. At the Controller’s written request, the Processor must assist the Controller in communicating the Data Breach to the supervisory authorities and Data Subjects.

9. AUDITING

   1. The Controller or an independent auditor authorised by the Controller shall be entitled to audit the Processor’s compliance with the obligations relating to the Processing of Personal Data in accordance with this Processing Agreement and the applicable Information Security Legislation.

   2. The Parties shall be liable for their own auditing costs.

   3. The Controller must notify the Processor in writing at least sixty (60) days in advance of its intention to exercise its auditing right.

   4. The audit should be performed in a way that does not disrupt the Processor’s normal business activities.

10. LIMITATIONS OF LIABILITY

    1. The limitation of the Processor’s liability stated in the Service Agreement shall apply to this Processing Agreement.

11. ERASURE OR RETURN OF PERSONAL DATA

    1. During the validity of this Processing Agreement, the Processor must not erase the Personal Data it Processes on the Controller’s behalf, except at the express request of the Controller. The Processor shall be obliged to provide the Controller, within a reasonable time, with the Personal Data it is processing, a copy or extract thereof, at the written request of the Controller at the email address info@plussal.com.

    2. The Processor must erase or return to the Controller, as decided by the Controller, all the Personal Data at the Controller’s written request or when this Processing Agreement is no longer in force or when the Processing of the Personal Data is no longer necessary for the provision of the Services. When the Personal Data has been erased or returned to the Controller, the Processor shall destroy the Personal Data. The Processor shall be entitled to charge the Controller a fee for the erasure or return of the Personal Data.

 

APPENDIX A – List of Plussal’s subcontractors and technology partners

Plussal uses subcontractors and technology partners to enable it to provide the services it offers. The suppliers and technology partners provide digital marketing platforms, systems and services, storage and cloud services, technical support, customer service, research services, diagnostics and reporting services, and investigation services.

Operator Location

​

• Google  Dublin, Ireland

• Microsoft  Dublin, Ireland

• Tiktok  Culver City, United States

• Facebook, Meta  Dublin, Ireland

• LinkedIn  Dublin, Ireland

• Twitter  Dublin, Ireland

• The Rocket Science Group LCC (MailChimp)  Georgia, United States

• UpCloud  Uusimaa, Finland

• Slack  Dublin, Ireland

• Atlassian (Trello)  Amsterdam, the Netherlands

• OK Perintä  Ostrobothnia, Finland

• Multim Oy  Satakunta, Finland

• PoptinTel   Aviv-Yafo, Israel

• Dashthis  Quebec, Canada

• Wix  Tel Aviv, Israel

• Leadsie  London, United Kingdom 

​

 

APPENDIX B – Description of personal data processing activities

 

In this appendix, the Parties describe in more detail the nature and purpose of the processing of personal data, the categories of Personal Data, the categories of data subjects, the applicable information security measures, and the duration of the processing of Personal Data.

​

• Nature and purpose of processing the Personal Data:

 

Provision of Plussal’s Services to the Customer.

​

• Categories of personal data and categories of data subjects:

 

The Service Provider shall process the following categories of data subjects: customers, customer’s customers, customer’s employees.

 

The Service Provider shall process the following categories of personal data: name, personal ID code, email address, phone number

 

(c)     Applicable information security measures

 

The Service Provider shall follow its own information security procedures.

​

• Duration of the processing of Personal Data

 

During the validity of the Service Agreement.