Data processing agreement

Article 28 GDPR · version 1.5 · in force from 3 November 2026. Part of the terms of service.

1. Parties and scope

This agreement binds the customer (the "controller") and Sanni Pauliina Härkönen, a sole trader established in Finland, Business ID 3518859-2 (the "processor", "we"), as part of the terms of service, to the extent that we process personal data on the customer's behalf when scanning a site the customer has named, paid or free. It does not cover data we process as an independent controller (account, billing, support and log data, and our own research scans); the privacy notice describes those. If the customer scans a client's site, the customer answers for its agreement with the client allowing us as a sub-processor; we contract only with the customer. In matters of personal data this agreement takes precedence over the terms.

2. What is processed

• Subject and nature: loading the public pages of the site the customer names in a browser, analysing them, taking and marking screenshots, storing the findings, producing the report and repeating this weekly for a subscription.
• Purpose: finding and reporting the site's accessibility failures to the customer.
• Data and data subjects: personal data the site itself publishes, such as names, job titles, contact details and photos of staff or other people, as they appear in screenshots and in the code of failing elements; the addresses of the pages.
• Special categories: not intended. If a site's public pages show them, they become part of the screenshots; the customer answers for the legal basis.
• Duration: for the subscription and 90 days after it ends; free results 30 days.

3. Our obligations

Instructions. We process the data only on the customer's documented instructions: the terms, this agreement and the site the customer names. If we think an instruction breaks data protection law, we say so at once.

Confidentiality. Only the operator of Sigila, who is bound to confidentiality, has access to the data, and only as far as the task requires.

Security. We keep the measures in annex 2 (article 32) and keep them up to date.

Sub-processors. The customer authorises the sub-processors in annex 1. We announce intended changes by email at least 30 days in advance; the customer may object on reasonable grounds, and if we find no solution, cancel before the change takes effect. We bind sub-processors to equivalent obligations and answer for them as for ourselves. We do not send the customer's pages to an AI service unless the customer has separately ordered it.

Transfers. The scanned pages, screenshots and findings stay in the EU. Transfers outside the EU/EEA happen only through the sub-processors in annex 1 on the grounds stated there, or where EU or member-state law requires it, in which case we tell the customer first unless the law forbids it.

Data subjects. We help the customer, with reasonable technical means, to answer requests from data subjects. If a person contacts us about a customer's scan, we pass the request to the customer without delay.

Assistance. We help the customer with security, breach notifications, impact assessments and prior consultation (articles 32–36) with the information we have.

Personal data breach. We tell the customer without undue delay and at the latest within 48 hours of becoming aware of it, with what we know of its nature, the data and people concerned, its likely consequences and what we have done, and we add to it as we learn more.

Deletion. When the subscription ends, we delete the reports and the personal data in them after 90 days, unless the law requires us to keep them; the customer can download the findings as CSV or JSON before that. Backups are overwritten in their normal cycle.

Demonstrating compliance and audits. On request we give the customer the information needed to show that this agreement is kept. The customer or an independent auditor it appoints may audit once a year, with 30 days' notice, in normal working hours and without putting other customers' data at risk; we may answer first in writing and with our sub-processors' certifications.

4. The customer's obligations

The customer answers for its right to have the site scanned and for the legal basis of the processing, and for informing people on its own site where needed. The customer does not instruct us to sign in, submit forms, get past access controls or target special categories of data.

5. Liability and other terms

The limits of liability in the terms apply as far as article 82 GDPR allows. This agreement is in force while we process personal data on the customer's behalf. Finnish law and the dispute clause of the terms apply.

Annex 1: sub-processors

• UpCloud Oy, Helsinki, Finland: server and database, where scans run and reports are stored. No transfer outside the EU.
• Resend (USA): sends the emails that tell the customer a report is ready; they carry the site address and a link, not the pages. Transfer under the EU–US Data Privacy Framework or the EU standard contractual clauses.
• Google (Gemini API, USA): only when the customer starts a Sigila Crash Test, which is the separate order for AI processing; receives pictures and text of the pages the test visits, to decide the AI persona's steps. Not used to train Google's models. Transfer under the EU–US Data Privacy Framework or the EU standard contractual clauses.

Annex 2: technical and organisational measures

• Server and database in Finland; access only over SSH with a key, by the operator alone.
• All traffic encrypted (HTTPS/TLS); reports open only through a sign-in link or a private result link.
• Sign-in tokens stored only as hashes; no passwords exist.
• Nightly backups in an AES-256 encrypted image on the operator's own computer in Finland, not on third-party storage.
• Monitoring of the service and the disk, with alerts to the operator's phone; server logs kept 30 days.
• An incident procedure that records each event and its deadlines.