This Privacy Policy explains how Avalus Oy processes personal data as a controller — that is, where we decide why and how the data is processed.
It does not cover documents our customers upload to the eSoppari service. For that processing we act as a processor on our customer's behalf, and this policy does not apply. Section 2 explains the difference and tells you where to go instead.
1. Who we are
Avalus Oy Business ID (Y-tunnus): 2554583-2 VAT number: FI25545832 Registered address: Lumikatu 11, 15340 Lahti, Finland
Contact for privacy matters: support@esoppari.fi
Data Protection Officer: Data Protection Officer, Avalus Oy, support@esoppari.fi
2. When this policy applies, and when it does not
This is the distinction that determines your rights and who you should contact.
2.1 Where we are the controller — this policy applies
We decide the purposes and means of processing, and this policy applies, when we process:
- personal data of people who contact us, register interest, or ask for a demonstration;
- personal data of our customers' administrators and users, for the purpose of operating their account, authenticating them, supporting them and billing them;
- our billing and accounting records;
- the platform audit register — the record of security-relevant and compliance-relevant actions taken in the service; and
- technical, service and security records generated by operating the service.
2.2 Where we are the processor — this policy does not apply
We act as a processor, on the instructions of our customer, in respect of:
- the contents of any document a customer uploads for signing;
- the personal data of signers invited by that customer; and
- the signing evidence generated for that customer's signing requests.
For that processing our customer is the controller. They decide what to upload, whom to invite, how long to keep it and when to erase it. Our role is governed by our Data Processing Agreement with them, not by this policy.
If you were invited to sign a document and want to know how your personal data is used, exercise a right, or object — contact the organisation that asked you to sign. They are the controller. If you contact us instead, we will not respond substantively; we will forward your request to that organisation without undue delay, because we are not permitted to act on your data on our own initiative.
The notice is on the page that every signing invitation opens, ahead of the identification step. It is not a separate page and there is no separate signer privacy policy: the notice is a card on the signing page itself, shown above the signature step. It identifies the organisation that invited the signer as the controller, names us as processor, states the Article 6(1) ground and the purpose that organisation selected for that signing request, explains that retention follows the inviting organisation's own schedule, and lists the signer's rights including the right to complain to a supervisory authority. The page asks the signer to confirm they have read the notice before it lets them continue to identification, and that confirmation, with the time it was given, is recorded against the signing request. It is kept with that request's own records, separately from the signed document.
A person named in a signing request the customer has not sent sees no notice, because we never contact them. A customer can save a signing request without sending it, holding the names and email addresses it has entered and the document it uploaded. Nothing is emailed to those people while the request stays unsent, so there is no point at which a notice would reach them. That data is still our customer's: they are the controller of it, we hold it as their processor, and Section 11 of our Data Processing Agreement sets out how long it is kept.
Because the inviting organisation is the controller, that notice is theirs, not ours. We present it on their behalf; the specifics of their processing — why they asked for the signature, how long they keep it — are theirs to state and ours to display. The Article 6(1) ground is theirs to choose, per signing request, alongside an optional purpose description in their own words. New accounts are seeded to Article 6(1)(b) — performance of a contract — so an organisation that never revisits the setting states that ground to its signers.
2.3 What a signature in the service attests
Access to a signing slot is authorised by possession of the signing link plus successful authentication with a valid national eID for the country the inviting organisation required. The service holds no expected national identification number for a signer, and so a completed signature attests that a verified national electronic identity signed that slot — not that a specific named person did. The identity recorded in the signed document is the one the eID scheme returned for whoever authenticated.
The inviting organisation is responsible for delivering each signing link to the intended person. We are not in a position to verify that it reached them.
3. What we process, why, and on what legal basis
3.1 Prospects and enquiries
| Data | Name, business email address, organisation, job title, the content of your enquiry |
| Purpose | Responding to you; assessing whether the service fits your needs; preparing a proposal |
| Legal basis | Article 6(1)(b) — steps at your request prior to entering a contract; or Article 6(1)(f) — our legitimate interest in responding to business enquiries |
| Retention | 24 months from the last contact, then deleted |
3.2 Registration for a tenant account
| Data | Name, business email address, the name the account is registered under (your organisation, or your own trade name), the business identifier where you register an organisation, country, the role you select, and the time and document versions of your acceptance of our Terms of Service and Data Processing Agreement |
| Purpose | Creating and provisioning your account; verifying the organisation; establishing who is authorised to administer it; evidencing which version of each agreement was accepted and when |
| Legal basis | Article 6(1)(b) — performance of a contract, or steps prior to it. Providing these details is a contractual requirement: without them we cannot open or operate an account |
| Retention | For the term of the agreement, plus the period in Section 6 |
3.3 Administrators and users of a customer account
| Data | Name, business email address, assigned role and permissions, preferred language, authentication events, multi-factor enrolment status |
| Purpose | Authenticating you; applying your permissions; providing support; notifying you about your account and the service |
| Legal basis | Article 6(1)(f) — our legitimate interest in operating a secure multi-tenant service and administering our contract with your employer. Where you are the contracting party yourself, Article 6(1)(b) |
| Retention | While your access is active, plus the period in Section 6 |
We receive your name, email address and role from your employer when it invites you. Your employer decides whether you have an account and what you may do with it. If you want your access removed, ask them — we act on their instruction.
3.4 Billing and accounting
| Data | Billing contact name and email, invoicing address, business identifier, VAT number, invoices, payment records, usage volumes |
| Purpose | Invoicing, collecting payment, tax and statutory accounting |
| Legal basis | Article 6(1)(b) — performance of the contract; and Article 6(1)(c) — compliance with a legal obligation, in particular the Finnish Accounting Act and the Finnish VAT Act |
| Retention | Six years from the end of the calendar year in which the financial year ended, as required by the Finnish Accounting Act (kirjanpitolaki 1336/1997). A finalised invoice is a snapshot: it keeps the billing details as they stood at issue, and that snapshot is the one category of personal data an erasure cannot remove, because the Finnish VAT Act (arvonlisäverolaki 1501/1993) requires the invoice to remain intact |
3.5 Support correspondence
| Data | Your name and email, the content of your message, and any information you choose to include |
| Purpose | Handling and resolving your request; improving the service |
| Legal basis | Article 6(1)(b) or Article 6(1)(f) — our legitimate interest in supporting our customers |
| Retention | 24 months from resolution |
Please do not send us documents containing personal data as part of a support request. If you need to show us a problem, describe it or send a redacted extract.
3.6 Security, service records and the audit register
| Data | IP address, user agent, request and session identifiers, timestamps, authentication outcomes, rate-limit events, and audit records of administrative, lifecycle, billing and compliance actions |
| Purpose | Detecting and investigating unauthorised access, abuse and fraud; diagnosing faults; maintaining the integrity of the service; demonstrating that compliance obligations were met |
| Legal basis | Article 6(1)(f) — our legitimate interest in the security and integrity of our service, and that of our customers; Article 6(1)(c) where retention is required to demonstrate compliance |
| Retention | See below — three classes, set by us as platform policy |
The audit register is ours, not our customers'. Its retention is fixed by platform policy and is not configurable by a customer, because it is the evidence that we operated the service correctly. Every audit record falls into one of three classes:
| Class | Covers | Retained |
|---|---|---|
| Short | Authentication events and data-access records | About 90 days |
| Long | Administrative actions, account lifecycle, billing | About seven years |
| Permanent | Compliance records — records of erasure and of legal-hold overrides | Indefinitely |
Permanent records are never deleted, because deleting them would destroy the evidence that a compliance obligation was met. This is separate from, and unaffected by, the retention schedule a customer configures for its own documents (Section 2.2).
We minimise personal data in our operational records by design. Error messages, log entries, monitoring metrics and health checks are written to carry opaque identifiers only. Email addresses, names, national identifiers and IP addresses are deliberately kept out of them. The web server's access log is the exception: it records the IP address and browser identification of each request, as an operational record outside the audit register. It is rotated by size and holds no more than the most recent 100 MB of requests, after which the oldest entries are discarded.
3.7 Marketing
We do not send marketing email.
The only email we send is transactional: messages required to operate the service, such as signing invitations, reminders, completion notifications, security alerts, invoices and notices about changes to the service or to these documents. You cannot unsubscribe from those, because they are how the service works — but they are not marketing, and we do not use them to promote anything.
We do not build marketing profiles, we do not run advertising, and we do not sell, rent or share contact details with anyone for their own marketing. There is no newsletter, no tracking pixel in our email, and no third-party marketing platform holding your details.
If this changes, we will update this policy before sending anything, and any marketing we ever send will carry a working unsubscribe link and honour an objection immediately.
4. Cookies and similar technologies
We use only cookies that are strictly necessary to operate the service.
We do not use third-party analytics, advertising or tracking technologies. There is no Google Analytics, no tag manager, no advertising pixel and no third-party session-recording tool anywhere in the service.
Because we set only strictly necessary cookies, no consent banner is required under section 205 of the Finnish Act on Electronic Communications Services (917/2014), which implements Article 5(3) of Directive 2002/58/EC, and we do not display one.
| Cookie | Purpose | Type |
|---|---|---|
esign_session |
Identifies your authenticated session in the customer administration portal. Contains an opaque random identifier only — no personal data and no access token | Session, strictly necessary |
esign_operator_session |
The same, for our own operators' console | Session, strictly necessary |
esign_signing_token |
Associates a signer with the signing request they were invited to | Session, strictly necessary |
esign_locale |
Remembers your language choice so pages that cannot read your profile still render in it | Persistent, strictly necessary for functionality |
| Transient sign-in cookies | Short-lived values protecting the sign-in and eID exchanges against interception and cross-site request forgery, and returning you to the page you started from. Deleted as soon as the exchange completes | Session, strictly necessary |
Access tokens are never placed in a cookie or exposed to the browser. They are held on our servers and referenced by the opaque session identifier above. This limits what an attacker who obtains a cookie can do.
5. Who we share personal data with
We share personal data only with:
- Service providers processing on our behalf. For controller-side processing these are our cloud infrastructure provider, our email relay, and our business email service, which holds the mailbox your correspondence with us arrives in. The providers processing our customers' data are named in Annex III to the Data Processing Agreement.
- Professional advisers — accountants, auditors and lawyers — where necessary and under a duty of confidentiality.
- Authorities, where we are required by law to disclose. We will tell you unless legally prohibited.
- A successor, in connection with a merger, acquisition or sale of assets, subject to this policy continuing to apply.
We do not sell personal data, and we do not share it for third-party marketing.
6. How long we keep personal data
Retention periods are stated in each row of Section 3. Where none is stated, we keep personal data for as long as necessary for the purpose, and then delete it.
After a customer agreement ends and the tenant account is closed, controller-side account data — administrator and user records, contact details, account configuration — is deleted within 12 months, except:
- billing and accounting records, retained for six years from the end of the calendar year in which the financial year ended, under the Finnish Accounting Act (Section 3.4);
- audit records, retained by class as set out in Section 3.6, with the permanent class kept indefinitely.
Customer documents and signer data follow the customer's own retention schedule, not this policy — see Section 2.2, and Section 11 of the Data Processing Agreement. We do not state a date by which they are gone, because we do not set it: closing an account submits an erasure request for every signing request in it, and each is executed only once the customer's own retention window has lapsed; closing the account releases any legal hold the customer declared. Where a customer configured a ten-year window, erasure follows that window. A signing request a customer saved and never sent follows no retention window at all, because none can be computed for it. If the service marks it incomplete and nobody has edited it for at least 30 days, we may delete it automatically; otherwise we do not delete it on our own initiative. Section 11 of the Data Processing Agreement explains what does happen to it.
7. Where personal data is processed
We do not transfer personal data outside the European Economic Area. All processing is carried out in the EEA, and our personnel are located in the EEA.
| Processing | Provider | Location |
|---|---|---|
| Application compute, managed PostgreSQL database, hardware security module holding the seal key | Google Cloud | europe-north1 (Hamina, Finland) |
| Object storage for documents, signed documents and invoice PDFs | Amazon Web Services | eu-north-1 (Stockholm, Sweden) |
| Qualified electronic timestamps and the organisational seal certificate | SK ID Solutions | Estonia |
| Electronic identification broker | Idura ApS; Signicat AS is the alternate, engaged only after notice under the DPA | Copenhagen, Denmark |
| Transactional email relay | Scaleway Transactional Email (Scaleway SAS) | fr-par (Paris, France) |
| Business email: the mailbox for support, notices and requests | Google Workspace (Google Ireland Limited), with an EU data region policy applied | EEA |
If this changes, we will update this policy and put in place a valid transfer mechanism under Chapter V GDPR before any transfer takes place.
8. How we protect personal data
We apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest, strict separation between customers enforced at the database level, role-based access control with multi-factor authentication on every account, retention locks on completed signed documents and invoices in object storage, and audit logging of administrative action.
These measures are described in detail in Annex II to our Data Processing Agreement, including a section listing controls we do not currently have.
No system is perfectly secure. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will inform you in accordance with Article 34 GDPR.
9. Automated decision-making
We do not carry out automated decision-making producing legal or similarly significant effects, and we do not carry out profiling, within the meaning of Article 22 GDPR.
The service applies automated processing — for example, deciding when a document's validation data is extended, or when a retention period has elapsed — but these are technical operations under rules our customer configures or our agreement with them sets, not decisions about a person.
10. Your rights
Where we are the controller, you have the right to:
- access the personal data we hold about you, and receive a copy;
- rectify inaccurate or incomplete data;
- erasure, where the data is no longer necessary, you withdraw consent we relied on, or you successfully object;
- restrict processing while an objection or accuracy dispute is resolved;
- data portability, for data you provided to us that we process by automated means on the basis of contract or consent;
- object to processing based on our legitimate interests, on grounds relating to your particular situation. You may object to direct marketing at any time, without giving reasons, and we will stop; and
- withdraw consent at any time, where we rely on consent. This does not affect processing carried out before withdrawal.
Two limits apply. Finalised invoices cannot be altered or erased, because the Finnish VAT Act requires them to remain intact (Section 3.4), and audit records in the permanent class are not deleted (Section 3.6).
To exercise a right, contact us at support@esoppari.fi. We respond within one month, extendable by two further months for complex requests, in which case we will tell you within the first month.
We may need to verify your identity before acting, and will ask only for what is necessary to do so.
Requests about signing documents. If your request concerns a document you were asked to sign, see Section 2.2 — please contact the organisation that invited you.
11. Complaints
If you believe we have processed your personal data unlawfully, please contact us first so we can try to resolve it.
You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement. The Finnish supervisory authority is:
Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) Postal address: PO Box 800, FI-00531 Helsinki, Finland Website: https://tietosuoja.fi
12. Changes to this policy
We may update this policy. Every version is versioned and dated, and the current version is always published at this address. Where a change materially affects how we process your personal data, we will notify affected individuals directly where we can, and in any event before the change takes effect.
Superseded versions remain available on request.