Terms and Conditions

These general terms and conditions (hereinafter "Terms of Service") govern the use of the online service and related website provided by Quulio (business ID: 3243343-3) to sole traders ("toiminimi") and limited liability company entrepreneurs, as further described in the service description.

"Service Provider" means Quulio Oy, which provides the Customer with services available via the internet, enabling the Customer to register a sole trader ("toiminimi") or a limited liability company ("osakeyhtiö") in the registers of the Finnish Patent and Registration Office (PRH) and the Finnish Tax Administration (Verohallinto), and to manage obligations related to the business operations of the sole trader or limited liability company, such as invoicing, accounting, and tax filings.

"Customer" or "Company" means a Finnish sole trader ("yksityinen elinkeinonharjoittaja") or Finnish limited liability company ("osakeyhtiö") registered or to be registered through the service in the trade register of the Finnish Patent and Registration Office (PRH) and the registers of the Finnish Tax Administration, which has acquired the online service provided by the Service Provider.

"Sole Trader Entrepreneur" ("Toiminimiyrittäjä") means a natural, adult person residing in the European Economic Area (EEA) who is subject to taxation in Finland, and who registers a sole trader through the service or transfers the accounting of a previously established sole trader to the service.

"Owner-Entrepreneur" ("Omistajayrittäjä") means a natural, adult person residing in the EEA who is subject to taxation in Finland and who, alone or together with their family, owns at least 50% of the shares of the Customer's limited liability company.

"User" means the Sole Trader Entrepreneur, the Owner-Entrepreneur, or a third person designated by them who uses the service. The User's access right is personal and credentials may not be transferred to third parties.

"Service" means the service, applications and software, and the website content available at https://www.quulio.com/, through which a Sole Trader Entrepreneur or Owner-Entrepreneur may independently incorporate a company, invoice clients for work performed through the Company, pay invoices, review the company's account transactions, manage the company's accounting, submit statutory notifications to authorities, and make statutory payments. The Service includes only those measures described as part of the service in the service description. The Service does not include, for example, financial, legal, or tax advisory services related to the Customer's business activities.

"Add-on Service" means all free and paid supplementary services defined in the price list, which the Service Provider offers to Customers alongside the Service, either independently or together with a payment service provider or other partner. Each add-on service enables broader use of the Service by the Customer. Add-on services may, depending on their nature, be free of charge, charged as a one-time fee, or charged as a monthly fee. A selected add-on service is activated in the service or by notifying customer support of its activation, and is activated from the date of approval or the selected start date.

"Voucher" ("Tosite") means a purchase invoice, sales invoice, travel expense report, memorandum voucher, payroll voucher, or other accounting document uploaded to or created in the service by the Customer, on the basis of which the service produces accounting materials and reports for the Customer.

Hereinafter, the Service Provider and the Customer are each referred to individually as a "Party" and collectively as the "Parties."

The contract is deemed to have been formed between the Parties when the Customer has accepted these Terms of Service and the Privacy Policy.

The Terms of Service apply to all registered Customers and to Users operating on behalf of the Customer. The Service may only be used for conducting business operations, and the Customer confirms their understanding that consumer protection legislation ("kuluttajansuojalaki") does not apply to the use of the Service or to the relationship between the Parties.

The monthly service fee includes financial administration features related to the Company's invoicing and accounting. The Service enables the Customer to perform double-entry bookkeeping ("kahdenkertainen kirjanpito") for limited liability companies based on information provided and documents and vouchers uploaded to the service. Use of the Service requires that the Customer grant the Service a suomi.fi authorisation for the management of tax matters and payroll calculation.

The Service does not include any financial, legal, or tax advisory services related to the Customer's business operations, and the Service Provider is not obligated to provide such services. Any guidance offered by the Service Provider relates solely to the usability of the Service and software support. The Service Provider is not responsible for the interpretation of foreign tax, corporate, or other legislation.

The Customer, as an entity subject to the Accounting Act ("kirjanpitovelvollisuus"), is solely responsible for their bookkeeping; as a taxpayer, for their taxes; as an employer, for their employer obligations; and as a data controller ("rekisterinpitäjä"), for their data controller obligations. The Customer is responsible for planning and executing their own business operations. The Service may not be used if the Customer has income sources other than those subject to the Business Income Tax Act ("elinkeinoverolaki"). It is the responsibility of a limited liability company Customer to ensure that their business accounting is suitable for preparation on a cash basis ("maksuperusteinen").

Use of the limited liability company service requires the Customer to grant the Service the right to mirror transaction data from the Customer's accounting software to the Service Provider's service through a secure connection via BRIOX. Following account integration, the Customer and the Service Provider may view the transaction data of the linked account directly within the service.

Accounting included in the monthly service fee is prepared from the date of registration, provided that the Sole Trader Entrepreneur or Owner-Entrepreneur has granted the Service a suomi.fi authorisation for tax matters and payroll. Accounting for periods prior to registration ("backlog accounting" / "rästikirjanpito") is prepared under a separate agreement and pricing schedule. The Service Provider is under no obligation to perform backlog accounting and may refuse to do so at its discretion. For the avoidance of doubt, the transfer of opening balances from accounting reports prepared by the Customer's previous accountant does not constitute backlog accounting.

The Customer may upload vouchers to the service and store them there for the duration of the customer relationship; however, the Service Provider is not responsible for fulfilling the Customer's personal statutory obligations regarding the preservation of uploaded vouchers and accounting materials. The Customer acknowledges that, as an entity subject to the Accounting Act, it is solely responsible for the statutory retention of its vouchers and accounting materials. To meet these obligations, the Customer must ensure it retains and stores legally required information appropriately outside of the Service. The Service Provider retains vouchers uploaded by the Customer for two (2) months from the termination of the customer relationship. The Customer is responsible for backing up vouchers and accounting materials upon termination of the customer relationship.

The current price list is available on the Service Provider's website unless otherwise agreed. Pricing is based on a monthly fee, either as a percentage and/or a fixed fee, which covers the basic features and is invoiced to the Customer as an e-invoice ("verkkolasku") on the last day of each month. The Customer may add add-on services for which separate charges apply in addition to the monthly fee. Pricing may vary between customer segments, and the Service Provider may offer discounts to eligible customers. The Service Provider reserves the right to amend service prices. Price changes will be communicated to the Customer in advance, taking effect at the beginning of the next billing period. By continuing to use the Service after a price change, the Customer accepts the new prices.

The Sole Trader Entrepreneur and Owner-Entrepreneur are, under certain statutory conditions, obligated to take out an entrepreneur's pension insurance ("yrittäjän eläkevakuutus / YEL"). This insurance may also be taken out voluntarily. Each entrepreneur is responsible for independently determining their YEL obligation and taking out the required insurance. YEL insurance provided by the Service Provider's partner insurance company may be applied for through the service. When applying for the insurance, the Customer understands that information entered into the service for insurance purposes will be transmitted to the insurance company for assessment.

The Customer is obligated to independently insure their business and the sole trader or owner-entrepreneur, for example with accident and liability insurance ("tapaturma- ja vastuuvakuutus") covering personal injury and property damage caused to the Customer, a client, or third parties during the performance of work on behalf of the Customer.

The Customer may authorise the Service Provider in the service to transmit the Customer's contact details to an insurance company for purposes of offering other relevant business insurance coverage.

The Service Provider, in turn, maintains an adequate liability insurance ("vastuuvakuutus") for its own operations. In the event of a loss, the Customer must cooperate in providing the insurance company with necessary information and must afford the insurer the opportunity to assess the extent and nature of the loss.

A detailed description of the Service's content and scope limitations is found in a separate service description document. The Service Provider has the right to produce the Service and add-on services in a manner it deems appropriate, and may use subcontractors ("alihankkijat") in delivering the Service. The Service Provider does not guarantee the suitability of the Service for the Customer's intended purpose and does not guarantee uninterrupted service availability.

General instructions for using the Service are available on the Service Provider's website. Specific instructions may be sent to the Customer via the service, email, or text message. The Customer may also be contacted by phone, and customer calls may be recorded for the purpose of confirming instructions given, quality assurance, or staff training.

The Service Provider has the right to modify the technical implementation of the Service provided the overall level of service does not decrease. The Service Provider also has the right to modify the Service if such a change is required by mandatory legislation or a regulatory authority's order.

Use of the Service is subject to the following restrictions and prohibitions:

• Conducting or invoicing for business activities contrary to law or these Terms of Service is prohibited
• When operating a licensed business, the Customer is solely responsible for holding the required licence, registration, qualification, and any applicable self-monitoring plan ("omavalvontasuunnitelma")
• A person subject to a business prohibition ("liiketoimintakielto") may not act as a Customer or serve as CEO or board member of the Customer company
• The Customer has no right to use intellectual property rights ("immateriaalioikeudet") held in the Service Provider's name; all trademarks, registered trademarks, product names, trade names, or similar assets are the property of the Service Provider.

The Service Provider has excluded certain industries and circumstances from the Service, as specified in the service description and service limitations document on the Service Provider's website. If the Customer's company operates in or its business is related to those industries, the Service Provider may terminate the Customer's agreement and cease providing the Service without notice. In ambiguous cases, the Customer must contact the Service Provider's customer support.

The Service does not, as a rule, handle employee payroll calculations, although users may calculate their own salaries within the service.

The Owner-Entrepreneur may withdraw funds from the limited liability company in various ways, such as salary or dividends ("osingot"). The Service provides the option for the Owner-Entrepreneur's own payroll calculation, but the payroll of any employees must be handled outside the Service. If the Customer employs external workers, the Customer is independently responsible as the employer for interpreting and complying with employment legislation, applicable collective agreements ("työehtosopimukset"), employer obligations, and working time records.

If the Owner-Entrepreneur wishes to distribute dividends, they must contact the Service Provider's customer support. Dividends may only be distributed when the conditions for the distribution of funds under the Limited Liability Companies Act ("osakeyhtiölaki") are met and when separately agreed with the Service Provider. There may be at most one dividend distribution decision per calendar year. The Customer is responsible for ensuring compliance with the provisions of the Limited Liability Companies Act governing the distribution of assets and that dividend distribution decisions and related documentation meet statutory requirements.

Responsibility for the accuracy, sufficiency, correctness, completeness, and relevance to accounting of data and materials submitted to the accounting office relating to the financial year and subsequent events lies with the Customer.

The Customer must ensure that the Service Provider at all times holds up-to-date basic information about the Customer, including contact details, personal information, financial year, trade register details, industry, registered domicile, nationality, board members, and any other information required by current legislation or otherwise necessary.

The Customer and each User undertake, when using the Service, to comply with Finnish legislation in force, regulatory guidelines, these Terms of Service, and any instructions given by the Service Provider from time to time. The Customer is responsible for ensuring that statutory requirements applicable to the limited liability company's business operations, including qualifications, licences, and special guarantees, are met, and that work has not been performed in a manner contrary to good practice or law.

The Customer is independently responsible for their accounting and taxes. The Customer acknowledges that the Service Provider does not act as the accountant or accounting firm of the entity subject to the Accounting Act, and does not guarantee the accuracy or correctness of the accounting, financial statements, or tax filings produced on the basis of information provided by the Customer. The Customer acknowledges that the sole trader or limited liability company does not cease to exist even if the Customer suspends use of the Service, and that the company's obligation to maintain accounts continues. The Customer undertakes to make all changes to the sole trader's or limited liability company's operations (e.g., changes in responsible persons) directly with the Finnish Patent and Registration Office or the Finnish Tax Administration, and to notify the Service Provider of such changes without delay.

The Customer must be able to demonstrate to the Service Provider, when requested, that they have delivered a work performance in accordance with the engagement contract between the Customer and the client, or that only correct and business-related transactions and vouchers are included in the accounting. The Customer is responsible for keeping balance sheet entries up to date and accurate, and for notifying the Service Provider of any changes. The Customer is liable for the accuracy and acceptability of all information provided, invoices created, and expense reports, and is obligated to provide the Service Provider and the client with all information necessary to settle the agreed price for the work performed and to deduct taxes and statutory fees.

The Customer understands that the Service Provider produces the Service based on information delivered by the Customer and has no obligation to verify and does not verify the accuracy, sufficiency, or completeness of such information and materials. In the Sole Trader service, the Service Provider reserves the right to reject a voucher, invoice, or expense claim that is contrary to legislation or the Terms of Service, or where the basis for the invoice is otherwise unclear. The Service Provider also reserves the right to request additional information or clarification concerning an entry, voucher, or invoice. In the limited liability company service, the Service Provider has the right to request further information concerning vouchers added to the accounting and their accuracy. If an added voucher is not related to business operations, it is recorded as a receivable from the Owner-Entrepreneur. The Customer must respond to information requests from the Service Provider without delay.

If the Customer refuses to follow the Service Provider's bookkeeping instructions or other guidance related to preparing accounting records, the Service Provider may, at its discretion, either accept the corresponding entries at the Customer's own risk or cease providing the Service. This clause also applies where there is a divergence in interpretation of applicable law, regulation, guidance, or good accounting practice ("hyvä kirjanpitotapa").

The Customer is responsible for providing the Service Provider with the information and materials required for service provision at the times notified by the Service Provider, so that the service can be delivered on the promised schedule. The Service Provider is not responsible for delays in service delivery caused by the Customer. The Customer undertakes to notify the Service Provider of all matters that may affect the provision of the Service.

The Customer confirms that they are subject to taxation in Finland for work invoiced through the Service. Throughout the customer relationship, the Customer must maintain a valid registration in the Prepayment Register ("ennakkoperintärekisteri"). VAT registration ("arvonlisäverorekisteröinti") becomes mandatory if the Customer's turnover exceeds EUR 15,000. VAT registration is not required if the Customer's industry is defined as VAT-exempt under the Value Added Tax Act ("arvonlisäverolaki"). The Customer acknowledges that operating as an entrepreneur and using the Service may affect the responsible person's eligibility for unemployment benefits and other compensation. The Sole Trader Entrepreneur and Owner-Entrepreneur are independently responsible for determining the potential effects of using the Service on their own benefits and obligations.

The Customer must provide the Service Provider and the account information service provider with the customer due diligence information required under Chapter 3, Section 3 of the Act on Preventing Money Laundering and Terrorist Financing ("rahanpesulaki") as part of opening the customer relationship, and must keep such information up to date throughout the term of the agreement. If the Customer fails to provide this information or does not meet the requirements of the Anti-Money Laundering Act, the Service cannot be provided and the Service Provider may terminate the service relationship without explanation.

The service fee entitling access to the basic features of the Service is charged in accordance with the current price list in force at the time. Any paid add-on services activated by the Customer are charged in addition to the general service fee. Changes to the pricing of the Service and add-on services are notified in accordance with these Terms. All prices are subject to applicable VAT. Purchased services are non-refundable and no payments made for unused services will be returned under any circumstances.

The Service Provider has the right to charge additional fees resulting from the Customer's failure to follow instructions received from the Service Provider (e.g., a surcharge for the processing of accounting materials submitted late).

The Service Provider issues a sales invoice to the Customer for the service fee. The Service Provider has the right to refer overdue invoices to a debt collection agency.

The Service Provider has the right to suspend the provision of the Service and add-on services to a Customer whose service fee is overdue. The Service Provider may also suspend service provision for statutory reasons or pursuant to a regulatory authority's order. The Service Provider is not liable to compensate the Customer for any loss caused by the temporary suspension of the Service or add-on services attributable to the Customer, or by changes to the content of such services, nor is it obligated to reduce or waive service fees.

The Service Provider has the right to suspend the delivery or use of the Service and add-on services in whole or in part if such suspension is necessary for the repair, updating, or maintenance of the Service or a part thereof, or to otherwise ensure the usability or functionality of the product. The Service Provider will notify the Customer of a suspension in advance where reasonably possible. The notification obligation does not apply to technical changes such as software updates.

The contract is valid indefinitely or for a fixed term, depending on the service order, commencing from the moment the Customer registers or from the agreed start date of a fixed-term contract.

An indefinitely valid contract may be terminated and the user account deleted within the service or by notifying customer support in writing at any time. The Customer separately selects the termination date, but service fees already paid will not be refunded. On the selected termination date, the Service Provider's obligation to provide the service, including the processing of pending vouchers and the submission of authority notifications based on vouchers, and its right to invoice, all terminate.

A fixed-term contract remains in force until the agreed end date, unless renewed or converted to an indefinitely valid contract during the contract period, after which the contract continues as an indefinitely valid contract in accordance with the then-current price list. If the Customer terminates service use during a fixed-term contract, the Service Provider has the right to invoice the service fee for the remaining contract period.

The Customer may terminate a monthly-fee add-on service subscription at any time during the contract period within the service or by notifying customer support. A monthly-fee add-on service terminates at the end of the current billing period as a result of termination. A one-time or fixed-term add-on service terminates on the agreed date. If the Customer terminates the Service, add-on services also terminate without a separate notice of termination.

The Service Provider will deliver accounting materials to the Customer upon termination of the customer relationship. Materials will not be delivered if the Customer has outstanding unpaid service fees. The Service Provider also has the right to bring a legal claim against the Customer for unpaid service fees.

The Service Provider has the right to terminate the Service or an add-on service without notice if it has reasonable grounds to suspect that:

• The service has been used for activities contrary to law or good practice
• The service has been used to invoice for suspicious or illegal business
• The Customer does not comply with these Terms and/or the Service Provider's instructions and requests
• The Customer behaves inappropriately or threatens the Service Provider or its staff

Where circumstances permit, the Service Provider may require the Customer to rectify their conduct or remedy the situation within seven (7) days via a written notice, after which the Service Provider has the right to rescind ("purkaa") the contract.

The Service Provider has the right to terminate the contract in the following circumstances:

• Use of the Service has been entirely suspended for more than six (6) months
• No sales invoice has been sent through the Service within twelve (12) months
• The Customer is, in the Service Provider's assessment, not conducting active business operations
• Payment of the monthly service fee has been delayed or fees have been outstanding for more than four (4) months

The Service Provider's decision to terminate the customer relationship is based solely on the Service Provider's independent assessment of the Customer's business and accounting transactions. The termination decision is final, and the Customer may not demand reinstatement of the customer relationship after termination.

The Service Provider has the right to discontinue the provision of the Service or any feature thereof entirely if there are justified grounds, such as a change in mandatory legislation or a regulatory authority's order.

The Service Provider continuously monitors the operation and conditions of use of the Service, and corrects any defects as soon as practically possible. The Customer is obligated to notify the Service Provider without delay of any materially non-conforming operation or other defect in the Service or add-on service.

The Service Provider has no obligation to correct defects or disruptions caused by the Customer or a third party, such as improper use of the Service, negligence in following service instructions, or devices, software, settings, configurations, connections, or other prerequisites outside the scope of the Service.

The Service Provider has no obligation to correct errors in third-party software or interfaces.

The Parties are mutually liable for damages caused to the other Party. The Customer is obligated to pay compensation to the Service Provider and the client for damage caused by the Customer's intentional act or negligence, or by a User operating on the Customer's behalf having transferred access rights to third parties.

The Service Provider is not liable for damages caused by incomplete, incorrect, or late materials, data, or information provided by the Customer, nor for business decisions made by the Customer in relation to their business.

The Service Provider is not liable and has no obligation to compensate for costs, expenses, or damages arising from circumstances or events within the Customer's responsibility or otherwise outside the Service Provider's control, including damages resulting from unauthorised use of the Service or software, or attempts at such use.

The Service Provider's aggregate maximum liability under any circumstances corresponds to a maximum of six (6) months' service fees (exclusive of VAT). This liability cap applies regardless of the amount or cause of direct or indirect damages suffered by the Customer, including, but not limited to, damages caused by erroneous or incomplete payments or transfers made through the Service.

Neither Party is liable for delays or damages caused by a circumstance beyond its control that could not reasonably have been anticipated at the time of contracting and whose consequences could not reasonably have been avoided or overcome ("force majeure"). Such circumstances include, but are not limited to, problems, errors, or interruptions in third-party software or technical equipment, such as telecommunications networks. A force majeure event affecting a Party's subcontractor also releases that Party from liability.

The above liability limitations do not apply to damage caused intentionally or by gross negligence ("törkeä huolimattomuus"), or to damage resulting from the Customer's transfer of access rights to third parties.

Claims for compensation must be submitted to the Service Provider in writing without delay after the damage has been identified. If the Customer has not submitted a specified claim within six (6) months of identifying the damage, the Customer loses the right to rely on that damage.

The Service Provider maintains valid and adequate liability insurance for its operations. In the event of a loss, the Customer must cooperate in investigating the loss and undertakes to provide the insurance company with necessary information and to afford the insurer the opportunity to assess the extent and nature of the loss.

The Service Provider is obligated to maintain the information security of the Service at an adequate level. The Service Provider is not responsible for the security of the public internet or for any disruptions or other factors impairing the use of the Service that are outside the Service Provider's control.

The Service may contain links to third-party websites, for example in connection with campaigns and advertisements. The Service Provider assumes no responsibility for the security or content of such sites.

The Service Provider may use cookies and other similar identifiers on its websites as described in its website privacy policy. Cookie acceptance and blocking practices vary by campaign, but cookie policies always comply with applicable legislation.

The Customer is responsible for their own information security, including maintaining their devices, telecommunications connections, antivirus and other security systems, ensuring that the service username or password is not disclosed to third parties, that the password used in the service is strong, and that it is stored securely.

The Service Provider registers those personal data (“henkilötiedot”) of the Customer, Sole Trader Entrepreneur, Owner-Entrepreneur, Users, and the Customer's beneficial owners (“tosiasialliset edunsaajat”) that are provided by the Customer or collected from public registers at the time of registration, upon placing an order, or during use of the Service. Further information on the processing of personal data is available in the Service Provider's Privacy Policy (“tietosuojaseloste”).

The Service enables the Customer to collect and store personal data of its own clients in the Service Provider's system. The Service Provider acts as processor (“henkilötietojen käsittelijä”) of personal data relating to the Customer's end clients stored by the Customer, in accordance with the Data Processing Agreement attached as Annex 1 and applicable legislation. The Customer, as data controller (“rekisterinpitäjä”), is responsible for the accuracy and lawfulness of its clients' personal data, and for ensuring that it has the right to process such data, deliver it for processing, and grant the Service Provider the right to process it. The Customer, as data controller, is independently responsible for preparing a privacy notice (“tietosuojaseloste”) compliant with the General Data Protection Regulation (GDPR) and making it available to its own clients.

The maintenance of the customer register and the processing of personal data are also conducted in accordance with applicable data protection legislation and practice.

Upon activation of the Service, the Customer gains access to a useful email and text message service providing information about the Service Provider's and its partners' products, customer benefits, and offers.

The Customer has the right to opt out of receiving marketing from the Service Provider at any time. The marketing opt-out does not, however, apply to service notifications, customer surveys, or add-on service messages.

The current Terms of Service are available within the Service. The Service Provider has the right at its discretion to make changes to the terms and price list relating to the Service and add-on services without the Customer's consent.

Amendments to the Terms of Service will be communicated on the Service Provider's website and within the Service at least thirty (30) days before they take effect. However, amended Terms of Service take effect immediately if the Service Provider must amend them to comply with changed legislation or case law ("oikeuskäytäntö").

The Customer accepts the updated Terms of Service by continuing to use the Service. If the Customer does not accept an amendment, they may terminate the contract with effect from the date the new terms enter into force.

The Customer has no right to assign the contract or access rights to the Service to a third party without the Service Provider's prior written consent. The Service Provider reserves the right to assign the contract and/or the Services to a third party.

Together, these Terms of Service and the Service's price list constitute the entire agreement between the Parties. These Terms of Service are available in multiple languages. In the event of a discrepancy between language versions, the Finnish-language version is authoritative ("määräävä").

If any provision, term, or definition contained in these Terms of Service is found to be void or invalid, it will not affect the validity or applicability of the remaining Terms of Service. A void or invalid term or definition shall be replaced by a new one that is as legally similar as possible to the replaced term or definition.

This contract is governed by Finnish law ("Suomen laki"). Disputes shall primarily be resolved through negotiation between the Parties. If resolution is not possible, the competent court is the District Court of Vantaa ("Vantaan käräjäoikeus").

These Terms and Conditions enter into force on 1 June 2025 and remain in force indefinitely.

This Data Processing Agreement is an annex to the Quulio Oy Terms of Service ("Terms"), which the Customer registered with the Service ("user") accepts as binding upon registration with the Service.

This annex governs the processing of personal data in cases where Quulio Oy processes personal data belonging to the user's customer data ("user's personal data") on behalf of the user acting as data controller, for the purpose defined in the Terms.

Quulio Oy is responsible for ensuring that the service it maintains complies with the requirements of applicable data protection legislation at all times.

Quulio Oy undertakes to comply with the terms of this agreement when processing the user's personal data on the user's behalf. Individuals whose personal data are processed under this annex are referred to as "data subjects." Data subjects are primarily the user's clients, their contact persons, or the owners of client companies.

For the processing of personal data, this Data Processing Agreement takes precedence if its content conflicts with the Terms of Service. Quulio Oy complies with the procedures and provisions governing the processing and protection of personal data as required by applicable data protection legislation.

When processing personal data, the user is the data controller (rekisterinpitäjä) and Quulio Oy is the data processor (henkilötietojen käsittelijä), unless the purpose of processing otherwise requires. In this Data Processing Agreement, the user's personal data refers to all personal data for which the user is responsible as data controller.

The obligations under this annex apply to all employees of Quulio Oy and to its sub-processors ("alikäsittelijä") or other external parties involved in the collection or processing of personal data.

Quulio Oy implements appropriate technical and organisational measures to ensure that the processing of the user's personal data is carried out in accordance with the requirements of the agreement and the agreed practices. The purpose of these measures is to ensure the lawful processing of personal data and the confidentiality, integrity, availability, and resilience of processing systems and services.

Quulio Oy has designated a contact person responsible for data protection matters relating to the user's personal data. Queries may come from either the user or data subjects.

Quulio Oy shall make available to the user, upon request, all information the user requires to demonstrate compliance with the obligations imposed on the data controller and on Quulio Oy.

Quulio Oy shall notify the user without delay of all requests from data subjects concerning the exercise of data subjects' rights. Quulio Oy shall not respond to such requests on its own behalf.

Quulio Oy shall, where necessary, assist the user in fulfilling its obligations to respond to requests from data subjects, including assistance with communicating with data subjects, implementing data subject access rights, rectifying or erasing personal data, and implementing restrictions on processing.

Quulio Oy ensures that all its employees with access to the user's personal data are committed to complying with agreed confidentiality obligations or are subject to a statutory duty of confidentiality and non-disclosure, which continues after termination of the employment contract.

Quulio Oy ensures that every employee with access to the user's personal data is aware of their obligations relating to the processing of personal data and processes such data only in the manner instructed.

The Parties have agreed that Quulio Oy may engage sub-processors in its operations. To the extent that Quulio Oy uses subcontractors who process personal data, the terms described in this annex apply to the subcontracting arrangement and to the sub-processor's employees. Quulio Oy is fully responsible to the user for the sub-processor's performance of its obligations.

Quulio Oy warrants to the user that sub-processors comply with the obligations imposed on data processors. Quulio Oy shall, upon request, provide the user with an up-to-date list of the sub-processors currently processing the user's customer data.

Where a sub-processor of Quulio processes the user's personal data, engaging the sub-processor requires that Quulio Oy has signed a contract with the sub-processor, accepted terms of service, or otherwise ensured that personal data is processed at least to the standard of this agreement.

Quulio Oy processes the user's personal data exclusively within the European Economic Area. Quulio Oy may transfer the user's personal data to sub-processors outside the EEA only in situations where adequate assurance of the sub-processor's level of diligence and EU-standard protection of personal data has been established.

Quulio Oy and any sub-processor must notify the user in writing of any personal data breach affecting the user's or data subjects' personal data as soon as possible and no later than 48 hours after becoming aware of the breach.

In addition, Quulio Oy undertakes to notify the user without undue delay of any other service disruption or problem that may have implications for the status and rights of data subjects.

During the user's customer relationship, Quulio Oy may not delete personal data of data subjects processed on behalf of the user without the user's explicit request. Requests to delete personal data relating to a data subject or data subjects must be submitted in writing to Quulio Oy. Quulio Oy must inform the user whether, in its assessment, it is able to delete the data subject's information.

Upon termination of the customer relationship, Quulio Oy shall delete all personal data of data subjects stored in Quulio Oy's systems or processed on behalf of the user by Quulio Oy or its sub-processors.

In neither of the above cases may personal data be deleted before the expiry of the applicable retention period, if legislation or a regulatory authority's order requires Quulio Oy to retain the personal data for the specified retention period.

Quulio Oy does not independently collect or process data subjects' data; rather, the user may store data subjects' data in the service administered by Quulio Oy for the purpose of invoicing data subjects and processing their data within the service.

The categories of personal data collected and processed concerning data subjects are:

• Basic: Name, contact details, business ID (y-tunnus) of the data subject
• Customer relationship and behavioural: Invoicing data, payment behaviour of the data subject
• Consents and contracts: Information on agreements between the user and the data subject, and services acquired by the data subject

Data is primarily collected from the following sources:

• Data stored in the service by the user
• Data provided by the data subject when paying an invoice

Quulio Oy may use data collected on data subjects for the following purposes:

• Fulfilment of obligations under the Anti-Money Laundering Act (rahanpesulaki)
• Analysis and service development

Data is stored on cloud servers used by Quulio Oy, located within the EU in Amazon AWS infrastructure, or in other equivalent servers from time to time. Data may also be stored in the information systems of sub-processors or equivalent parties used by Quulio Oy.

Quulio Oy is liable to compensate both the user and data subjects for material and non-material damages ("aineelliset ja aineettomat vahingot") resulting from:

• Failure to comply with the obligations of this Data Processing Agreement
• Acting contrary to the user's lawful instructions
• Violation of GDPR obligations

In the event of a dispute, Quulio bears the burden of proof (osoitusvelvollisuus) that it has acted in accordance with this Data Processing Agreement and the applicable legislation.

No separate remuneration is payable to Quulio Oy for the measures and obligations described in this annex.

Quulio Oy may unilaterally amend the terms of this Data Processing Agreement and make the revised agreement available to the user. By continuing to use the Service, the user accepts the new content as binding.