1. Data Controller

Alvarius Oy

Business ID: 2529942-4

Address: Bulevardi 46, 00120 Helsinki, Finland

Email: info@vaulacrm.fi

2. Name of the Register

Vaula CRM Customer and User Register

3. Purposes and Legal Bases for Processing

Personal data is processed for the following purposes. The legal basis under the EU General Data Protection Regulation (GDPR) is stated for each purpose.

3.1 Performance of a contract (GDPR Art. 6(1)(b))

• Providing the CRM service and managing user accounts
• Customer relationship management and invoicing
• Technical customer support

3.2 Legitimate interest (GDPR Art. 6(1)(f))

• Information security and prevention of misuse
• Service development and analytics
• Usage monitoring for quality assurance

3.3 Legal obligation (GDPR Art. 6(1)(c))

• Invoicing and financial administration obligations under the Accounting Act
• Other applicable statutory obligations

4. Personal Data Collected

4.1 User data

• Name and email address
• Login and session data
• Usage logs and audit trails

4.2 Organisation data

• Company name and business ID
• Billing and postal address

4.3 Data entered by the customer organisation

• Leads, contacts, and other data entered by the customer for their own use

Note: This data belongs to the customer organisation. Vaula CRM acts only as a data processor for this data, not as a data controller.

5. Retention Period

Personal data is retained for the duration of the customer relationship and for a maximum of 24 months after its termination, unless a statutory obligation (e.g. accounting legislation) requires a longer retention period.

Upon request, data will be permanently deleted from the database (right to erasure).

6. Recipients and Data Processors

Personal data may be processed by:

• Employees of Alvarius Oy for service maintenance purposes
• Amazon Web Services EMEA SARL (AWS) – cloud infrastructure, servers located in the EU (Stockholm, eu-north-1)
• Other technical subcontractors involved in maintenance or development of the CRM

Data is not transferred outside the EU or EEA without appropriate safeguards (e.g. EU Standard Contractual Clauses).

7. Automated Decision-Making and Profiling

Vaula CRM does not use personal data for automated decision-making or profiling that produces legal or similarly significant effects on data subjects.

8. Cookies and Usage Tracking

The service may use technically necessary cookies for session management and security. Further details are available in the separate Cookie Policy.

9. Rights of Data Subjects

Every data subject has the right to:

• Access their personal data (right of access)
• Request correction of inaccurate data (right to rectification)
• Request erasure of their data (right to erasure)
• Request restriction of processing in certain circumstances
• Object to processing based on legitimate interest
• Receive their data in a machine-readable format (right to data portability)
• Lodge a complaint with a supervisory authority

Requests will be responded to without undue delay and within one month at the latest.

10. Right to Lodge a Complaint

Data subjects have the right to lodge a complaint with the competent supervisory authority if they consider that the processing of their personal data infringes applicable data protection legislation.

The competent supervisory authority in Finland is:

Office of the Data Protection Ombudsman

Lintulahdenkuja 4, 00530 Helsinki, Finland

tietosuoja.fi

11. Contact

For questions regarding data protection and to exercise your rights, please contact:

Email: info@vaulacrm.fi

Data Controller: Alvarius Oy, Bulevardi 46, 00120 Helsinki, Finland

Effective: 21/05/2026