Helios One

Helios One · buyer workflow

Helios One data processing addendum

Public template — effective only when signed

This Data Processing Addendum (DPA) is a template for a customer that signs an order form with Helios One Oy, business ID 3596623-5, VAT FI35966235, Servin Maijan tie 10 B 19, 02150 Espoo, Finland. It becomes binding only when the customer and Helios sign or otherwise incorporate it into an order form. Questions: support@heliosone.fi.

1. Roles and subject matter

The customer is the controller for personal data it puts into an enabled supplier PO follow-up workspace. Helios is the processor for that data and processes it only to provide the services described in the signed order form: intake of customer-provided open-PO data, supplier follow-up messages, reply and exception handling, support, security, and service operation. Helios may process account, member, supplier-contact, purchase-order, message, and support data for those purposes.

2. Instructions and confidentiality

The order form, this DPA, and documented customer instructions define the processing. Helios will ensure that people authorised to process customer data are bound by confidentiality. The customer must not instruct Helios to process data it may not lawfully use.

3. Security measures

The enabled service uses access controls, tenant-scoped record checks, bounded email handling, server-side credentials, expiry or revocation for applicable tracking links, and human review before operational adoption. The Security overview describes the implementation evidence and limitations. The optional vault is not universal encryption and does not establish ITAR compliance or certification.

4. Subprocessors and transfers

The current provider disclosures are listed at /subprocessors. Helios remains responsible for subprocessors it authorises for the service. Provider regions, contracts, and transfer mechanisms are service-specific; no general residency promise is made. A new subprocessor will be disclosed through the current page or another agreed notice route before it is used for the customer’s data, subject to the order form’s objection procedure.

5. Assistance and data-subject rights

Taking account of the processing, Helios will provide reasonable assistance with data-subject requests, security information, and customer instructions. The customer handles the legal relationship with its data subjects. Requests should identify the workspace and be sent to support@heliosone.fi without including passwords, API keys, bearer links, or unnecessary personal data.

6. Incidents

Helios will notify the customer without undue delay after confirming a personal-data breach affecting the customer’s data, using the security contact in the order form or support@heliosone.fi if none is specified. The notice will contain the information reasonably available at the time. This clause does not promise a fixed response or remediation time.

7. Return and deletion

At the end of the applicable service, Helios will follow the customer’s documented choice to return or delete customer data, subject to the order form, legal retention, security records, provider copies, backups, and data already downloaded by recipients. The export format and any backup purge period must be stated in the order form; this public template does not invent a fixed period.

8. Audits and precedence

Helios will make available information reasonably necessary to demonstrate compliance and will address a customer audit request proportionately. A signed order form controls commercial scope; this DPA controls customer-directed personal-data processing; the Privacy Policy explains independent-controller processing. If the documents conflict, the signed order form and DPA control in that order.

Schedule: data and security summary