Helios One · buyer workflow
Helios One privacy policy
Effective 24 October 2026
This privacy policy describes how Helios One Oy (business ID 3596623-5, VAT FI35966235), Servin Maijan tie 10 B 19, 02150 Espoo, Finland, handles personal data for this website and for the supplier purchase-order follow-up service. Questions and data-subject requests can be sent to support@heliosone.fi.
What we handle
For a plant customer, the service may handle business contact details, supplier contacts, purchase-order lines, promised dates, replies, exception notes, account and workspace identifiers, and support messages. The customer decides what to put into the service and remains responsible for having the right to use it.
The public workflow pages use fictional examples. They do not upload files or create a customer workspace. Free browser tools and staging demonstrations should use public, fictional, or otherwise authorised data.
Why we handle it
We use data to provide the enabled workflow, authenticate users, keep tenant access scoped, send configured messages, prevent abuse, troubleshoot, provide support, and maintain security and operational records. For customer workspace data, Helios generally acts as a processor on the customer’s documented instructions; Helios may act as an independent controller for account administration, security, support records, and business communications. The signed order form and DPA control where they differ.
Providers and transfers
The service may use infrastructure, email, AI-assisted extraction, authentication, hosting, and telemetry providers described on /subprocessors. Provider locations and transfer safeguards are service-specific and are not a blanket residency promise. We do not claim that the service is certified under SOC 2, ISO 27001, CMMC, or any other scheme.
Retention and deletion
Retention depends on the enabled service and the customer’s instructions. One-time status-code rows and messages in the documented Mini ERP path are designed to expire after seven days; tracking links have their own expiry; downloaded copies and provider or backup copies may persist outside Helios’ control. Some developer usage records have no automatic cleanup. At the end of a customer service, the signed DPA and order form govern export, return, and deletion. Send a request to support@heliosone.fi and identify the workspace without sending secrets.
Sensitive and controlled data
The service is for business users and is not directed to children. Do not submit special-category personal data, payment-card data, classified information, or export-controlled technical data unless the signed service scope expressly permits it. ITAR parts go in the ITAR vault; the optional vault is a technical feature and does not mean Helios is ITAR compliant or certified.
Rights and complaints
You may ask for access, correction, deletion, restriction, objection, or portability where applicable. Helios will route processor requests to the customer and assist as required by the DPA. We verify the requester and respond under applicable law. You may also complain to the Finnish supervisory authority, the Office of the Data Protection Ombudsman.
Changes and contact
We may update this policy when the service or applicable law changes. The effective date at the top identifies the current version. Contact: Helios One Oy, Servin Maijan tie 10 B 19, 02150 Espoo, Finland; support@heliosone.fi.