This Data Processing and Confidentiality Statement (the “Statement”) describes how Virkka Oy (“Virkka”, “we”, “us”) processes and protects the information that a customer (the “Customer”, “you”) provides to Virkka for regulatory services, including the preparation of EUDAMED device registration data and post-market surveillance documentation (the “Services”).
Where Virkka and the Customer have entered into a separate non-disclosure agreement or data processing agreement, that agreement prevails over this Statement to the extent of any conflict.
1. Definitions
1.1“Customer Materials” means all documents and data provided by or on behalf of the Customer in connection with the Services, including price lists, product lists, certificates, declarations of conformity, instructions for use and labelling.
1.2“Deliverables” means the files and documents that Virkka prepares for the Customer on the basis of Customer Materials, including EUDAMED upload files and review workbooks.
1.3“Personal Data”, “Controller”, “Processor”, “Processing” and “Personal Data Breach” have the meanings given to them in Article 4 of Regulation (EU) 2016/679 (the “GDPR”).
1.4“Sub-processor” means a third party engaged by Virkka that processes Customer Materials on Virkka’s behalf.
2. Company details
Company: Virkka Oy
Business ID: 3660320-9
Registered office: Jämeräntaival 7C, 02150 Espoo, Finland
Data protection contact: Ville Palola, ville.palola@virkka.com
3. Purpose limitation
3.1Virkka processes Customer Materials only for the purpose of providing the Services and only on the documented instructions of the Customer, unless required to do otherwise by Union or Member State law.
3.2Virkka does not use Customer Materials for its own purposes, including marketing, the provision of services to other customers or the compilation of data sets.
4. Confidentiality
4.1Virkka keeps Customer Materials and Deliverables confidential and does not disclose them to any third party, except to the Sub-processors listed in Annex 1 to the extent necessary to provide the Services, or where disclosure is required by law.
4.2Virkka ensures that persons authorised to process Customer Materials have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
4.3At the Customer’s request, Virkka will sign the Customer’s non-disclosure agreement before any Customer Materials are provided.
5. Processing of Personal Data
5.1Customer Materials may contain Personal Data, such as the names, signatures and business contact details of the Customer’s personnel. With respect to such Personal Data, the Customer acts as Controller and Virkka acts as Processor. The processing is described in Annex 2.
5.2Virkka processes such Personal Data in accordance with Article 28(3) GDPR. At the Customer’s request, the parties will enter into a data processing agreement based on the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/915.
5.3Taking into account the nature of the processing, Virkka assists the Customer in responding to requests from data subjects to exercise their rights under the GDPR.
5.4The Services do not require data concerning health, other special categories of Personal Data within the meaning of Article 9 GDPR, or any data concerning patients. The Customer shall not provide such data. If Virkka receives such data, Virkka will delete it and notify the Customer.
5.5Virkka acts as Controller for the business contact details it uses to communicate with the Customer, as described in the privacy notice on this website.
6. Use of automated tools
6.1Virkka uses software tools, including artificial intelligence services, to extract data from Customer Materials. Such services are used only under commercial terms that include a data processing agreement and that prohibit the provider from using Customer Materials to train its models. Customer Materials are not processed with consumer AI applications.
6.2Each value in a Deliverable is referenced to the Customer Material from which it was derived. Virkka reviews each Deliverable before delivery.
7. Security of processing
7.1Virkka implements appropriate technical and organisational measures to protect Customer Materials against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include:
- restricting access to Customer Materials to personnel assigned to the Customer’s project;
- storing Customer Materials in Google Workspace, which encrypts data in transit and at rest; and
- not publishing Customer Materials or sharing them by means of publicly accessible links.
8. Sub-processors
8.1Virkka engages the Sub-processors listed in Annex 1.
8.2Virkka informs the Customer in writing of any intended addition or replacement of a Sub-processor at least ten (10) days in advance, giving the Customer the opportunity to object to such changes.
8.3Where a Sub-processor processes Personal Data outside the European Economic Area, the transfer is governed by the standard contractual clauses adopted by the European Commission, as stated in Annex 1.
9. Security incidents
9.1Virkka notifies the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a breach of security affecting Customer Materials, including a Personal Data Breach. The notification contains the information the Customer needs to meet its obligations under Articles 33 and 34 GDPR.
10. Retention and deletion
10.1Virkka deletes Customer Materials, including copies held in email, within thirty (30) days of delivery of the Deliverables, or earlier at the Customer’s request.
10.2Virkka retains copies of Deliverables only at the Customer’s request.
10.3Invoices and accounting records are retained as required by the Finnish Accounting Act (1336/1997).
10.4At the Customer’s request, Virkka confirms the deletion in writing.
11. Audits and supplier qualification
11.1Virkka makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR and this Statement, and allows for and contributes to audits conducted by the Customer or an auditor mandated by the Customer, subject to reasonable prior notice.
11.2Virkka completes supplier qualification questionnaires required under the Customer’s quality management system.
12. EUDAMED access
12.1The Customer submits data to EUDAMED using its own EU Login credentials. Virkka does not request, hold or use the Customer’s EU Login or EUDAMED credentials and does not submit data to EUDAMED on the Customer’s behalf.
13. Changes to this Statement
13.1Virkka may amend this Statement. The current version is published at virkka.com/data-processing. Customers with an ongoing project are informed of material changes before they take effect.
14. Governing law and supervisory authority
14.1This Statement is governed by the laws of Finland.
14.2The competent supervisory authority is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), www.tietosuoja.fi.
14.3Questions concerning this Statement may be addressed to ville.palola@virkka.com.
Annex 1 – List of Sub-processors
| Sub-processor | Service | Location of processing | Transfer mechanism |
|---|---|---|---|
| Google (Google Workspace) | Email and file storage | European Union and other locations | Standard contractual clauses (Google Cloud Data Processing Addendum) |
| Anthropic (Claude API) | Extraction of data from documents | United States | Standard contractual clauses (Anthropic Data Processing Addendum) |
Annex 2 – Description of the processing
| Data subjects | Personnel of the Customer and of its suppliers or authorised representatives named in Customer Materials |
|---|---|
| Categories of Personal Data | Names, job titles, signatures and business contact details |
| Special categories of data | None |
| Nature of the processing | Storage, extraction of data and preparation of Deliverables |
| Purpose | Provision of the Services |
| Duration | Until deletion in accordance with clause 10 |