Skip to content
Reachify
ENFI

Data protection

Data processing agreement

How we handle personal data on our clients’ behalf, for example messages from your website forms and reviews on your Google profile (GDPR Article 28).

Sub-processors

Last updated: 29 September 2026

This agreement applies when Reachify Oy, Helsinki, Finland processes personal data on a client’s behalf while delivering our services. It forms part of our General Terms of Service and of every order. The client is the controller and Reachify is the processor, as defined in Article 28 of the EU General Data Protection Regulation.

01What we process

  • Messages sent through contact and booking forms on the client’s website: names, contact details and message content.
  • Reviews on the client’s Google Business Profile: reviewer names and review text, when we draft or post replies.
  • Website analytics: aggregated visit statistics. We don’t use cookies or identify individual visitors.
  • Contact details of the client’s staff that we need to deliver the service.

The data subjects are the client’s customers, website visitors and staff.

02Purpose and duration

We process the data only to deliver the services the client has ordered, and only for as long as the order is in force.

03Our obligations as processor

  • We process personal data only on the client’s documented instructions: the order, our terms and any written instructions the client gives us. If we believe an instruction is unlawful, we tell the client.
  • Everyone who handles the data is bound by confidentiality.
  • We protect the data with appropriate technical and organisational measures: access control, least-privilege access, encrypted connections and secure backups.
  • We help the client respond to requests from data subjects and, where needed, with data protection impact assessments.
  • We notify the client without undue delay if we become aware of a personal data breach, and give the information the client needs to assess it.
  • We make available the information needed to show that we comply with this agreement, and allow reasonable audits with advance notice. Audits are at the client’s expense.

04Sub-processors

The client gives general authorisation to use the sub-processors listed on our Sub-processors page. We tell the client at least 30 days before we add or replace a sub-processor, and the client may object on reasonable grounds. Each sub-processor is bound by data protection obligations equivalent to this agreement.

05Transfers outside the EU and EEA

We transfer personal data outside the EU or EEA only on the basis of an adequacy decision of the European Commission or the Commission’s standard contractual clauses.

06When the service ends

Within 30 days of the end of the service, we return the data to the client or delete it, as the client chooses, unless the law requires us to keep it.

07The client’s responsibilities

The client is responsible for having a lawful basis for the processing and for informing its customers and website visitors about it, for example in its own privacy notice.

08Liability and governing law

Liability follows our General Terms of Service. This agreement is governed by Finnish law.

Data protection questions

Email privacy@reachify.cloud. We can also send this agreement as a document for signing.