1. General
Koskinen Family Business Oy (“Koskinen & Co”) engages third-party service providers (“Sub-Processors”) to support operations and deliver customer services. This page lists the Sub-Processors that may process personal data.
2. Core Business Tools
- Google Workspace: Business communication, document management, cloud storage (EU/US)
- HubSpot: Customer relationship management (EU/US)
- Linear: Project management (US)
- GitHub: Code hosting and version control (US)
- Hetzner Cloud: Website hosting and self-managed automation infrastructure (EU)
- Cloudflare: Authoritative DNS, CDN and reverse proxy, WAF, and Zero Trust Access for koskinen.co and its services. Processes visitor IP addresses, request metadata, and Access login identities (US, with global edge; free plan)
- Buffer: Social media scheduling and publishing (US)
- Sentry: Application error monitoring and diagnostics, with personal data scrubbed before transmission (region per project configuration)
3. Communication Tools
- Spark (Readdle): Email client with AI features (EU/US)
- Fireflies.ai: Meeting transcription (US)
- Telegram: Operational alert routing for workflow notifications. Metadata only, no client personal data (UAE)
- Postmark: Transactional email delivery for automated notifications and DMARC aggregate reporting (US)
4. AI Tools
- Anthropic (Claude): AI-assisted analysis, content generation, and workflow orchestration (US)
- Google (Gemini): AI-assisted data processing and content generation (EU/US)
AI tools are used to assist with analysis, drafting, and research tasks. Decisions based on AI-assisted work are reviewed and made by humans.
Client data processed through AI tools is not used for training AI models (modifying model weights or parameters). AI tools may be used for indexing, vector embeddings, and retrieval-augmented generation (RAG) solely for service delivery. These techniques do not modify the AI model and all data remains within secured infrastructure.
5. Data and Analytics
- Toggl Track: Time tracking (EU/US)
6. Independent Data Controllers
The following services are used by Koskinen & Co but act as independent data controllers, not sub-processors. They are listed here for transparency.
- Apple iCloud: Device synchronisation and backup. Apple acts as an independent data controller (EU/US)
- Holvi: Business banking. Holvi acts as an independent data controller regulated by FIN-FSA (EU)
7. Additional Sub-Processors
Additional Sub-Processors will be engaged only for specific client projects and notified per the Data Processing Agreement.
8. Data Protection
All Sub-Processors are engaged under appropriate data processing agreements. For international transfers outside the EU/EEA, we rely on Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) or adequacy decisions as applicable.
9. Updates
Material changes to Sub-Processors used for client data will be notified per the Data Processing Agreement.
Data retention and deletion policies are published alongside the first client offboarding. Until then, retention follows each Sub-Processor’s standard terms.