Cloudpoint Oy Trust Center

1. Dual-Portfolio Governance Model

Cloudpoint Oy (Business ID 2325703-6, Malminkaari 17-19B, 00700 Helsinki, Finland) operates as an official Google Cloud Premier Partner and managed service provider for Finnish and Nordic municipalities, educational institutions, and enterprises. To provide complete transparency for municipal Data Protection Officers (DPOs), CISOs, and procurement teams, this document details the technical architecture and data boundaries across both of Cloudpoint's operational portfolios:

• Portfolio A — Managed Support, Security Auditing & DPIA Advisory Services (MSP): Operational administration, teacher support, device lifecycle management, and regulatory auditing performed directly within or for the Customer's own cloud tenant.
• Portfolio B — Cloud SaaS & Automated Identity Integration Platforms: Dedicated cloud software platforms engineered and operated by Cloudpoint and its group entities (Edudata.io and Nomen).

2. Portfolio A: Managed Support & Cloud Security Services (MSP)

In Managed Support engagements, customer data resides inside the Customer's own Google Workspace or Microsoft 365 tenant. Cloudpoint engineers never store bulk student or employee payloads on local endpoints; all administrative operations occur via encrypted TLS 1.3 sessions using hardware-enforced MFA and role-based Just-In-Time (JIT) access.

3. Regulatory Precedent Alignment: Supreme Administrative Court KHO:2025:29 (236353745124)

4. Portfolio B: SaaS & Identity Integration Architecture

Alongside managed services, Cloudpoint develops and operates specialized cloud solutions hosted in Google Cloud Platform (`europe-north1`, Hamina, Finland):

5. Infrastructure Sovereignty & Logical Isolation

• Primary Production Datacenter: Google Cloud Platform europe-north1 (Hamina, Finland), powered by carbon-free energy and protected by ISO/IEC 27001, 27017, 27018, and SOC 1/2/3 certifications.
• Strict Multi-Tenant Isolation: Each municipal or enterprise customer environment is logically isolated at the database, IAM, and cryptographic key level.
• Zero Secondary Use: Customer personal data processed in Managed Support, Nomen, or Edudata.io is never sold, used for advertising, or used to train foundational AI models.

Effective Date: April 1, 2026 | Contracting Entity: Cloudpoint Oy (Business ID 2325703-6, VAT FI23257036), Malminkaari 17-19B, 00700 Helsinki, Finland

1. Scope of Application & Contracting Parties

These General Terms of Service ("Terms") govern the delivery and use of Managed Support Services (MSP), professional consulting, security auditing, DPIA advisory, training, cloud license resale, and proprietary SaaS/integration services provided by Cloudpoint Oy ("Supplier" or "Cloudpoint", Business ID 2325703-6) and its associated product entities (including Edudata.io 3460068-8 and Nomen Finland Oy 2851575-1) to business, municipal, and public-sector customers ("Customer").

2. Framework Alignment (IT2022 & JIT 2015)

Unless otherwise agreed in a signed Customer Order or Public Procurement Contract, the following standard Finnish contractual frameworks apply in supplementary order of precedence:

• Public Sector & Municipal Customers: General Terms of Public Procurement in IT (JIT 2015 — Yleiset ehdot and applicable special conditions for services delivered via cloud and expert consulting).
• Corporate & Private Sector Customers: IT2022 General Terms and Conditions (IT2022 YSE) together with IT2022 ETP (Consulting & Maintenance Services) and IT2022 EKP (Cloud Services).
• Personal Data Processing: Cloudpoint Oy's binding GDPR Article 28 Data Processing Agreement (DPA) forms an integral part of every Managed Support, Nomen, and Edudata.io service agreement.

3. Service Categories & Service Level Agreements (SLA)

4. Customer Responsibilities & Access Governance

• Administrative Authorization: For Managed Support and auditing services, the Customer grants Cloudpoint engineers least-privilege or Just-In-Time (JIT) administrative access required to perform the agreed tasks.
• License Subscriptions: Annual committed cloud licenses (such as Google Workspace for Education Plus, Teaching & Learning, or ChromeOS Education/Enterprise Upgrades) are bound to the hyperscaler's commitment term and renewal schedule managed via Delling Cloud or direct order.

5. SaaS-Specific Provisions (Edudata.io & Nomen)

Access to Edudata.io and Nomen is granted as a non-exclusive, non-transferable subscription license for the Customer's internal educational or organizational operations. Reverse engineering, automated scraping, benchmarking, or use by competing vendors to replicate Cloudpoint's or Edudata.io's proprietary assessment methodology is strictly prohibited and subject to immediate termination and liquidated damages (€250,000 for competitive misappropriation of Edudata.io curated databases).

6. Pricing, Invoicing & Official E-Billing Details

All prices are stated excluding Value Added Tax (VAT 25.5% or applicable statutory rate). Unless otherwise specified in a public procurement contract, standard payment terms are 14 days net from invoice date (or 21–30 days net for municipal framework agreements). Late interest accrues in accordance with the Finnish Interest Act (Korkolaki 633/1982).

7. Intellectual Property Rights & Confidentiality

Each party retains all Intellectual Property Rights to its pre-existing materials, software, methodologies, and tools. Upon full payment, the Customer receives a perpetual internal right to use customer-specific audit reports and DPIA documentation delivered by Cloudpoint. Both parties bind themselves to strict confidentiality regarding non-public technical, security, and commercial information, surviving contract termination for five (5) years (and indefinitely for statutory secrets under Finnish municipal law).

8. Limitation of Liability

Neither party shall be liable for indirect or consequential damages (such as lost profits or business interruption), except in cases of willful misconduct, gross negligence, or breach of confidentiality/IP restrictions. Cloudpoint Oy's aggregate liability under any service agreement is capped at the total service fees (excluding pass-through hyperscaler license fees) paid by the Customer for the relevant service during the twelve (12) months preceding the claim, in accordance with IT2022 YSE / JIT 2015.

9. Governing Law & Dispute Resolution

These Terms and all agreements between Cloudpoint Oy and the Customer are governed by the laws of Finland, excluding its conflict-of-law rules. Any disputes that cannot be resolved through good-faith executive negotiation within thirty (30) days shall be finally settled in the first instance by the Helsinki District Court (Helsingin käräjäoikeus).

Original Release: 4.2.2025 | Last Updated: April 2026 (Trust Center 2.0) | Framework: EU GDPR (2016/679) & Finnish Data Protection Act (1050/2018)

This is the Privacy Notice of Cloudpoint Oy (hereinafter "Cloudpoint" or "Controller") in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). It explains how Cloudpoint Oy collects, processes, retains, and safeguards personal data relating to its customers, prospective customers, training and webinar participants, technical support contacts, and website visitors. Cloudpoint Oy is part of the Nordic Delling Cloud group and an Official Google Cloud Premier Partner.

§ 1 Data Controller & Data Protection Officer (DPO) Contact Details

§ 2 Data Subjects & Register Structure

Name of the Register: Cloudpoint Oy's Customer, Contract, Training, Support Service, and Marketing Register.

Personal data is processed across the following categories of data subjects:

• Current B2B & Public Sector Customers: Decision-makers, IT administrators, contract contacts, and finance representatives at municipalities, joint municipal authorities, education providers, and private enterprises.
• Prospective Customers (Prospects): Representatives of organizations whose professional responsibilities relate to cloud infrastructure, digital education, cybersecurity, or IT procurement.
• Training, Webinar & Event Participants: Individuals registered for Cloudpoint trainings, workshops, webinars, or seminars on Google Workspace, Google Cloud, AI, and information security.
• Newsletter Subscribers & Resource Downloaders: Individuals who subscribe to newsletters or download whitepapers/guides on www.cloudpoint.fi and blogi.cloudpoint.fi.
• Technical Support Contacts (tuki@cloudpoint.fi): Designated customer administrators and contacts submitting support tickets, service requests, or incident reports.

§ 3 Purpose & Legal Basis of Processing (GDPR Art. 6)

Cloudpoint Oy processes personal data exclusively for specified, explicit, and legitimate purposes under Article 6(1) of the GDPR:

• Performance of a Contract & Pre-Contractual Measures (GDPR Art. 6(1)(b)): Onboarding customers, delivering licenses and cloud services (Google Workspace, Google Cloud Platform, Chrome Enterprise / Education, Nomen, Edudata.io), executing Managed Support and technical helpdesk services (tuki@cloudpoint.fi), organizing trainings, and managing invoicing.
• Controller's Legitimate Interest (GDPR Art. 6(1)(f)): Managing and developing B2B/public-sector customer relationships, customer communications, quality surveys, professional B2B direct marketing relevant to the data subject's organizational role, event invitations, and maintaining information security under our ISO/IEC 27001:2022 ISMS. Legitimate interest assessments (LIA) have been conducted, and data subjects have an unconditional right to opt out of direct marketing at any time.
• Consent (GDPR Art. 6(1)(a)): Sending electronic newsletters, consent-based marketing communications, and placing non-essential functional, analytics, and marketing cookies via the HubSpot Consent Banner. Consent may be withdrawn at any time.
• Compliance with a Legal Obligation (GDPR Art. 6(1)(c)): Fulfilling statutory accounting, tax, and audit obligations under the Finnish Accounting Act (Kirjanpitolaki 1336/1997) and mandatory data protection and cybersecurity regulations.

Automated Decision-Making (GDPR Art. 22): Cloudpoint Oy does not perform automated decision-making or profiling based on personal data that produces legal or similarly significant effects on data subjects.

§ 4 Processed Data Categories & Regular Sources

In accordance with the principle of data minimization, Cloudpoint Oy collects only the data necessary for the stated purposes:

• Basic & Contact Details: First name, last name, work email address, work telephone number, and office postal address.
• Organization & Role Information: Employer/customer organization name, Business ID, job title, department/role, and authorization details (e.g., signatory status or designated admin privileges).
• Contract, Order & Billing Data: Subscribed services, Google license tiers, contract terms, invoicing details, and payment history.
• Support & Event Data: Support ticket contents and timestamps (tuki@cloudpoint.fi), training and webinar registrations, attendance records, and customer feedback.
• Communication & Consent Preferences: Newsletter subscriptions, direct marketing permissions/opt-outs, and cookie consent logs.
• Technical Website & Session Data: IP address, browser type, operating system, session timestamps, visited URLs, and cookie identifiers (see Document B).

Regular Sources of Data: Personal data is collected primarily from the data subject directly during RFPs, contract negotiations, support requests, web form submissions, email correspondence, and event registrations. Data may also be provided by authorized representatives of the customer organization or obtained from public business and authority registers (e.g., Finnish Business Information System YTJ, public municipal/corporate websites, LinkedIn).

§ 5 Retention Periods

Cloudpoint Oy retains personal data only for as long as necessary to fulfill the purposes defined in § 3 or to comply with statutory obligations:

• Active Customer & Contract Relationships: Contract and contact person records are retained for the duration of the contractual relationship and for up to three (3) years following termination to address potential legal or warranty claims.
• Inactive Marketing Prospects & Event Leads: Personal data of prospective B2B contacts in the marketing register is retained for a maximum of 24 months from the last active interaction (e.g., webinar attendance, content download, or correspondence), after which the data is deleted or anonymized unless renewed consent is given.
• Statutory Accounting & Invoicing Material: Pursuant to the Finnish Accounting Act (Kirjanpitolaki 1336/1997, Chapter 2, Section 10), accounting vouchers, invoices, and financial correspondence are retained for at least six (6) years from the end of the calendar year in which the financial year ended.
• Support Ticket History (tuki@cloudpoint.fi): Retained for the duration of the active customer agreement to ensure service continuity, auditability, and security, and deleted or anonymized within 24 months after contract termination.

§ 6 Approved Controller Subprocessors

When acting as a Data Controller, Cloudpoint Oy engages only vetted service providers bound by written GDPR Article 28 Data Processing Agreements. Below is the complete table of all eight (8) verified subprocessors and group affiliates:

§ 7 International Transfers Outside the EU/EEA

Cloudpoint Oy stores and processes personal data primarily within data centers located in the European Union (EU) and European Economic Area (EEA) (specifically Finland europe-north1 in Hamina and other EU regions). Personal data is not routinely transferred outside the EU/EEA.

Where any international technology provider listed in § 6 (such as Google, HubSpot, Atlassian, or Harvest) processes limited technical metadata or global support routing outside the EU/EEA (e.g., in the United States), Cloudpoint Oy ensures an essentially equivalent level of data protection in compliance with GDPR Chapter V through:

• EU–U.S. Data Privacy Framework (DPF): The European Commission's Adequacy Decision of 10 July 2023 (GDPR Art. 45) for certified U.S. organizations.
• European Commission Standard Contractual Clauses (SCCs): Standard Contractual Clauses pursuant to Commission Implementing Decision (EU) 2021/914 (GDPR Art. 46(2)(c)), supplemented by Transfer Impact Assessments (TIAs) and strong cryptographic controls (TLS 1.3 in transit and AES-256 at rest).

§ 8 Data Subject Rights (GDPR Art. 15–22) & Supervisory Authority

Under the GDPR, every data subject has the following enforceable rights regarding their personal data:

• Right of Access (Art. 15): The right to obtain confirmation as to whether personal data concerning you is being processed by Cloudpoint Oy and to receive a copy of that data.
• Right to Rectification (Art. 16): The right to request the correction or completion of inaccurate, outdated, or incomplete personal data without undue delay.
• Right to Erasure ("Right to be Forgotten", Art. 17): The right to request the deletion of personal data where it is no longer necessary for the purposes collected or where consent is withdrawn, provided no statutory retention obligation (such as the Accounting Act) applies.
• Right to Restriction of Processing (Art. 18): The right to request restriction of processing in specific statutory situations (e.g., while contesting data accuracy).
• Right to Data Portability (Art. 20): The right to receive personal data provided to us in a structured, commonly used, and machine-readable format where processing is based on consent or contract.
• Right to Object (Art. 21): The right to object to processing based on legitimate interest on grounds relating to your particular situation, and an unconditional right to object at any time to processing for direct marketing purposes.
• Right to Withdraw Consent (Art. 7(3)): Where processing is based on consent, you may withdraw your consent at any time via the unsubscribe link in any marketing email or via the website Cookie Settings banner.

Exercising Your Rights: Requests should be submitted in writing to our Data Protection Officer: Lauri Kaski, lauri@cloudpoint.fi (or info@cloudpoint.fi). We respond to all requests without undue delay and within one (1) month of receipt (GDPR Art. 12(3)).

Original Release: 2.7.2024 | Last Updated: April 2026 | Scope: www.cloudpoint.fi & blogi.cloudpoint.fi

This Cookie Policy explains how Cloudpoint Oy (2325703-6) uses cookies and similar terminal storage technologies on its websites www.cloudpoint.fi and blogi.cloudpoint.fi, in compliance with Section 205 of the Finnish Act on Electronic Communications Services (917/2014), the EU GDPR, and the guidelines of the Finnish Transport and Communications Agency (Traficom).

1. What Are Cookies and What Is the Legal Basis for Their Use?

Cookies are small text files stored on your terminal device (computer, mobile phone, or tablet) by your web browser when visiting our websites. They enable core site security and functionality, remember language preferences and consent choices, and help us understand how visitors interact with our content.

• Strictly Necessary / Essential Cookies: Placed pursuant to Section 205 of the Act on Electronic Communications Services without prior consent, as they are strictly required for website security, load balancing, form submission integrity, and storing your cookie consent state.
• Functional, Analytics & Marketing Cookies: Placed on your device only after you grant explicit prior consent (Opt-In, GDPR Art. 6(1)(a)) via our HubSpot Consent Banner.

2. Cookie Categories Used on www.cloudpoint.fi and blogi.cloudpoint.fi

3. Managing, Withdrawing Consent, or Blocking Cookies

• Website Cookie Settings: You can review, modify, or withdraw your cookie consent at any time by clicking the "Cookie Settings" (Evästeasetukset) button in the website footer to reopen the HubSpot Consent Banner.
• Browser Controls: You can also configure your web browser (Chrome, Firefox, Safari, Edge) to block cookies or delete existing cookies from your device. Please note that disabling strictly necessary cookies in your browser may impair form submissions or site navigation.

For any inquiries regarding cookies or privacy, please contact our Data Protection Officer Lauri Kaski (lauri@cloudpoint.fi).

Version: 2026.2 | Effective Date: April 2026 | Regulatory Alignment: EU GDPR Art. 28, JIT 2015, IT2022 & KHO:2025:29

§ 1 Definitions

In this Data Processing Agreement ("DPA"), capitalized terms shall have the meanings set forth in Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and the Finnish Data Protection Act (1050/2018):

• Controller (GDPR Art. 4(7)): The Customer, which alone or jointly with others determines the purposes and means of the Processing of Personal Data.
• Processor (GDPR Art. 4(8)): Cloudpoint Oy, which processes Personal Data on behalf of the Controller pursuant to the Main Agreement and this DPA.
• Personal Data (GDPR Art. 4(1)): Any information relating to an identified or identifiable natural person ("Data Subject") processed by the Processor on behalf of the Controller as specified in Annex 1.
• Personal Data Breach (GDPR Art. 4(12)): A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.
• Subprocessor: Any third-party subcontractor or affiliate listed in Annex 3 engaged by the Processor to process Personal Data on behalf of the Controller.

§ 2 Scope, Purpose & Contractual Hierarchy

This DPA forms an integral part of the master services agreement, public procurement contract, or order confirmation ("Main Agreement") under which Cloudpoint Oy provides Google Workspace, Google Cloud Platform (GCP), Chrome Enterprise / Education (Chromebook), Managed Support (`Pääkäyttäjäpalvelu`), technical consulting, security/DPIA audits, or Nomen (2851575-1) / Edudata.io (3460068-8) integration services ("Service").

For Finnish public-sector customers, this DPA supplements the JIT 2015 Special Terms for the Processing of Personal Data, and for corporate customers, the IT2022 ETP Special Terms. In the event of any conflict between the Main Agreement and this DPA regarding data protection, this DPA and mandatory data protection law shall prevail, unless stricter customer-specific terms have been explicitly agreed in writing.

§ 3 Obligations of the Controller and the Processor (GDPR Art. 28(3))

• Controller Responsibilities: The Controller is responsible for ensuring a valid legal basis for Processing under the GDPR and national law (including the Finnish Basic Education Act 628/1998 and Act on the Openness of Government Activities 621/1999), informing Data Subjects, and providing lawful, documented instructions to the Processor. The Main Agreement and this DPA constitute the Controller's complete initial instructions.
• Processor Obligations: The Processor shall process Personal Data solely in accordance with the Controller's documented instructions and exclusively for the purposes set out in Annex 1. The Processor shall never process Customer Personal Data for its own commercial purposes, profiling, or advertising.
• Notification of Unlawful Instructions: The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other Union or Finnish data protection provisions (GDPR Art. 28(3) final subparagraph).
• DPO Contact Details: The Controller shall provide the Processor with up-to-date contact details for its Data Protection Officer (DPO) or privacy contact for incident notifications and compliance coordination.

§ 4 Zero Standing Privilege & Just-In-Time (JIT) Admin Access

Cloudpoint Oy enforces strict Zero Standing Privilege (ZSP) and Just-In-Time (JIT) administrative access controls across all Managed Support operations:

• Cloudpoint specialists do not maintain continuous, unmonitored standing access to Customer content data (such as end-user emails or Google Drive files).
• All administrative actions performed in the Customer's Google Workspace, GCP, or Chromebook Admin Console are executed strictly upon authorization by the Customer's designated administrator or pursuant to an explicit support ticket (tuki@cloudpoint.fi).
• Every administrative session requires hardware U2F/FIDO2 multi-factor authentication (YubiKey MFA) and is immutably recorded in the Customer's own Google Admin Audit Log for full transparency.

§ 5 Confidentiality & Statutory Secrecy under Finnish Law

The Processor ensures that all personnel and authorized consultants processing Personal Data have executed binding Non-Disclosure Agreements (NDAs) and are subject to statutory duties of confidentiality (GDPR Art. 28(3)(b)), including statutory secrecy obligations under the Finnish Act on the Openness of Government Activities (621/1999) when handling municipal and educational data. These confidentiality obligations survive the termination or expiry of the Main Agreement and this DPA indefinitely.

§ 6 Technical and Organizational Security Measures (GDPR Art. 32)

The Processor implements and maintains appropriate technical and organizational security measures pursuant to GDPR Article 32 and its ISO/IEC 27001:2022 Information Security Management System (ISMS) to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems. Compliance is continuously monitored via the Vanta automated compliance platform. Detailed security controls (including VPM-38, VPM-3, and AST-4..AST-9) are specified in Annex 2.

§ 7 Subprocessors (GDPR Art. 28(2) & 28(4))

The Controller grants the Processor general written authorization to engage the approved Subprocessors listed in Annex 3 for the delivery of the Service.

• Flow-Down of Obligations: The Processor shall enter into a written agreement with each Subprocessor imposing data protection and security obligations no less protective than those set out in this DPA. The Processor remains fully liable to the Controller for the performance of each Subprocessor's obligations (GDPR Art. 28(4)).
• Prior Notice & Right to Object: The Processor shall notify the Controller in writing at least 30 days in advance of any intended addition or replacement of Subprocessors. The Controller may object to such change on reasonable data protection grounds within 14 days of notification. If the Parties cannot reach an alternative resolution, the Controller may terminate the affected Service component.

§ 8 International Data Transfers & EU/EEA Data Residency

The Processor stores and processes Customer Personal Data primarily within the European Union (EU) and European Economic Area (EEA) (Finland europe-north1 and Belgium europe-west1). The Processor shall not transfer Customer Personal Data outside the EU/EEA without the Controller's documented instruction or consent.

Where the Customer's subscribed cloud configuration requires limited global follow-the-sun support routing outside the EU/EEA, such transfers are governed strictly by GDPR Chapter V using the European Commission's Adequacy Decision (EU–U.S. Data Privacy Framework, Art. 45), European Commission Standard Contractual Clauses (SCCs, Decision (EU) 2021/914, Art. 46), Transfer Impact Assessments (TIAs), and Google Cloud Data Regions controls.

§ 9 Assistance with Data Subject Rights

Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organizational measures, insofar as possible, for the fulfillment of the Controller's obligation to respond to requests for exercising Data Subject rights under GDPR Chapter III (Articles 15–22). Should a Data Subject submit a request directly to the Processor, the Processor shall forward the request to the Controller without undue delay.

§ 10 Personal Data Breach Notification (48–72 Hours)

The Processor shall notify the Controller in writing without undue delay and no later than within 48–72 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data (Control VPM-38, GDPR Art. 33(2)).

Such notification shall include at least the information required under GDPR Article 33(3):

• A description of the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and Personal Data records concerned;
• The name and contact details of the Processor's Data Protection Officer (Lauri Kaski, lauri@cloudpoint.fi, +358 9 4257 9280);
• A description of the likely consequences of the Personal Data Breach;
• A description of the measures taken or proposed to be taken by the Processor to address the breach and mitigate its possible adverse effects.

§ 11 DPIA Assistance & Audit Rights (Aligned with KHO:2025:29 & Decision 236353745124)

The Processor shall assist the Controller in conducting Data Protection Impact Assessments (DPIA, GDPR Art. 35) and prior consultations with supervisory authorities (Art. 36). For municipalities and education providers, Cloudpoint Oy's technical architecture, logging minimization, and organizational controls are specifically aligned with the Finnish Supreme Administrative Court precedent KHO:2025:29 (and decision 236353745124) concerning the lawfulness of educational cloud processing, restriction of telemetry/additional services, and protection of student personal data across Google Workspace for Education and Chromebooks.

Right to Audit (GDPR Art. 28(3)(h)): The Controller or an independent third-party auditor mandated by the Controller (bound by an NDA and not a direct competitor of the Processor) may audit the Processor's compliance with this DPA. Upon request, the Processor provides current ISO/IEC 27001:2022 / Vanta compliance reports and third-party penetration test summaries. On-site or technical audits may be conducted up to once every 12 months with at least 30 days' prior written notice, unless a verified Personal Data Breach or supervisory authority order requires an immediate inspection.

§ 12 Return and Deletion of Personal Data (30–90 Days)

Upon termination or expiry of the Main Agreement, the Processor shall, at the choice of the Controller, return or permanently delete all Personal Data and existing copies in the Processor's possession, and revoke all Cloudpoint support and administrative credentials from the Customer's environment within 30–90 days of termination, unless Union or Finnish law requires storage of the Personal Data (GDPR Art. 28(3)(g)).

Databases hosted within the Customer's own Google Workspace, Google Cloud, and Nomen/Edudata.io projects remain under the direct ownership and control of the Customer, with Cloudpoint's administrative access revoked immediately upon termination.

§ 13 Liability

Liability toward Data Subjects is governed by GDPR Article 82. Inter-party contractual liability is governed by the Main Agreement (including JIT 2015 or IT2022 terms where applicable). Unless otherwise stipulated in the Main Agreement or mandatory law, the Processor's maximum aggregate liability under this DPA is capped at 100% of the service fees paid by the Controller to the Processor during the preceding 12 months.

§ 14 Term and Termination

This DPA enters into force upon execution or ordering of the Main Agreement and remains in effect for as long as the Processor processes Personal Data on behalf of the Controller, including the 30–90 day return and deletion period under § 12.

§ 15 Governing Law and Dispute Resolution

This DPA shall be governed by the laws of Finland, excluding its conflict-of-law provisions. Any disputes arising out of this DPA shall be resolved primarily through good-faith negotiations and ultimately by the District Court of Helsinki (Helsingin käräjäoikeus).

Version: 2.0 | Effective Date: April 2026 | Regulatory Framework: EU AI Act ((EU) 2024/1689), GDPR & ISO/IEC 27001:2022

This AI Governance and Responsible AI Policy defines the architectural safeguards, privacy commitments, and regulatory controls enforced by Cloudpoint Oy (Business ID 2325703-6, part of Delling Cloud and an Official Google Cloud Premier Partner) when designing, deploying, and managing generative AI solutions for municipalities, education providers, and enterprise customers.

1. Google Workspace with Gemini & NotebookLM — Enterprise Privacy Architecture

When a customer organization deploys Google Workspace with Gemini or NotebookLM Enterprise / Education through Cloudpoint Oy, all processing is governed by Google's binding enterprise data protection commitments (Google Workspace Cloud Data Processing Addendum):

• Zero Foundational Model Training: Customer data (emails, Google Docs/Slides/Sheets, Meet transcripts, and Gemini prompts) is never used to train or fine-tune public Gemini foundational models.
• No Human Prompt Review: Customer prompts and generated outputs are never read or reviewed by external human raters.
• Strict Permission Inheritance (RBAC & Zero Trust): Gemini only retrieves and synthesizes information from documents to which the authenticated user already holds explicit read permissions within Google Workspace.
• Granular Organizational Unit (OU) & Age-Based Controls in Education: Cloudpoint configures strict OU-level policies in the Google Admin Console to govern AI access across teaching staff, municipal administration, and eligible student cohorts based on age and pedagogical policy.

2. Vertex AI & EU Data Residency (europe-north1 Finland & europe-west1 Belgium)

For custom enterprise AI agents, Retrieval-Augmented Generation (RAG / Enterprise Search), and workflow automation, Cloudpoint Oy builds on Google Cloud Platform's (GCP) Vertex AI:

• Strict EU Data Residency: All model inference, embeddings, vector databases, and document storage are pinned to European Union regions — primarily Finland (europe-north1, Hamina) and Belgium (europe-west1).
• Customer-Owned GCP Tenant Isolation: Custom deployments reside inside a logically isolated GCP project owned by the customer, preserving full customer control over Customer-Managed Encryption Keys (CMEK), IAM policies, and VPC Service Controls perimeters.
• Cryptographic Protection: All Vertex AI API traffic is encrypted in transit via TLS 1.3 and encrypted at rest via AES-256.

3. EU AI Act ((EU) 2024/1689) & High-Risk Education Safeguards

The European Union Artificial Intelligence Act (Regulation (EU) 2024/1689) classifies specific AI systems deployed in education and vocational training (Annex III, Point 3) as High-Risk AI Systems. Cloudpoint Oy ensures that all deployed and managed AI environments adhere to EU AI Act safeguards:

• Prohibition of Unacceptable-Risk Practices (EU AI Act Art. 5): AI solutions delivered by Cloudpoint are never configured or used for emotion recognition in schools or workplaces, social scoring, or subliminal behavioral manipulation.
• Mandatory Human Oversight — Human-in-the-Loop (EU AI Act Art. 14 & GDPR Art. 22): AI operates strictly as an assistive co-pilot for teachers, civil servants, and enterprise specialists. AI is never used to make autonomous binding decisions regarding student admissions, unverified grading of learning outcomes, or disciplinary measures.
• Transparency Obligations (EU AI Act Art. 50): Users are clearly informed whenever they interact with an AI system and whenever content is AI-generated or AI-assisted.
• AI Literacy Enablement (EU AI Act Art. 4): Cloudpoint delivers structured training programs for municipal staff, educators, and enterprise teams to foster safe, critical, and privacy-compliant AI literacy.

4. Municipal & Educational AI DPIA Advisory (Aligned with KHO:2025:29 & Edudata.io)

Prior to deploying generative AI in a municipality or educational institution, the Data Controller must complete a Data Protection Impact Assessment (DPIA, GDPR Art. 35) and, where applicable, a Fundamental Rights Impact Assessment (FRIA, EU AI Act Art. 27).

Cloudpoint Oy and our group affiliate Edudata.io (3460068-8) provide end-to-end compliance advisory for public-sector and enterprise controllers:

5. Contact Information for AI Governance & Privacy

For inquiries regarding Cloudpoint Oy's AI Governance, Gemini security configurations, or DPIA advisory services, please contact our Data Protection Officer: Lauri Kaski, CEO & DPO, Cloudpoint Oy, lauri@cloudpoint.fi, Phone: +358 9 4257 9280.

Organization: Cloudpoint Oy (2325703-6, part of Delling Cloud) | Version: 2.0 (April 2026) | Framework: ISO/IEC 27001:2022 & Vanta

1. Executive Summary

Cloudpoint Oy (Business ID 2325703-6, VAT ID FI23257036, Official Google Cloud Premier Partner) serves as a trusted cloud and cybersecurity partner for municipalities, education providers, and enterprises across Finland and the Nordics. Because our specialists support mission-critical Google Workspace, Google Cloud Platform (GCP), and Chromebook environments alongside Nomen and Edudata.io integrations, uncompromising information security is foundational to our operations.

This Security Whitepaper details Cloudpoint Oy's technical and organizational controls governed by our ISO/IEC 27001:2022 Information Security Management System (ISMS), Zero Trust access architecture, and Privacy by Design engineering principles.

2. ISMS Governance & Continuous Monitoring via Vanta

Cloudpoint Oy's Information Security Management System (ISMS) is architected in strict alignment with ISO/IEC 27001:2022. Rather than relying solely on point-in-time annual audits, Cloudpoint enforces automated, continuous compliance monitoring via Vanta:

• Risk & Vulnerability Management (Control VPM-3): Vanta and Google Cloud Security Command Center continuously ingest and evaluate technical vulnerability intelligence, software dependencies, and cloud posture configurations. Identified vulnerabilities are triaged and patched under strict SLA timelines.
• Infrastructure Hardening & Incident Management (Control VPM-38): Supporting cloud infrastructure and endpoints are routinely patched and hardened under scheduled maintenance protocols, backed by a formalized 4-tier Incident Response Plan.
• Asset & Endpoint Lifecycle Governance (Controls AST-4..AST-9): Every informational and physical asset is inventoried and monitored via MDM and the Vanta Agent. Controls AST-4, AST-5, AST-6, AST-7, AST-8, and AST-9 enforce mandatory tracking from hardware provisioning through offboarding, cryptographic wipe, and physical return.
• Personnel Security & Confidentiality: All employees and authorized subcontractors sign binding Non-Disclosure Agreements (NDAs), complete recurring security and GDPR awareness training, and maintain verified Google Cloud certifications.

3. Access Control & Managed Support Security (YubiKey MFA & JIT)

Cloudpoint Oy enforces a strict Zero Trust and Principle of Least Privilege (RBAC) access model across all internal systems and customer Managed Support operations (tuki@cloudpoint.fi):

• Hardware U2F/FIDO2 Multi-Factor Authentication (YubiKey MFA): Administrative access to production environments, source code repositories, and customer admin consoles requires phishing-resistant hardware YubiKey (U2F / FIDO2 / WebAuthn) security keys.
• Zero Standing Privilege & Just-In-Time (JIT) Admin Access: Cloudpoint specialists do not maintain continuous standing access to customer end-user content. Administrative actions are performed on a Just-In-Time (JIT) basis strictly upon authorization by the customer's designated administrator or pursuant to a documented support ticket.
• Immutable Admin Audit Log Transparency: Every administrative action or policy change executed by a Cloudpoint specialist is immutably logged in the customer's own Google Admin Audit Log (capturing actor identity, timestamp, source IP, and exact configuration delta).

4. Endpoint, Network & Cryptographic Security

• Mandatory Full Disk Encryption (FDE): All company-issued laptops and workstations utilized by Cloudpoint staff enforce mandatory Full Disk Encryption (FDE — FileVault / BitLocker / LUKS), automatic screen lock policies, and continuous endpoint compliance verification via Vanta.
• Encryption at Rest (AES-256): All persistent cloud storage, databases, audit logs, and backups are encrypted at rest using AES-256 encryption.
• Encryption in Transit (TLS 1.2 / TLS 1.3): All external and internal network traffic between client devices, APIs, and microservices is encrypted in transit using TLS 1.2 or TLS 1.3 with enforced HSTS.
• Email & Domain Authentication Monitoring (SPF / DKIM / DMARC): Cloudpoint continuously enforces and monitors strict SPF, DKIM, and DMARC (p=reject/quarantine) policies across both corporate domains and managed customer tenants to prevent spoofing and phishing attacks.

5. 3-Tier Data Classification Model

Cloudpoint Oy's Data Management Policy classifies all organizational and customer information into three distinct security tiers:

6. Physical Security at Malminkaari 17-19B, 00700 Helsinki

Cloudpoint Oy's headquarters at Malminkaari 17-19B, 00700 Helsinki, Finland, and our underlying EU cloud infrastructure enforce multi-layered physical security:

• 24/7 Monitored Access Control & Surveillance: Office premises are secured by electronic badge access control, intrusion detection alarms, professional security guarding, and 24/7 CCTV surveillance covering building entry points.
• Visitor Logs & Clean Desk Policy: All external visitors are registered in a visitor log and must be escorted by authorized staff at all times. A strict Clean Desk and Clear Screen policy is enforced across all workspaces.
• Zero On-Premises Customer Servers & Encrypted EU Backups: No customer personal data is stored on local office servers or removable USB media. All cloud workloads and encrypted backups reside in ISO/IEC 27001-certified Google Cloud EU data centers (primarily europe-north1 in Hamina, Finland).

7. Incident Response Plan (VPM-38) & Annual External Penetration Testing

Cloudpoint Oy maintains a formalized Incident Response Plan (Control VPM-38) overseen by our CEO and Data Protection Officer Lauri Kaski (lauri@cloudpoint.fi):

• Containment & Post-Mortem Root-Cause Analysis: Upon any Indicator of Compromise (IOC), our response team executes immediate containment runbooks ("stop the bleeding" via credential rotation and mutating access revocation), followed by a formal Post-Mortem Root-Cause Analysis to prevent recurrence.
• Annual External Penetration Testing: Cloudpoint Oy and its group affiliates (Nomen / Edudata.io) undergo annual independent security assessments and external penetration tests conducted by certified third-party cybersecurity firms.

Statement Updated: April 2026 | Standard: WCAG 2.2 Level AA & EN 301 549 | Legal Framework: Laki digitaalisten palvelujen tarjoamisesta (306/2019) & Directive (EU) 2016/2102

1. Compliance Status & Scope

This Accessibility Statement applies to Cloudpoint Oy's public website (https://www.cloudpoint.fi) and its embedded Trust Center 2.0 documentation portal. Because Cloudpoint Oy serves Finnish municipalities, schools, and public-sector authorities, we voluntarily and contractually align our digital services with the Finnish Act on the Provision of Digital Services (306/2019), the EU Web Accessibility Directive (EU) 2016/2102, the European Accessibility Act (EU) 2019/882, and the Web Content Accessibility Guidelines (WCAG) 2.2 Level AA.

Based on our technical accessibility audit conducted in Q2 2026, the www.cloudpoint.fi/trust-center portal is fully compliant with WCAG 2.2 Level AA criteria, and the broader www.cloudpoint.fi marketing site is substantially compliant with ongoing continuous monitoring.

2. Verified WCAG 2.2 Level AA Technical Controls

3. Accessibility Feedback & Contact Channel

Did you notice an accessibility barrier on www.cloudpoint.fi, or do you require any legal, DPIA, or compliance document in an alternative accessible format? Please contact us:

• Email: tietosuoja@cloudpoint.fi or info@cloudpoint.fi
• Telephone: +358 9 4257 9280
• Responsible Officer: Lauri Kaski, CEO / Data Protection Officer (lauri@cloudpoint.fi)
• Statutory Response Time: We acknowledge all accessibility inquiries promptly and provide a formal response within 14 days in accordance with the Act on the Provision of Digital Services (306/2019).

4. Supervisory Authority & Enforcement Procedure (Traficom)

If you notice accessibility issues on the site, first give feedback to us (the site administrator). If you are not satisfied with the response you receive, or if you do not receive a response within 14 days, you may file a notification with the national supervisory authority in Finland: