Entities involved in the processing of data

Data Protection and Information Security are central functions within the SD Worx Group and all essential policies and controls are effectuated equally throughout all companies that form part of SD Worx Group. We therefore hold that data delivered for the purposes of our fulfilment of a contractual obligation to one of the subsidiaries of SD Worx Group is to be considered as data delivered to all subsidiaries of SD Worx Group. The data exchanged between subsidiaries may however be limited based on the delivery model chosen and the country of operations. 

 

On premise (OP)
During a normal on-premise delivery, the customer has the database containing personal data in-house and we are therefore unable to access the data without permission from the customer. All requirements relating to GDPR compliance mentioned on https://www.sdworx.com/en-en/gdpr are applicable to all our products but as the market has shifted towards a cloud service based model we do have more of our newer products available for this model which may mean that functionalities are delivered through an onsite custom installation. Please contact our consulting team for more information.

Outside of onsite installations and maintenance of our products we may be able to access personal data in the normal course of business such as when providing support. In this case you as a customer will be taking initial contact and need to be aware of privacy best practice and operating standards.

 

Support Services. Any data delivered to us that may contain personal data is not identified as such there where it concerns the normal day-to-day business activities. E-mail and support tickets send to us are send over a trusted network but are left unencrypted. Such E-mails may contain personal data send to us and the sender should be aware that no large amounts of data are send in the text body of the E-mail. In this case think before you send applies and customers will be made aware and our staff will be trained to avoid unnecessary sharing of data.

 

Technical support services. Customer data for testing or for resolving errors in software or in the handling of software is only used upon consent from customer and preferably within customer environment. The data delivered to us in form of any attachment is removed within two years. We are sending files that may likely contain larger records of personal data such as CSV (excel) or XML files only encrypted and reduce where possible unique identifiers such as personal identification numbers. Of any files delivered to us that may likely contain sensitive data please ensure to:

1. Send files encrypted;
2. Filter personal data and alter by for example anonymizing where possible.

 

Cloud (CL)
The information under “support services” and “technical support services” applies also to our cloud customers. Otherwise our software as a service will not entail the transfer of large data files as we already are in possession of the database. It is therefore also that we have a special responsibility towards your data. Your data is handled by our centralized Cloud Team with offices in Espoo, Finland. Here delivery management, change management, information security management are working close together to ensure both availability and integrity of your data. Under technical and organisational security measures you will be able to find more information on how your data is safeguarded and respected.

 

Managed Payroll Services  (MPS)
Managed Payroll Services is foremost done through the entities marked with “MPS” in the company name and data received in the execution of tasks is normally not shared outside the country of operations.

 

External entities as sub-processors

As part of our service delivery we may use external parties, in the case where such external parties have access to personal data these are listed here. Based on the access to personal data these sub-processors have received a criticality status critical or major. There where the sub-processor is listed as critical the sub-processor is subject to an on-site audit according to our audit policy.

 

On-Premises (OP)
Technical Support Services, customer data only used upon consent from customer and preferably within customer environment. There are limited entities that may be involved in sub processing and this is only due access to support incidents or through additional products purchased.

 

Cloud
For cloud service management we have strategical partners for the provision of hosting services and back-ups management. Please find more information below.

 

Managed Payroll Services (MPS)
As part of the Managed Payroll Services delivery model we have partnerships with companies foremost for the provision of ancillary services such as printing and postage of payslips, such ancillary services are always agreed on in the master agreement. Please find more information below.

*Elisa Appelsiini Oy (1539836-5) was merged with its parent company Elisa Oyj 0116510-6, as per 31 December 2018.

** www.sdworx.com/en-en/gdpr-servicenow. Security log data (such as IP addresses and logon/logoff information) may, in limited cases, be accessed by ServiceNow employees located outside the EU/EEA.

 

Last update: August 2025