Draft, pending approval

Tarumo terms of service

Draft of 28 October 2026, not yet in force

Previous versions

This is a draft pending approval by Tarumo Oy. The terms take effect only once the approved version is published on this page. Online ordering of the Small (Pieni) and Handover (Siirto) packages opens only after that.

These terms of service apply to the Tarumo service, which Tarumo Oy provides to companies and other organisations. The processing of personal data is agreed in the data processing agreement, which forms part of the same contract. The terms are written in Finnish and English. The Finnish version is authoritative, and the English version is a faithful translation of it.

The key terms in brief

• Businesses only. The service is sold to companies and other organisations for their business, not to consumers (section 1).
• Small continues month by month, and the card is charged every month until the contract is cancelled. A paid month is not refunded, except in the situations described in sections 6, 15 and 16 and in sections 11 and 19 of the data processing agreement.
• Handover is a one-off fee that is not refunded once the organisation has been opened (exception in section 5). It includes 3 months of interviews followed by 12 months of read access.
• If a payment fails, use is suspended until the payment succeeds. The data is kept.
• After the contract ends the Customer can export its data for at least 30 days. After that, the data is permanently deleted. If the Customer switches to another service, the service first continues as normal for a 30-day transition period (section 12 a).
• Liability is limited on both sides (section 14).
• Changes: Tarumo announces changes to the terms in advance. The Customer may terminate the contract before a change unfavourable to it takes effect (section 16).

This summary does not replace the terms. In a conflict, the sections below apply.

1. Parties and scope

The service is provided by Tarumo Oy (business ID 3664892-5, Artturintie 4, 43500 Karstula, Finland), hereinafter Tarumo. The customer is the company or other organisation that orders the service, hereinafter the Customer.

• Businesses only. The service is sold only to businesses and other organisations for their trade, business or profession, not to consumers. In an online order, the person ordering confirms separately that they order the service for the business of a company or other organisation and not as a consumer. A company in another EU country must give a valid VAT number in the order (section 6). A sole trader may order the service for their business. Tarumo may check the Customer's details in public registers, such as the Finnish Business Information System (YTJ) and the EU's VIES system for VAT numbers. If the person ordering is not a company or other organisation, Tarumo may cancel the order and refund the payment.
• Authority of the person ordering. The person placing the order confirms that they are authorised to enter into the contract on the Customer's behalf. If they were not, they are liable for the contract and for damage under section 25 of the Finnish Contracts Act.
• Sanctions. Tarumo complies with the sanctions of the European Union and Finland. The service is not sold or provided, directly or indirectly:
  • to the state or public bodies of Russia or Belarus, or to companies or other entities established in Russia or Belarus. A branch of a Russian company outside Russia counts as established in Russia;
  • to persons or entities whose assets the EU has frozen, or to entities they own or control;
  • to anyone acting on behalf or for the benefit of the above.
  The service includes AI and speech recognition. The EU has prohibited providing AI services to legal persons established in Russia (Council Regulation (EU) No 833/2014, Article 5n(1)(g)). Tarumo does not provide the service in Belarus at all. The Customer confirms that it is none of the above. The Customer does not give access to the service or pass content produced by the service to such a party, for example a Russian parent company. Tarumo may suspend the service and end the contract at once without liability if this confirmation proves untrue, the Customer breaches this item, or the sanctions change so that the service can no longer be provided. The export period of section 12 also applies in this case, unless the sanctions require otherwise.
• The terms apply to all packages: Small (Pieni), Handover (Siirto), Standard (Perus), Extended (Laajennettu), Group (Konserni) and Mapping (Kartoitus).
• For online orders (Small and Handover), the contract is formed when the person ordering has accepted these terms and the data processing agreement and the payment has been accepted. For other packages, the contract is formed when the parties have signed the order or contract, including electronically.
• Order of documents. If the documents conflict, they apply in this order: (1) a signed order or contract, (2) the data processing agreement in matters of personal data processing, (3) these terms and (4) the price list. A signed order may depart from the data processing agreement only if the order names the item it changes. The Customer's own purchasing or contract terms do not bind Tarumo unless agreed in writing.

2. Definitions

• Service: the Tarumo online service with its guides, including the web app that can be installed on a phone and, if the Customer enables it, Tarumo's Microsoft Teams app.
• User: a person whom the Customer has invited to the service as an administrator, manager, expert or reader.
• Accountant: a person whom the Customer's administrator has invited to see the Customer's billing (section 7 a). The accountant does not see Customer content.
• Key person: a person whose knowledge capture is tracked in the service. Package prices and limits are set by the number of key people.
• Customer content: everything the Customer and its users store in the service, such as interview answers, knowledge cards, information on key people and knowledge areas, and the Customer's own changes to knowledge packs.
• Knowledge card: a card made from an interview or from the expert's own writing, which is published only once the expert has approved it.
• AI output: a question, a polished suggestion of an answer, a card draft, a knowledge pack draft, a mapping pack proposal or an answer in Ask that the AI drafts in the service.
• Exportable data: the data listed in section 9.

3. The service and its principles

Tarumo captures the tacit knowledge of departing experts. The risk radar shows the knowledge areas where knowledge is at risk of being lost. The AI interviews the expert and turns the answers into draft knowledge cards. The expert approves the cards, and users can search them and ask the AI about them. Section 4 and the price list describe what each package includes.

Tarumo commits to these principles:

• A knowledge card is published only with the expert's approval. An unapproved card does not appear in search or in the AI's answers.
• The AI answers only from published cards and always states the source (expert and date). If no answer is found, it says so and suggests whom to interview.
• The service does not evaluate or compare employees, and it does not score them for the employer. The risk radar measures the risk of knowledge being lost, not how people perform. Incentive points are visible only to the person themselves (section 3 b).
• In the service, interview answers are visible only to the interviewee. The Customer's administrators and managers do not see them. They can be disclosed only under a statutory obligation, as set out in section 13 of the data processing agreement. Section 9 of the data processing agreement describes the technical access of Tarumo's staff to the database.
• Swear words and inappropriate content are filtered out. Filtered content is not stored and is not reported to the employer (section 3 c).
• Knowledge is not deleted but replaced. This principle concerns knowledge cards: an outdated or incorrect card is archived when a corrected version is approved, and the version history is kept. An administrator can withdraw a card that contains offensive text, a third person's personal data or confidential information. The expert is told and can publish a corrected version. If a card is withdrawn because of personal data or confidential information, its content is deleted after 30 days, or at once on a data subject's erasure request, and the version history keeps only the reason and the date (section 7 of the data processing agreement).
• Personal data is still deleted under the GDPR and the data processing agreement. When the contract ends, Tarumo deletes the organisation's data, knowledge cards included, as set out in section 12. When an individual person's data is erased, their interviews, audio recordings and unapproved drafts are deleted, and the published cards they approved stay with the organisation, either under their name or with "Former expert" as the source, as the Customer decides (section 13 of the data processing agreement).

Tarumo may change and develop the service but will not materially reduce the core features the Customer has paid for during the contract period. Changes are announced on the service's What's new page. Features marked "coming" in the price list become part of the service only when they are released.

The AI drafts questions, card drafts and answers, and it can make mistakes. That is why the expert approves every card and every answer shows its source. The Customer is responsible for how it uses the cards and answers. Instructions relating to safety, health or significant financial decisions must be checked against the source card and the Customer's own instructions before use.

3 a. AI and intended purpose

• Under the EU AI Act (2024/1689), Tarumo is the provider of the service's AI system and the Customer is its deployer.
• Intended purpose: the service is used to capture an organisation's know-how and give access to it. The AI interviews the expert, turns the answers into card drafts and answers questions from published cards. The risk radar is a rule-based calculation that uses knowledge areas, departure dates and the amount of knowledge captured. It measures the risk of knowledge being lost and does not assess how a person performs.
• The service tells users when they are interacting with AI, and AI output is marked visibly and in a machine-readable way in the service.
• The service makes no decisions about people based solely on automated processing, and it does not infer emotions or states of mind from voice or text.
• Prohibited use: the Customer does not use the service or its data (a) for recruitment or the selection of people, (b) for decisions on the terms of employment, pay, promotion or the termination of employment, (c) to allocate tasks based on a person's behaviour or traits, (d) to monitor, evaluate, score or compare employees' performance or behaviour, or (e) to infer emotions or states of mind. The service's own incentives are allowed as they work in the service (section 3 b), but their data must not be used for these purposes.
• If the Customer uses the service for a prohibited purpose, the Customer is responsible for it, including the obligations under the AI Act, and compensates Tarumo for the resulting damage.
• Tarumo explains how the service works and the limits of the AI on the service's Help page. The Customer tells its users what the service is used for and that the AI can make mistakes.

3 b. Incentives

• The Customer's administrator can switch on the service's incentives: personal achievements and the Growth ring (points for approved cards and for colleagues' "useful" marks), shared team challenges and the employer's rewards. Incentives are off by default in an organisation.
• A person's own points, level and achievements are visible only to them. A reward granter learns of an achievement and a reward only if the person themselves agrees. Others see only team-level information.
• Everyone can switch incentives off for themselves. There are no penalties, and an achievement once earned is never taken away.
• Points and achievements are not exported to HR or appraisal systems. The Customer does not use them for decisions on employment, in appraisals or to compare people (section 3 a).
• The Customer is responsible for the taxation of its rewards. For example, gift cards and lunches may be taxable benefits.

3 c. Content filtering, notices and points of contact

Tarumo stores content provided by users at their request. The rules of the EU Digital Services Act (2022/2065) on hosting services therefore apply to Tarumo.

• Filtering: the service removes swear words from interview answers, card edits, the notes of card reports and the texts of knowledge packs, and leaves offensive, inappropriate or unclear content out of knowledge cards. The filtering is automatic, by AI classification, with word lists as a fallback. If the AI is unavailable, content that has passed the word lists waits for the AI's review and is not shown to others.
• Filtered content is not stored and is not reported to the employer. The service tells the person answering at once that the answer was not saved, and they can answer again. Only the number of filterings is logged.
• If a user thinks the filtering was wrong, they can write to support@tarumo.fi. A person reviews the matter from what the user tells, because the filtered content has not been kept.
• Notice of illegal content: anyone can report illegal content in the service to the same address. The notice states which content it is and where it is, why the person reporting considers it illegal, and their name and email address. Tarumo confirms receipt, handles the notice without undue delay and tells the person reporting of the decision. Customer content is not visible in Tarumo's administration tools, so Tarumo handles a notice together with the Customer's administrators where needed. If content is removed or its visibility restricted, Tarumo gives the reasons to whoever stored the content.
• If Tarumo becomes aware of a criminal offence that threatens someone's life or safety, it informs the authorities.
• Point of contact: authorities and users of the service can contact Tarumo on matters under Articles 11 and 12 of the Digital Services Act at support@tarumo.fi, in Finnish or English.

4. Packages

• Mapping, Standard, Extended and Group are sold on invoice under a separate order or contract. Mapping is a one-off risk mapping. Standard, Extended and Group are annual contracts with a monthly price. The price, number of key people, contract period and invoicing are agreed in the order.
• Small costs €149 per month + VAT and includes up to three key people. It is a monthly subscription that continues month by month until cancelled.
• Handover costs €1,490 as a one-off fee + VAT and includes one key person, usually the departing person. The contract starts with a three-month interview period, after which the cards can be read for another 12 months (no new interview can then be started, but one in progress is completed), and the customer can continue to a Small subscription in the same organisation from 90 days before the read access ends, keeping the data.
• Readers who use search and Ask are free of charge. The price is set by the number of key people, not users.
• Discounts and launch offers apply only as agreed in writing. They do not apply to the Handover package.

5. Term and termination

• Small runs until further notice. The Customer can cancel it at any time on the service's Organization page (Billing and payments) or by email. The contract ends at the end of the paid month. A period already paid is not refunded. A cancellation can be withdrawn before the end of the period.
• Handover is a fixed-term contract that ends without notice when the read access ends, that is 15 months after it starts (the 3-month interview period followed by the 12-month read access). The one-off fee is not refunded once the Customer's organisation has been created and the service opened, unless otherwise agreed. If Tarumo, however, discontinues the service or ends the contract for a reason not attributable to the Customer, Tarumo refunds the part of the one-off fee that corresponds to the days remaining of the 15-month contract period.
• Packages sold on invoice run as set out in the order. Unless the order says otherwise, the contract continues until further notice after the contract period, and either party may terminate it with three months' notice.
• Tarumo may terminate a contract running until further notice with three months' notice.
• In addition, the Customer may at any time request a switch to another service or the porting of its data under section 12 a, also during a fixed-term contract.
• Either party may terminate the contract with immediate effect if the other party materially breaches it and does not remedy the breach within 14 days of a written notice.
• Tarumo may suspend the service or a single user's access at once if the use endangers the security of the service or the service of other customers, or is clearly unlawful. The suspension lasts only as long as necessary, and Tarumo informs the Customer without delay.
• Sections 12 and 12 a describe the end of the contract and data export.

6. Prices, payment and VAT

• VAT: prices are in euros and exclude VAT. VAT is added to the invoice as required by the law in force. A Finnish Customer is charged Finnish VAT. A company in another EU country must give a valid VAT number in the order: its invoice carries no VAT, is marked "käännetty verovelvollisuus / reverse charge", and the Customer accounts for the tax in its own country. A company outside the EU is not charged Finnish VAT, and the Customer is responsible for any taxes payable in its own country. The Customer pays the price without deductions. If the law of the Customer's country requires tax to be withheld, the Customer pays an additional amount so that Tarumo receives the agreed price in full.
• Online orders: Small and Handover are paid through Stripe Payments Europe Ltd (Ireland) by card or by another method offered on the payment page. Handover is charged once when ordered. Small is charged monthly in advance: by ordering Small, the Customer authorises Tarumo to charge the monthly fee through Stripe to the payment method the Customer has given at the start of each billing period until the contract ends. The invoice and receipt are sent by email and are also available under Billing and payments in the service. Tarumo does not see or store card details. Stripe processes payment data partly on its own behalf; the privacy notice describes this.
• Failed payment: Stripe retries the charge and notifies the Customer by email. If the payment still fails after the retries, Tarumo suspends the service. Users then cannot access the organisation, but the data is kept, and administrators can still pay, export the knowledge cards and view the log. When the payment succeeds, the service resumes automatically. If payment is not received within 30 days of the suspension, Tarumo may end the contract, and the export period of section 12 begins.
• Packages sold on invoice are invoiced as set out in the order. Unless the order says otherwise, payment is due within 14 days net. Late payment interest is charged under section 4 a of the Finnish Interest Act, together with the fixed compensation of €40 for recovery costs under section 10 i of the Finnish Act on the Collection of Debts. If a payment is more than 30 days late, Tarumo may, after a written reminder, suspend the service in the same way as for online orders.
• Price changes: Tarumo may change the prices of a contract running until further notice by giving at least 90 days' notice. The Customer may terminate the contract to end before the change takes effect, and the unused part of a period paid in advance is then refunded pro rata. A change does not affect periods already paid or the Handover package. The prices of a fixed-term contract are those in the order.

7. Responsibilities of the customer and users

• The Customer appoints administrators, invites users and assigns their roles. The Customer is responsible for its users complying with these terms.
• Users keep their means of signing in to themselves. The Customer informs Tarumo without delay if it suspects misuse of an account.
• The Customer as controller and employer. The Customer is responsible, at its own cost, for ensuring that
  • there is a legal basis for processing personal data, employees and other data subjects are informed of the processing under Articles 13 and 14 of the GDPR, and any required impact assessment has been carried out;
  • the introduction of the service has been handled with the staff as the law requires: in the dialogue under the Finnish Co-operation Act in a company with at least 50 employees, in the dialogue under section 7 a of that Act in a company with 20–49 employees, and under sections 4 and 21 of the Finnish Act on the Protection of Privacy in Working Life. In a smaller company, employees are heard before the service is introduced when section 21 of that Act requires it;
  • interviews take place during working hours or are agreed in line with the rules on working time, and an interview with a person whose employment has already ended is agreed separately;
  • the Customer has the necessary rights to the content experts write and dictate, and publishing the content under the expert's name or as "Former expert", and correcting it, has been agreed with the staff;
  • the service is used only for the intended purpose in section 3 a;
  • the access of people who have left the organisation is removed or their role is changed.
  For these obligations, Tarumo explains how the service works on the service's Help page and in the data processing agreement. Tarumo does not give legal advice.
• The Customer is responsible for having the right to store its content in the service, such as third parties' confidential information. Special categories of personal data, such as health data, and data on criminal offences are not stored in the service. The Customer instructs experts to describe practices rather than individual people.
• The service must not be used for unlawful content, circumventing security or overloading the service. The prohibitions on copying, reverse engineering and automated data collection are in section 8. Accounts must not be shared outside the Customer's organisation. This does not prevent inviting an accountant under section 7 a.

7 a. Accountant

• The Customer's administrator can invite one accountant for the organisation, for example a representative of an accounting firm. The same person can be the accountant of several organisations.
• The accountant sees only billing: the contract details, invoices and payment details. They do not see the organisation's people or the content it has stored. For a Customer paying on invoice, the accountant sees the invoice list and can download PDF copies of the invoices. For a Customer paying by card, the accountant can see invoices and receipts in Stripe's payment portal and change the card, billing address, name and VAT number, but cannot cancel the contract or change the billing email address.
• In Small and Handover, a member of the organisation may also be its accountant. In other packages, a member of the organisation cannot be invited as a new accountant.
• The Customer decides who the accountant is and is responsible for the accountant's actions as for its own. The Customer ensures that the accountant is bound by confidentiality and removes the accountant when their task ends. When the accountant changes, the previous one keeps access until the new one accepts the invitation.
• Tarumo may remove the accountant's access if it suspects misuse, and informs the Customer.
• The accountant's actions, such as downloading invoices and opening the payment portal, are recorded in the Customer's log. For changes made in the payment portal, the log records which details changed.
• The accountant receives an email when a new invoice is available. The email contains no amounts and no attachments. The accountant can switch these notices off on the Your account page.
• Tarumo processes the accountant's user account and the log data arising from their actions on the Customer's behalf under the data processing agreement. Tarumo's own invoices, their copies and the new-invoice notices are Tarumo's own processing, described in the privacy notice.

8. Content, AI output and intellectual property

• Customer content and its intellectual property belong to the Customer or its licensors. Tarumo transfers to the Customer any rights it may have in AI output that the service produces from Customer content. Tarumo does not guarantee that AI output is protected by copyright.
• For the term of the contract, the Customer gives Tarumo a limited right to process Customer content only to provide, maintain, secure and back up the service, for support the Customer asks for, and where the law requires it.
• Customer content is never used to train AI models, neither Tarumo's nor anyone else's. Tarumo does not use Customer content to develop its general knowledge packs without the Customer's express written permission in each case. Under the terms between Tarumo and the AI provider, the provider does not read, analyse or use the content of prompts or answers to train models. The exceptions, such as content kept in case of errors, are in section 8 of the data processing agreement.
• Tarumo may use statistics compiled from the use of the service to develop the service, provided they contain no Customer content and identify neither the Customer nor any person.
• Tarumo may use the Customer's development ideas to improve the service without compensation, but not Customer content or confidential information.

Tarumo's rights in the service

The service, its software, the AI prompts, the risk calculation, the user interface, the guides and Tarumo's general knowledge packs belong to Tarumo or its licensors. The Customer's organisation-specific changes to knowledge packs are Customer content. For the contract period the Customer receives a non-exclusive right to use the service for its own internal purposes and those of the group companies agreed in the order. The right cannot be transferred except as section 17 provides. The accountant's access under section 7 a is allowed.

The Customer must not, and must not allow its users to:

• copy the service, modify it or make derivative works of it;
• reverse engineer or decompile the service, or try to find out its source code or prompts, except as the law allows;
• resell or sublicense the service or offer it to third parties;
• use the service, its outputs or its knowledge packs to build or train a competing product or AI model;
• remove proprietary notices from the service or the packs;
• scrape the service systematically with automated means, other than through the exports and interfaces Tarumo provides;
• test the security of the service without Tarumo's written permission.

The prohibitions do not apply to the Customer's content or to the exportable data (section 9): the Customer may move them to another service (section 12 a). The prohibitions apply only to the extent mandatory law allows them. The law, such as sections 25 j and 25 k of the Finnish Copyright Act and Articles 5 and 6 of the Software Directive (2009/24/EC), allows some acts that a contract cannot exclude. If you find a vulnerability in the service, please report it to support@tarumo.fi. We welcome reports made in good faith.

9. Data export

The Customer receives the exportable data at any time during the contract, also while the service is suspended, and after the contract ends within the periods of sections 12 and 12 a. Export is free of charge. The same list is in section 17 of the data processing agreement.

Exportable data

The Customer's administrators can export themselves in the service:

• the published knowledge cards and their archived versions with their sources (the expert or "Former expert" and the dates), and the cards' warnings of outdated or incorrect information without who reported them, in Markdown and JSON;
• the organisation's log as CSV (at most the 10,000 newest events), except card views and card reports;
• the mapping report in Markdown, if the Customer has had Mapping;
• invoices as PDF files for as long as they are in the service: Customers paying on invoice from the service's invoice list, and Customers paying by card from Stripe's payment portal. The accountant can also download them.

In addition, administrators can download themselves, from the service's Organisation page, the published knowledge cards and the following data as one ZIP file in JSON. If an administrator cannot download them, for example because the organisation no longer has an administrator who can access the service, Tarumo delivers them on request in JSON within 14 days at the latest:

• key people and their knowledge areas: departure date and its confirmation, criticality, whether they are the only expert, successor and link to a knowledge pack;
• the Customer's own knowledge packs and the Customer's changes to Tarumo's packs with their versions, and the mapping pack proposals experts have sent;
• coverage by knowledge area and by part;
• users and their roles, the accountant, teams, team challenges, reward settings and the organisation's other settings;
• the organisation's whole log, except card views and card reports.

On request, Tarumo delivers card read counts and the numbers of "useful" marks as figures per card in JSON within 14 days at the latest.

The structure and formats of the exported files are described at tarumo.fi/en/export. If a request is made within the export or retrieval period, Tarumo delivers the data even if the delivery falls after that period ends, and does not delete the data before delivering it.

Data not exported

• Interview texts and audio recordings, undecided card drafts and draft mapping proposals. They are visible only to the interviewee and are deleted after a short time. This is how the Customer, as controller, has given instructions, and data protection law takes precedence over the Data Act.
• Personal points, levels, achievements and reward choices. They are visible only to the person themselves.
• The card view rows (who opened which card) and who reported a card. They are not shown to the Customer, so that the log does not tell who read or reported what.
• Filtered content, which is not stored.
• The service's internal workings: the AI's prompts, the intermediate results of the risk calculation, the search index vectors and the service's technical log. They are Tarumo's trade secrets or tied to Tarumo's implementation.
• Tarumo's general knowledge packs, which are Tarumo's intellectual property. The Customer's changes to them are exported.

10. Personal data, data location and security

In the service, the Customer is the controller and Tarumo the processor. The processing is agreed in detail in the data processing agreement. The key commitments:

• Location: the servers, database, backups, AI and speech recognition are in the EU. The servers and the database are in Helsinki, the backups in Helsinki with an encrypted, locked copy in Paris, and the AI and speech recognition in Paris.
• Not all processing takes place in the EU. The technical support of Tarumo's email service (Zoho) may access support messages from India, Teams messages may pass through Microsoft's global services, and Stripe may transfer payment data to the United States. The grounds for these transfers are in section 12 of the data processing agreement and in the privacy notice.
• Government access: Tarumo takes reasonable technical, legal and organisational measures to prevent authorities of countries outside the EU from accessing or transferring the Customer's non-personal data where this would conflict with EU or Finnish law (Article 32(1) of the Data Act). The Customer's data is stored in the EU in the services of providers established in the EU, whose parent companies may be outside the EU (section 12 of the data processing agreement). Tarumo discloses data to such an authority only where the disclosure complies with Article 32 of the Data Act, and informs the Customer before the disclosure unless this is prohibited. Information on the location and jurisdiction of the service's infrastructure and on these measures is published at tarumo.fi/en/data-location.
• Separation: customers' data is kept apart. Every row of data belongs to one organisation, and the database's row-level security prevents seeing other organisations' data.
• Dictation audio is deleted by default 30 days after transcription. The Customer can shorten this or prevent audio from being stored at all.
• In the service, the interview text is visible only to the interviewee and is deleted when the card made from it is approved or rejected, at the latest 30 days after the interview ends. Section 9 of the data processing agreement describes the technical access of Tarumo's staff.
• The service logs what is viewed, changed, approved and exported. Searches and questions are not stored or logged.
• Tarumo notifies the Customer of personal data breaches and security incidents under section 14 of the data processing agreement.
• Tarumo's processing of its own customer and billing data, such as invoices, their copies and the new-invoice notices, is described in the privacy notice.

11. Service level and support

• Tarumo provides the service professionally and with care. In the standard packages (Small, Handover, Standard and Mapping), availability is a best-effort level: Tarumo strives to keep the service available and to fix faults without delay.
• Service level commitments (SLA) and any service credits are agreed separately in Extended and Group contracts.
• Maintenance breaks are scheduled at quiet times where possible and announced in advance when possible. Urgent security updates may be installed without prior notice.
• The production database is backed up every night, encrypted, and restoring is tested monthly.
• Support is available by email at support@tarumo.fi in Finnish or English on business days. We aim to reply within two business days.
• Tarumo is not responsible for outages of third-party services that the Customer uses with the service, such as Microsoft or Google sign-in or the Customer's own systems.

12. End of the contract and deletion of data

• The contract ends through cancellation, the end of Handover's read access, termination or non-payment. If the Customer has requested a switch to another service or the porting of its data, the service first continues for the transition period of section 12 a.
• Once the contract has ended, the organisation moves to the ending state. Users can no longer access the organisation, but administrators can export data under section 9, and Tarumo delivers the other exportable data on request.
• The export period is at least 30 days from the start of the ending state. The service shows administrators the date by which the export must be made.
• After the export period, Tarumo permanently deletes the organisation's data within 30 days at the latest and confirms the deletion in writing on request. The data leaves the encrypted backups at the latest 36 days after the deletion.
• After the deletion, only the following are kept:
  • the invoices, vouchers and billing records that belong to Tarumo's own bookkeeping. They are kept for the time required by chapter 2, section 10 of the Finnish Accounting Act and section 209 n of the Finnish VAT Act, at most until the end of the seventh year after the invoice year. The invoices contain the Customer's billing details and the name and contact details of the billing contact;
  • the organisation's name and identifier and the record of the deletion;
  • Tarumo's own administration log, described in the privacy notice.
• The PDF copies in the service's invoice list are deleted with the organisation. The Customer keeps its purchase invoices in its own bookkeeping.
• Microsoft stores its own copy of the Teams app's chat in the Customer's Microsoft 365 environment. That copy is under the Customer's control, and Tarumo cannot delete it.

12 a. Switching to another service and porting data

This section gives effect to the rights under Articles 23–26 and 29 of the EU Data Act (2023/2854). It applies to all packages.

1. Request. The Customer may at any time notify Tarumo in writing, for example by email, that it wishes to (a) switch to another provider's service, (b) port its data to its own systems or (c) erase its data.
2. The notice period is two months or a shorter period the Customer gives. For Small, the notice period ends at the end of the current billing period.
3. Transition period. After the notice period, a 30-day transition period begins. The contract is then still in force and the service works as normal: all users can access it, and interviews, cards and export are available. Tarumo assists the Customer and third parties it authorises to a reasonable extent, gives the information relevant to the switch, informs the Customer of known risks to the continuity of the service and maintains the level of security.
4. Extension. The Customer may extend the transition period once, for a period it considers appropriate, by giving notice before the transition period ends. If 30 days is technically unfeasible, Tarumo informs the Customer, with reasons, within 14 working days of the request and proposes a transition period of at most seven months, during which the service continues.
5. End of the contract. The contract ends when the switch has succeeded or at the latest when the transition period ends. If the Customer chose only the erasure of its data, the contract ends when the notice period ends. Tarumo informs the Customer that the contract has ended.
6. Retrieval period. After the transition period, the Customer still has at least 30 days to export its data, and Tarumo delivers the requested data during that time (section 9).
7. Erasure. After the retrieval period, Tarumo permanently erases all exportable data and the Customer's other data under section 12.
8. Charges. Tarumo charges no switching charges and no data transfer charges. The transition period is paid at the contract price. For the early termination of a fixed-term contract, the Customer pays the fees for the remaining contract period, unless the order says otherwise.
9. Data and formats. The exportable data and the data not exported are listed in section 9.
10. Location and government access. Information on the location and jurisdiction of the service's infrastructure and on the measures by which Tarumo prevents unlawful access to the data by authorities outside the EU is in section 10.

13. Confidentiality

• Each party keeps the other party's trade secrets and other confidential information confidential and uses them only to perform the contract. Customer content is always confidential.
• A party may give confidential information only to those of its employees, subcontractors and advisers who need it to perform the contract and who are bound by an equivalent duty of confidentiality.
• This does not apply to information that is public, that the party has lawfully received from elsewhere or developed itself, or that the law or an authority requires to be disclosed.
• The obligation applies during the contract and for three years after it ends. The obligation concerning trade secrets, however, applies for as long as the information is a trade secret, and the obligation concerning Customer content for as long as Tarumo keeps it. For personal data, the obligation applies as long as Tarumo processes the data.

14. Limitation of liability

• A party is liable only for direct damage caused by its breach of contract. A party is not liable for indirect damage, such as lost profit or revenue, interruption of production or business, or loss of goodwill.
• General cap: each party's total liability per contract year is limited to the fees the Customer has paid, or that have fallen due, for the service in the 12 months before the damage, but at least €5,000. For a package with a one-off fee (Handover and Mapping), the cap is the one-off fee, but at least €5,000.
• Data protection and confidentiality: the general cap does not apply to liability arising from a breach of the obligations concerning the processing of personal data (data protection law and the data processing agreement) or of the confidentiality obligation (section 13). Such liability has a separate cap per contract year: three times the fees on which the general cap is based, or €15,000, whichever is greater.
• The separate cap also covers, as direct damage, compensation a party has paid to data subjects under Article 82 of the GDPR for a breach for which the other party is responsible and which it claims back under Article 82(5), as well as reasonable costs of investigating and notifying a personal data breach and of restoring data. Each party is liable for the administrative fines imposed on it.
• These limitations, the separate cap included, do not apply to the Customer's payment obligations, to breaches of the prohibitions in sections 3 a, 7 and 8, to damage caused intentionally or by gross negligence, or to liability that cannot be limited under mandatory law.
• Tarumo is not responsible for the accuracy of Customer content or for how the Customer uses the knowledge cards and the AI's answers (section 3).
• Liability to data subjects is governed by Article 82 of the GDPR, and this section does not limit it between a data subject and either party. Between the parties, this section applies.
• A claim must be made in writing within 12 months of the date the party discovered the damage or should have discovered it.

15. Force majeure

A party is not liable for delay or damage caused by an impediment beyond its control that it could not reasonably have taken into account or avoided. Such an impediment may be, for example, a widespread telecommunications or power outage, an order of an authority, a natural event, war or a large-scale cyberattack that could not have been prevented by security measures in line with good industry practice. An impediment affecting a subcontractor is force majeure only if a substitute service cannot be obtained at reasonable cost or without unreasonable delay. The party informs the other of the impediment without delay. If the impediment lasts more than 60 days, either party may end the contract by notice in writing, and the unused part of a period paid in advance is refunded.

16. Changes to the terms

• Tarumo may change these terms. Tarumo notifies the Customer's administrators of a change by email and in the service at least 30 days before it takes effect. If a change is not solely to the Customer's benefit and is not required by law or an authority, the notice period is at least 90 days. Price changes are always notified at least 90 days in advance (section 6).
• If a change is not solely to the Customer's benefit and is not required by law or an authority, or is a price change, the Customer may terminate the contract to end before the change takes effect. The unused part of a period paid in advance is then refunded pro rata.
• Changes required by law, an order of an authority or security, and changes that are solely to the Customer's benefit, may take effect sooner.
• The version in force is on this page. Each online order records which version the person ordering accepted. A signed contract is governed by the terms in force when it was signed, unless it says otherwise, and it is changed only in writing.

17. Subcontractors and assignment

• Tarumo may use subcontractors and is responsible for their work as for its own. The sub-processors that process personal data are listed in the data processing agreement.
• Either party may assign the contract to a company in the same group or to the party to which it transfers the business the contract relates to, by notifying the other party in writing. The assignee is liable for the contract from the assignment. Otherwise, the contract may be assigned only with the other party's written consent, which will not be refused without good reason.
• A Handover package may be assigned to the buyer of the business on the same terms. The organisation, the cards and the remaining contract period pass to the buyer as the seller and the buyer have agreed in their deal. The transferor and the buyer are responsible for the processing of personal data that the assignment involves.

18. Governing law and disputes

• The contract is governed by Finnish law, excluding its conflict of laws rules.
• The parties first try to settle disagreements by negotiation. If a matter is not settled within 30 days of a party notifying the disagreement in writing, it is settled by the District Court of Central Finland (Keski-Suomen käräjäoikeus). Tarumo may, however, also bring an action for a receivable in the court of the Customer's domicile. This option does not apply to a Customer whose domicile is outside the European Union, Iceland, Norway and Switzerland.
• If the Customer's domicile is outside the European Union, Iceland, Norway and Switzerland, all disputes, Tarumo's receivables included, are settled as follows: Any dispute, controversy or claim arising out of or relating to this contract, or the breach, termination or validity thereof, shall be finally settled by arbitration in accordance with the Rules for Expedited Arbitration of the Finland Chamber of Commerce. The seat of arbitration shall be Helsinki, Finland. The language of the arbitration shall be English.
• In Extended and Group contracts, the parties may agree on this clause instead of the District Court: Any dispute, controversy or claim arising out of or relating to this contract, or the breach, termination or validity thereof, shall be finally settled by arbitration in accordance with the Arbitration Rules of the Finland Chamber of Commerce. The number of arbitrators shall be one. The seat of arbitration shall be Helsinki, Finland. The language of the arbitration shall be Finnish. The proceedings are confidential.
• The negotiation stage does not prevent seeking interim measures.

19. Contact details and notices

Tarumo Oy (business ID 3664892-5)
Artturintie 4, 43500 Karstula, Finland
Email: sales@tarumo.fi

Tarumo sends notices about the contract by email to the Customer's administrators and to the billing address given in the order. The Customer sends its notices to the address above. In these terms, "in writing" includes email. An email is deemed received on the business day after it was sent. The Customer keeps the contact details of its administrators and billing up to date.

20. Other terms

• Survival. Sections 8, 9, 12, 12 a, 13, 14 and 18, and payments that fell due before the end, remain in force after the contract ends for as long as their purpose requires.
• Invalid terms. If a term is invalid or cannot be enforced, the other terms remain in force. The invalid term is replaced by a valid term closest to its purpose.
• Entire agreement. The order, these terms, the data processing agreement and the price list form the entire agreement between the parties. They replace earlier negotiations and offers.
• No waiver. If a party does not exercise a right, this does not mean that it waives it.