Draft, pending approval

Tarumo terms of service

Draft of 30 October 2026, not yet in force

Previous versions

This is a draft pending approval by Enarra Oy. The terms take effect only once the approved version is published on this page and the Service's production environment has been taken into use. Online ordering of the Small (Pieni) and Handover (Siirto) packages opens only after that.

The service provider is Enarra Oy (Business ID 3664892-5, Artturintie 4, 43500 Karstula, Finland), “Enarra”. Enarra provides a software service called Tarumo (the “Service”). Tarumo is the commercial name of the Service and not a registered secondary business name. The contracting party is Enarra Oy.

These terms of service apply to the Service, which Enarra provides to companies and other organisations. The processing of personal data is agreed in the data processing agreement, which forms part of the same contract. The terms are written in Finnish and English. The Finnish version is authoritative, and the English version is a faithful translation of it.

Key terms – this does not replace the contract text

• Businesses only. The Service is sold to companies and other organisations for their business, not to consumers. Online ordering is open only to companies in the European Economic Area and Switzerland (section 1).
• Small continues month by month, and the card is charged every month until the contract is terminated. A paid month is not refunded, except where the law requires it, where Enarra does not deliver the agreed service, or in the situations set out in sections 6, 15 and 16 and in sections 11 and 19 of the data processing agreement.
• Handover is a one-off fee that is not refunded once the organisation has been opened, except where the law requires it or Enarra does not deliver the agreed service (section 5). It includes 3 months of interviews followed by 12 months of read access.
• If a payment fails, use is suspended until the payment succeeds. The data is kept, and administrators can still export it.
• After the contract ends, the Customer can export its data for at least 30 days. After that the data is permanently deleted, and it disappears from backups within 36 days at the latest. If the Customer switches to another service, the Service first continues normally for a 30-day transition period (sections 12 and 12 a).
• If a fixed-term contract is ended early, the Customer pays the fees for the rest of the term, unless the order says otherwise or the end is due to Enarra (section 12 a). No switching charges are made.
• Liability is capped for both parties (section 14).
• Changes: Enarra gives advance notice of changes to the terms. The Customer can terminate the contract before a change to its disadvantage takes effect (section 16).

This summary does not replace the contract text. In the event of a conflict, the sections below apply.

1. Parties and scope

The service provider is Enarra Oy (Business ID 3664892-5, Artturintie 4, 43500 Karstula, Finland), “Enarra”. Enarra provides a software service called Tarumo (the “Service”). Tarumo is the commercial name of the Service and not a registered secondary business name. The contracting party is Enarra Oy. The Customer is the company or other organisation that orders the Service.

• Businesses only. The Service is sold only to businesses and other organisations for their trade, business or profession, not to consumers. A sole trader may order the Service for their business.
• Verifying business status. When ordering, the person placing the order gives the Customer's name, business or registration number, domicile and billing address and confirms separately that the Service is acquired for a trade, business or profession and not for private use. A company in another EU country is asked for its VAT number if it has one, and Enarra may check it in the EU's VIES system. Enarra may also check the details in the Finnish Business Information System (YTJ) or another public register, and may ask a Customer outside the EU for a register extract or other reliable evidence of its business status. If the person ordering is not a company or other organisation, Enarra may cancel the order and refund the payment. A false confirmation is a breach of contract, but it does not take away the rights a consumer has under mandatory law.
• Countries for online ordering. Online orders (Small and Handover) can be placed only by a company domiciled in the European Economic Area or Switzerland. A company in the Åland Islands, in an EU outermost region outside the EU VAT area (such as the Canary Islands) or in Monaco, and other Customers order the Service on invoice under a separate order, which Enarra accepts after a business and sanctions check.
• Authority of the person ordering. The person placing the order confirms that they are authorised to enter into the contract on the Customer's behalf. If they were not, they are liable for the contract and for damages under section 25 of the Finnish Contracts Act.
• Sanctions. Enarra complies with the sanctions of the European Union and Finland.
  • The EU prohibits providing, directly or indirectly, AI services, including access to platforms for training, fine-tuning or running AI models, to the Government of Russia and to legal persons, entities or bodies established in Russia (Council Regulation (EU) No 833/2014, Article 5n(1)(g)). A similar prohibition applies to the state, government, public bodies, enterprises and agencies of Belarus and to those acting on their behalf or at their direction (Council Regulation (EC) No 765/2006 as amended by Regulation (EU) 2025/2041).
  • The Service is not provided to persons or entities whose assets the EU has frozen, nor to entities they own or control, nor otherwise made available to them.
  • As a commercial policy stricter than the law, Enarra does not sell or provide the Service to anyone established in Russia or Belarus or to anyone acting on their behalf. A branch of a Russian or Belarusian company outside these countries is treated as established there.
  Enarra screens Customers on a risk basis when the customer relationship starts and when there is a material change in ownership or control. Where needed, Enarra may ask the Customer for information on its ownership, control and beneficial owners. The Customer confirms that it is not one of the above, notifies Enarra without delay of any change that may affect this, and does not give access to the Service or pass on content the Service has produced to any such party. Enarra may suspend the Service and terminate the contract with immediate effect and without liability if the confirmation proves false, the Customer breaches this section, or sanctions change so that the Service can no longer be provided. The export period of section 12 also applies in this situation, unless sanctions require otherwise.
• The terms apply to all packages: Small, Handover, Standard, Extended, Group and Mapping.
• Formation of the contract. For online orders (Small and Handover), the contract is formed when the person ordering has accepted these terms of service and the data processing agreement and the payment has been accepted. Before acceptance, the order page links the PDF files of the version to be accepted (the terms and the data processing agreement), which the person ordering can download and save. The order records the identifier of the accepted version, the time of acceptance, the SHA-256 digests of the PDF files and the time of the business-use confirmation, and the order confirmation links the same PDF files. For other packages, the contract is formed when the parties have signed the order or contract, electronically included. A signed contract always has the PDF version of the applicable terms and data processing agreement attached.
• Order of precedence. If documents conflict, they apply in this order: (1) the signed order or contract, (2) the data processing agreement in matters concerning the processing of personal data, (3) these terms of service and (4) the price list. A signed order may depart from the data processing agreement only if it identifies the section being changed. The Customer's own procurement or contract terms do not bind Enarra unless agreed in writing.

2. Definitions

• Service: the online service called Tarumo with its guide, including the web app that can be installed on a phone and, if the Customer enables it, the Service's Microsoft Teams app.
• Enarra: Enarra Oy, which provides the Service and is party to the contract.
• User: a person the Customer has invited to the Service as an administrator, manager, expert or reader.
• Accountant: a person the Customer's administrator has invited to see the Customer's billing (section 7 a). The accountant does not see the Customer's content.
• Key person: a person whose knowledge is being captured in the Service. Package prices and limits are set by the number of key people.
• Customer content: everything the Customer and its users store in the Service, such as interview answers, knowledge cards, data on key people and knowledge areas, and the Customer's own changes to knowledge packs.
• Knowledge card: a card made from an interview or written by the expert, which is published only once the expert has approved it.
• AI output: a question the AI phrases in the Service, a tidied suggestion for an answer, a card draft, a draft knowledge pack, a mapping pack proposal or an answer from Ask.
• Exportable data: the data listed in section 9.

3. The service and its principles

Tarumo captures the tacit knowledge of departing experts. The Risk radar shows in which knowledge areas knowledge is at risk of being lost. The AI interviews the expert and turns the answers into knowledge card drafts. The expert approves the cards, and users can search them and ask the AI about them. The contents of the packages are in section 4 and the price list.

Enarra is committed to these principles:

• A knowledge card is published only with the expert's approval. An unapproved card does not appear in search or in the AI's answers.
• The AI answers only from published cards and always gives the source (the expert and the date). If no answer is found, it says so and suggests whom to interview.
• The Service does not evaluate or compare employees, nor score them for the employer. The Risk radar measures the risk of knowledge being lost, not how people perform. Incentive points are visible only to the person themselves (section 3 b).
• In the Service's user interface, interview answers are visible only to the interviewee. The Customer's administrators and managers do not see them, and Enarra's ordinary administration tools cannot reach them. They can be disclosed only on the basis of a legal obligation under section 13 of the data processing agreement. Enarra staff's technical superuser access and its limits are described in section 9 of the data processing agreement.
• Swear words and inappropriate content are filtered out. Filtered content is not stored or reported to the employer (section 3 c).
• Information is not deleted but replaced. This is an operating principle for knowledge cards: an outdated or incorrect card is archived when a corrected version is approved, and the version history is kept. The principle gives way where the law, security or the rights of data subjects require it.
• Withdrawn cards. An administrator can withdraw a card that contains offensive text, another person's personal data or confidential information. The card leaves search, the AI's answers and the export at once. The expert is told and can publish a corrected version. If the reason is personal data, the card's content is blanked as soon as the administrator has confirmed the action. If the reason is confidential information or a trade secret, the Customer chooses whether the content is blanked at once or after 30 days. The content of a card withdrawn as offensive is kept hidden so that a corrected version can be made from it. A blanked card leaves no old content in the version history, only an entry with the reason and the date. The blanking also covers the card's earlier versions, the notes of reports about it and the search index, and open correction drafts of the card are rejected. The action is logged without the content (section 7 of the data processing agreement).
• Enarra may quarantine a card at once, removing it from search, answers and the export, if it has reasonable grounds to suspect that the card endangers the Service's security, breaks the law or infringes another person's rights. Enarra tells the Customer the reason and asks for the Customer's decision on correcting or deleting the card.
• Personal data is deleted in accordance with the GDPR and the data processing agreement. A valid erasure request from a data subject is handled without undue delay. When the contract ends, Enarra deletes the organisation's data, knowledge cards included, under section 12. When an individual's data is deleted, their interviews, audio recordings and unapproved drafts are deleted, and the published cards they approved remain with the organisation either under their name or with "Former expert" as the source, as the Customer decides (section 13 of the data processing agreement).

Enarra may change and develop the Service, but does not materially weaken, during the contract period, the key functions the Customer pays for. Changes are announced on the Service's What's new page. Functions marked "coming" in the price list become part of the Service only once they have been introduced.

The AI phrases questions, card drafts and answers, and it can make mistakes. That is why the expert reviews and approves every card before publication, and every answer shows its source. The Customer is responsible for how it uses the cards and answers. Guidance relating to safety, health or significant financial decisions must be checked against the source card and the Customer's own instructions before use.

3 a. AI and intended purpose

• Under the EU AI Act (2024/1689), Enarra is the provider of the Service's AI system and the Customer is its deployer, even though a third party supplies the underlying AI model.
• Intended purpose: the Service captures an organisation's knowledge and gives access to it. The AI interviews the expert, turns the answers into card drafts and answers questions from published cards.
• Risk radar: the purpose of the Service's Risk radar is to identify risks to knowledge areas and to the continuity of documentation, not to evaluate an individual employee's performance, reliability, behaviour or worth. The Risk radar is a fixed, rule-based calculation that uses the criticality of knowledge areas, whether there is only one expert, departure dates and the coverage of the captured knowledge. It does not use a person's age or presumed retirement. A confirmed departure date and an estimate are kept apart.
• Prohibited use: the Customer must not use the Service to monitor employees, to score individual performance, to allocate tasks on the basis of employees' behaviour or personal characteristics, or to make employment decisions. Nor does the Customer use the Service or its data for recruitment or selecting people, for decisions on terms of employment, pay, promotion or termination, or to infer emotions or states of mind.
• The incentive feature is off by default, personal points are visible only to the person concerned, and they are not exported to HR systems (section 3 b). The Service's own incentives are allowed as they work in the Service, but their data must not be used for the purposes prohibited above.
• Knowledge cards produced by the Service must be reviewed and approved before publication. In the Service, the card's expert does this.
• The Service tells users when they are interacting with AI. Ask answers, the AI's follow-up questions and card drafts are marked visibly and machine-readably in the Service. Published knowledge cards also carry a machine-readable marking under Article 50(2) of the AI Act (in the Service, in Teams and in exports) and a visible note "Drafted with the help of AI, approved by the expert".
• The Service makes no decisions about people based solely on automated processing and does not infer emotions or states of mind from voice or text.
• If the Customer uses the Service for a prohibited purpose, it is responsible for this itself, including obligations under the AI Act, and compensates Enarra for the resulting damage under section 14.
• Enarra explains how the Service works and the AI's limitations on the Service's Help page. The Customer tells its users what the Service is used for and that the AI can make mistakes.

3 b. Incentives

• The Customer's administrator can enable the Service's incentives: personal achievements and the Growth ring (points from approved cards and colleagues' "useful" marks), team challenges and employer rewards. Incentives are off by default in an organisation.
• A person's own points, level and achievements are visible only to them. Whoever grants a reward learns of the achievement and the reward only if the person accepts this. Others are shown only team-level information.
• Everyone can switch incentives off for themselves. There are no penalties, and an achievement once earned is not taken away.
• Points and achievements are not exported to HR or performance review systems. The Customer does not use them for employment decisions, performance reviews or comparing people (section 3 a).
• The Customer is responsible for the taxation of its rewards. Gift cards and lunches, for example, may be taxable benefits.

3 c. Content filtering, notices and points of contact

The Service stores content users provide at their request. Enarra complies with the rules of the EU Digital Services Act (2022/2065) on hosting services to the extent that they apply to the Service.

• Filtering: the Service removes swear words from interview answers, card edits, the details of card reports and knowledge pack texts, and leaves offensive, inappropriate or unclear content out of knowledge cards. Filtering is done automatically by AI classification, with word lists as a fallback. If the AI is unavailable, content that passes the word lists waits for the AI check and is not shown to others.
• Filtered content is not stored or reported to the employer. Only the fact of filtering is logged, without the content.
• Notice of filtering: when the Service filters an answer, it tells the person why the answer was not saved (it appeared to contain swear words, personal data, confidential information or content against the terms of service) and advises them to rephrase the answer or ask for a review at support@tarumo.fi. The notice does not reveal the filtered content to the employer. A person reviews the matter on the basis of what the user tells us, because the filtered content is not kept. If a knowledge card is withdrawn, the expert is told the reason and that they can publish a corrected version (section 3).
• Notice of illegal content: anyone can report illegal content in the Service to the same address. The notice states which content it concerns and where it is, why the reporter considers it illegal, and the reporter's name and email address. Enarra confirms receipt of the notice, handles it without delay and tells the reporter of its decision. Customer content is not visible in Enarra's administration tools, so Enarra handles the notice together with the Customer's administrators where needed. If content is removed or its visibility restricted, Enarra tells whoever stored the content the reasons, the contractual or legal ground, and how they can ask for the decision to be reviewed.
• If Enarra becomes aware of a criminal offence that threatens someone's life or safety, it notifies the authorities.
• Point of contact: authorities and users of the Service can contact Enarra on matters under Articles 11 and 12 of the Digital Services Act at support@tarumo.fi, in Finnish or English.

4. Packages

• Mapping, Standard, Extended and Group are sold on invoice under a separate order or contract. Mapping is a one-off risk mapping. Standard, Extended and Group are annual contracts with a monthly price. The price, number of key people, contract period and invoicing are agreed in the order.
• Extended and Group customers sign a master agreement with annexes on the service level, security, subprocessors, audits, continuity and incident handling. These terms apply as part of the master agreement to the extent it does not provide otherwise.
• Small costs €149 per month + VAT and includes up to three key people. It is a monthly subscription that continues month by month until cancelled.
• Handover costs €1,490 as a one-off fee + VAT and includes one key person, usually the departing person. The contract starts with a three-month interview period, after which the cards can be read for another 12 months (no new interview can then be started, but one in progress is completed), and the customer can continue to a Small subscription in the same organisation from 90 days before the read access ends, keeping the data.
• Readers who use search and Ask are free of charge. The price is set by the number of key people, not users.
• Discounts and launch offers apply only as agreed in writing. They do not apply to the Handover package.

5. Term and termination

• Small runs until further notice. It is charged monthly in advance. The Customer can cancel it at any time on the Service's Organisation page (Billing and payments) or by email. The contract ends at the end of the paid month. A period already paid is not refunded, except where the law requires it, where Enarra does not deliver the agreed service, or as provided in sections 6, 15 and 16 or sections 11 and 19 of the data processing agreement. A cancellation can be withdrawn before the end of the period.
• Handover is fixed-term and ends without notice when the read access ends, that is 15 months after it starts (a 3-month interview period followed by 12 months of read access). The one-off fee is not refunded once the Customer's organisation has been created and the Service opened, unless otherwise agreed or required by law. If Enarra does not deliver the agreed service, discontinues the Service or terminates the contract for a reason not attributable to the Customer, Enarra refunds the share of the one-off fee that corresponds to the days remaining of the 15-month term.
• Packages sold on invoice run as set out in the order. Unless the order says otherwise, the contract continues after the contract period until further notice, and either party can terminate it with three months' notice.
• Enarra can terminate a contract that runs until further notice with three months' notice.
• The Customer can also ask at any time to switch to another service or to port its data under section 12 a, including during a fixed-term contract.
• Either party can terminate the contract for cause if the other party materially breaches it and does not remedy the breach within 14 days of a written notice.
• Enarra can suspend the Service or an individual user's access immediately if the use endangers the Service's security or other customers' service, or is manifestly unlawful. The suspension lasts only as long as necessary, and Enarra informs the Customer without delay.
• The end of the contract and data export are covered in sections 12 and 12 a.

6. Prices, payment and VAT

• VAT: prices are in euros and exclude VAT. VAT is added to the invoice in accordance with the law in force. A Finnish Customer is charged Finnish VAT. An invoice to a VAT-registered company in another EU country carries no VAT, is marked "reverse charge", and the Customer accounts for the tax in its own country. A company outside the EU is not charged Finnish VAT, and the Customer is responsible for any taxes payable in its own country. The VAT treatment of an invoice to a company in the Åland Islands is settled with the order under the place-of-supply rules for services. The Customer pays the price without deductions. If the law of the Customer's country requires withholding tax, the Customer pays an additional amount so that Enarra receives the agreed price in full.
• Online orders: Small and Handover are paid through Stripe Payments Europe Ltd (Ireland) by card or another method offered on the payment page. Handover is charged once when ordered. Small is charged monthly in advance: by ordering Small, the Customer separately authorises Enarra to charge the monthly fee through Stripe to the payment method the Customer has given at the start of each billing period until the contract ends. The invoice and receipt are sent by email and can also be found in the Service under Billing and payments. Enarra does not see or store card details. Stripe processes payment data partly on its own behalf; this is explained in the privacy notice.
• Failed payment: Stripe retries the charge and notifies by email. If the payment still fails after the retries, Enarra suspends the Service. Users cannot then enter the organisation, but the data is kept, and administrators can still pay, export all exportable data and view the log. When the payment succeeds, the Service is restored automatically. If payment is not received within 30 days of the suspension, Enarra may terminate the contract, and the export period of section 12 begins.
• Packages sold on invoice are invoiced as set out in the order. Unless the order says otherwise, payment terms are 14 days net. Late payment carries interest under section 4 a of the Finnish Interest Act and a fixed €40 compensation for recovery costs under section 10 i of the Finnish Debt Collection Act. If a payment is more than 30 days late, Enarra may, after a written notice, suspend the Service in the same way as for online orders. Administrators can still export the data during the suspension.
• Price changes: Enarra can change the prices of a contract that runs until further notice by giving at least 90 days' notice. The Customer can terminate the contract to end before the change takes effect, and the unused part of a period paid in advance is then refunded pro rata. The change does not apply to periods already paid or to the Handover package. The prices of a fixed-term contract are as set out in the order.

7. Responsibilities of the customer and users

• The Customer appoints administrators, invites users and gives them roles. The Customer is responsible for its users complying with these terms.
• Users keep their sign-in method to themselves. The Customer notifies Enarra without delay if it suspects misuse of credentials.
• The Customer as controller and employer. The Customer is the controller of the processing of its employees' data for knowledge retention, and is responsible, at its own cost, for ensuring that
  • there is a legal basis for processing personal data and the data processed is directly necessary for the employment relationship (section 3 of the Act on the Protection of Privacy in Working Life);
  • employees and other data subjects are informed of the processing under Articles 13 and 14 of the GDPR, and the need for a data protection impact assessment has been assessed and the assessment carried out before deployment if the processing is likely to result in a high risk;
  • the deployment has been handled with the staff as the law requires: in the procedure under the Co-operation Act in a company with at least 50 employees, in the dialogue under section 7 a of the Co-operation Act in a company with 20–49 employees, and under sections 4 and 21 of the Act on the Protection of Privacy in Working Life where they apply. Staff representatives are told the purpose of the Service, the data collected, who has access, how long it is kept and that the Service must not be used to evaluate performance;
  • departure dates are recorded primarily as confirmed facts, and an estimate is marked as an estimate. A departure date is not inferred from age and is not used for HR decisions;
  • interviews take place during working hours or are agreed in accordance with working time rules, and interviewing a person whose employment has already ended is agreed separately;
  • the Customer has the necessary rights to the content experts write and dictate, and publishing it under the expert's name or as "Former expert", and correcting it, has been agreed with the staff;
  • the Service is used only for the intended purpose in section 3 a;
  • data subjects' requests are decided, and the access of people who have left the organisation is removed or their role changed.
  To support these obligations, Enarra explains how the Service works on the Service's Help page and in the data processing agreement. The templates Enarra provides for a staff notice and an impact assessment are starting material that the Customer must adapt to its own purpose, legal basis, staff, retention periods and procedures. They are not a finished impact assessment and do not transfer the Customer's obligations to Enarra. Enarra does not give legal advice.
• The Customer is responsible for having the right to store its content in the Service, for example third parties' confidential information.
• Special categories of data and colleagues. Enarra uses automated and, where needed, manual safeguards to try to identify and block special categories of personal data, criminal offence data and content that evaluates individual employees. The safeguards do not catch every case. The Customer and the expert approving a card must review the content before publication; a card must not include unnecessary personal data or data processed unlawfully. Health, criminal or other sensitive information does not belong in a knowledge card unless the Customer has shown a lawful special basis for processing it. Colleagues are referred to in cards by job title or role unless the name is necessary to understand the guidance; in that case the Customer assesses the legal basis and the duty to inform before publication. Enarra may block or remove content it reasonably suspects breaks these restrictions. The card approval view highlights names and other identifiers detected in the text, and the expert must tick "I have checked the card" before the card is published, in Teams too. The Customer instructs experts to talk about practices rather than individual people.
• The Service must not be used for unlawful content, to circumvent security or to overload the Service. Other restrictions on the use of the Service are in section 8. Credentials must not be shared outside the Customer's organisation. This does not prevent inviting an accountant under section 7 a.

7 a. Accountant

• The Customer's administrator can invite one accountant to the organisation, for example someone from an accounting firm. The same person can be the accountant of several organisations with the same user account.
• The accountant sees only billing: the contract details, invoices and payment details. They do not see the organisation's people or the content it stores. The accountant of a Customer paying on invoice sees the invoice list and can download PDF copies of the invoices. The accountant of a Customer paying by card can, in Stripe's payment portal, see invoices and receipts and change the payment card, billing address, name and VAT number, but cannot cancel the contract or change the billing email address.
• In Small and Handover, a member of the organisation can also be its accountant. In other packages, a member of the organisation cannot be invited as a new accountant.
• The Customer decides who the accountant is and is responsible for the accountant's actions as for its own. The Customer ensures that the accountant is bound by confidentiality and removes the accountant when their role ends. When the accountant changes, the previous one keeps access until the new one accepts the invitation.
• Enarra can remove the accountant's access if it suspects misuse, and informs the Customer.
• The accountant's actions, such as downloading invoices and opening the payment portal, are recorded in the Customer's log. For changes made in the payment portal, the log records which details changed.
• The accountant receives an email when a new invoice is available. The message contains no amounts or attachments. The accountant can switch these notifications off on the My account page.
• Roles by purpose. The accountant's membership and rights in the Customer's organisation, and the data their actions create in the Customer's log, are the Customer's processing, in which Enarra is the processor. The user account shared across organisations, sign-in, authentication, the Service's security logs and abuse prevention are Enarra's own processing as controller to the extent Enarra determines their purposes. Enarra's own invoices, their copies, payment data, bookkeeping and new-invoice notifications are Enarra's own processing as controller. These are described in the privacy notice.

8. Content, AI output and intellectual property

• Customer content and its intellectual property rights belong to the Customer or its licensors. Enarra assigns to the Customer any rights it may have in AI output the Service produces from Customer content. Enarra does not guarantee that AI output is protected by copyright.
• For the term of the contract, the Customer grants Enarra a limited right to process Customer content only to provide, maintain, secure and back up the Service, for support the Customer requests, and where the law requires it.
• Customer content is never used to train AI models, neither Enarra's nor anyone else's. Enarra does not use Customer content to develop its general knowledge packs without the Customer's express written permission in each case. Under the terms between Enarra and the AI service provider, the provider does not read, analyse or use the content of prompts or answers to train models. Exceptions, such as content kept when errors occur, are in section 8 of the data processing agreement.
• Enarra may use statistics compiled from the use of the Service to develop the Service, provided they contain no Customer content and identify neither the Customer nor any person.
• Enarra may use development ideas the Customer gives to develop the Service without compensation, but not Customer content or confidential information.

Enarra's rights in the Service

The Service, its software, the AI's prompts, the risk calculation, database structures, the user interface, the guides and Enarra's general knowledge packs belong to Enarra or its licensors. The Customer's organisation-specific changes to knowledge packs are Customer content. For the contract period, the Customer receives a non-exclusive right to use the Service for its own internal purposes and for those of the group companies agreed in the order. The right cannot be transferred except under section 17. Access by the accountant under section 7 a is permitted.

The Customer must not, and must not let its users:

• copy the Service, its software or Enarra's knowledge packs without permission;
• interfere with or overload the Service, or systematically collect data from it by automated means other than through the exports and interfaces Enarra provides;
• share credentials or give access to the Service to anyone other than as permitted in sections 7 and 7 a;
• resell, sublicense or provide the Service to third parties;
• circumvent or attempt to circumvent the Service's security or access controls, or test the Service's security other than under the vulnerability policy below;
• use Enarra's confidential information, such as its prompts, to build or train a competing service or AI model;
• misuse Enarra's trade secrets;
• remove proprietary notices from the Service or the packs.

The restrictions do not apply to Customer content or exportable data (section 9): the Customer may move them to another service (section 12 a). They do not prevent developing or acquiring a competing service that does not use Enarra's confidential information, trade secrets or protected material. Nor do they limit acts that mandatory law permits, such as using the program, observing, studying and testing how it works, making a backup copy and the decompilation necessary to achieve interoperability (sections 25 j and 25 k of the Finnish Copyright Act and Articles 5 and 6 of Directive 2009/24/EC).

Reporting vulnerabilities

If you find a vulnerability in the Service, report it to the security contact point security@tarumo.fi. The reporting instructions are at tarumo.fi/en/security and in tarumo.fi/.well-known/security.txt. Enarra acknowledges the report within five working days, assesses it, fixes the vulnerability and keeps the reporter informed of progress. Do not send other people's personal data or Customer content with the report. When we need more information, we agree on a secure way to share it. Enarra takes no legal action against a reporter who has acted in good faith under this policy. Testing that disrupts the Service or accesses other people's data is not permitted.

9. Data export

The Customer receives the exportable data at any time during the contract, also while the Service is suspended, and after the contract ends within the periods of sections 12 and 12 a. Export is free of charge. Enarra provides the exportable data in a structured, commonly used and machine-readable format. The export specification (tarumo.fi/en/export) identifies the categories of data, formats, structures, technical limitations and retrieval procedure. The same text is in section 17 of the data processing agreement.

Exportable data

The Customer's administrators can export themselves in the service:

• the published knowledge cards and their archived versions with their sources (the expert or "Former expert" and the dates), and the cards' warnings of outdated or incorrect information without who reported them, in Markdown and JSON;
• the organisation's log as CSV (at most the 10,000 newest events), except card views and card reports;
• the mapping report in Markdown, if the Customer has had Mapping;
• invoices as PDF files for as long as they are in the service: Customers paying on invoice from the service's invoice list, and Customers paying by card from Stripe's payment portal. The accountant can also download them.

In addition, administrators can download themselves, from the service's Organisation page, the published knowledge cards and the following data as one ZIP file in JSON. If an administrator cannot download them, for example because the organisation no longer has an administrator who can access the service, Enarra delivers them on request in JSON within 14 days at the latest:

• key people and their knowledge areas: departure date and its confirmation, criticality, whether they are the only expert, successor and link to a knowledge pack;
• the Customer's own knowledge packs and the Customer's changes to Enarra's packs with their versions, and the mapping pack proposals experts have sent;
• coverage by knowledge area and by part;
• users and their roles, the accountant, teams, team challenges, reward settings and the organisation's other settings;
• the organisation's whole log, except card views and card reports;
• read counts and "useful" marks per card as monthly totals, with no information about the readers or the card's author. Only completed calendar months in which the card has at least three reader-days are included; other months are not released and their figures are not carried over to other months. Reads are counted per day, and the Service aims to count the same reader once per card and day. The reads of a released month do not change, but the number of "useful" marks can go down if a mark is withdrawn or a user's data is erased, and a card leaves the file when it is corrected or withdrawn.

The structure and formats of the exported files are described at tarumo.fi/en/export. The contract is governed by the version of the export page archived under the same version identifier as the terms the Customer accepted. If a request is made within the export or retrieval period, Enarra delivers the data even if the delivery falls after that period ends, and does not delete the data before delivering it.

Data not exported, and why

The following categories of data are not part of the Customer's export. This does not prevent switching: the content meant for the organisation's use moves as the published knowledge cards and the data listed above.

10. Personal data, data location and security

The Customer acts as controller for the personal data whose purposes and essential means of processing it determines in order to deploy and use the Service. Enarra processes this personal data as processor in accordance with the Customer's documented instructions. Enarra acts as an independent controller only for processing whose purposes and essential means it determines itself, such as its own invoicing, statutory bookkeeping and the security of the Service. Processing is agreed in more detail in the data processing agreement, and Enarra's own processing is described in the privacy notice. Key commitments:

• Location: servers, the database, backups, AI and speech recognition are located in the EU. Servers, the database and backups are in Helsinki, and AI and speech recognition in Paris. In production, a locked copy of the backups is also made in Paris; it is introduced together with the production environment.
• Not all processing takes place in the EU. Technical support for Enarra's email service (Zoho) may access support messages from India under the EU standard contractual clauses, and Teams messages may pass through Microsoft's global services if the Customer enables the Teams app. Once online ordering opens, Stripe may transfer payment data to the United States. The subprocessors, their tasks, locations and the grounds for transfers are in sections 11 and 12 of the data processing agreement.
• Access by authorities: Enarra takes reasonable technical, legal and organisational measures to prevent authorities of countries outside the EU from accessing or transferring the Customer's non-personal data contrary to EU or Finnish law (Article 32(1) of the Data Act). The Customer's data is stored in the EU with service providers established in the EU whose parent companies may be outside the EU (section 12 of the data processing agreement). Enarra discloses data to such an authority only if the disclosure complies with Article 32 of the Data Act, and informs the Customer of the authority's request before disclosure unless the law prohibits this. The information required by Article 28 of the Data Act on the location and jurisdiction of the infrastructure and on these measures is at tarumo.fi/en/data-location. The page is kept up to date, and changes that weaken the protection of data are notified under section 19 of the data processing agreement.
• Separation: customers' data is kept separate. Every row of data belongs to one organisation, and the database's row-level security prevents seeing other organisations' data.
• Encryption: connections to the Service and between service providers are encrypted. Backups are encrypted. Encryption at rest of the database and disks is confirmed with the provider before real customer data is processed in production. The technical and organisational measures in place are described in section 10 of the data processing agreement and its annex.
• A dictation's audio recording is deleted by default 30 days after transcription. The Customer can shorten this period or prevent audio from being stored at all.
• In the Service's user interface, an interview's text is visible only to the interviewee, and it is deleted when the card made from it is approved or rejected, and at the latest 30 days after the interview ended. Enarra staff's technical superuser access and its limits are described in section 9 of the data processing agreement.
• The Service logs what is viewed, changed, approved and exported. Searches and questions are not stored or logged.
• Enarra notifies the Customer of a personal data breach without undue delay and at the latest within 24 hours of becoming aware of the breach or of a reasonable suspicion that one has occurred, and of security incidents, under section 14 of the data processing agreement.
• Enarra's processing of its own customer and billing data, such as invoices, their copies and new-invoice notifications, is described in the privacy notice.

11. Service level and support

• Enarra provides the Service professionally and with due care. In the standard packages (Small, Handover, Standard and Mapping), availability is a target level: Enarra aims to keep the Service available and to fix faults without delay.
• Service level commitments (SLA) and any service credits are agreed separately in Extended and Group contracts.
• Maintenance breaks are scheduled for quiet hours where possible and announced in advance when possible. Urgent security updates may be installed without advance notice.
• The production database is backed up every night in encrypted form, and restoring is tested monthly. Backups and restore tests start when the production environment is taken into use, before any Customer data is processed.
• Support is available by email at support@tarumo.fi in Finnish or English on working days. We aim to reply within two working days. Please do not send unnecessary personal data or sensitive material in a support message.
• Enarra is not responsible for outages of third-party services the Customer uses with the Service, such as Microsoft or Google sign-in or the Customer's own systems.

12. End of the contract and deletion of data

• The contract ends on termination, at the end of Handover's read access, on termination for cause or for non-payment. If the Customer has asked to switch to another service or to port its data, the Service first continues for the transition period of section 12 a.
• If the Customer has not asked to switch, the organisation moves into an ended state when the contract ends. Users can no longer enter the organisation, but administrators keep access for the export period and can export the data under section 9. On request, Enarra delivers data an administrator cannot download themselves.
• The export period is at least 30 days from the start of the ended state. The Service shows administrators the date by which the export must be done. The Customer must start retrieval by the end of the export period at the latest.
• After the export period, Enarra permanently deletes the exportable data and the Customer's other data within 30 days at the latest and confirms the deletion in writing on request, unless keeping them is necessary under mandatory law or to establish legal claims. The data disappears from encrypted backups as the backups rotate, within 36 days of deletion at the latest. Personal data is returned and deleted also in accordance with the data processing agreement and Article 28 of the GDPR.
• After deletion, only the following is kept:
  • invoices, vouchers and billing data that belong to Enarra's own bookkeeping. They are subject to the retention periods of the Finnish Accounting Act and VAT Act, in practice at least six years from the end of the year in which the financial year ends (ten years for the financial statements and the chart of accounts). The invoices contain the Customer's billing details and the name and contact details of the billing contact;
  • the organisation's name and identifier and a record of the deletion;
  • Enarra's own administration log, for the retention period described in the privacy notice.
• The PDF copies in the Service's invoice list are deleted with the organisation. The Customer keeps its purchase invoices in its own bookkeeping.
• Microsoft stores its own copy of the Teams app conversation in the Customer's Microsoft 365 environment. That copy is under the Customer's control, and Enarra cannot delete it.

12 a. Switching to another service and porting data

This section implements the rights under Articles 23–26 and 29 of the EU Data Act (2023/2854). It applies to all packages, the pilot included.

1. Request. The Customer can at any time notify Enarra in writing, for example by email, that it wishes to (a) switch to another provider's service, (b) port its data to its own systems or (c) delete its data.
2. The notice period is two months or a shorter period the Customer states. For Small, the notice period ends at the end of the current billing period.
3. Transition period. After the notice period, a transition period of at most 30 calendar days begins. The contract is still in force, and the Service works normally: all users can access the Service, and interviews, cards and export are available. Enarra gives reasonable assistance to the Customer and third parties it authorises, provides the information needed for the switch, informs the Customer of known risks to the continuity of the service and keeps security at the same level.
4. Extension. The Customer can extend the transition period once, for as long as it considers necessary, by giving notice before the transition period ends. If 30 days is technically unfeasible, Enarra says so with reasons within 14 working days of the request and proposes a transition period of at most seven months, during which the Service continues.
5. End of the contract. The contract ends when the switch has been completed, or at the latest when the transition period ends. If the Customer chose only to delete its data, the contract ends when the notice period ends. Enarra informs the Customer that the contract has ended.
6. Retrieval period. After the transition period, the Customer still has at least 30 days to export the data, and Enarra delivers requested data during this time (section 9).
7. Deletion. After the retrieval period, Enarra permanently deletes all exportable data and the Customer's other data under section 12.
8. Charges. Charges are kept apart as follows:
   • Use of the Service: for the notice and transition periods, during which the Service remains available to the Customer, the Customer pays the normal price under the contract. This is not a switching charge.
   • Switching charges: Enarra makes no switching charges or data transfer charges. Article 29 of the Data Act prohibits them from 12 January 2027.
   • Early termination: if a fixed-term contract ends at the Customer's request before the end of the contract period, the Customer pays as compensation the monthly fees for the rest of the contract period, unless the order says otherwise. No compensation is charged if the end is due to Enarra's material breach, to Enarra's termination for a reason not attributable to the Customer, to the Customer's termination because of a price change or a change to the terms (sections 6 and 16), or to force majeure (section 15). The compensation is not a switching charge.
9. Data and formats. The exportable data and the data not exported are in section 9.
10. Location and access by authorities. Information on the location and jurisdiction of the Service's infrastructure and on the measures Enarra takes to prevent unlawful access to the data by authorities outside the EU is in section 10.

13. Confidentiality

• Each party keeps the other party's business and trade secrets and other confidential information confidential and uses them only to perform the contract. Customer content is always confidential.
• A party may disclose confidential information only to those of its employees, subcontractors and advisers who need it to perform the contract and who are bound by a corresponding duty of confidentiality.
• The obligation does not apply to information that is public, that the party has obtained lawfully elsewhere or developed itself, or whose disclosure the law or an authority requires.
• The obligation lasts as follows:
  • general confidential information: for the term of the contract and five years after it ends;
  • trade secrets: for as long as the information is a trade secret;
  • Customer content: for as long as Enarra holds it, including in backups, logs or a statutory archive;
  • personal data: as data protection law requires;
  • invoicing and bookkeeping material kept by law: for its retention period.
  Confidentiality does not entitle anyone to keep data longer than these terms and the data processing agreement otherwise allow.

14. Limitation of liability

• A party is liable only for direct damage caused by its breach of contract. A party is not liable for indirect damage, such as lost profit or turnover, interruption of production or business, or lost goodwill. The limitations in this section are the same for both parties and apply to claims for damages based on the contract.
• General cap: each party's total liability per contract year is limited to the fees, excluding VAT, that the Customer has paid or that have fallen due for the Service in the 12 months before the event giving rise to liability, but at least €5,000. For a one-off package (Handover and Mapping), the cap is the one-off fee excluding VAT, but at least €5,000.
• Data protection and confidentiality: the general cap does not apply to liability arising from breach of the obligations concerning the processing of personal data (data protection law and the data processing agreement) or of the confidentiality obligation (section 13). The separate cap for such liability per contract year is three times the fees on which the general cap is based, or €15,000, whichever is greater.
• The separate cap also covers, as direct damage, compensation a party has paid to data subjects under Article 82 of the GDPR because of a breach for which the other party is responsible and which it claims back under Article 82(5), as well as reasonable costs of investigating and notifying a security breach and of restoring data. Each party bears any administrative fines imposed on it.
• The limitations, the separate cap included, do not apply to the Customer's payment obligation, to damage caused intentionally or through gross negligence, to intentional misuse of the other party's trade secrets, to intentional infringement of intellectual property rights, to intentional circumvention of the Service's security, or to liability that cannot be limited under mandatory law. Other breaches of sections 3 a, 7 and 8 fall under the general cap.
• The limitations of liability in this contract do not limit the rights of third parties, data subjects included, under mandatory law. The parties' liability towards each other and any right of recourse are determined by this contract and the applicable law.
• A claim must be made in writing within 12 months of the party discovering the damage or when it should have discovered it.
• Enarra is not responsible for the accuracy of Customer content or for how the Customer uses knowledge cards and AI answers (section 3).

15. Force majeure

A party is not liable for delay or damage caused by an impediment beyond its control that it could not reasonably have taken into account or avoided. Such an impediment may be, for example, a widespread telecommunications or power outage, an order of an authority, a natural phenomenon, war or a large-scale cyber attack that could not be prevented by security measures in line with good industry practice. An impediment affecting a subcontractor is force majeure only if a replacement service cannot be obtained at reasonable cost or without unreasonable delay. A party notifies the other of the impediment without delay. If the impediment lasts more than 60 days, either party can terminate the contract by notice in writing, and the unused share of a period paid in advance is refunded.

16. Changes to the terms and contract versions

• Enarra can change these terms. Enarra notifies the Customer's administrators of a change by email and in the Service at least 30 days before it takes effect. If the change is not solely to the Customer's benefit and is not required by law or an authority, the notice period is at least 90 days. Price changes are always notified at least 90 days in advance (section 6).
• If the change is not solely to the Customer's benefit and is not required by law or an authority, or is a price change, the Customer can terminate the contract to end before the change takes effect. The unused part of a period paid in advance is then refunded pro rata.
• Changes required by law, an order of an authority or security, and changes solely to the Customer's benefit, may take effect sooner.
• Versions. The version in force is on this page. Every published version has an unchangeable copy and a PDF file that can be saved at a permanent address (version archive), and their SHA-256 digests are published. The data processing agreement and the export page are archived with their PDF files under the same version identifier. An online order records the identifier of the accepted version and the time of acceptance, and the order confirmation links the PDF files of exactly that version.
• A signed contract is governed by the versions attached to it and accepted when it was signed. A later web version does not replace them automatically; a signed contract is changed only by notice under this section or by written agreement.

17. Subcontractors and assignment

• Enarra may use subcontractors and is responsible for their work as for its own. The subprocessors that process personal data are listed in the data processing agreement.
• Either party may assign the contract to a company in the same group or to whoever it transfers the business related to the contract by notifying the other party in writing. The assignee is responsible for the contract from the time of assignment. Otherwise, the contract may be assigned only with the other party's written consent, which is not withheld without good reason. Assigning the Customer's contract requires that the assignee accepts the data processing agreement as controller.
• Handover in a business sale. If a Customer that has paid for Handover sells its business, the Handover rights can pass to the buyer only under a new contract or a tripartite transfer agreement between Enarra, the seller and the buyer. It settles the transfer of the contract, the remaining interview and read period, responsibilities, the data processing agreement, the buyer's role as controller, users' access and the lawfulness of transferring the data. The staff's personal data does not pass to the buyer automatically; the seller and buyer first check the purpose, the legal basis and the duty to inform. If only the right to read published cards passes to the buyer, access is limited to that content.

18. Governing law and disputes

• The contract is governed by Finnish law, excluding its conflict of laws rules.
• The parties first try to settle disagreements by negotiation. If a matter is not settled within 30 days of a party notifying the disagreement in writing, it is settled by the District Court of Central Finland (Keski-Suomen käräjäoikeus). Enarra may, however, also bring an action for a receivable in the court of the Customer's domicile. This option does not apply to a Customer whose domicile is outside the European Union, Iceland, Norway and Switzerland.
• If the Customer's domicile is outside the European Union, Iceland, Norway and Switzerland, all disputes, Enarra's receivables included, are settled as follows: Any dispute, controversy or claim arising out of or relating to this contract, or the breach, termination or validity thereof, shall be finally settled by arbitration in accordance with the Rules for Expedited Arbitration of the Finland Chamber of Commerce. The seat of arbitration shall be Helsinki, Finland. The language of the arbitration shall be English. The arbitration is administered by the Arbitration Institute of the Finland Chamber of Commerce, and Finnish law applies to the dispute.
• In Extended and Group contracts, the parties may agree on this clause instead of the District Court: Any dispute, controversy or claim arising out of or relating to this contract, or the breach, termination or validity thereof, shall be finally settled by arbitration in accordance with the Arbitration Rules of the Finland Chamber of Commerce. The number of arbitrators shall be one. The seat of arbitration shall be Helsinki, Finland. The language of the arbitration shall be Finnish. The proceedings are confidential.
• The negotiation stage does not prevent seeking interim measures.
• The Service is intended only for businesses and other organisations. This section does not limit a consumer's rights under mandatory law to choose the court if the buyer is in fact a consumer.

19. Contact details and notices

Enarra Oy (Business ID 3664892-5)
Artturintie 4, 43500 Karstula, Finland
Contract matters and notices: sales@tarumo.fi
Privacy matters and data subject requests: tietosuoja@tarumo.fi
Security reports and vulnerabilities: security@tarumo.fi
User support: support@tarumo.fi

Enarra sends notices about the contract by email to the Customer's administrators and to the billing address given in the order. The Customer sends its notices about the contract to the sales address. Privacy questions, data subject requests and notices of security breaches go to the addresses reserved for them, where they are handled separately from sales. Enarra has not appointed a data protection officer. In these terms, "in writing" includes email. An email is deemed received on the business day after it was sent. The Customer keeps the contact details of its administrators and billing up to date.

20. Other terms

• Survival. Sections 8, 9, 12, 12 a, 13, 14 and 18, and payments due before the end, remain in force after the contract ends for as long as their purpose requires.
• Invalid term. If a term is invalid or unenforceable, the other terms remain in force. An invalid term is replaced by a valid term closest in purpose to the original.
• Entire agreement. The order, these terms of service, the data processing agreement with its annexes and the price list form the parties' entire agreement. They replace earlier negotiations and offers.
• No waiver. If a party does not exercise a right, this does not mean it waives that right.