Updated: 02.11.2026
This agreement is part of the terms of service of doggso. It applies between the school or company that uses doggso (the customer, controller) and aimget Oy, business ID 2525683-8, Viipurinkatu 14 B23, 00510 Helsinki (the provider, processor), and it meets the requirements of Article 28 of the EU General Data Protection Regulation (GDPR). In data protection matters it prevails over the other terms.
The provider processes personal data on behalf of the customer in order to provide the doggso service: the customer's website, enrollments, bookings, webshop, payments, invoices, messages, forum and the other features the customer uses. Processing lasts as long as the customer uses the service and ends as described in section 10.
The provider processes the personal data only on the customer's documented instructions. The terms of service, this agreement and the customer's use of the service and its settings are the instructions. The provider informs the customer if it believes an instruction infringes data protection law, and processes data otherwise only where EU or Finnish law requires it, informing the customer unless the law forbids it.
Only the provider's staff who need it for their work have access to the personal data. They are bound to confidentiality.
The provider takes the technical and organisational measures of Article 32 GDPR, at least:
The customer gives a general authorisation to use sub-processors. The current list with purposes, locations and safeguards is at sub-processors. The provider binds every sub-processor by a written agreement to the same data protection obligations and remains liable to the customer for them.
The provider informs the customer at least 30 days before it adds or replaces a sub-processor, by email to the customer's administrators or by an announcement in the service. The customer may object in writing within that time for reasons of data protection. If no solution is found, the customer may end the use of the service before the change takes effect.
Personal data is transferred outside the EU and the European Economic Area only with a safeguard of Chapter V GDPR, such as the EU-US Data Privacy Framework or the EU standard contractual clauses. The sub-processor list shows the transfers and their safeguards.
The provider helps the customer, as far as possible and taking into account the nature of the processing:
The customer has a ready privacy notice template on its website, which it may replace with its own.
The provider notifies the customer of a personal data breach without undue delay and at the latest within 48 hours of becoming aware of it, with the information available about its nature, the data and data subjects concerned, the likely consequences and the measures taken. The provider fixes the breach and limits its effects.
When the customer stops using the service, the provider gives the customer, on request made within 30 days, its data in a machine-readable format, and deletes the personal data within 90 days of the end, unless law requires it to be kept. Backups are deleted as they expire, within 12 months.
The provider gives the customer the information needed to show that it meets this agreement. The customer may audit the provider, itself or through an auditor bound to confidentiality, once a year and after a personal data breach, with 30 days' notice and at its own cost. Questions: office@aimget.com.
The customer is responsible for having a legal basis for the processing, for informing its data subjects and for the lawfulness of its instructions and of the data it enters into the service.
Liability follows Article 82 GDPR and the terms of service. The provider may change this agreement for changes in law or in the service, informing the customer at least 30 days in advance; the date of the version is at the top. Finnish law applies; disputes are settled in the Helsinki District Court.