EN16931 / XRechnung / Peppol BIS 3 Validator

Privacy Policy

Last updated 2026-10-24. This policy explains what personal data we process when you use the EN16931 / XRechnung / Peppol BIS 3 Validator, why, and what your rights are under the EU General Data Protection Regulation (GDPR).

1. Controller

Niko yhtiöt Oy
Business ID (Y-tunnus): 3636929-9
VAT ID: FI36369299
Registered office: Helsinki, Finland
Postal address: Aleksis Kiven katu 22, 00500 Helsinki, Finland
E-mail: nyo-agentti@nikoy.fi

2. What we process and why

Data	Purpose and legal basis	Retention
Invoice files you submit (UBL/CII XML). They typically contain business names, addresses, identifiers and may contain names and contact details of individuals.	To produce the validation result or the repaired file you asked for. The file is held in memory only for the duration of the request. Free use: legitimate interest in providing the service you requested (Art. 6(1)(f)). Paid plans: performance of the contract (Art. 6(1)(b)); where you process your customers' data, we act as your processor under a data processing agreement (Art. 28).	Not stored. Discarded when the response has been sent.
PDF files you submit for the PDF/UA check. They may contain any personal data that is in the document.	To produce the veraPDF result and the fixed file you asked for (Art. 6(1)(f) for the free check, Art. 6(1)(b) for the purchased fix). The file is written to a temporary file only while veraPDF reads it, in the same isolated service.	Not stored. The temporary file is deleted when the result has been sent.
Request log: timestamp, file size, accepted/rejected, duration, HTTP status. No file content, no file name, no rule messages.	Operating the service, capacity planning and abuse prevention (Art. 6(1)(f)).	Up to 90 days.
Page view counts: the page path, the domain of the site that linked to it (for example google.com) and whether the browser identifies itself as a bot. No cookies, no IP address, no device or user identifier.	Measuring which pages are useful and where visitors come from (Art. 6(1)(f)). The data does not identify anyone.	Up to 90 days.
Infrastructure logs kept by our hosting provider (Render), which may include your IP address and user agent.	Security and reliability of the hosting platform (Art. 6(1)(f)).	According to the hosting provider's retention policy.
Subscription and billing data for paid plans: name, e-mail address, company name, country, VAT ID, plan, invoice identifiers and the payer details of your bank transfer. For card payments: the Stripe payment and customer identifiers and the last digits of the card shown to us by Stripe; we never see or store full card numbers.	Providing the subscription and support, and complying with accounting and tax law (Art. 6(1)(b) and (c)).	For the duration of the subscription, then as required by the Finnish Accounting Act (6 years from the end of the financial year).
API keys and usage counters for paid API plans.	Authentication and quota enforcement (Art. 6(1)(b)).	Until the subscription ends plus 30 days.
Partner records for the partner programme: company name, country, VAT ID or company registration number, website, contact e-mail and the partner code; the code is also stored with the payments it brought.	Running the partner programme: calculating, reporting and paying commissions, and complying with accounting law (Art. 6(1)(b) and (c)).	For the duration of the arrangement, then as required by the Finnish Accounting Act (6 years from the end of the financial year).
Correspondence you send us.	Answering you (Art. 6(1)(f)).	Up to 2 years.

3. Cookies and tracking

We set no cookies and run no third-party analytics or advertising scripts. Each page sends one anonymous page-view count to our own server (see section 2: path and referring domain only, nothing stored on your device). When you arrive through a partner link (an address with ?ref=), the partner's code — which identifies the partner, not you — is stored with your payment for commission accounting; no cookies or browser storage are used for this. The card checkout page is provided by Stripe and sets the cookies Stripe needs for payment and fraud prevention (Stripe privacy policy: stripe.com/privacy).

4. Recipients and processors

Our bank receives the payments you make by bank transfer and processes the payer details as an independent controller under banking law.
Stripe (Stripe Payments Europe, Ltd., Ireland) processes card payments for the Pilot and single-file repairs (for these, the file name and SHA-256 checksum of your file are stored with the payment so that the download can recognise the file; the file itself is not stored) and PDF/UA fixes (for these, the file name, the SHA-256 checksums of the original and the fixed file, the chosen document language and the before/after rule counts are stored with the payment; the file itself is not stored). Stripe receives your e-mail, VAT ID, company name and card details and acts as an independent controller for payment processing and fraud prevention.
Our e-mail hosting provider processes the e-mails, invoices and files you send us or we send you, as our processor.
Render (Render Services, Inc., United States) hosts the service. We deploy in Render's Frankfurt (EU) region; personal data is processed in the EU. Render acts as our processor under its data processing agreement, which includes the EU Standard Contractual Clauses for any support access from outside the EU.
The static rule reference pages may be served by GitHub Pages (GitHub, Inc.) or Cloudflare Pages (Cloudflare, Inc.); the provider sees your IP address to deliver the page and keeps its own infrastructure logs.

We do not sell personal data and do not share it with anyone else, except where required by law.

5. Your rights

You have the right to access, rectify and erase your personal data, to restrict or object to processing, and to data portability where applicable. Because we do not store submitted files, there is normally nothing to access or erase about them; billing data requests are answered within one month. Contact us using the details in section 1. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) or the supervisory authority of your residence.

6. Security

All traffic is encrypted (HTTPS). Invoice files are processed in memory in an isolated service and are never written to disk by our application; PDF files for the PDF/UA check are written to a temporary file only while the validator reads them and deleted right after. Access to the hosting account is restricted to the operator.

7. Changes

We will post changes to this policy on this page with a new date. Material changes affecting subscribers are also announced by e-mail.