Records of Processing Activities (ROPA)

Version 1.3 | Last reviewed: 2026-09-30 | Next review: 2027-09-30

Document owner: Privacy contact (info@fintower.se)

Important notice

This ROPA is a living document and must be reviewed at least annually or upon material changes to processing activities. Any updates must be reflected within 30 days of implementation.

Introduction

This Records of Processing Activities document is maintained in accordance with Article 30 of the General Data Protection Regulation (GDPR) and represents the accountability framework for Fintower AB's personal data processing activities.

Fintower AB (organisation number 559468-3913) is established as both a Data Controller and a Data Processor.

This document covers:

• Part A: Processing activities where Fintower AB acts as the Data Controller
• Part B: Processing activities where Fintower AB acts as the Data Processor on behalf of Customers
• Appendix: Comprehensive Sub-processor Register

Company details

Part A: Fintower AB as data controller

A-01: User account management

Purpose: Creating and maintaining user accounts to enable access to the Fintower platform; managing user profiles, permissions, and account lifecycle.

Legal basis: Contract performance (Art. 6(1)(b) GDPR)

Data categories: Full name, work email address, company name, job title, account credentials (hashed/encrypted), account status, last login timestamp, account creation date.

Data subjects: Employees and representatives of Customer companies subscribed to Fintower platform.

Sub-processors:

Sub-processors: Supabase Inc. (authentication and identity management).

Retention: Duration of subscription plus 12 months following contract termination or account deletion.

International transfers: EU only.

A-02: SSO authentication (Google OAuth / Microsoft Entra ID)

Purpose: Enable users to authenticate using federated identity providers.

Legal basis: Contract performance (Art. 6(1)(b)); Legitimate interests (Art. 6(1)(f)).

Data categories: Name from identity provider, email address, identity provider token/assertion, authentication timestamp, device identifier, authentication events.

Retention: Session tokens cleared on logout or timeout (24h max).

International transfers: Google LLC: EU/US transfer under DPF and SCCs. Microsoft Entra ID: EU data residency.

A-03: Service usage analytics

Purpose: Understanding how users interact with the Fintower platform to improve feature effectiveness and user experience.

Legal basis: Legitimate interests (Art. 6(1)(f)).

Data categories: Usage events linked to the user's analytics profile (which may include email address and name), session duration, browser type, device type, country-level location, IP address.

Sub-processors: Mixpanel Inc. (product analytics), PostHog Inc. (product analytics and experimentation, EU).

Retention: 90 days; aggregated analytics retained indefinitely after anonymisation.

International transfers: Mixpanel Inc.: EU data residency, no transfer required. PostHog Inc.: EU data residency (eu.i.posthog.com), no transfer required.

A-04: Customer billing & invoicing

Purpose: Processing subscription payments, issuing invoices, maintaining financial records.

Legal basis: Contract performance (Art. 6(1)(b)); Legal obligation (Art. 6(1)(c)), Swedish Bookkeeping Act and tax law.

Data categories: Company name, billing address, contact person name, email, VAT number, payment method details, invoice amounts, subscription tier.

Retention: 7 years as required by Swedish Bookkeeping Act.

International transfers: EU only.

A-05: Marketing & lead generation (marketing site only)

Purpose: Understanding marketing campaign effectiveness, tracking prospect engagement, nurturing potential customers.

Legal basis: Consent (Art. 6(1)(a)) for non-essential cookies; Legitimate interests (Art. 6(1)(f)) for existing customer communications.

Data categories: Email address, company name, full name, website visit data, LinkedIn profile identifier, UTM parameters.

Sub-processors: Google LLC (Analytics), LinkedIn Ireland Limited (Insight Tag), Mixpanel Inc. (product analytics), PostHog Inc. (product analytics and experimentation, EU), Microsoft Corporation (Clarity session replay, US under DPF/SCCs).

Retention: Marketing cookies per consent duration (12–24 months).

International transfers: Google, LinkedIn, Microsoft (Clarity): EU/US transfer under DPF and SCCs. Mixpanel, PostHog: EU data residency.

A-06: Customer support communications

Purpose: Responding to support requests, investigating bug reports, maintaining knowledge base.

Legal basis: Contract performance (Art. 6(1)(b)); Legitimate interests (Art. 6(1)(f)).

Retention: 2 years following ticket closure. Chatwoot live chat conversations: 30 days.

Sub-processors: Resend Inc. (transactional email delivery), Chatwoot Inc. (live chat support, US under SCCs, 30-day retention).

International transfers: Resend Inc.: EU, no transfer required. Chatwoot Inc.: US transfer under SCCs.

A-07: Security monitoring & incident management

Purpose: Detecting, investigating, and responding to security incidents; maintaining audit logs.

Legal basis: Legitimate interests (Art. 6(1)(f)); Legal obligation.

Data categories: IP addresses, access logs, authentication events, API request logs, error logs, security alert events.

Retention: Operational logs: 90 days. Security incident records: 1 year. Audit logs for data breaches: 3 years.

International transfers: EU only.

A-08: Employee & contractor HR processing

Purpose: Managing employment relationships, processing payroll, tax and social security reporting.

Legal basis: Contract performance (Art. 6(1)(b)); Legal obligation (Art. 6(1)(c)), Swedish employment law, Skatteverket.

Data categories: Full legal name, personnummer, home address, bank account details, salary information, employment contract terms.

Retention: 7 years following end of employment as required by Swedish law.

International transfers: EU only, Sweden.

Part B: Fintower AB as data processor

B-01: Processing Customer data in the Fintower platform

Purpose: Enabling Customers to upload, store, process, and analyse their financial data within the secure Fintower platform.

Role: Data Processor. Controller: The Customer (B2B company).

Legal basis: Data Processing Agreement (DPA) per GDPR Art. 28.

Data categories: Accounting transaction data, invoices, payroll data, revenue data, cost allocations, budget data, forecast models, balance sheet items, cash flow data, and bank account data (account details, balances and transactions) where the Customer connects a bank through Enable Banking.

Sub-processors: Supabase Inc. (EU, Irland), Amazon (EU, Irland), Trigger.dev Inc. (EU, Germany), E2B Inc. (EU), Enable Banking Oy (EU, bank connections only).

Retention: Per Customer instruction; Customer Data is deleted within 30 days after termination, or earlier on the Customer's request, unless retention is required by law. Deleted data may remain in encrypted backups until those backups expire.

AI processing: No Customer data is used for training, fine-tuning, or improving any AI models. Each AI request is processed in isolation.

B-02: AI-powered financial analysis

Purpose: Running machine learning and large language models on Customer's financial data to generate insights, scenario analyses, and forecasts.

Role: Data Processor. Controller: The Customer.

Sub-processors: Amazon Web Services (Amazon Bedrock, running Anthropic Claude models; EU, Irland), E2B Inc. (EU).

AI model training: Customer data is NEVER used for training, fine-tuning, or improving any model. Data is processed in isolation for each request and is not retained by any sub-processor for model improvement.

Data flows: Customer financial data → Fintower platform → encrypted transmission → Amazon Bedrock (EU) → processed output → returned to Customer. Where an AI agent runs code, it does so in an E2B sandbox, which can hold Customer data during the conversation.

International transfers: EU only (E2B: EU hosting according to E2B's written confirmation).

Appendix: Sub-processor register

Contact information

Privacy contact:
Email: info@fintower.se
Address: Stampgatan 14, 411 01 Göteborg, Sweden