Terms and conditions of use for stakeholder testing

1. General

The Positive credit register is a national electronic database containing credit and income data. The controller of the register is the Finnish Tax Administration’s Incomes Register Unit.

The Positive credit register has a separate stakeholder testing environment, which is maintained by the project to establish a positive credit register (later in this text also referred to as the Incomes Register Unit). The testing environment is for testing how the data systems of the data notifiers and data users function. Both the reporting of data to the Positive credit register and the requesting of data saved in the register can be tested.

The Positive credit register's testing environment provides operators that report data to the register or use the register’s data with an opportunity to test the register and its technical APIs. The test customer data and credit and income data used in testing are either entirely artificial or anonymised.

These terms and conditions of use apply to the testing of the Positive credit register’s technical API in the register’s testing environment. The use of the testing environment requires that the tester agrees to comply with the terms and conditions of use for the stakeholder testing environment.

2. Definitions

The concepts used in these terms and conditions have the following meanings.

Artificial personal identity code is an imaginary personal identity code generated for a test customer and used in testing.
Artificial Business ID is an imaginary Business ID generated for the tester and used in testing.
Tester is a business with reporting obligation, a business using the register’s data, a credit information company or an authority referred to in the Act on the Positive Credit Register (739/2022) and wishing to have access to the Positive credit register’s testing environment, or a party representing any of the above.
Testing contact person coordinates the testing, the data used in testing and the test observations on the tester’s behalf. Hereinafter in these terms and conditions, ‘tester’ also refers to the testing contact person, where applicable.
Testing environment refers to the technical API and the stakeholder testing environment provided by the Incomes Register Unit for the purpose of testing the Positive credit register.
Testing certificate is a unique electronic identifier generated for the use of the testing environment and granted by the Incomes Register Unit. The testing certificate serves to verify the authenticity of the tester and the files sent by the tester, and to establish an encrypted and reliable connection between the tester and testing environment.
Data user refers to a business using the register’s data, a credit information company or an authority which is referred to in the Act on the Positive Credit Register (739/2022) and to which data is disclosed from the Positive credit register, or a party representing any of the above.
Data notifier refers to a business that is obligated to report loan contract information to the register under the Act on the Positive Credit Register.
Incomes Register Unit means the Finnish Tax Administration’s Incomes Register Unit referred to in the Act on the Positive Credit Register. Where applicable, the Incomes Register Unit also refers to the project to establish a positive credit register, which is responsible for maintaining the register's stakeholder testing environment.

3. Scope and validity of the access right to the testing environment

The tester signs up for testing by submitting a testing start notification. In the notification, the tester informs the Incomes Register Unit of the technical APIs it wants to test.

Based on the tester’s notification, the Incomes Register Unit determines the scope of the tester’s access right to the testing environment, the technical APIs to be tested and, where necessary, the data user’s data access profiles that the tester can use in the testing environment.

The tester's right to access the testing environment enters into force when the Incomes Register Unit sends the tester an artificial Business ID and instructions on how to retrieve a testing certificate. However, the access right is not valid until after the Incomes Register Unit has opened the testing environment for testers.

The tester can use the testing environment after receiving an artificial Business ID sent by the Incomes Register Unit and retrieving a testing certificate required for the testing of the technical API. The access right to the testing environment is valid until further notice.

The tester must immediately notify the Incomes Register Unit of any material changes to the information it reported in connection with sign-up.

4. Testing certificate and artificial Business ID

A separate testing certificate is required for the use of the technical APIs in the testing environment. The testing certificate is assigned to an artificial Business ID. The Incomes Register Unit sends the tester an artificial Business ID and instructions on how to retrieve the testing certificate.

The testing certificate consists of a key pair, i.e. a matching pair of keys used in public key methods. The key pair consists of a public key and a private key. The private key is created by the user, and it is known only to the user. The private key may never be handed over to anyone, not even to the Tax Administration.

The tester agrees to keep the certificate safe, ensuring that it is available only to individuals who are entitled to use it. The tester identified by the certificate is responsible for all the operations performed through the API, such as submitting, requesting and retrieving data, until the certificate is revoked.

If the tester knows or suspects that the certificate’s private key has been lost or fallen into the wrong hands, they must inform the Tax Administration immediately. In this way, unauthorised use of the API service can be prevented. If the certificate is not needed, it must be revoked.

When the tester no longer needs the testing certificate or wants it to be revoked for some other reason, they should request revocation by phoning the Tax Administration:

During office hours (9 am–4 pm on business days)
The Positive credit register’s customer service: 029 497 570

Outside office hours
Only urgent revocation of certificates: +358 9 427 34 834

The testing certificate is valid for 2 years from the date of grant. If the tester wants to continue testing the APIs after the period has ended, the testing certificate must be renewed in accordance with the instructions issued by the Incomes Register Unit. Instructions on the testing certificate used in stakeholder testing are available on the Positive credit register’s website.

5. Availability and restrictions of the testing environment

The aim is to keep the stakeholder testing environment available during office hours. If problems occur in the testing environment, they will be responded to during office hours. Testing is also allowed outside the office hours, but the testing environment cannot be guaranteed to function at such times.

However, the Incomes Register Unit can interrupt the use of the testing environment due to technical, functional or information security problems or errors detected in the environment, or for other justified reasons. The Incomes Register Unit makes every effort to keep the interruptions as brief as possible. The Incomes Register Unit does not assume responsibility for any adverse impact on the tester arising from such interruptions of use. Further, the Incomes Register Unit is not liable for any costs incurred to the tester on account of interruptions.

The functions available for testing in the testing environment may not necessarily cover all features and services of the Positive credit register’s production environment.

6. Test data

The Incomes Register Unit sends the tester artificial test customer data to be used in testing. The tester can forward the received test customer data to parties representing the tester and participating in the testing of the tester’s systems. The tester must handle the test customer data with care and destroy it when the data is no longer needed for testing the tester’s own systems or related functions.

In addition to using the test customer data provided by the Incomes Register Unit, the tester can send the Incomes Register Unit its own test customer data that it wants to use for testing. The test customer data that the tester submits to the Incomes Register Unit will also be available to all other testers in the testing environment. The organisation providing its own test customer data for testing purposes transfers all rights of use to the data to the Incomes Register Unit. The tester’s own test data (for example, test customers and loan contract information) may not contain real personal data. All test customer data used in testing must be entirely artificial or, alternatively, anonymised in such a manner that it is not possible to link the information on test customers or on loans concerning them to actual persons.

Anonymisation means that test data is made unidentifiable such that it cannot be restored to the original format by the use of a certain value or, for example, an encryption key. Anonymisation must be carried out in accordance with the Incomes Register Unit’s instructions. Instructions on the anonymisation of test data are available on the Positive credit register’s website.

The tester is responsible for seeing that the test data it has submitted to the Positive credit register’s testing environment does not include any real personal data and that the test data has been anonymised in accordance with the Incomes Register Unit’s instructions. The Incomes Register Unit is not obligated to inspect the test data submitted by the tester. If the tester detects that protection of personal data is jeopardised, it must notify the Incomes Register Unit of the situation immediately.

The Incomes Register Unit is not responsible if the tester’s test data is destroyed, lost or altered. Also, the Incomes Register Unit is not liable for any related costs, such as costs arising from the recreation of test data and files.

7. Data shared with data users

Data from the testing environment is shared with data users only in accordance with data access profiles, which are based on the data users’ data access rights. The testing contact person is informed by email of the data access profiles to be used in testing when the testing begins. Data users testing the requesting of credit register extracts are provided only with information that according to the Act on the Positive Credit Register is to be indicated on the credit register extract. Other data users are provided with information according to the data access right laid down in the above Act. The data shared is artificial or anonymised test data generated by the Incomes Register Unit, by other data submitters using the testing environment or by the data users themselves.

8. Monitoring of testing and test observations

The Incomes Register Unit monitors the operation of the testing environment and any disruptions
and errors detected during testing. The Incomes Register Unit publishes a delivery report in
conjunction with each new version published to the stakeholder testing environment. The delivery
report describes the functionalities of the new version, any defects detected and changes made
after the previous version.

Any errors and other deviations relating to the implementation of the Positive credit register that
are detected during testing must be reported to the Incomes Register Unit immediately. Data users
must also notify the Incomes Register Unit if they receive any such data from the testing
environment that they are not entitled to receive (for example, information that should not be
included in the credit register extract).

Testers report observations by filling in the stakeholder testing observation form, from which a
ticket will be created. No personal data may be entered in the description field of the observation
form. The stakeholder testing observation form is available on the Positive credit register's website.

9. Responsiblity for hardware and testing costs

The tester, a party representing the tester, and the Incomes Register Unit are responsible for seeing – each for their own part – that the hardware, software, systems or data connections they use in testing do not cause any damage, disruption or other harm to the other party or to outsiders. If such disruption occurs, the other party must be notified immediately. In case of larger than minor damage, error or harm, the matter must be communicated in writing. The tester or a party representing the tester, and the Incomes Register Unit are obligated to investigate and eliminate, without any undue delay, any error, disruption or other reason which causes damage and for which they are responsible.

The tester, a party representing the tester, and the Incomes Register Unit are each responsible for their own costs arising from the testing and the use of the testing environment.

10. Changes to the testing environment and instructions

The Incomes Register Unit is entitled to change the instructions, the APIs tested in the testing environment and their content, and the availability of the testing environment. Changes may be attributable to general development of the Positive credit register or its testing environment, or correction of errors detected in the operation, for example.

The Incomes Register Unit informs the tester of upcoming changes so that the tester can take the changes into account in its own operations. The Incomes Register Unit is not liable for the tester’s costs arising from the changes or from related interruptions in the use of the testing environment.

11. Instructions on stakeholder testing

In addition to these terms and conditions, the instructions on stakeholder testing must also be followed. The instructions can be found on the Positive credit register’s website.

12. Amending the terms and conditions of use

The Incomes Register Unit has the right to amend the terms and conditions of use for the testing environment. The amendments enter into force when the amended terms and conditions are published on the positivecreditregister.fi website. Before the release of amended terms and conditions, testers with valid testing certificates will be notified of the upcoming amendment by the Incomes Register Unit. The tester accepts the amendments to the terms and conditions by continuing to use the service.

13. Ending and transferring the access right to the testing environment

The tester may terminate its access right to the testing environment with immediate effect by giving written notice to the Incomes Register Unit.

The Incomes Register Unit may terminate the tester’s access right to the testing environment by giving 1 month’s written notice to the tester. The Incomes Register Unit can unilaterally terminate the access right to the testing environment with immediate effect and prevent the use of the testing environment if the tester is in material breach of these terms and conditions and does not correct its actions without delay despite being requested to do so by the Incomes Register Unit. The Incomes Register Unit can also terminate the access right to the testing environment when the testing environment is closed down. The Incomes Register Unit cannot terminate the access right to the testing environment without a separate reason.

Terminating the access right does not incur any penalty payments, neither to the tester nor to the Incomes Register Unit.
The tester does not have the right to transfer its access rights to the testing environment or any related rights or obligations, in full or in part, to a third party without the Incomes Register Unit’s written consent.

14. Settlement of disputes

Any disputes arising from these terms and conditions will primarily be settled in mutual negotiations between the Incomes Register Unit and the tester. If the dispute cannot be settled through negotiations, the matter will be decided by a competent court of law.