Data processing agreement

1. Parties and roles

This agreement is between the customer, as controller, and Connectivo AB, reg. no. 556932-7777, Mailbox 345, 411 41 Göteborg, Sweden, as processor. It forms part of the terms of service and applies as long as we process personal data on the customer's behalf.

For account, payment and user data that we process for our own administration, we are the controller. The privacy policy describes this.

2. The processing

• Purpose: to deliver Bolagsdelta, that is to store and show the customer's lists, watches, rules, notes and settings and to run notifications.
• Types of personal data: name and e-mail of the customer's users, and personal data the customer adds, for example in notes. Data about people in registers, such as board members, is source data for which we are the controller.
• Data subjects: the customer's users and people the customer registers.
• Duration: while the subscription is active. After termination the customer can, within 30 days, ask us to export its data. After that it is deleted, except what the law requires us to keep.

3. Our commitments

• We process the personal data only on the customer's documented instructions. This agreement, the terms of service and the customer's use of the service are the instructions. We tell the customer if an instruction infringes data protection rules.
• Personnel with access are bound by confidentiality.
• We take appropriate technical and organisational security measures under Article 32. They are described on the security page.
• We help the customer respond to data subject requests and meet Articles 32-36, to a reasonable extent.
• We notify the customer of a personal data breach affecting the customer's data without undue delay after becoming aware of it, stating what happened, which data is affected and what we are doing.
• We provide the information needed to show compliance and allow audits by the customer or an auditor it appoints, once a year or after an incident, with reasonable notice and under confidentiality.
• When the agreement ends we delete or return the personal data under section 2, unless the law requires storage.

4. Sub-processors

The customer gives us general authorisation to engage sub-processors. We have a contract with each sub-processor giving the same protection as this agreement, and we are responsible for them. We notify the account owner by e-mail at least 30 days before we add or replace a sub-processor. The customer may object on reasonable grounds. If we cannot accommodate the objection, the customer may cancel the subscription.

Current sub-processors:

• DigitalOcean: servers, database and encrypted backups. Location: Frankfurt, Germany.
• Cloudflare: DNS, protection and delivery of web traffic (proxy) for bolagsdelta.se. Processes IP addresses and request data.
• Loopia AB: sending e-mail for sign-in links and notifications. Sweden.
• Stripe Payments Europe, Ltd.: payments and receipts. Ireland. We do not store card details. Stripe is in part an independent controller of payment data.
• OpenAI: optional AI summary of companies. We send only company facts with source references, no personal names.
• For customers with an invoice agreement: Cavat (invoicing) and Banksignering.se (BankID signing of agreements).

5. Transfers to third countries

We store the customer's data within the EU/EEA. If a sub-processor processes data outside the EU/EEA, for example OpenAI, the transfer relies on an adequacy decision, the European Commission's standard contractual clauses or another valid mechanism under Chapter V of the GDPR.

6. Liability and law

Liability follows the terms of service, including the limitation of liability, and Article 82 of the GDPR. Swedish law applies. Disputes are decided by the Gothenburg District Court.

Questions about the agreement: [email protected]