Data processing agreement

This is an English translation. In case of any discrepancy, the Swedish version prevails.

The definitions in the terms of service also apply to this data processing agreement (“the DPA”). In addition:

• Controller – the party that alone or jointly with others determines the purposes and means of the processing of personal data, here the Customer.
• Processor – the party that processes personal data on behalf of the controller, here AltitudeHR (“the Processor”).
• Processing – any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, storage, adaptation, alteration, use, disclosure, combination, restriction, erasure or destruction.
• Personal data – any information relating to an identified or identifiable living natural person.
• Personal data breach – a breach of security leading to the accidental or unlawful destruction, loss or alteration of, or unauthorised disclosure of or access to, personal data.
• Sub-processor – another processor engaged by the Processor to carry out processing on behalf of the Customer.
• GDPR – Regulation (EU) 2016/679 and supplementary Swedish legislation.

This DPA is entered into to meet the requirements of Article 28 of the GDPR and supplements the parties' agreement on the AltitudeHR service (“the Main Agreement”).

The Main Agreement sets out what the Processor shall do on behalf of the Customer. The Processor processes personal data only to the extent necessary to perform the Main Agreement and in accordance with the Customer's documented instructions, as set out in the Main Agreement, this DPA and the settings the Customer makes in the service. If the Processor considers that an instruction infringes the GDPR, it shall inform the Customer immediately.

The Processor shall implement appropriate technical and organisational measures to protect the personal data processed. The measures shall ensure a level of security at least in line with applicable law and appropriate with regard to:

• the state of the art,
• the costs of implementation,
• the specific risks of the processing, and
• the sensitivity of the personal data.

Particular regard shall be given to the risk of accidental or unlawful destruction, loss or alteration and of unauthorised disclosure of or access to the personal data. The Processor's measures include:

• encryption of personal data in transit and at rest,
• logical separation of each customer's data at every layer of the service,
• least-privilege access control, including support for two-factor authentication,
• logging of access and changes in a tamper-protected log,
• regular backups and tested restoration,
• secure development with code review, vulnerability scanning and recurring security testing.

The Processor shall ensure that employees, consultants and others processing personal data on its behalf are bound by appropriate confidentiality, only have access to the personal data to the extent required for their tasks, and are informed of how the personal data may be processed in accordance with the Customer's instructions.

The Processor shall notify the Customer without undue delay after becoming aware of a personal data breach. The notification shall, to the extent available, describe the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed.

The Processor shall assist the Customer in meeting its obligation to notify the Swedish Authority for Privacy Protection (IMY) within 72 hours and, where applicable, to inform the data subjects.

The Processor shall assist the Customer through appropriate technical and organisational measures in fulfilling its obligations when data subjects exercise their rights under Chapter III of the GDPR, such as access, rectification and erasure. Requests received directly from data subjects are forwarded to the Customer.

Taking into account the nature of the processing and the information available to it, the Processor shall also assist the Customer with data protection impact assessments and prior consultation with the supervisory authority.

The Customer may, itself or through an independent third party bound by confidentiality, audit the Processor's compliance with this DPA. Audits shall be announced at least thirty (30) days in advance, carried out during normal business hours and without unnecessarily disrupting the Processor's operations. The Processor shall provide the assistance and information necessary to demonstrate compliance with Article 28.

If data subjects, IMY or another third party request information about the processing, the parties shall cooperate and exchange the necessary information. Neither party may disclose personal data or information about the processing without the other party's consent, except where required by mandatory law or a decision of an authority.

By this DPA the Customer gives general prior authorisation for the Processor to engage sub-processors. The Processor shall enter into written agreements with each sub-processor imposing the same obligations as those in this DPA, and remains liable to the Customer for the sub-processor's processing as for its own.

On request, the Processor shall provide an up-to-date list of sub-processors, the processing they perform and their geographical location, as well as copies of the parts of the sub-processor agreements needed to demonstrate compliance.

The Processor shall inform the Customer at least thirty (30) days before engaging a new sub-processor or replacing an existing one. The Customer may object on reasonable grounds. If the parties cannot agree, the Customer may terminate the Main Agreement with effect from the day the change takes effect.

Personal data is stored and processed within the EU/EEA. Transfers outside the EU/EEA may only take place with the Customer's written approval and where there is a basis under Chapter V of the GDPR, such as an adequacy decision or the European Commission's standard contractual clauses with the necessary supplementary measures.

The Processor shall indemnify the Customer for damage, administrative fines or other costs attributable to the Processor processing personal data in breach of the GDPR, the Customer's instructions or this DPA. The limitations of liability in the Main Agreement apply, to the extent mandatory law does not provide otherwise.

When the Main Agreement ends, the Processor shall, at the Customer's choice, return all personal data in a common machine-readable format and then delete it, or delete it directly. Deletion shall take place no later than thirty (30) days after the end of the agreement, on all media where the data is stored, unless the law requires continued storage. Data in backups is overwritten according to the Processor's ordinary routines and is not otherwise processed in the meantime.

This DPA applies for as long as the Processor processes personal data on behalf of the Customer.

• Sensitive personal data, such as sick leave, shall only be accessible to Users the Customer has specifically authorised.
• AI features may only process personal data within the permissions of the logged-in User. Personal data may not be used to train AI models provided by third parties.
• The Processor may only access the Customer's data when needed for support, troubleshooting or operations, and such access is logged.

This DPA is governed by Swedish law. Disputes are resolved in accordance with the dispute resolution clause of the Main Agreement.