Data processing agreement

1.1 The controller is the customer, that is the business or association that has an agreement with Qonnecta ("you").

1.2 The processor is Albin Lindén, sole trader, trading as Qonnecta ("Qonnecta", "we").

1.3 Words such as "personal data", "processing", "personal data breach" and "data subject" have the same meaning as in the General Data Protection Regulation (EU) 2016/679 ("GDPR").

1.4 This agreement covers the personal data we process on your behalf when we deliver Qonnecta. It does not cover data for which we are the controller ourselves, such as data about your employees as users of Qonnecta Admin for our own invoicing and support. That is described in our privacy policy.

The purpose, types of data, categories of data subjects and nature of the processing are in Annex 1. Processing continues for as long as the customer agreement is in force and then until the data is deleted or returned under section 11.

3.1 We process the personal data only on your documented instructions. The instructions are this agreement, the customer terms and the settings and choices you make in Qonnecta Admin (for example which data the booking page asks for, which messages are sent, and whether the AI assistant, e-signing, locks or automatic anonymisation are used). The instructions also include that we may send service messages in Qonnecta's name to your customers about outages, faults, security issues and changes that affect their bookings. These messages are factual, never marketing, and go only to the contact details on the booking. We tell you when we have sent such a message.

3.2 If the law requires us to process the data in another way, we tell you beforehand, unless the law forbids it.

3.3 If we believe an instruction breaks the GDPR or other data protection law, we tell you at once. We do not have to follow the instruction until you have confirmed or changed it.

3.4 You are responsible for there being a legal basis for the processing, for your customers receiving information under Articles 13 and 14, and for your instructions being lawful.

Everyone who works for us and has access to the personal data is bound by confidentiality, by contract or by law, and may process the data only to deliver the service. We give access only to the people who need it.

We take the technical and organisational measures required by Article 32. The measures are listed in Annex 2. We may improve them, but not lower the overall level of protection.

6.1 You give us a general written authorisation to engage sub-processors. The sub-processors at the start of the agreement are listed in Annex 3.

6.2 Before we add or replace a sub-processor, we notify you by e-mail at least 30 days in advance. If you have reasonable grounds to object, for example that the sub-processor does not provide sufficient guarantees, you must tell us within that time. If we cannot resolve it together, you may terminate the affected parts of the service, or the whole agreement, at no cost.

6.3 We enter into written agreements with each sub-processor with the same data protection obligations as in this agreement. We are responsible to you for the sub-processors meeting their obligations.

We transfer personal data to a country outside the EU/EEA only if Chapter V of the GDPR allows it, for example an adequacy decision (such as the EU–US Data Privacy Framework for certified recipients) or the European Commission's standard contractual clauses, with supplementary measures where needed. Annex 3 shows where each sub-processor processes the data and which basis is used.

8.1 Qonnecta Admin has features that help you answer requests from your customers: you can view, correct and anonymise customer data and set inactive accounts to be anonymised automatically, and your customers can delete their own accounts.

8.2 Your customers may contact us about technical problems with the booking page, the payment, the locks and the app, and we answer them. Questions about the rental itself, such as price, damage, terms and refund decisions, we refer to you. We tell you when we have been in contact with your customers.

8.3 If a data subject asks to access, correct or erase data for which you are responsible, we pass the request on to you without undue delay and do not answer it on the merits ourselves, unless you ask us to. If you need more help, for example an export of one customer's data, we help you.

9.1 We notify you without undue delay, and no later than 36 hours, after becoming aware of a personal data breach affecting your data, so that you have time to notify the Swedish Authority for Privacy Protection (IMY) within 72 hours under Article 33.

9.2 The notification contains, as far as possible: what has happened, the types and approximate number of data subjects and records concerned, the likely consequences, what we have done and propose, and a contact person. Information we do not have at once we provide as soon as we have it.

9.3 You are responsible for notifying IMY and informing the data subjects when required. We help you with the information we have.

Taking into account the nature of the processing and the information available to us, we help you meet your obligations under Articles 32–36: security, breaches, impact assessments and prior consultation with IMY. Extensive help beyond the usual may be charged as agreed.

11.1 When the customer agreement ends, you may request your data within 30 days, see section 11 of the customer terms.

11.2 After that we delete the personal data within 90 days, unless the law requires us to keep it. Data in backups is deleted when the backups are overwritten on our normal schedule (Annex 2). Until then it is protected under this agreement and not used.

11.3 On request we confirm in writing that the data has been deleted.

12.1 We give you the information needed to show that we comply with Article 28 and this agreement, primarily through written answers and documentation.

12.2 If that is not enough, you, or an independent auditor bound by confidentiality whom you appoint, may carry out an audit once a year, with at least 30 days' notice, during office hours and without disrupting operations or other customers' security. You bear your own costs. Audits of sub-processors are done through their own reports and certifications.

12.3 In case of a personal data breach, or if a supervisory authority requires it, an audit may be carried out at shorter notice.

13.1 Compensation to data subjects is governed by Article 82 GDPR.

13.2 Otherwise, the limitation of liability in the customer terms (section 13) also applies to this agreement. It does not apply if a party has breached the agreement through intent or gross negligence.

13.3 Administrative fines imposed by a supervisory authority are paid by the party they are imposed on.

14.1 This agreement applies for as long as we process personal data on your behalf.

14.2 If this agreement and the customer terms say different things about personal data, this agreement applies.

14.3 Changes are made in the same way as changes to the customer terms (section 14). Changes required by law or by a decision of an authority may be made immediately.

14.4 Swedish law applies. Disputes are resolved under the customer terms.

• Encryption: all traffic is encrypted with HTTPS/TLS. Passwords are stored hashed. One-time codes for igloohome locks are stored encrypted. IP addresses in the change log are stored as hash values.
• Access: login with individual accounts and roles. Your customers see only their own data. Access to servers and the database is limited to the people who run the service.
• Traceability: a change log of who changed what and when.
• Operations: servers and database at DigitalOcean. The database is backed up daily and can be restored to a point in time. Service status is monitored and published at qonnecta.betteruptime.com. Technical error reports are sent without the IP address.
• Development: changes are tested before release. Personal data from production is not used for testing; the test environment has made-up data.
• The AI assistant: changes in Qonnecta Admin are made only once you have approved them, or under rules you have set yourself for automatic approval. The assistant never makes refunds or card charges.
• Data minimisation: automatic anonymisation of inactive customer accounts (if you switch it on) and automatic deletion of AI conversations after the set time.

The AI provider may not use the data to train its models.

Services you engage yourself. Stripe (card, Apple Pay, Google Pay and Klarna) and Swish in Sweden are connected to your own account and your own agreement with Stripe or your bank. Stripe and the banks are generally controllers of the payment data themselves, and they are not our sub-processors. We send the payment requests for you and store references and amounts, never card details. The same goes for the connection to ChatGPT or Claude: what the assistant reads there is sent to OpenAI or Anthropic under your own account with them.