Data processing agreement

1. Parties and conclusion of the agreement

This agreement is entered into between the company or other legal entity on whose behalf an organisation has been created in the service (the “Customer”), as controller, and Addable Labs AB, registration number 559602-2615, VAT number SE559602261501, with its registered office in Eslöv (“we” or “us”), as processor.

The agreement is accepted by the person who creates the organisation. A new version of it may be accepted by the organisation's owner in the service; otherwise section 15 applies. Whoever accepts thereby warrants that they are authorised to enter into agreements in the Customer's name. Under Article 28(9) GDPR the agreement must be in writing, which includes electronic form. The acceptance, the version accepted and the date are recorded and will be provided on request; requests should be sent to support@fluentor.se.

This agreement forms part of the agreement between the Customer and us under the terms of service. In the event of any conflict between the terms of service and this agreement as regards the processing of personal data, this agreement prevails.

Notices to the Customer under this agreement are sent by email to the address registered for the organisation's owner. Notices to us are sent to support@fluentor.se.

2. Controller and processor

A member's assessment is created in the member's account in the organisation and is not available to the Customer until the member submits it; until then we are responsible for it towards the member. When the member submits the assessment to the organisation, the Customer is the controller for the processing carried out on the Customer's behalf — making the assessment available to the managers above the member and to the owner, as defined in the terms of service, unless the Customer has chosen there that nobody sees results, including it in aggregate results, comparing it with target levels and reporting, through the service's API, aggregate results and whether the member has submitted an assessment, but never the member's individual answers or levels — and for the data the Customer itself enters, such as who is invited, each person's role and team, reporting lines and target levels. We carry out that processing as the Customer's processor.

We are independently the controller for each user's sign-in, display name and times of signing in, for the user's private account and for assessments the user has not submitted to the organisation, since that relationship exists directly between us and the user, whether or not the user belongs to the Customer's organisation. That processing is governed by the privacy policy and not by this agreement. A member may also have accounts in other organisations; the Customer has no access to them or to the member's private account.

The Customer is responsible for having a legal basis for the processing, for informing the data subjects in accordance with Articles 13 and 14 GDPR, and for ensuring that its instructions comply with the GDPR.

3. Subject matter, duration, nature and purpose

Subject matter: the provision of the nivå service to the Customer.

Duration: for as long as the Customer's organisation exists in the service, and for the periods thereafter set out in section 11.

Nature and purpose: collecting self-assessment answers from the Customer's members, storing them, computing individual and aggregate results, and displaying the results in accordance with the visibility rules in the terms of service and the settings the Customer chooses, including making them available through the service's API to systems the Customer authorises.

4. Types of personal data and categories of data subjects

Categories of data subjects: the Customer's employees, contractors and other persons the Customer invites to the organisation.

• Identity and organisational data: email address and display name as shown within the organisation, team, role in the organisation, reporting line, dates of joining and leaving, and the email addresses of people invited.
• Assessment data: the level from 1 to 5 selected in each area, the version of the maturity model and the role the answers relate to, the date of completion, and whether and when the assessment was submitted to the organisation.
• Data shown to the managers above the member and to the owner, unless the Customer has chosen that nobody sees results: next steps chosen from a submitted result, and areas marked as blocked, with the reason given.
• Derived data: individual and aggregate maturity indices, trends over time and gaps to target level.

5. No special categories of personal data

The service is not intended for the processing of special categories of personal data under Article 9 GDPR — such as data concerning health, racial or ethnic origin, trade union membership, beliefs, sexual orientation or biometric data — or of personal data relating to criminal offences under Article 10. All wording in the assessment is supplied by us and cannot be modified by the Customer, and no question in the service asks for such data. Free-text fields in the service, such as notes and reasons, are not intended for such data. The Customer is responsible for any data it causes to be collected by other means.

6. Processing only on the Customer's instructions

We process the personal data only on the Customer's documented instructions, including with regard to transfers to a third country. This agreement, the terms of service and the Customer's choice of settings in the service constitute the Customer's instructions. We do not process the personal data on any other basis unless required to do so by Union or Member State law to which we are subject; in that case we inform the Customer of that legal requirement before processing, unless that law prohibits such information.

The Customer instructs us to delete the personal data about a member that we process on the Customer's behalf when the member's sign-in, with all the member's accounts, is deleted, whether at the member's request or ours.

If we consider that an instruction infringes the GDPR or other data protection law, we will inform the Customer immediately.

7. Confidentiality

We ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to the personal data is restricted to persons who need it to operate the service or provide support. Access to the administrative tools is limited to named staff through an allow-list and may be withdrawn at any time.

8. Security

We implement appropriate technical and organisational measures under Article 32 GDPR. In particular: access to data is governed by row-level access rules in the database, designed so that a fault in the application cannot make one organisation's data available to another; submitted assessments cannot be altered, which is enforced in the database; data is encrypted in transit and at rest; sign-in is by one-time link sent by email and no passwords are stored; and averages are shown only to the organisation's owner and to managers, never to other members, and to nobody where the Customer has chosen that nobody sees results. Averages that include people outside a manager's own teams are shown only as snapshots that update only once at least three such people have changed their answers.

An average over few people can reveal one person's level to someone who does not otherwise see that person's results, directly or by following averages over time; the risk is described in our impact assessment. The database is backed up daily by our hosting provider and a backup is kept for seven days; personal data that has been deleted may therefore remain in a backup for up to seven days. We do not undertake that the personal data can be restored to a particular point in time.

The measures are described in more detail in our record of processing activities, which we make available on request.

9. Sub-processors

The Customer gives general prior written authorisation for us to engage sub-processors. The sub-processors engaged are listed in the privacy policy, with what each does, where it processes data and on which basis any transfer outside the EU/EEA takes place. Each sub-processor is bound by contract with us to data protection obligations meeting the requirements of Article 28 GDPR, and we remain fully liable to the Customer for the performance of each sub-processor's obligations.

We will inform the Customer by email to the organisation's owner at least 14 days before a new sub-processor, whether added or replacing another, begins processing the Customer's personal data, or an existing sub-processor begins transferring it outside the EU/EEA, stating what the sub-processor does, where it processes the data and on which basis any transfer takes place. Within that period the Customer may object on reasonable data protection grounds by writing to support@fluentor.se. If the objection cannot be resolved, the Customer may terminate the agreement as regards the affected processing, without charge and without re-pricing under the terms of service. When one of our sub-processors notifies us of a change to its own sub-processors, we pass the notice on to the organisation's owner without delay; where the sub-processor gives us less than 14 days, the Customer is notified on the day we are.

10. Assistance to the Customer

Taking into account the nature of the processing, we assist the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling its obligation to respond to requests for exercising the data subjects' rights. A member can at any time download their own data.

We also assist the Customer in ensuring compliance with the obligations under Articles 32 to 36 GDPR — security, notification of personal data breaches, data protection impact assessments and prior consultation — taking into account the nature of the processing and the information available to us. Our own impact assessment is available on request.

If we become aware of a personal data breach affecting personal data we process on the Customer's behalf, we will notify the organisation's owner by email without undue delay and, where feasible, within 48 hours of becoming aware of it, with the information set out in Article 33(3) GDPR to the extent available, and supplement the notification as further information becomes available. Decisions on notifying the supervisory authority and informing the data subjects are taken by the Customer as controller.

11. Deletion and return

When the provision of the service ends, we delete or return, at the Customer's choice, the personal data we process on the Customer's behalf. Each member can at any time download their own data. Return of the organisation's data as a whole takes place on request, in a machine-readable format, within 30 days.

Removal of an organisation is carried out by us on the written request of the organisation's owner, so that the request and its execution are documented. We carry out the removal within 30 days of the request and thereby delete the organisation's data — member list, teams, role assignments, target levels, settings, invitations and aggregate results — except to the extent that Union or Member State law requires storage. The accounting records we retain under the Swedish Bookkeeping Act (1999:1078) concern the Customer and contain no data about the Customer's members.

When the organisation is removed, all processing on the Customer's behalf ends, and the Customer no longer has access to the members' assessments. The Customer instructs us that, when the organisation is removed, members' assessments are not deleted but remain with each member, in the member's private account, no longer connected to the organisation, and that no copy is kept for the Customer. We thereafter process them as controller in relation to the member in accordance with the privacy policy. When a member's sign-in is deleted, the member's assessments are deleted with it.

12. Information and audits

We make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR, and allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer. In the first instance we respond to a request with our record of processing activities, our impact assessment and our written procedures. An on-site audit may be requested once in any twelve-month period, on 30 days' notice and at the Customer's expense, and must not compromise the confidentiality or security of other customers' data.

13. Transfers to third countries

Personal data is transferred to or accessed from countries outside the EU/EEA only by the sub-processors listed in the privacy policy, to the extent stated there and on the basis stated there for each of them: an adequacy decision of the European Commission (Article 45 GDPR) or the standard contractual clauses adopted by the Commission in Decision (EU) 2021/914 (Article 46(2)(c) GDPR). A copy of the safeguards is available on request. A new transfer is notified under section 9.

14. Restrictions on the use of results

This section is a restriction on the Customer as controller. A result in the service is a self-assessment: a person's own account of how they work, given for the purpose of their development. It is not a measure of performance and not evidence of competence.

The Customer may not use results, individually or in aggregate, as a basis for decisions concerning a person's employment, such as recruitment, promotion, pay, performance rating, disciplinary measures or termination. The Customer may not present participation as compulsory where it has informed the persons concerned that participation is voluntary. If the Customer processes results for purposes of its own beyond the service, it does so on its own responsibility as controller and must have its own legal basis and inform the data subjects.

15. Term, amendments and liability

This agreement takes effect when it is accepted and remains in force for as long as we process personal data on the Customer's behalf. Provisions which by their nature are intended to survive the termination of the agreement continue to apply.

We may amend this agreement where the law or the service changes. A new version applies from the day it is published here to a Customer that accepts this agreement after that day. For an existing Customer, a material amendment takes effect no earlier than 30 days after we have notified the organisation's owner by email, unless the owner accepts the new version on the Customer's behalf in the service before that date; until then the previous version continues to apply. If the Customer does not accept an amendment, it may terminate the agreement with effect from the date on which the amendment takes effect for it, without re-pricing under the terms of service. Corrections and clarifications that do not change the parties' rights or obligations, amendments solely in the Customer's favour, and amendments required by law may take effect on publication here. A change of sub-processor, including where it processes data and on which basis it transfers data, is notified under section 9 and is not an amendment under this section.

Liability is governed by the terms of service. Nothing in this agreement limits either party's liability towards a data subject or a supervisory authority under the GDPR.