Data Processing Agreement

This Data Processing Agreement ("DPA") is between the Customer under the Allocate Terms of Service (the controller) and Joakim Svärd, sole trader, trading as Allocate (the processor, "we"). It governs our processing under Article 28 of the GDPR.

What it covers.Personal data that the Customer and its users put into their Allocate workspace, and that we process to provide Allocate to the Customer: bookings, equipment, the team list, roles and role assignments, and invitations, including sending service emails on the Customer's behalf, such as invitations and notices about team changes. The Customer decides whom to invite. The Customer also decides which roles and permissions its users have, and is responsible for informing its users and the people it invites.

Acceptance.The Customer accepts this DPA when it accepts the Terms of Service; no signature is needed. A user who is not an admin does not accept this DPA on the Customer's behalf.

What it does not cover. Personal data for which we are the controller ourselves: user accounts and sign-in, billing, support requests and our correspondence with the Customer (including any workspace data the Customer chooses to send us there), the emails we send for our own purposes (such as account and billing emails) and our security logs. Our Privacy Policy describes those.

Instructions.The Terms, this DPA and the Customer's use of Allocate's features are the Customer's complete instructions. They include an instruction to create anonymised, aggregated statistics about how Allocate is used, which identify neither the Customer, its users nor its projects, and which we may then use freely. Further instructions must be in writing and fit the service; if they cost us extra work, we may charge for it after agreeing the price with the Customer.

We will:

• 1. process the personal data only on the Customer’s documented instructions, unless EU or Swedish law requires otherwise, in which case we tell the Customer first unless the law forbids it;
• 2. tell the Customer if we believe an instruction breaks data protection law;
• 3. make sure everyone who can access the data is bound by confidentiality;
• 4. take appropriate security measures, as described in the Annex;
• 5. use sub-processors only as described in section 4;
• 6. help the Customer answer requests from data subjects, mainly through the features in Allocate (for example export and deletion), and pass on any request we receive directly;
• 7. help the Customer with security, breach notifications, data protection impact assessments and prior consultation (Articles 32–36), taking into account what we know about the processing;
• 8. at the end of the agreement, delete or return the data as described in section 8;
• 9. give the Customer the information needed to show compliance with Article 28, and allow audits as described in section 7.

The Customer's part. The Customer is responsible for having a legal basis for the personal data it puts into Allocate, for informing its own users and staff, and for the instructions it gives.

The Customer gives general permission for us to use sub-processors. We bind each of them by written contract to data protection obligations that protect the Customer's personal data at least to the level Article 28(4) of the GDPR requires, and we remain responsible to the Customer for their work as that article provides.

Current sub-processors

Stripe is not a sub-processor under this DPA: it handles only our own billing of the Customer, where we are the controller.

Changes. The list above is the current list of sub-processors. We email admins in advance, before we add or replace a sub-processor, and publish an updated version of this DPA. The Customer may object in writing before the change takes effect, on reasonable data protection grounds. If we cannot solve the concern, an admin may end the agreement by writing to support@allocate.at before the change takes effect. We then refund fees paid in advance for the time after the end date.

We store the Customer's workspace data in the EU. Our providers' own sub-processors may access it from other countries as described in their data processing terms, with the safeguards those terms provide. Email delivery through Resend in the United States, and the email with the download link under section 8 sent through Google Workspace (Google LLC, United States), are transfers outside the EU/EEA under this DPA; they rely on the EU Commission's Standard Contractual Clauses in Resend's and Google's data processing terms, and also on the EU-U.S. Data Privacy Framework while Resend and Google LLC are certified under it.

User accounts and sign-in (Firebase Authentication, which runs in the United States) are our own data as controller (section 1), even though an account holds the same name and email address as the Customer's team list. Our Privacy Policy describes them and that transfer.

We transfer the Customer's personal data outside the EU/EEA only with a safeguard under Chapter V of the GDPR. A new sub-processor is added only as described in section 4.

If we become aware of a breach affecting the Customer's personal data, we email the Customer's admins without undue delay after we become aware of it. The notice includes, as far as we know it at the time:

• what happened and when;
• the kinds and approximate number of people and records affected;
• the likely consequences;
• what we have done and propose to do to limit the harm;
• a contact for further information.

We send the rest as soon as we have it. Notifying the supervisory authority and the people affected remains the Customer's decision, and we help with what we know.

Documentation first.We meet the Customer's audit right in the first place by answering written questions within a reasonable time and by providing this DPA, the Annex, and our sub-processors' certifications and audit reports (for example Google Cloud's ISO 27001 and SOC 2 reports) where we may share them.

Inspections. If that is not enough to show compliance, or a supervisory authority requires it, or after a breach, the Customer or an independent auditor it appoints may carry out an inspection, on these terms:

• at least 30 days’ written notice, and at most once a year. A supervisory authority’s requirement, or a personal data breach that seriously affects the Customer’s personal data, allows a further inspection with at least 10 working days’ notice;
• during normal business hours, without unreasonably disturbing our work;
• the auditor is bound by confidentiality and is not a competitor of ours;
• the auditor never gets access to other customers’ data;
• the Customer pays its own costs and our reasonable time.

All data is hosted by our sub-processors, mainly Google, so an inspection is a review of documents and settings, which can be done remotely. Google's data centres cannot be visited; Google's own audit reports cover them.

When the subscription or trial ends, or when an arrangement we have agreed with the Customer ends, the workspace is locked and then deleted, as described in the Terms of Service. Where such an arrangement applies, the three periods for an ended or missing subscription (the first three rows below) start on the day it ends, not before, and the period for an ended paid subscription (90 days) applies from that day. The other rows do not depend on any arrangement:

Return. Before the deletion date, the Customer, through an admin, may ask at support@allocate.at for either deletion or a copy of all personal data we process for it: bookings, equipment (including units and categories), the team list, roles and role assignments, and invitations, as JSON or CSV. We send the copy within 30 days. A copy at the end of the agreement or when switching provider is free of charge; for other copies we may charge a reasonable fee agreed in advance, and we may handle overlapping requests together. If the request reaches us at least 2 working days before the deletion date, we do not delete the company until the copy has been sent. If an admin has scheduled the deletion of the company in Allocate, the admin must first cancel it there. Internal operational records (support notes, audit and event logs, payment records) are not included.

Deletion.Deleted data can remain in our backups for up to 35 days, in our email send queue for up to 30 days after an email is sent, in our email provider's logs for the period its terms set, and in Google's internal deletion process for up to 180 days. Backups are used only to restore the service after an error. After that we keep none of the Customer’s workspace data, unless EU or Swedish law requires it. We keep a short record of the deletion itself as our own record, for the periods set out in our Privacy Policy.

Liability.We are liable to the Customer only for damage caused by our breach of this DPA or of the obligations the GDPR places on processors. The limits on liability in the Terms of Service also apply to claims under this DPA and data protection law, to the extent the law allows. The Customer is responsible for, and covers our reasonable costs of, claims from data subjects, authorities or others to the extent they arise from the Customer's unlawful instructions, from personal data the Customer or its users put into Allocate in breach of the Terms or data protection law, or from the Customer lacking a legal basis, and not from our breach of this DPA. Nothing here limits either party's liability towards data subjects under Article 82 of the GDPR.

Term. This DPA applies for as long as we process personal data for the Customer, including after the agreement has ended until the data is deleted.

Order of precedence. On personal data, this DPA wins over the Terms of Service. If the EU Standard Contractual Clauses apply to a transfer, they win over both.

Changes.We may update this DPA when the law or our sub-processors change. Changes that do not reduce the Customer's rights or increase its obligations, such as corrections and clarifications, take effect when published; for other changes we tell admins by email in advance. Changes of sub-processors always follow section 4. Changes do not materially reduce the overall protection of the Customer's personal data.

Law. Swedish law applies, and disputes are settled as described in the Terms of Service.

Version 1.1

These are the measures in place when this version is published. We may change them, provided the overall level of security is not reduced.