Data processing agreement.

1. Parties and scope

This DPA is between Bizlution AB, a company incorporated in Sweden, which operates Jarel (Jarel), and the organisation that accepts it for its workspace (the Customer).

It forms part of the agreement under which Jarel provides the Service to the Customer (the Agreement), and it applies to personal data that Jarel processes on the Customer's behalf through the Service.

For that personal data the Customer is the controller, or a processor acting for its own clients, and Jarel is the processor, or a subprocessor. Terms such as personal data, processing, controller, processor, data subject and personal data breach have the meaning they have in the GDPR.

2. Details of the processing

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex I.

3. The Customer's instructions

Jarel processes personal data only on the Customer's documented instructions. The Agreement, this DPA, and the Customer's use of the features and settings of the Service are those instructions, unless Union or Member State law requires Jarel to process the data otherwise, in which case Jarel tells the Customer before processing, unless the law forbids it.

Jarel tells the Customer if it believes an instruction infringes data protection law.

The Customer is responsible for having a lawful basis for the personal data it puts into the Service, and for what it chooses to upload.

4. Confidentiality

Jarel makes sure that the people it authorises to process the personal data are bound by a duty of confidentiality, by contract or by law.

5. Security

Jarel takes the technical and organisational measures required by Article 32 GDPR. The measures in place at the date of this version are in Annex II. Jarel may improve them over time and will not lower the overall level of protection.

6. Subprocessors

The Customer gives Jarel general written authorisation to use the subprocessors listed in Annex III.

Jarel tells the workspace's admins by email at least 30 days before it adds or replaces a subprocessor. The Customer may object on reasonable data protection grounds within that time. If the parties cannot resolve the objection, the Customer may end the part of the Service that depends on the new subprocessor.

Jarel binds each subprocessor to data protection obligations no less protective than these, and stays responsible to the Customer for what its subprocessors do.

7. Where the data is processed

Customer data is stored in the EU. Some subprocessors in Annex III process data outside the European Economic Area, for example in the United States.

Where personal data is transferred to a country without an adequacy decision, Jarel makes sure that an appropriate safeguard under Chapter V GDPR applies, such as the subprocessor's certification under the EU-US Data Privacy Framework or the Standard Contractual Clauses.

8. Requests from data subjects

Taking into account the nature of the processing, Jarel helps the Customer answer requests from data subjects to exercise their rights. The Service includes tools to export a user's data and to delete it.

If a data subject contacts Jarel about data it processes for the Customer, Jarel passes the request on and does not answer it itself, unless the Customer asks it to.

9. Personal data breaches

Jarel tells the Customer without undue delay after it becomes aware of a personal data breach affecting the Customer's personal data. It gives the information it has when it tells the Customer and adds to it as it learns more, so the Customer can meet its own duty to notify.

Jarel is a small team. This clause sets no fixed number of hours; the incident page in the Service describes how Jarel responds today.

10. Help with the Customer's obligations

Taking into account the nature of the processing and the information available to it, Jarel helps the Customer meet its obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultation of a supervisory authority.

11. Return and deletion

When the Agreement ends, the Customer can export its data. Jarel then deletes the personal data it processes for the Customer within 90 days, unless Union or Member State law requires it to keep some of it.

12. Information and audits

Jarel gives the Customer the information needed to show that Jarel meets Article 28 GDPR, including its current security overview and a way to export and verify the workspace's audit log. The current status of Jarel's certifications is stated at jarel.se/security.

Jarel allows audits, including inspections, by the Customer or an auditor the Customer appoints, on 30 days' notice, during business hours, once a year unless a supervisory authority requires more or a personal data breach has occurred. The auditor keeps what it learns confidential and the Customer pays for the audit.

13. Liability, precedence and term

Each party's liability under this DPA is subject to the limits in the Agreement. If this DPA and the Agreement conflict on the processing of personal data, this DPA prevails.

This DPA lasts as long as Jarel processes personal data for the Customer. Governing law and jurisdiction are those of the Agreement.

14. Acceptance

An owner or admin of the Customer's workspace accepts this DPA in the Service. Jarel records the workspace, the person who accepted it, the date, the version and a fingerprint of the exact text accepted, and writes an entry to the workspace's audit log.

Customers that need changes to this standard DPA can write to privacy@jarel.se.