Data processing agreement

Parties and roles

The customer (a consultant with their own account or a staffing agency) is the controller of the personal data the customer enters or has collected in TidFai. Tizfai Technologies AB, reg. no. 559284-7379, is the processor and processes it only on the customer's behalf.

Purpose, nature and duration

The processing provides TidFai: schedules, stamping, time reports, BankID signing, invoices, payroll, employer declarations, bank files, notifications and support. It lasts as long as the agreement and thereafter as described under deletion.

Data subjects and personal data

The processing concerns consultants, the customer's users and contacts at clients and staffing agencies.

• Name, personal identity number, email, mobile number and profession.
• Schedules, stamped times, disturbances, time reports and signature evidence from BankID.
• Invoices, payments, payslips, tax and bank details.
• Sign-in and event logs.
• The customer should not enter sensitive data, for example about health, in free-text fields.

Instructions and confidentiality

The processor processes the personal data under the agreement and the customer's documented instructions, as expressed in how the customer uses the service. Those processing the data at the processor are bound by confidentiality. The processor tells the customer if an instruction in its view breaks data protection rules.

Security

The processor takes technical and organisational measures under Article 32: servers within the EU, encryption of personal identity numbers, mobile numbers, account numbers, tax details, attachments and salary amounts, access control per company and role, encrypted traffic, logging, backups and regular updates.

Sub-processors

The customer accepts that the processor uses the following sub-processors. The processor announces changes at least 30 days in advance; the customer may object and end the agreement if the change cannot be accepted.

• Hetzner Online GmbH, Germany: servers and storage.
• Tizfai Identity (Tizfai Technologies AB): BankID signing, which in turn uses BankID (Finansiell ID-Teknik BID AB).
• Tizfai Technologies AB's SMS and email service: one-time codes and notifications.
• Apple and Google: notifications to the mobile app, without personal identity numbers, amounts or free text.
• Stripe Payments Europe Ltd, Ireland: payments for consultants' subscriptions. Stripe is an independent controller of the payment data.

Transfers to third countries

Personal data is processed within the EU/EEA. Notifications to the mobile app may pass Apple's and Google's services outside the EU; they contain only a short text and are protected by the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.

Assistance and personal data breaches

The processor helps the customer answer data subjects' requests for access, rectification and erasure, and with impact assessments when needed. A personal data breach is reported to the customer without undue delay and at the latest 36 hours after the processor became aware of it, with the information the customer needs for its notification.

Deletion and return

When the agreement ends, the customer can export its data for 90 days. After that it is deleted, except records the customer must keep by law, for example signed time reports and invoices under the Swedish Bookkeeping Act, which the processor archives on the customer's behalf for as long as the law requires unless the customer asks otherwise.

Audit and liability

The processor provides the information the customer needs to show that the agreement is followed and takes part in reasonable audits upon written request with 30 days' notice. Liability between the parties follows the terms of service and Article 82 of the GDPR. The agreement applies as long as the processor processes personal data on the customer's behalf.