Skip to content
NodeCE
Language:EN
Sign in
Menu

Data processing agreement

This agreement applies when we process personal data on your behalf in NodeCE.

1. Parties and scope

This agreement applies between NodeiWest AB, org.nr 559169-4210 (the processor), and the customer that has an agreement about NodeCE with us (the controller). It forms part of the customer agreement and applies once the customer has accepted the order form. Notices under this agreement are sent as section 1 of the Terms of Service states.

The agreement covers the processing we carry out on the customer’s behalf:

  • operation of NodeCE as a cloud service;
  • email that NodeCE sends for the customer via us, for example sign-in codes and invitations;
  • support, including error reports that users send from NodeCE Desktop, for the cloud service and for self-hosting;
  • data in our central service about support access and collaboration between organisations, for example the names of those who started, approved or ended them.

2. The processing

We process the personal data to deliver, operate and support NodeCE under the customer agreement.

The data concerns the customer’s users and members and the people who appear in the customer’s documentation. This includes names, email addresses, roles and sign-in details, IP addresses, browser and device data and installations of NodeCE Desktop, work tasks and signatures, logs of what users have done, what the customer itself enters into NodeCE, and what users send with an error report, for example logs, screenshots and files. The customer must not enter sensitive personal data into NodeCE.

The processing continues for as long as the customer agreement applies and then until the data has been returned or deleted under section 10.

3. Instructions

We process the personal data only according to the customer’s documented instructions, including for transfers to countries outside the EU/EEA. The customer agreement, this agreement and the customer’s settings in NodeCE are the customer’s instructions. If EU law or Swedish law requires us to process the data in some other way, we inform the customer before processing starts, unless the law prohibits it on important grounds of public interest. If we consider an instruction to infringe data protection rules, we inform the customer immediately.

The customer is responsible for ensuring that the instructions and the personal data the customer enters into NodeCE comply with data protection rules.

4. Confidentiality

Everyone who processes personal data with us, employees and consultants alike, is bound by a duty of confidentiality through agreement or law. The duty of confidentiality continues after the agreement has ended.

5. Security

We take the technical and organisational measures required under Article 32 of the GDPR. The measures are described at nodece.se/trust. We may change the measures, but not in a way that lowers the overall level of protection.

6. Support

Our operations staff access the cloud service’s database only when operation or support requires it.

7. Sub-processors

The customer gives us a general prior authorisation to engage sub-processors. We engage only sub-processors that provide sufficient guarantees under Article 28(1) of the GDPR and that process the data within the EU/EEA or using an approved transfer mechanism. The sub-processors we use are listed at nodece.se/subprocessors, with where they process the data, what they do and which sub-processors they themselves engage.

We email the customer’s contact person for the agreement at least 30 days before a new sub-processor starts processing the data. The customer may object in writing within those 30 days; if the customer does not object, the customer has approved the sub-processor. If we cannot resolve the objection, the customer may terminate the part of the customer agreement affected, and we repay what the customer has paid in advance for the period after termination.

We enter into a data processing agreement with each sub-processor under Article 28(4) of the GDPR, and we are liable to the customer for the sub-processor’s processing. If a sub-processor’s agreement gives shorter deadlines than this agreement, that is stated on the sub-processor list. If a sub-processor changes its own sub-processors with less than 30 days’ notice, we inform the customer when we learn of it. The customer may then object until the change takes effect, with the same right to terminate as above.

8. Transfers outside the EU/EEA

We transfer personal data to countries outside the EU/EEA only where an approved transfer mechanism under Chapter V of the GDPR exists. The cloud service’s data is stored within the EU, except for email and error reports.

Email from NodeCE and error reports from NodeCE Desktop are sent via Resend, a US company. Resend stores them in the USA, including the recipient’s address and name, the message with attachments and delivery logs, for as long as stated at nodece.se/subprocessors. The transfer is covered by the European Commission’s decision on the EU-US Data Privacy Framework, under which Resend is certified. If Resend is no longer certified, the transfer is covered by the European Commission’s standard contractual clauses (module three). Resend also uses data about how the service is used, including the sender’s and recipient’s addresses and logs, for its own purposes: to provide and improve the service, to prevent fraud and misuse, to verify identity and to run its business. Resend does this as an independent controller, and the customer names Resend as a recipient in its own information to data subjects. A customer that self-hosts may send email through its own email server, but error reports always go via Resend.

9. Assistance to the customer

We assist the customer, as far as possible given how the processing is carried out, to:

  • respond to requests from data subjects, for example for erasure or access to records;
  • meet the requirements for security;
  • report personal data breaches to the supervisory authority and inform data subjects;
  • carry out data protection impact assessments and prior consultations.

The customer is itself responsible for reporting and for informing data subjects.

If we discover a personal data breach, we notify the customer’s security contact without undue delay. The notice describes, as far as we know:

  • what has happened;
  • which categories of persons and data are affected, and approximately how many;
  • the likely consequences of the incident;
  • what we have done;
  • who at our end the customer can contact.

We provide information we do not yet have as soon as we have it.

10. When the agreement ends

When the customer agreement ends, the customer retrieves its data and we delete it under section 9 of the Terms of Service. Our backup copies of it are deleted 30 days later. Error reports and support cases are deleted within 90 days after the customer agreement has ended. Resend deletes its copies under its own terms, which are listed at nodece.se/subprocessors.

If the customer deletes a person in NodeCE, that person’s name remains on records that the law requires the customer to keep, for example signed minutes.

11. Audit

We provide the customer with all the information needed to demonstrate that we comply with Article 28 of the GDPR, and we take part in audits, including inspections, carried out by the customer or an auditor the customer engages.

  • The customer gives written notice of an audit at least 30 days in advance and states what it is to cover.
  • An audit is carried out at most once every twelve months, during office hours. With Resend, audits follow Resend’s terms, at most once per calendar year.
  • Following a personal data breach affecting the customer’s data, or when a supervisory authority requests it, the customer may audit more often and with shorter notice.
  • We first respond with documentation: our description of security, our procedures, extracts from the organisation’s history and our record of processing activities. If that is not sufficient, the customer chooses how the audit is carried out.
  • The auditor is bound by confidentiality and may not develop or sell software for machinery safety, CE marking or chemical management. An audit does not give access to other customers’ data.
  • Each party bears its own costs.

12. Liability and disputes

This agreement does not affect data subjects’ right to compensation under Article 82 of the GDPR. Each party pays its own administrative fines. Between the parties, the limitation of liability in section 10 of the Terms of Service applies, including when one party claims recourse from the other for its share of compensation to a data subject. Swedish law applies, and disputes are resolved as section 14 of the Terms of Service states.