Data processing agreement

This data processing agreement (the "DPA") applies where the Customer is controller and nexroom ("nexroom") processes personal data on the Customer's behalf in the service. The DPA becomes binding only when incorporated into an agreement accepted by both parties. For processing where nexroom determines the purposes and means, nexroom is controller under the privacy policy.

nexroom may process personal data only on the Customer's documented instructions, these terms and applicable data-protection law. If nexroom considers that an instruction infringes data-protection law, nexroom must inform the Customer without undue delay. nexroom may process data where required by Union or Swedish law, but must inform the Customer in advance unless the law prohibits that information.

Authorised personnel and subprocessors are bound by confidentiality. nexroom must maintain risk-appropriate technical and organisational measures, including identity and session controls, server-side authorisation, tenant isolation, restricted administrative privileges, protection in transit, logging, backups and secure development. The current verified security overview forms the security schedule.

Taking into account the nature of the processing and information available, nexroom must assist the Customer with data-subject rights, security, personal-data breaches, impact assessments and prior consultations. nexroom must notify the Customer without undue delay after becoming aware of a personal-data breach concerning Customer data and provide available information as the investigation progresses.

nexroom has general prior authorisation to use the subprocessors listed in the published list. nexroom must impose data-protection terms providing at least equivalent protection and remains responsible for their Article 28 obligations. The Customer must be notified of intended additions or replacements within the notice period stated in the master agreement and may object on documented data-protection grounds.

Personal data must not be made available outside the EU/EEA without the Customer's documented instruction and a valid transfer mechanism. Current providers, regions and safeguards are stated in the subprocessor list.

At the end of the agreement, nexroom must, at the Customer's choice, delete or return the personal data and delete existing copies unless law requires continued storage. Data in backups is deleted through the ordinary rotation cycle and may meanwhile be used only for recovery and security. A documented legal hold prevails to the extent required by law.

On request, nexroom must provide information reasonably required to demonstrate compliance and permit an audit no more than once per year, and more often following an incident or authority requirement. An audit must be conducted on reasonable notice, under confidentiality, with minimum disruption and without access to other customers' data. The Customer bears its audit costs and nexroom's reasonable additional costs unless the audit identifies a material breach. Contact the contact form at nexroom.app/kontakta-oss to incorporate the DPA into the Customer's agreement.