Data protection
Data processing agreement for LöneFai
Annex 2 – Data processing agreement
The agreement is annex 2 to the customer agreement and describes how Tizfai Technologies AB processes personal data on the customer's behalf under Article 28 of the GDPR. It is signed with BankID together with the customer agreement.
The text is the same as the agreement's annex. The customer agreement you have signed takes precedence over this page.
1. Parties and roles
The customer is the controller and Tizfai Technologies AB (the Supplier) the processor of the processing that takes place when the Supplier provides LöneFai under the customer agreement. When the customer is an accounting firm that is itself a processor for its client companies, the Supplier is the firm's sub-processor, and the firm is responsible for its mandate allowing it. This agreement meets the requirements of Article 28 of the General Data Protection Regulation (GDPR).
2. Subject, nature and purpose
Storing and processing data for staff administration, payroll, payslips and the employees' approval, bookkeeping, payouts, employer declarations, messages, agreements and support, for as long as the customer agreement applies.
3. Data subjects and personal data
The data subjects are the staff and former staff of the customer (and for an accounting firm, of its client companies), users and contacts, and next of kin the staff give. The personal data are identity and contact details (name, personal identity or coordination number, email, phone, address), employment and pay details (terms, salary, tax, bank account, absence, benefits, deductions and garnishment), payslips with the employees' approvals and BankID signatures, documents and messages, and technical logs. Details of sick leave may be health data; the customer is responsible for there being a legal basis for processing them.
4. Instructions
The Supplier processes the personal data only on the customer's documented instructions: this agreement, the customer agreement and the settings the customer makes in the service. If the Supplier considers an instruction to infringe data protection rules, it informs the customer without delay.
5. Security and confidentiality
The Supplier takes appropriate technical and organisational measures under Article 32 GDPR, among them encrypted transfer, encryption of personal identity numbers, bank accounts, payslips and files, access control, logging, backups and ongoing security updates. Anyone processing the personal data for the Supplier is bound by confidentiality.
6. Sub-processors
The customer gives a general prior authorisation for the Supplier to engage sub-processors. The Supplier makes written agreements with sub-processors with equivalent obligations and informs the customer at least 30 days before engaging a new sub-processor; the customer may object on reasonable grounds. Sub-processors when the agreement is made:
| Sub-processor | Task | Location |
|---|---|---|
| Hetzner Online GmbH | Server operation, storage and backups | Germany (EU) |
| OpenAI Ireland Ltd | Reading pay basis the customer uploads as a PDF or picture, when its text cannot be read otherwise; nothing is kept at OpenAI | EU, with transfer under section 7 |
| Google Ireland Ltd (Firebase Cloud Messaging) | Push notifications to the mobile app | EU, with transfer under section 7 |
| Apple Distribution International Ltd (Apple Push Notification service) | Push notifications to iPhones | EU, with transfer under section 7 |
Email is sent from the Supplier's own mail server and SMS through the Supplier's SMS service. Integrations the customer turns on itself, such as the Tax Agency, Fortnox and banks, mean that data is given to the recipient on the customer's instruction; the recipient is then not a sub-processor of the Supplier. BankID is provided by Finansiell ID-Teknik BID AB.
7. Transfers to third countries
The personal data is stored within the EU/EEA. If a sub-processor transfers data outside the EU/EEA, it is done only under Chapter V GDPR, such as the European Commission's adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.
8. Assistance and data subjects' rights
The Supplier assists the customer, through the service's functions and otherwise to a reasonable extent, in answering requests from data subjects and in meeting the obligations of Articles 32–36 GDPR.
9. Personal data breaches
The Supplier notifies the customer without undue delay, within 48 hours where possible, after becoming aware of a personal data breach, with the information the customer needs to report it to the Swedish Authority for Privacy Protection (IMY).
10. Audits
The Supplier gives the customer the information needed to show that the obligations of this agreement are met and allows audits on written request with reasonable notice. Each party bears its own costs.
11. Deletion and return
When the customer agreement ends, the customer can export its data for 30 days. The Supplier then deletes the customer's personal data within 90 days, and it leaves the backups as they rotate, except data the Supplier must keep by law, such as accounting records.
12. Liability and term
Each party is liable for damage under Article 82 GDPR. The limitation of liability in Annex 1 applies between the parties to the extent mandatory law allows. This agreement applies as long as the Supplier processes personal data on the customer's behalf.