Business data processing terms

Data Processing Agreement

This DPA applies when a SaleQMS business customer uses the Complete workspace to process personal data for which that customer is the controller.

1. Parties and scope

The customer is the controller. Kai Kimmo Mikael Kiviranta, Bränningestrandsvägen 125, 151 39 Södertälje, Sweden, is the processor for personal data placed in the workspace by the customer. Processing lasts for the subscription and the retention/deletion period described in the Terms and Privacy information.

2. Instructions and purpose

SaleQMS processes workspace personal data only to provide, secure, back up, support, export and delete the Complete service in accordance with the customer's documented use of the product and this DPA, unless Union or Swedish law requires otherwise.

3. Data and data subjects

Depending on customer use, workspace data can include names, business contact details, roles, commercial observations, project information and other business-related personal data entered by authorised users. Data subjects can include the customer's personnel, prospects, customers, suppliers and other business contacts. The customer must not use SaleQMS for special-category or highly sensitive personal data unless separately agreed in writing.

4. Confidentiality and security

SaleQMS limits access to persons and providers who need it to operate the service and requires appropriate confidentiality. Measures include access controls, encrypted transport, private storage, provider-signed billing evidence, backup controls and security monitoring appropriate to the service and risk.

5. Subprocessors and international transfers

The customer authorises SaleQMS to use subprocessors reasonably necessary for hosting, email, payment/billing, backup and service security. SaleQMS remains responsible for imposing data-protection obligations appropriate to each processor relationship. Material subprocessor changes can be requested from info@saleqms.com.

Where a subprocessor processes personal data outside the EEA, SaleQMS will rely on an applicable lawful transfer mechanism and appropriate safeguards.

6. Assistance and incidents

Taking into account the nature of processing, SaleQMS will provide reasonable assistance with data-subject requests, security obligations and regulator enquiries relating to workspace processing. SaleQMS will notify the customer without undue delay after becoming aware of a personal-data breach affecting customer workspace data.

7. Return and deletion

The customer can export workspace data through the service. After paid access ends, workspace data remains readable/exportable for 90 days and is then deleted from active systems. Backup copies may remain for up to a further 90 days solely for disaster recovery, unless applicable law requires longer retention. Commercial/accounting records for which SaleQMS is independently responsible are outside workspace deletion where a separate legal basis requires retention.

8. Information and audit

SaleQMS will make information reasonably necessary to demonstrate compliance with this DPA available to the customer. Audits must be proportionate, protect other customers and security, and normally begin with documentation or remote evidence before any on-site request.

9. Priority

If this DPA conflicts with the Terms concerning processing of customer-controlled workspace personal data, this DPA prevails for that processing. The governing-law and dispute provisions in the Terms apply.