Data Processing Agreement

gnice Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the gnice Terms of Service between the Customer and J Resources AB, company registration number 559133-6721, Sweden ("we").
The DPA applies where we process personal data on behalf of the Customer when providing the Service, in accordance with Article 28 of Regulation (EU) 2016/679 ("GDPR").
It is accepted together with the Terms when an authorized administrator accepts the agreement on behalf of the Customer.
1. Roles and instructions
The Customer is the controller of the personal data in its instances and accounts.
We are the processor and process that personal data only on the Customer's documented instructions, including with regard to transfers of personal data to a third country or international organization, unless applicable law requires otherwise.
The Terms, this DPA and the Customer's use and configuration of the Service constitute the Customer's documented instructions.
If applicable law requires us to process personal data other than on the Customer's instructions, we will inform the Customer before doing so unless the law prohibits such notice.
We will inform the Customer if, in our opinion, an instruction infringes applicable data protection law.
The Customer is responsible for ensuring that its instructions and its processing of personal data through the Service comply with applicable data protection law and that it has a lawful basis for the personal data it processes.
2. What we process
Subject matter and purpose: hosting, operating, maintaining, securing, backing up and supporting the Service.
Duration: the term of the agreement plus the export, deletion and backup-retention periods described in the Terms and this DPA.
Categories of data subjects: the Customer's users, including employees, contractors and consultants, and people named in data stored by the Customer, for example sample collectors or geologists.
Types of personal data: names, e-mail addresses, account and security data such as passkeys and login history, audit and activity logs, and any personal data the Customer enters into its instances.
Special categories of personal data: not expected. The Customer should not intentionally store special-category personal data in the Service unless separately agreed and legally permitted.
3. Our obligations
We:
process personal data only on the Customer's documented instructions;
ensure that persons authorized by us to process personal data are bound by confidentiality;
implement appropriate technical and organizational measures as described in Section 4;
taking into account the nature of the processing, assist the Customer by appropriate technical and organizational measures, insofar as reasonably possible, in responding to requests by data subjects exercising their rights;
taking into account the nature of the processing and the information available to us, assist the Customer with its obligations under Articles 32 to 36 GDPR, including security, personal data breach notification, data protection impact assessments and prior consultation;
notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data and provide the information reasonably available to us;
make available the information reasonably necessary to demonstrate compliance with this DPA; and
allow for and contribute to reasonable audits or inspections concerning our compliance with this DPA, subject to reasonable prior notice and reasonable confidentiality, security and operational requirements.
Where information available through documentation, security information or other reasonable means is sufficient to demonstrate compliance, the parties may use that information before requiring an on-site audit.
4. Security measures
We maintain technical and organizational measures appropriate to the risk of the processing, including the following:
Each managed product instance runs in isolated containers with its own database and storage.
Data in transit is protected with TLS.
Direct database access for supported GIS tools is only available through a per-instance encrypted VPN.
Backups are encrypted before leaving the production server, kept for a limited period (currently 14 days); restores are tested from time to time.
Operator access requires multi-step authentication.
Administrative access is restricted and logged.
Secrets and credentials are stored separately from application data and are not intentionally written to application logs.
Changes to the Service are subject to automated testing and controlled release procedures.
Access is limited according to role and operational need.
We may update these measures over time provided that the overall level of protection is not materially reduced.
5. Sub-processors
The Customer gives general written authorization for us to use sub-processors.
The currently authorized sub-processors are:
Hetzner Online GmbH (Germany): server hosting in Helsinki, Finland, and backup object storage in Falkenstein, Germany.
Cloudflare, Inc. (USA): DNS for the Service's domains, and network protection and TLS for the gnice portal and operator console. Customer instance application and database traffic does not pass through Cloudflare's proxy unless otherwise disclosed for a specific product or feature.
Resend, Inc. (USA): delivery of transactional e-mails such as invitations, sign-in and notification e-mails.
The AI model provider identified in the Service's AI settings: only if and to the extent that the Customer enables AI features that send personal data to that provider.
We will inform the Customer at least 30 days before adding or replacing a sub-processor.
The Customer may object during that period on reasonable data-protection grounds.
If we cannot reasonably accommodate the objection, the Customer may terminate the affected Service before the change takes effect.
We impose data-protection obligations on each sub-processor that provide protection for personal data consistent with the requirements applicable to us under this DPA, as required by Article 28 GDPR.
We remain responsible to the Customer for the performance of our sub-processors' data-protection obligations to the extent required by applicable law.
6. International transfers
Customer Data in managed product instances is stored in the European Economic Area unless otherwise expressly agreed.
Where a sub-processor processes personal data outside the EEA, we ensure that the transfer is covered by a lawful transfer mechanism under Chapter V GDPR.
This may include:
an applicable adequacy decision;
for eligible US recipients, participation in the EU-US Data Privacy Framework; or
the European Commission's Standard Contractual Clauses, together with supplementary measures where required.
7. Return and deletion at the end of the agreement
On termination, the Customer may retrieve and export its personal data during the 30-day export period described in the Terms.
At the Customer's request during that period, we will make the personal data available for return using the export formats supported by the Service.
After that period, we delete personal data in the Customer's instances and accounts unless applicable law requires us to retain it.
Personal data remaining in backups is deleted through the ordinary backup-retention cycle.
If access to the Service is suspended because an updated agreement was not accepted (Terms, Section 15), an administrator may download a complete database export during the suspension. Unless the updated agreement is accepted, personal data in the Customer's instances and accounts is deleted 90 days after the updated agreement took effect.
If applicable law requires retention, we will continue to protect the retained personal data and process it only as required by law.
8. Changes to this DPA
We may update this DPA in accordance with the change procedure in the Terms.
A change to this DPA does not reduce or remove obligations that are mandatory under applicable data protection law.
Changes to sub-processors are subject to the specific notice and objection procedure in Section 5.
Where we reasonably consider renewed acceptance appropriate, including for a material change to the processing arrangement, we may require an authorized Customer administrator to expressly accept the updated DPA before ordering a new instance, enabling a new feature or continuing to use the affected Service.
9. Liability and order of precedence
The limitations of liability in the Terms apply to this DPA to the extent permitted by law.
If this DPA and the Terms conflict regarding the processing of personal data, this DPA prevails.
10. Contact
Data protection questions:
J Resources AB
Address: Töresjövägen 13, 135 47 Tyresö, Sweden
E-mail: [email protected]