Data processing agreement for SDR Bookings

Under Article 28(3) of the General Data Protection Regulation (GDPR).

1. Parties

Controller (“the Customer”): the organisation that has signed an agreement with Formacon for SDR Bookings, with the details stated on signature.

Processor and supplier (“Formacon”): Forss Management Consulting AB (Formacon), org.nr 559086-4780, Lantmannagatan 33, 583 32 Linköping, formacon.se.
Pierre Lindbom, pierre.lindbom@formacon.se, 0735-28 12 15.

This agreement covers the personal data processed in SDR Bookings (sdr.achiever.se) on the Customer's behalf. For the web server's technical logs (IP address, time and requested address, for troubleshooting and protection against attacks) Formacon is itself the controller. See also the privacy policy.

2. Subject matter, nature, purpose and duration

• Subject matter and purpose: developing and operating the portal where the Customer's sales development representatives (SDRs) register booked customer meetings, follow up results against targets and quotas, take part in sales competitions and receive reminders.
• Nature of the processing: recording, storage, compilation, display, sending of invitations and push notifications, backup and erasure.
• Duration: for as long as Formacon operates the portal for the Customer, and thereafter for the wind-down period set out in section 12.

3. Categories of data subjects

• SDRs and administrators with an account in the portal.
• People invited to the portal.
• Sellers for whom meetings are booked.
• Contact persons at customers, to the extent they are mentioned in bookings, customer names or notes.

4. Categories of personal data

• User account: name, email address, password (only as a salted hash), administrator rights and linked SDR profile.
• Invitations: email address, when the invitation was created, expires and is used.
• SDR profile and results: selected products and sellers, bookings, calls per day, targets, competition results, notifications and answers to questions.
• Bookings and customers: the customer's name, size and notes, booked date, responsible seller, product, status, comment and reminder time.
• Sellers: name, products and quotas, and number of bookings.
• Activity log: who created, changed or deleted a booking, with time, IP address and the browser's user agent.
• Push subscriptions: endpoint, encryption keys, user agent and linked account.

No special categories of personal data (Article 9) or national identity numbers are processed intentionally. The Customer is responsible for users not entering such data in comments and notes.

5. The Customer's instructions

Formacon processes the personal data only on the Customer's documented instructions. This agreement, the assignment and the Customer's own choices in the portal constitute the complete instructions. Processing required by Union or Swedish law may take place without instruction; Formacon then informs the Customer before processing, unless the law prohibits it. Formacon immediately informs the Customer if, in its opinion, an instruction infringes the GDPR. Formacon does not use the data for its own purposes and does not sell it.

6. Confidentiality

Formacon ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under a statutory obligation of confidentiality. Confidentiality continues after the agreement has ended.

7. Security measures (Article 32)

• Own server in Sweden. The portal and database run on hardware Formacon operates itself in Sweden.
• Encryption. All traffic uses TLS (HTTPS). Passwords are stored as salted hashes. Push notifications are encrypted so that only the recipient's device can read them.
• Backups. The database is backed up automatically. The backups are encrypted before a copy is stored in Microsoft OneDrive as protection against hardware failure, and are kept for up to 12 months.
• Access control. Accounts are created only through personal invitations. Login attempts are rate limited, login cookies cannot be read by scripts, requests are protected against forgery (CSRF) and administrative functions require administrator rights. Access to the production server is limited to named people at Formacon and uses personal SSH keys.
• Logging. The activity log shows who created, changed or deleted a booking. The portal uses no analytics or advertising services.

Formacon may change the measures, provided the level of protection is not lowered.

8. Subprocessors

The Customer gives a general prior authorisation for Formacon to engage subprocessors. Formacon enters into written agreements with each subprocessor imposing the same data protection obligations as this agreement, and is liable to the Customer for the subprocessor's processing as for its own. Formacon notifies the Customer at least 30 days before a subprocessor is added or replaced, and the Customer may object on reasonable grounds. If the parties cannot agree, the Customer may terminate the assignment.

Subprocessors when this agreement was last changed:

9. Assistance with data subjects' rights

Formacon assists the Customer in responding to requests for access, rectification, erasure, restriction, portability and objection. The portal has no built-in export or account deletion, so Formacon carries out such actions at the Customer's request. A request received directly by Formacon is forwarded to the Customer without undue delay.

10. Assistance under Articles 32–36

Formacon assists the Customer in meeting its obligations regarding security (Article 32), notification of personal data breaches (Articles 33–34), data protection impact assessments (Article 35) and prior consultation with the supervisory authority (Article 36), taking into account the nature of the processing and the information available to Formacon.

11. Personal data breaches

Formacon notifies the Customer without undue delay and no later than 48 hours after becoming aware of a personal data breach affecting the data in the portal, with the available information on what happened, which and approximately how many data subjects and records are concerned, likely consequences and measures taken or proposed. Formacon assists in investigating and containing the breach.

12. Deletion and return

When the assignment ends, Formacon shall, at the Customer's choice, delete all personal data or return it in a machine-readable format and then delete it, within 30 days. Data in backups disappears as the backups are pruned, no later than after 12 months, and is meanwhile not used for any purpose other than restoration. Longer storage only takes place where Union or Swedish law requires it.

13. Where the data is and transfers to third countries

The portal and database are in Sweden. Encrypted copies of the backups are stored in Microsoft OneDrive, in the data centre Microsoft states as the storage location for Formacon's account (within the EU/EEA for European accounts). Google and the push services may process data outside the EU/EEA. Such transfers only take place on a legal basis under Chapter V of the GDPR, for example the European Commission's adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.

14. Audits

Formacon makes available to the Customer the information necessary to demonstrate compliance with Article 28, and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer who is bound by confidentiality. Audits are announced at least 30 days in advance and take place during normal working hours, unless a breach or an authority requires otherwise.

15. Liability

Each party is liable for damage it has caused by breaching this agreement or the GDPR, in accordance with Article 82. This agreement does not limit either party's liability towards data subjects or for administrative fines imposed on that party by an authority.

16. Term and amendments

The agreement applies from signature and for as long as Formacon processes personal data on the Customer's behalf. Amendments must be in writing and signed by both parties; changes to the list of subprocessors are however made under section 8.

17. Governing law and disputes

Swedish law applies to the agreement. Disputes are settled by Swedish general courts.

Signatures

The agreement is signed by authorised representatives of the Customer and of Forss Management Consulting AB. It is not signed in this published version.