Data Processing Agreement
Version 1.4 · in force from 2026-09-06 · new wording 2026-11-18
This agreement governs how Softsyde AB processes personal data on your behalf when you use Fidova as a trainer or organization. It is required by Article 28 of the GDPR and applies between you as controller and us as processor. You accept it when you become a trainer on Fidova. It applies for as long as your organization uses the service. In the event of a conflict between the Swedish and English versions, the Swedish version prevails.
The parties
The processor is Softsyde AB (company reg. no. 559598-7354), which operates the Fidova service. Contact details are on our contact page. The controller is the organization that accepted this agreement when it started using Fidova as a trainer, and that subsequently uses Fidova in its business. You are the controller for data about your own customers. We are the controller for the platform itself – accounts, sign-in, the marketplace, security logs and retention periods. That boundary is described in our privacy policy. This agreement covers only the part where we process data on your behalf.
What we process, and why
The purpose is to provide Fidova to you, so that you can run courses and venue bookings. Nothing else. We do not use your customers' data for our own purposes, do not sell it on, and do not use it to train models. The processing covers: • storing and making available your participant lists, attendance registers, course and session data, forms and training material, • delivering your messages and announcements to your participants, • storing the files you upload, • backup and operation of the above. Categories of data subjects: your customers and participants, and the people they enter into the service themselves. Types of personal data: names and contact details, information about the dog, bookings and attendance, notes and assessments you write, answers to your forms, and messages between you and the participant. Duration: for as long as your organization uses Fidova, and thereafter as set out under deletion below.
We process only on your instructions
We process personal data only on your documented instructions. Those instructions consist of this agreement, the terms of service, and the settings and actions you take in the service – creating a course, sending a message or deleting a participant is an instruction. If we are required by law to process the data otherwise, we will inform you before doing so, unless the law prohibits us from telling you. If we consider an instruction to infringe data protection law, we will say so.
Confidentiality
Those of us who have access to your data are bound by confidentiality, and have access only to the extent the work requires. We do not read your participant lists or notes routinely. Access happens during troubleshooting or support, normally at your request, and is logged.
Security
We take appropriate technical and organisational measures under Article 32. In practice that includes: • Access control in the database. Each organisation's data is separated at row level, so another organisation cannot reach it — even if someone bypassed the interface. • Encrypted transmission of all traffic, and encryption of stored data at our sub-processors. • Logging of administrative actions and sensitive lookups. • Separate environments for development and production, so live data is not used in development work. • Automatic deletion of data that has passed its retention period. • Backups of the database, and procedures for restoring it. The security model is documented and checked automatically on every change to the service: a set of rules about access and permissions is run against the database before a change can ship, and a change that breaks them is stopped. Some of the measures are our sub-processors'. We hold SOC 2 reports from Supabase, Vercel, Sentry and Resend, and SOC 2 and ISO 27001 from Cloudflare, plus penetration-test reports from Sentry, Vercel and Resend. If you want to see the documentation ahead of an audit, we provide it under the section on audits below. We do not engage outside parties to penetration-test Fidova itself. Instead the code is reviewed automatically on every change, with static security analysis and checks for known vulnerabilities in the components we use.
Sub-processors
You give us general authorisation to engage sub-processors. Today we use: • Supabase — database, authentication and file storage. The data is stored in Stockholm. • Vercel — hosting, delivery, request logs and cookieless visitor statistics. The servers are in Stockholm. • Resend — transactional email. Delivery is handled in Ireland. • Sentry — error and performance monitoring. The data is stored in Germany. • Cloudflare — authoritative DNS for fidova.se. Cloudflare answers lookups of our domain name and therefore sees the name being queried and the address of the resolver asking. Web traffic does not pass through Cloudflare. Each sub-processor is bound by obligations equivalent to those in this agreement. We are responsible for their processing as for our own. If we change the list we tell you in advance and you have the right to object. If you object and we cannot agree, you may terminate the service. That is why this agreement is versioned: we record which version you accepted, so we know who needs to be told when the list changes. We monitor our sub-processors' own change notices ourselves. Those notices differ by provider — some send a message, some publish it on a page — and some give us no notice at all. Our own obligation to tell you in advance applies regardless, and we do not add a sub-processor without telling you first.
Assisting with data subject rights
If one of your customers approaches us with a request concerning you – access, rectification, erasure, objection – we refer them to you and inform you of the request. We help you respond. Data you entered yourself can be corrected and removed directly in the service. For access requests and data portability you retrieve the data yourself with the export under Settings. If you need something the export does not cover, contact us and we will produce it in time for you to answer the data subject within one month.
What you as controller must do yourself
Informing your own customers about how you process their data is your obligation, not ours. Our privacy policy covers the platform — accounts, bookings, notifications and what we are responsible for — but it does not describe your business. Participant registers, training notes, bookkeeping and contact with the customer are your processing, and the data subjects must be told by you what you do with their data and why. That applies from the outset, not only when somebody asks.
Personal data breaches
If we discover a personal data breach affecting your data, we notify you without undue delay after becoming aware of it. We provide the information you need for your own notification: what happened, which data and roughly how many people are affected, what consequences we assess it may have, and what we have done about it. If we do not have everything immediately, we send what we have and follow up, so you can start work on your notification. Your own 72-hour deadline starts running when we notify you. That is when you are considered to have become aware of the breach, under Article 33(1) read together with Article 33(2). If our notice is late, that is our failure towards you, not a deduction from your deadline. Where a breach originates with one of our sub-processors, our notice to you depends on theirs to us, and we pass it on without undue delay as soon as we have it. We also assist you with impact assessments and prior consultations under Articles 35 and 36, so far as they concern our processing.
Deletion and return
When you stop using Fidova we delete your data, or return it, at your choice. You request that through our contact page and we carry it out within 30 days of the request reaching us. Data is returned in a structured, commonly used and machine-readable format (CSV and JSON). You can also export the data yourself at any time, under Settings in the service. That export contains the same data in the same formats, so you do not have to wait for us. We keep data longer only where the law requires it, for example records covered by the Swedish Accounting Act. What is deleted when is set out in our privacy policy.
Audits and information
We provide the information you need to demonstrate compliance with the obligations in Article 28, and allow for and contribute to audits. In the first instance this is through documentation we can hand over: our own security documentation, and the audit reports and certifications we hold from our sub-processors. Where that documentation is not sufficient, you are entitled to an on-site audit. It takes place at most once in any twelve-month period, on at least 30 days' written notice, during business hours, and without disclosing other customers' data. You bear your own costs for the audit. If you engage an external auditor, they must be independent of us and bound by confidentiality. In the event of an actual personal data breach or an order from a supervisory authority, the limits on frequency and notice do not apply.
Liability
The limitation of liability in the terms of service applies to this agreement as well. That is a departure from the section on changes, which otherwise gives this agreement precedence: on the question of liability it is the terms' limitation that governs both agreements, so that there is one limit rather than two. Mandatory rules always take precedence. Our liability towards a data subject under Article 82 of the GDPR cannot be limited by agreement, and is not limited here.
Transfers outside the EU/EEA
The data is stored inside the EU/EEA. Four of our five sub-processors process it entirely within the union: Supabase in Stockholm, Vercel in Stockholm, Sentry in Germany, and Resend's sending infrastructure in Ireland. Two of the providers are, however, established outside the EU/EEA — Supabase Pte. Ltd in Singapore and Resend (Plus Five Five, Inc.) in the United States — and Cloudflare, which runs our DNS, is American. Where the data sits and where the provider is established are two different questions: a provider outside the union may need access for support and operations even when the data is stored in Stockholm. For those, the European Commission's standard contractual clauses apply. Resend is additionally certified under the EU-U.S. Data Privacy Framework. We do not transfer your data to a third country on our own initiative beyond what follows from the sub-processor list above.
Changes to this agreement
This agreement is versioned. We record which version your organization accepted, and when. If the agreement needs to change we will notify you in advance and ask for a new acceptance. Until then, the version you accepted applies. In the event of a conflict between this agreement and the terms of service, this agreement prevails on matters concerning the processing of personal data on your behalf. Swedish law applies.
Contact
Questions about this agreement, or about how we process data on your behalf, go through our contact page. We have not appointed a data protection officer – the Article 37 criteria are not met – so questions come to us directly.