1. The parties and this agreement
This Data Processing Agreement is part of the terms between Loheden AI Solutions AB ("we", the processor) and the customer whose account sends events to Respectlytics ("you", the controller). It applies to the personal data we process on your behalf when your apps send events to Respectlytics, and to every account.
2. The processing
- Subject matter and purpose: receiving the events your apps send, storing them, working out the figures and findings Respectlytics shows, and showing and sending them to you and to the people and services you give access to.
- Duration: as long as your account exists.
- Data subjects: the users of your apps.
- Personal data: the network address of each request your apps send, used to find the country and not stored with the event; and the stored event: its name, time, platform and country, a hashed session identifier, and on a paid plan the properties and values you declare.
You send no other personal data (terms, section 4).
3. Your instructions
We process the data only on your documented instructions, which are the terms, this agreement and the settings you choose in Respectlytics, including as to transfers outside the EEA, unless the law requires otherwise; in that case we tell you before we process, unless the law forbids it. You instruct us to process the data to provide, secure and improve Respectlytics, including to make aggregated or de-identified data. We tell you if we believe an instruction infringes data protection law.
4. Confidentiality and security
The people we authorise to process the data are bound by confidentiality. We take the technical and organisational measures that data protection law requires of us.
5. Sub-processors
You authorise us to engage sub-processors. We may engage new sub-processors. We tell the customer by email before a new one starts processing the customer's data. A customer who objects may end its subscription, which is its only remedy, without refund. The list of sub-processors is sent on request.
We bind each sub-processor by contract to the same data protection obligations as this agreement, and we answer to you for its performance of them.
6. Outside the EEA
Some sub-processors process data outside the EEA. Those transfers rely on an adequacy decision of the European Commission or on its standard contractual clauses; a copy is available on request.
7. Assistance
Taking into account the nature of the processing and the information available to us, we help you answer the people whose data it is when they exercise their rights, and meet your obligations on security, personal data breaches, impact assessments and prior consultation. The stored events hold no user or device identifier, so we may be unable to find one person's events; you can delete events by date, platform, country and event name in the dashboard or through the API.
We notify you without undue delay after becoming aware of a personal data breach affecting your data.
8. At the end
Before you close your account, you can export your events through the API. When the account is closed, we delete the data, unless the law requires us to keep it; deleted data can remain for a short time in copies kept to restore our services.
9. Information and audits
We make available to you the information necessary to demonstrate compliance with this agreement, and allow for and contribute to audits, including inspections, by you or an auditor you mandate who is bound by confidentiality. An audit is asked for in writing with reasonable notice, takes place at most once a year unless a supervisory authority requires more, is at your cost, and does not disrupt our services or reveal other customers' data. We may first answer with written information.
10. Liability, law and changes
The terms' sections on liability, indemnity, law and courts, and changes apply to this agreement.
11. Contact
Loheden AI Solutions AB, org. no. 559261-7566
Vretavägen 26
71993 Vintrosa
Sweden
Email: respectlytics@loheden.com