This Data Processing Agreement ("DPA") forms part of, and is incorporated by reference into, the Terms of Service between you (the "Admin", acting as data controller) and cloudblocks AB (org.nr 559520-4370), registered at Lindekullegatan 41B, 441 65 Alingsås, Sweden ("Processor", "we", "us"). By accepting the Terms of Service when you create an account, you also accept this DPA. It reflects the requirements of Article 28 of the GDPR.

See our Privacy Policy for a plain-language explanation of when we act as controller versus processor.

1. Subject matter and duration

This DPA governs our processing of personal data on your behalf in connection with the FakturaKlar service. It applies for as long as we process personal data on your behalf under the Terms of Service, and it survives termination for as long as we continue to hold any such data (see Section 9).

2. Nature and purpose of processing

We process personal data on your behalf solely to provide the FakturaKlar service to you: to store the customer and document records you enter, to generate and deliver the invoices and quotes you create, and to make that data available to you within the application.

3. Types of personal data and categories of data subjects

Personal data: names, addresses, email addresses, phone numbers, and (for business customers) organisation numbers, as entered by you; and the invoices and quotes you create, including line items, amounts, and tax rates.
Data subjects: your customers, and any contact persons at your business customers, as entered by you.

4. Your instructions

We will only process personal data on your documented instructions, which are given by your configuration and use of the application (for example, the customer and document records you create, and the emails you choose to send). We will inform you if, in our view, an instruction infringes the GDPR or other applicable data protection law.

5. Confidentiality

We ensure that any person authorised to process personal data on our behalf (including our employees and contractors) is subject to an appropriate obligation of confidentiality.

6. Security measures

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing.

[TODO: cloudblocks AB to describe the specific technical and organisational measures actually in place, for example: encryption in transit/at rest, access controls and authentication, backup and disaster recovery, and how security incidents are detected. This section currently only states the general legal obligation and must be completed with real facts before publishing, since we do not invent details about infrastructure we haven't confirmed.]

7. Sub-processors

You give us general authorisation to engage the sub-processors listed below to help us provide the Service. We will inform you of any intended changes concerning the addition or replacement of sub-processors, giving you the opportunity to object. Each sub-processor is bound by data protection obligations no less protective than those in this DPA.

Category	Provider	Purpose
Email delivery	Resend (Resend, Inc.)	Sending transactional email on your behalf
Payment processing	Stripe (Stripe, Inc.)	Processing your subscription and invoice-credit payments
Hosting	A hosting provider located within the EU	Hosting the application and its database

8. Assistance with data subject requests and breach notification

Taking into account the nature of the processing, we will assist you, insofar as reasonably possible, in responding to requests from data subjects exercising their GDPR rights, and in meeting your obligations regarding data security, data protection impact assessments, and consultation with supervisory authorities. If we become aware of a personal data breach affecting your data, we will notify you without undue delay after becoming aware of it.

9. Deletion or return of data on termination

At your choice, we will delete or return all personal data processed on your behalf after the end of the provision of services, and delete existing copies, unless retention is required by law, see the retention periods in our Privacy Policy (in particular, accounting records must be retained for seven years under the Swedish Bokföringslagen regardless of account closure).

10. Audit rights

We will make available to you all information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, subject to reasonable advance notice and confidentiality.

11. Contact

Questions about this DPA can be sent to info@fakturaklar.com.