Data processing agreement

1. Parties and roles

The controller is you as the customer, meaning the company that registers an account and uses the service. You determine the purposes and means of the processing of the personal data.

The processor is Qubint AB, reg. no. 559598-8915, with its registered office in Södertälje (“Qubint”, “the processor”, “we”). We process personal data only on your behalf and according to your instructions.

Contact for data protection matters: hej@qubint.co.

2. Scope and precedence

This agreement covers all processing of personal data that Qubint carries out on your behalf within the service. The subject matter of the processing, its duration, nature and purpose, and the categories of data subjects and personal data are set out in Appendix A.

In matters relating to the processing of personal data, this DPA takes precedence over the other parts of the terms of service in the event of any conflict.

3. Your instructions and processing

We process personal data only on your documented instructions. Your instructions consist of the terms of service, this agreement with Appendix A, how you configure and use the service, and any further written instructions you give. If we consider that an instruction infringes data protection law, we will inform you.

We do not process the personal data for our own purposes and do not share it except under this agreement or where required by law. If we are required by law to process data in another way, we will inform you before the processing, unless the law prohibits it.

4. Confidentiality

The people at Qubint who are authorised to process the personal data have committed themselves to confidentiality or are under a statutory obligation of confidentiality. Access is given only to those who need it to deliver the service.

5. Security

We take appropriate technical and organisational measures to protect the personal data, in accordance with Article 32 of the GDPR. The measures include:

• encrypted transfer (TLS) between the browser and the service
• passwords stored hashed with bcrypt, never in plain text
• permission and access control per role and customer
• an audit log that is encrypted in the database and never shown in plain text
• pseudonymisation and automatic de-identification of inactive drivers
• regular backups
• a hardened server and network environment with a firewall and protection against malicious traffic

The measures are evaluated continuously and may be updated to maintain a level of security appropriate to the risk.

6. Sub-processors

You give us general prior authorisation to engage sub-processors to deliver the service. The sub-processors we use are listed in Appendix B.

With each sub-processor we sign a written agreement that imposes at least the same data protection obligations on the sub-processor as apply under this agreement. We are liable to you for the sub-processor's processing.

If we intend to engage a new sub-processor or replace an existing one, we will inform you in advance, through the service or by email. You then have the right to object within a reasonable time. If you have reasonable objections that we cannot accommodate, either party may terminate the affected part of the service.

7. Transfers to third countries

Processing primarily takes place within the EU and EEA. If processing or a sub-processor involves transferring personal data to a country outside the EU and EEA, this only happens with appropriate safeguards, primarily the European Commission's standard contractual clauses, or to a country that the European Commission has decided provides an adequate level of protection.

8. Assistance to you

Taking into account the nature of the processing and the information available to us, we assist you in fulfilling your obligations under the GDPR. This includes:

• responding to requests from data subjects to exercise their rights (Articles 12–23)
• maintaining security, handling personal data breaches and carrying out data protection impact assessments and prior consultations (Articles 32–36)

Features in the service that you can use yourself to provide, correct, delete or export data count as part of our assistance.

9. Personal data breaches

If we become aware of a personal data breach affecting the data we process on your behalf, we will notify you without undue delay. We will provide the information we have and assist you with the necessary measures, so that you can meet any obligation to notify and inform.

10. Deletion and return

When the processing ends, for example when the agreement is terminated, we delete or return the personal data at your choice and delete existing copies, unless storage is required by law. In such cases, accounting records are kept for as long as bookkeeping legislation requires, currently seven years.

Within a reasonable time after the agreement ends, you may request your customer data in a machine-readable format.

11. Audits and inspections

We make available the information needed to demonstrate that we meet our obligations under this agreement, and allow for and contribute to audits and inspections carried out by you or an independent auditor appointed by you. Audits take place with reasonable notice, subject to confidentiality, and without unnecessarily disrupting our operations or affecting other customers' data.

12. Liability

Liability between the parties is governed by the terms of service and Article 82 of the GDPR. Any limitation of liability and liability cap are set out in the limitation of liability section of the terms of service.

13. Term

This agreement applies for as long as we process personal data on your behalf, meaning while you have an account and use the service. It ends when the processing has ended and deletion or return under section 10 has been completed.

14. Changes

We may update this agreement, for example to reflect changes in the service, the list of sub-processors or legislation. We inform you of material changes in advance. The latest version is always here, with the date at the top.

15. Governing law and disputes

This agreement is governed by Swedish law. Disputes are settled in the same way as set out in the terms of service, with Södertälje District Court as the court of first instance.

Appendix A: The processing

Subject matter and duration

The subject matter is the provision of the Qubint fleet management service. The processing continues for the term of the agreement and thereafter for as long as storage is required by law.

Nature and purpose

Collection, storage, structuring, display, analysis and deletion of personal data in order to deliver the features of the service: administration of vehicles and drivers, mileage logs, receipts and cost tracking, and account and permission management.

For customers with Qubint Pro, also: review of suppliers' quotes and invoices, booking of service, tyres and inspections, damage reports to insurers, and ordering and selling cars. Qubint then provides the necessary details to workshops, suppliers and insurers on the customer's behalf.

Categories of data subjects

• The customer's employees and other users (for example drivers, fleet managers and administrators)
• Any contact persons the customer enters into the service
• For customers with Qubint Pro: contact persons at the customer's suppliers, workshops and insurers

Categories of personal data

• Identity and contact details (name, email, phone number)
• Organisation and role details, and vehicle assignments
• Mileage logs and, for vehicles with Qubint Connect (telematics), location and trip data
• Receipts, expenses and cost data
• Login, security and event logs

No special categories of personal data (sensitive data) are intended to be processed in the service.

Appendix B: Approved sub-processors

The web analytics tool Microsoft Clarity is used only on the public website qubint.co and does not process customer data in the service. It is therefore not a sub-processor under this agreement, and is described in our privacy policy instead.