Annex 1 – Data processing agreement

This is a translation of the Swedish Bilaga 1 – Personuppgiftsbiträdesavtal. In case of differences, the Swedish version prevails.

1. Parties and background

1.1 This data processing agreement is Annex 1 to clearminds’ customer terms (https://nodus.se/villkor). It applies between the Customer as controller and clearminds AB, reg. no. 559476-7971, Luntmakargatan 26, Stockholm (“clearminds”), as processor.

1.2 Words defined in the customer terms, for example Service, Customer, Customer Data and Tenant/Member, have the same meaning in this annex. Words such as personal data, processing, controller, processor and personal data breach have the meaning they have in the EU General Data Protection Regulation (2016/679, the “GDPR”).

2. Subject matter, duration, nature and purpose

2.1 The subject matter of the processing is the personal data that clearminds processes on the Customer’s behalf when clearminds provides the Service under the customer terms.

2.2 The processing continues during the term of the agreement and thereafter until the personal data has been deleted under section 10.

2.3 The processing consists of collection, recording, storage, combination, display, synchronisation with the systems the Customer connects to the Service, transfer to sub-processors under section 7, and erasure.

2.4 The purpose is to provide the Service to the Customer and to the Customer’s Tenants/Members, including management of tenants and leases, access control and permissions, meeting rooms and bookings, printing, messages and announcements, the member portal, support with an AI assistant, and invoicing through the Customer’s Fortnox.

3. Types of personal data and categories of data subjects

3.1 The processing may cover the following types of personal data:

account data, for example name, email address, phone number, company and role, and data from external sign-in providers (user ID, display name, email address and profile picture),
contact details of tenants’ contact persons,
access and event logs, for example access events, doorbell events and alarm events, and the audit log of administrative actions,
bookings of meeting rooms and desks,
print history (document name, number of pages and time),
support cases and conversations with the AI assistant, in the member portal and in Slack,
data about devices on tenants’ networks that is shown in the Service (IP address, MAC address, hostname and status),
leases and the data extracted from them, including names, contact details and personal identity numbers of signatories and contact persons, and data about signatories and board members retrieved from company registers,
billing data exchanged with the Customer’s Fortnox company, and
announcement texts and messages that the Customer writes.

3.2 The data subjects are:

Tenants/Members, that is the people who use the Service on behalf of a tenant,
tenants’ contact persons, signatories and board members,
the Customer’s own users and administrators, and
visitors to the Customer’s premises, to the extent they appear in, for example, access or doorbell events.

4. Instructions

4.1 clearminds processes the personal data only on the Customer’s documented instructions. The customer terms, this annex and the settings the Customer makes in the Service constitute the Customer’s instructions.

4.2 The Customer instructs clearminds to:

provide the Service’s functions under section 3 of the customer terms,
let the AI assistant in the member portal and in Slack answer Tenants’/Members’ questions using language models in Google Cloud (Vertex AI), with the data set out in section 4 of clearminds’ privacy policy, and, at a Tenant’s/Member’s request, book and cancel meeting rooms and look up which devices are connected to the tenant’s network according to the DHCP server’s current assignments (IP address, MAC address, hostname, status and when the device was last seen),
have leases that the Customer uploads or sends in by email interpreted with AI in Google Cloud (Vertex AI), including the personal identity numbers and signatory details the leases contain, and retrieve data about signatories and board members from company registers to match the leases,
synchronise meeting room bookings with the Google calendars the Customer specifies for the rooms,
convert announcements the Customer writes into speech through Google Cloud Text-to-Speech,
synchronise access permissions to the Customer’s access-control system and, when the Customer has connected them, send events to and receive alarm events from the Customer’s camera and alarm systems,
exchange billing data with the Customer’s Fortnox company,
send notifications by SMS through the Customer’s own 46elks account, when the Customer has enabled it,
produce anonymised or aggregated data from the personal data to develop and improve the Service under section 8 of the customer terms, so that individuals cannot be identified, directly or indirectly, and
transfer personal data to sub-processors under section 7, also where the sub-processor processes the data outside the EU/EEA.

4.3 clearminds informs the Customer without delay if clearminds considers that an instruction infringes the GDPR or other data protection legislation.

5. Confidentiality

5.1 clearminds ensures that the persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5.2 clearminds does not disclose the personal data to third parties unless this follows from the Customer’s instructions, from section 7 or from law.

6. Security

6.1 clearminds takes the technical and organisational measures required under Article 32 of the GDPR. The measures include:

encrypted connections (TLS) between users’ browsers and apps and the Service,
role-based access control, where the Customer’s users can only access the Customer’s data and Tenants/Members can only access data for their own tenant,
operation in clearminds’ own operating environment within the EU,
an audit log of administrative actions in the Service,
error monitoring in a self-hosted installation, and
backups.

6.2 clearminds reviews the measures when the Service or the risks change.

7. Sub-processors

7.1 The Customer gives clearminds a general prior authorisation to engage sub-processors. clearminds currently engages the following sub-processors:

Sub-processor	Service	Purpose	Location
Google Cloud	Vertex AI	Language models for the AI assistant and the AI-assisted interpretation of leases	EU region
Google Cloud	Text-to-Speech	Speech synthesis of announcements the Customer writes	Not limited to the EU/EEA
Google	Google Calendar API	Synchronisation of meeting room bookings (title, time and description) with the Google calendars the Customer specifies	Not limited to the EU/EEA
Cloudflare	Proxy/CDN and DNS; Pages; Email Routing and Workers	Traffic to the Service passes through Cloudflare; the admin app and the member portal are served from Cloudflare Pages; incoming email to the Service, for example leases sent in by email, is received and forwarded	Not limited to the EU/EEA

7.2 The following are not sub-processors:

clearminds’ own operating environment within the EU. The Service, its databases, object storage, log server and error reporting are run by clearminds itself.
The Customer’s own suppliers. Fortnox, 46elks (SMS through the Customer’s own account), the access-control system, printing systems, camera and alarm systems and any Slack workspace the Customer connects the support to are services the Customer has its own agreements with.
Services that Tenants/Members choose themselves. Sign-in through Google, Microsoft, Slack, LinkedIn or Discord, and the assistant in a tenant’s own Slack workspace, are governed by the user’s or the tenant’s own agreement with the respective provider.
Company registers. Data about companies, signatories and board members is retrieved from Bizzdo (bizzdo.se), which is a source of the data and does not process personal data on the Customer’s behalf.

7.3 clearminds notifies the Customer by email at least 30 days before clearminds engages a new sub-processor or replaces a sub-processor. Within that time the Customer may object to the change on reasonable grounds. If the parties cannot agree, the Customer may terminate the part of the Service affected by the change, with effect from the day the change is made.

7.4 Where a sub-processor processes personal data outside the EU/EEA, the transfer relies on an adequacy decision, for example the European Commission’s decision for the EU–US Data Privacy Framework, to the extent the sub-processor participates in the framework, or on the European Commission’s standard contractual clauses.

7.5 clearminds imposes on each sub-processor data protection obligations that correspond to those in this annex. clearminds is liable to the Customer for the sub-processor’s processing.

8. Assistance to the Customer

8.1 Taking into account the nature of the processing and insofar as this is possible, clearminds assists the Customer in fulfilling the Customer’s obligation to respond to requests from data subjects exercising their rights. A request that clearminds receives directly from a data subject and that concerns data clearminds processes on the Customer’s behalf is forwarded to the Customer.

8.2 clearminds assists the Customer in fulfilling the obligations in Articles 32–36 of the GDPR, including with information the Customer needs for a data protection impact assessment, taking into account the nature of the processing and the information available to clearminds.

9. Personal data breaches

9.1 clearminds notifies the Customer without undue delay after becoming aware of a personal data breach concerning personal data that clearminds processes on the Customer’s behalf.

9.2 The notification contains, to the extent the information is available, the information the Customer needs to notify the breach under Article 33 of the GDPR. Information that is not available immediately is provided as soon as it is available.

10. Deletion and return

10.1 After the agreement has ended, the Customer can export its Customer Data, and clearminds then deletes the personal data in accordance with section 13.3 of the customer terms, unless the law requires the data to be kept.

11. Audits

11.1 clearminds makes available to the Customer the information necessary to demonstrate that the obligations in Article 28 of the GDPR and in this annex are met.

11.2 clearminds allows for and contributes to audits, including inspections, conducted by the Customer or by an auditor mandated by the Customer. The audit is announced reasonably in advance, is carried out so that it does not disrupt the Service or other customers’ data, and the auditor must be bound by confidentiality. The Customer bears its own costs for the audit.

12. Scope limitation

12.1 This annex does not cover network and traffic data and connection logs under section 7.4 of the customer terms. clearminds is an independent controller for that data. The annex does, however, cover the data about devices that the Service shows to the Customer and to Tenants/Members, including the DHCP server’s current assignments (sections 3.1 and 4.2).

12.2 Nor does the annex cover other data that clearminds processes as a controller, for example contact details of the Customer’s contact persons for clearminds’ customer relationship and invoicing, and data about visitors to the website nodus.se. That processing is described in clearminds’ privacy policy (https://nodus.se/integritet).

13. Miscellaneous

13.1 This annex applies between the parties even if the order or agreement does not specifically refer to it. If the parties have signed a separate data processing agreement, that agreement takes precedence over this annex.

13.2 If the customer terms and this annex conflict regarding the processing of personal data, this annex prevails.

13.3 The annex applies for as long as clearminds processes personal data on the Customer’s behalf. Governing law and dispute resolution follow from section 15 of the customer terms.

13.4 Questions about this annex can be sent to [email protected].