Data Processing Agreement

This Data Processing Agreement (the “Agreement”) governs how ClayStack AB processes personal data on the customer's behalf in the AIME service, and meets the requirements of Article 28(3) of the General Data Protection Regulation (GDPR). The Agreement exists in Swedish and English; this English version is a translation, and if the two differ the Swedish version prevails.

1. Parties and Scope

This Agreement is between the customer holding an AIME account (the “Customer”), as controller, and ClayStack AB, org. nr. 559586-4876, Bygatan 3, 171 49 Solna, Sweden (“ClayStack”), as processor. It forms part of the Terms of Service and is accepted when the Customer accepts them. If this Agreement and the Terms differ on the processing of personal data, this Agreement prevails.

If the Customer is itself a processor for someone else, such as a client, ClayStack is a sub-processor, and the Customer is responsible for making sure its instructions are consistent with those of the controller.

This Agreement does not cover data about the Customer's account, payments and use of the Service, which ClayStack processes as a controller under the Privacy Policy. Terms such as “personal data”, “processing”, “data subject” and “personal data breach” have the meaning given in the GDPR.

2. Subject Matter, Duration, Nature and Purpose

• Subject matter: ClayStack's provision of the AIME service to the Customer.
• Duration: for as long as the Customer uses the Service, and afterwards until the personal data has been deleted under section 12.
• Nature: storage, organisation, display, retrieval and alteration; sending by email and share links; AI analysis, generation and translation; producing PDFs; and erasure.
• Purpose: solely to provide the Service to the Customer under the Terms and this Agreement.

3. Categories of Data Subjects and Types of Personal Data

Data subjects:

• the Customer's users, employees and colleagues
• workers, including subcontractors' staff, who sign in on a site by QR code
• people who sign work permits
• people in the Customer's personnel register
• external reviewers and approvers
• other people named or shown in documents, photos and files the Customer uploads, for example in subcontractors' documents

Personal data:

• name, company or employer, role or trade
• email address and phone number
• ID06 or works number, preferred language and notes
• certificates and training, including uploaded certificate and identity documents that may contain a photo
• handwritten signatures, time of sign-in or signing, the language read, and certificate numbers for permits
• photos and any other personal data in documents and free text the Customer enters

The Service is not designed for special categories of personal data (Article 9 GDPR) or data about criminal offences. The Customer is responsible for entering such data, and national identity numbers, only where this is necessary and lawful.

4. The Customer's Responsibilities

The Customer is responsible for the processing being lawful, including having a legal basis, informing data subjects (for example workers who sign in), making sure the data is accurate and limited to what is needed, and making sure its instructions comply with applicable data protection law.

5. Instructions

ClayStack processes the personal data only on the Customer's documented instructions, including with regard to transfers to third countries. The instructions consist of this Agreement, the Terms, and the Customer's use and settings in the Service. Further instructions are given in writing, for example by email; if they go beyond the Service's features, they may require agreement on timing and cost.

ClayStack may process the data otherwise only where required by EU or Swedish law. In that case ClayStack will inform the Customer before processing, unless the law prohibits this. ClayStack does not use the personal data for its own purposes and does not sell it.

ClayStack will immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other data protection law.

6. Confidentiality

ClayStack ensures that people authorised to process the personal data have committed themselves to confidentiality or are under a statutory obligation of confidentiality, and that they access the data only as far as needed, for example for support the Customer has requested or to fix faults.

7. Security

ClayStack takes appropriate technical and organisational measures under Article 32 GDPR, taking into account the risk to data subjects. These include:

• encryption of data in transit (HTTPS/TLS)
• authentication and access control, with row-level security in the database limiting each account to its own data
• access-restricted file storage
• least-privilege access for staff and systems; administrative keys are used only on the server
• random, hard-to-guess links for sharing, site sign-in and signing
• limits on AI requests to prevent misuse
• backups and logging through ClayStack's hosting and database providers

ClayStack reviews these measures regularly and may change them, provided the level of protection is not reduced.

8. Sub-processors

The Customer gives ClayStack general written authorisation to engage sub-processors. ClayStack currently uses:

ClayStack enters into a contract with each sub-processor imposing data protection obligations equivalent to those in this Agreement, and remains fully liable to the Customer for each sub-processor's performance of its obligations.

ClayStack will notify the Customer by email, to the account's email address, at least 30 days before adding or replacing a sub-processor. Within that period the Customer may object to the change on reasonable data protection grounds. The parties will then try in good faith to find a solution. If they cannot, the Customer may terminate the Service with effect before the change takes effect.

9. International Transfers

ClayStack transfers personal data outside the EU/EEA only where safeguards under Chapter V GDPR are in place, in the form of the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework where the recipient is certified under it. On request, the Customer can receive information about which safeguards are used.

10. Assistance to the Customer

Taking into account the nature of the processing and the information available to it, ClayStack assists the Customer:

• with data subject requests, such as for access, rectification or erasure. The Customer can itself view, change, export and delete data in the Service. If a data subject contacts ClayStack directly, ClayStack will refer them to the Customer and inform the Customer without undue delay, and will not respond to the request itself unless the Customer instructs it to.
• with its obligations under Articles 32–36 GDPR: security, notification and communication of personal data breaches, data protection impact assessments and prior consultation with the supervisory authority.

ClayStack may charge a reasonable fee for assistance that goes beyond the Service's features and what is set out in this Agreement, except where the assistance is needed because ClayStack has breached this Agreement.

11. Personal Data Breaches

ClayStack will notify the Customer without undue delay, and no later than 48 hours after becoming aware of a personal data breach affecting the Customer's personal data. The notification is sent to the account's email address and describes, as far as the information is available:

• the nature of the breach, including the categories and approximate number of data subjects and records concerned
• the likely consequences
• the measures taken or proposed, including measures to mitigate possible adverse effects
• contact details for further information

Where not all information is available at once, it will be provided in phases without undue delay. ClayStack documents breaches and assists the Customer with notifying the supervisory authority and informing data subjects. The Customer decides on and makes any such notifications.

12. Deletion and Return

The Customer can export data from the Service at any time, for example by downloading documents as PDFs or using “Download my data” on the profile page, and can delete documents and records.

When the Customer deletes its account, ClayStack deletes the Customer's personal data, including stored files, no later than 30 days after the deletion, unless EU or Swedish law requires continued storage. Copies in providers' backups are deleted when those backups expire on each provider's schedule. Until then they remain protected under this Agreement and are not used for any other purpose.

If the Customer wants a copy of its data but cannot export it itself, it can request one by email before deleting the account.

13. Information and Audits

ClayStack makes available to the Customer the information needed to demonstrate compliance with Article 28 GDPR and this Agreement, for example by answering questions in writing. ClayStack allows for and contributes to audits, including inspections, carried out by the Customer or by an independent auditor appointed by the Customer and bound by confidentiality.

Audits must be notified reasonably in advance, normally at least 30 days, be carried out so as not to disrupt operations unnecessarily, and are at the Customer's cost. Sub-processors are audited primarily through the reports and documentation they make available.

14. Liability

The parties' liability under this Agreement follows the Terms of Service, including the limitation of liability section, to the extent mandatory law does not provide otherwise. This Agreement does not affect data subjects' right to compensation under Article 82 GDPR.

15. Term and Changes

This Agreement applies for as long as ClayStack processes personal data on the Customer's behalf. ClayStack may change this Agreement; material changes will be notified by email at least 30 days before they take effect. Changes required by law or by a decision of an authority may take effect sooner.

16. Governing Law and Language

This Agreement is governed by Swedish law, and disputes are decided by the Swedish courts in accordance with the Terms of Service. The Agreement exists in Swedish and English; if they differ, the Swedish version prevails.

17. Contact

Questions about this Agreement: ClayStack AB, Bygatan 3, 171 49 Solna, Sweden · chris@aime-app.co

See also our Privacy Policy and Terms of Service.