This Data Processing Addendum ("DPA") is entered into between the Customer ("Data Controller") and Softstuff AB, reg. no. 559271-4744 ("Data Processor" or "Washproof"), forming an integral part of the General Terms of Service. This DPA governs the processing of personal data in accordance with Article 28 of the General Data Protection Regulation (EU GDPR 2016/679).
The Processor (Softstuff AB, reg. no. 559271-4744) shall process personal data on behalf of the Controller (Customer) solely to perform and provide the Service for the duration of the Customer's active subscription or service agreement and in accordance with the configured audit retention window for reporting.
The Processor implements and maintains appropriate technical and organizational safeguards pursuant to Article 32 of the GDPR:
All data in transit is encrypted using modern TLS 1.3, and all data at rest is encrypted using AES-256 within Google Cloud.
Strict Principle of Least Privilege, scoped IAM service accounts, and mandatory MFA for all engineering personnel.
All production databases, cold storage, and compute instances are strictly locked to EU regions (europe-west1).
Automated daily incremental backups with point-in-time recovery and append-only audit logging for administrative actions.
The Controller hereby grants the Processor a general written authorization to engage sub-processors for cloud hosting and core integrations (Google Cloud Platform, Fortnox AB). The Processor ensures that all sub-processors are bound by equivalent data protection obligations as set forth in this DPA.
Upon confirming a Personal Data Breach, the Processor shall notify the Controller in writing without undue delay and at the latest within 48 hours of becoming aware of the incident, assisting the Controller in fulfilling its statutory reporting obligations to supervisory authorities (such as IMY).
(a) Raw Data & Audit Retention Window: When creating a report, the Customer configures an audit retention window (1 or 3 months). Upon expiry of this window, the Processor automatically purges underlying voucher files, invoice texts, and personal data in accordance with GDPR data minimization principles. Finalized report aggregates and Voucher IDs (voucherId, ledger accounts, transaction amounts, and calculated emissions) are retained permanently as an audit trail, enabling the Customer and its financial auditors to cross-reference and verify figures directly against the Customer's primary accounting records. Following raw data purging, new report versions cannot be generated from raw inputs.
(b) Termination: Upon termination of the Service, the Processor shall, at the choice of the Controller, delete or return all remaining personal data within ninety (90) days, unless European Union or Swedish national law mandates ongoing retention.