Privacy Policy

1. Data Controller

Softstuff AB (org. no. 559271-4744) is the Data Controller for personal data processing related to user accounts, platform administration, and customer relationships in Washproof.

Company: Softstuff AB

Org. no: 559271-4744

Address: Stockholm, Sweden

Privacy Contact: privacy@washproof.eu

When an enterprise customer uploads accounting records, invoices, or ledger files that contain personal data of employees or vendor contacts, the Customer acts as Data Controller and Washproof acts as Data Processor under our Data Processing Addendum (DPA).

2. Categories of Personal Data Collected

We only collect data strictly necessary to provide, secure, and operate the platform:

Account Credentials: Full name, business email address, password hash, phone number (if SMS MFA is enabled), profile image, and organizational role.
OAuth / SSO Authentication: When signing in via Google Workspace or Microsoft Entra ID, we receive your unique identifier (sub), name, and email address. We never request access to your private inboxes or files.
Company & Accounting Data: Business registration numbers, company legal names, addresses, uploaded SIE files, supplier invoice lines, and sustainability data points.
Technical Logs & Telemetry: IP addresses, browser specifications, login timestamps, session identifiers, and error reports required for intrusion prevention and service reliability.

3. Purposes and Legal Basis

Contractual Performance (Art. 6.1 b GDPR)

To provision user accounts, calculate greenhouse gas emissions according to the VS (Delegated Regulation C(2026) 5011), generate audit-ready reports, and deliver the service.

Legitimate Interests (Art. 6.1 f GDPR)

To maintain system telemetry, protect against malicious intrusion, mitigate SMS abuse, and enhance platform security and user experience.

Legal Obligation (Art. 6.1 c GDPR)

To satisfy statutory accounting and tax requirements regarding transaction history, billing, and corporate audit compliance.

Consent (Art. 6.1 a GDPR)

For optional non-essential cookies, technical newsletters, and pilot program invitations. Consent can be revoked at any time.

4. Sub-processors and Cross-border Transfers

We partner with trusted sub-processors for cloud infrastructure. All databases and core processing nodes are strictly located within the EU/EEA:

Sub-processor	Service	Location	Safeguard Mechanism
Google Cloud Platform	Hosting, Firestore & Cloud Functions	EU (Belgium / Frankfurt)	EU Data Boundary / GDPR DPA
Google Workspace	OAuth & Identity Platform	EU / Global	Standard Contractual Clauses (SCC)
Fortnox AB	Accounting & Voucher Sync	Sweden	EU DPA
Bolagsverket / Statistics Sweden	Public Corporate & NACE Directory	Sweden	Swedish Public Authority

5. Your Statutory Rights

Under Chapter III of the GDPR, you are entitled to:

Request an Access Extract of the personal records we hold concerning you.
Request Rectification of inaccurate or incomplete information.
Request Erasure ("Right to be Forgotten") when processing is no longer required.
Request Data Portability (receive your data in a structured, machine-readable format like JSON or Excel).
Lodge a complaint with the supervisory authority (Swedish Authority for Privacy Protection, IMY).

To exercise any of these rights, please contact us at privacy@washproof.eu. We reply to all inquiries within 30 days.

Quick Summary