# Data processing agreement

Version: 2026-11-02
Status: Processing terms
Operator: Codaform AB, organisation number 559607-6504, Fagermon 315, 705 91 Örebro, Sweden
Contact: info@codaform.se

Terms governing personal data that Codaform processes on a business customer's instructions.

## Parties and application

This data processing agreement applies when incorporated into an accepted order or service agreement between the business customer identified in that agreement (the controller) and Codaform AB, organisation number 559607-6504, Fagermon 315, 705 91 Örebro, Sweden (the processor). GDPR terms have the meanings given in Regulation (EU) 2016/679.

It covers only processing performed on the customer's documented instructions. Codaform's own account administration, licensing enforcement, security and merchant relationship activities are covered by the privacy policy where Codaform acts as an independent controller. In a conflict about the processing covered here, this agreement takes priority over general service terms.

## Processing schedule

| Item | Scope |
| --- | --- |
| Subject matter and purpose | Personal data supplied by the customer for an expressly agreed support or other processing service, solely to deliver that service under the accepted order. |
| Nature of processing | Receipt, storage, access, organisation, troubleshooting, secure communication, return and deletion as required for the agreed service. |
| Duration | The service term plus the return and deletion period described below, subject to legally required retention. |
| Data subjects | The customer's employees, authorised users and business contacts whose information is included in the agreed service. |
| Data categories | Business contact details, user identifiers, correspondence and diagnostic information supplied for the service. Special-category data, criminal-offence data and additional categories require prior written agreement on purpose and safeguards. |
| Instructions | The accepted order, this agreement and subsequent written instructions from the customer's authorised contact. Additional scope must be agreed before processing begins. |
| Contacts | The customer's authorised contact recorded in the order; Codaform: info@codaform.se. |

## Instructions and confidentiality

Codaform shall process personal data only on the controller's documented instructions, including instructions about international transfers, unless applicable Union or Member State law requires otherwise. Where legally permitted, Codaform shall inform the controller of that requirement before processing. Codaform shall promptly inform the controller if an instruction appears to infringe applicable data-protection law.

The controller is responsible for lawful grounds, required notices and the lawfulness of its instructions. Codaform shall ensure that personnel authorised to process the data are bound by confidentiality obligations and have access only as required for their duties.

## Security measures

For processing under this agreement, Codaform shall maintain technical and organisational measures appropriate to the risk, taking account of the state of the art, implementation costs and the nature, scope, context and purposes of processing. Measures shall include access controls and confidentiality, secure transmission, protection of stored data, recovery arrangements, security logging, incident handling and periodic assessment of effectiveness.

The security and installation overview describes account and licensing controls. Any additional measures required by the processing service shall be specified in the accepted order. Codaform shall not materially reduce the overall level of protection during the service term. The controller remains responsible for the security of its own accounts, devices and systems.

## Subprocessors

The controller grants general written authorisation for the subprocessors identified for the processing service in the accepted order or accompanying subprocessor schedule. The public providers page describes Codaform's wider service providers; it does not by itself authorise every provider for every customer processing activity.

Codaform shall give at least 30 days' written notice before adding or replacing a subprocessor. The controller may object on reasonable data-protection grounds within that period. The parties shall work to resolve the objection. If no suitable solution is available, the controller may terminate the affected processing service before the change takes effect and receive a refund of unused prepaid fees for that service.

Codaform shall impose data-protection obligations on subprocessors equivalent to those relevant under this agreement and remains responsible for their performance as required by GDPR Article 28.

## International transfers

Codaform shall transfer personal data outside the EEA only on documented instructions and in accordance with GDPR Chapter V. The order or processing schedule shall identify the applicable processing locations and recipients. Where required, the parties shall use an appropriate transfer mechanism and supplementary measures before the transfer takes place.

Codaform shall provide information reasonably needed by the controller to assess the transfer and its safeguards. If legally required processing prevents compliance with the instructions, Codaform shall inform the controller where permitted and cooperate on appropriate protective steps.

## Rights requests and incidents

Taking account of the nature of processing, Codaform shall assist the controller with requests to exercise data-subject rights through appropriate technical and organisational measures. It shall promptly forward requests relating to the controller's processing and shall not respond on the controller's behalf unless authorised or legally required.

Codaform shall notify the controller without undue delay after becoming aware of a personal data breach affecting the processing covered here. The notice shall provide available information about the breach, affected data and people, likely consequences, measures taken or proposed and a contact for follow-up. Information may be supplied in stages as it becomes available.

Codaform shall assist the controller with applicable security, breach-notification, impact-assessment and prior-consultation obligations, taking account of the processing and information available. The controller remains responsible for its decisions and notifications to supervisory authorities and affected individuals.

## Return and deletion

At the end of the processing service, the controller may choose return or deletion of the personal data. The controller must give its choice within 30 days; if it gives no instruction, Codaform shall delete the data. For a return request, the parties shall use a secure transfer channel and a commonly used format appropriate to the data. Codaform shall complete return or deletion of active copies within 60 days after the service ends, unless the parties agree a shorter period.

Copies retained because Union or Member State law requires it shall remain protected and limited to that purpose. Backup copies shall remain isolated from ordinary use until their scheduled deletion under the backup retention period specified for the service. If restored, they remain subject to the controller's deletion and restriction instructions. Codaform shall confirm completion on request.

## Accountability and audits

Codaform shall make available information necessary to demonstrate compliance with this agreement and shall allow and contribute to audits, including inspections, by the controller or its mandated auditor. The parties shall agree practical arrangements, reasonable notice and confidentiality protections that preserve other customers' data without obstructing statutory rights. Urgent incident or regulatory requirements may justify shorter notice.

The governing law and dispute provisions of the underlying agreement apply, subject to mandatory data-protection law. Nothing in this agreement restricts data subjects' rights or the powers of a competent supervisory authority.

## References

- [IMY: processor agreements](https://www.imy.se/verksamhet/dataskydd/det-har-galler-enligt-gdpr/personuppgiftsansvariga-och-personuppgiftsbitraden/personuppgiftsbitradesavtal/)