Data Processing Agreement

This data processing agreement (the “DPA”) is entered into between the customer using Blixtflow (the “Controller” or the “Customer”) and Blixtgo Agency AB, Swedish company registration number 559069-9038 (the “Processor” or “we”).

The DPA forms part of the agreement on Blixtflow under our terms of service (the “Main Agreement”). It is concluded when the Customer accepts it in Blixtflow and applies for as long as we process personal data on the Customer’s behalf. In case of conflict, the DPA prevails over the Main Agreement on matters of personal data.

Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meaning given in Regulation (EU) 2016/679 (the “GDPR”). “Data Protection Legislation” means the GDPR, the Swedish Act (2018:218) containing supplementary provisions to the GDPR and other applicable legislation on the protection of personal data. “Subprocessor” means another processor engaged by us for the processing.

We process personal data on the Customer’s behalf to provide Blixtflow under the Main Agreement: receiving, storing, displaying, sending and organising the Customer’s communication and related data, and for support, security and troubleshooting. The categories of data subjects, personal data and the duration are set out in Annex 1.

The Customer is responsible for ensuring that the processing of personal data in Blixtflow is lawful, that there is a legal basis, that data subjects receive information under Articles 13 and 14 GDPR and that the Customer’s instructions comply with Data Protection Legislation. The Customer is responsible for the settings made in Blixtflow, such as which channels are connected, which Users have access, call recording and retention periods.

We shall

• process the personal data only on the Customer’s documented instructions. The Main Agreement, this DPA and the Customer’s settings and choices in Blixtflow constitute the Customer’s complete instructions,
• inform the Customer without delay if we consider that an instruction infringes Data Protection Legislation,
• not process the personal data for our own purposes, and not use it to train general AI models,
• if the law requires us to process the data otherwise, inform the Customer before processing, unless the law prohibits this.

We ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under a statutory obligation of confidentiality. Access is limited to persons who need it to perform their duties. Support access to the Customer’s workspace takes place only through a logged support mode.

We implement the technical and organisational measures required under Article 32 GDPR to ensure a level of security appropriate to the risk. The measures are described in Annex 2. We may update the measures provided the level of protection is not reduced.

The Customer gives general prior authorisation for us to engage subprocessors. Current subprocessors are listed on the Subprocessors page, which constitutes Annex 3.

• We inform the Customer at least 30 days before a new subprocessor is engaged or an existing one is replaced, by email or in Blixtflow.
• The Customer may object to the change on reasonable grounds within this period. If the parties cannot agree, the Customer may terminate the Main Agreement with effect from the date of the change, with a refund of prepaid fees for the period thereafter.
• We enter into written agreements with each subprocessor imposing obligations equivalent to those in this DPA and remain liable to the Customer for the subprocessor’s performance.

Personal data may be transferred to a country outside the EU/EEA only if the transfer meets the requirements of Chapter V GDPR, for example through an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission’s standard contractual clauses, supplemented by additional safeguards where needed. Where subprocessors process personal data and which safeguard applies is stated in Annex 3.

Taking into account the nature of the processing, we assist the Customer

• through appropriate features in Blixtflow, such as data access reports, deletion of a person’s data and automatic retention, when data subjects exercise their rights,
• by forwarding without delay requests from data subjects that we receive directly, without responding to them ourselves,
• with information needed for impact assessments and prior consultations under Articles 35 and 36 GDPR, and
• otherwise in fulfilling the obligations under Articles 32–36 GDPR.

Assistance beyond what Blixtflow normally offers, and not caused by our own fault, may be charged at our current hourly rate by agreement.

We notify the Customer without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach affecting the Customer’s personal data. The notification shall, to the extent available, include

• a description of the nature of the breach, the categories and approximate number of data subjects and records concerned,
• the likely consequences,
• the measures taken or proposed to address the breach and mitigate its effects, and
• a contact person.

Information not available immediately is provided in phases. The Customer decides on notification to the supervisory authority and communication to data subjects.

We make available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR. The Customer, or an independent auditor appointed by the Customer and bound by confidentiality, may carry out an audit at most once a year, and additionally after a personal data breach or at the request of a supervisory authority. Audits shall be announced at least 30 days in advance, take place during office hours and not disrupt operations or other customers’ security. The Customer bears its own costs for the audit.

Liability towards data subjects and administrative fines are allocated under Articles 82 and 83 GDPR. Between the parties, the limitation of liability in the Main Agreement applies, except where we have processed personal data contrary to the Customer’s instructions or to the requirements Data Protection Legislation places on processors.

The DPA applies for as long as we process personal data on the Customer’s behalf. When the Main Agreement has ended, the Customer can export its data for 30 days. We then delete the personal data, including copies, unless the law requires storage. Backups are deleted within their normal rotation cycle and remain protected under this DPA in the meantime. On request, we confirm the deletion in writing.

The DPA is governed by Swedish law. Disputes are resolved as set out in the Main Agreement. The DPA is available in Swedish and English; in case of discrepancies, the Swedish version prevails.

Access and identity

• Passwords are stored with Argon2id. Login tokens are random (256 bits) and stored only as hashes.
• Two-step verification with one-time codes and recovery codes; the Customer can require it for all Users.
• Protection against automated attacks: rate-limited login attempts, increasing delays and account lockout after repeated failures.
• Sign-out after inactivity, “sign out everywhere” and revocation of sessions on password change.
• Role-based access (owner, administrator, team lead, member, projects only) and private channels.

Isolation and encryption

• Each customer’s data is logically isolated from other customers’ data.
• All transfer is encrypted (HTTPS/TLS). Keys and attachments are encrypted.
• The mobile app keeps the sign-in in the device’s secure key storage and encrypts locally cached data (AES-256-GCM); everything is deleted on sign-out.

Privacy in the features

• Personal identity numbers, card numbers and IBANs are masked before text is sent for AI processing.
• Email is displayed in isolation; external images and tracking pixels are blocked by default.
• Playback of call recordings is logged.
• Tools for data access reports, deletion of a person’s data and automatic retention.

Organisation

• Access under the principle of least privilege; support access only through a logged support mode.
• Confidentiality undertakings for staff and consultants.
• Procedures for backup, restore and handling of personal data breaches.
• Agreements with all subprocessors under Article 28 GDPR.

The current list of subprocessors, with service, location and safeguard, is available on the Subprocessors page. The list forms part of this DPA.