Data Processing
Agreement

This DPA is between the customer (the “Controller”) and Settio Partners AB, org. nr 559587-0303 (“Settio”, the “Processor”). Where an agency uses Settio to run cases for an employer, the agency is the Controller towards Settio, and is responsible for its own arrangement with the employer. If this DPA and the Principal Agreement conflict on data protection, this DPA prevails.

Terms not defined here have the meaning given in the GDPR. “Customer Data” means personal data that the Controller, its authorised users, or the people it invites (such as employees in the portal) put into or generate through the Services.

The Processor processes Customer Data only to provide and support the Services, for the duration of the Principal Agreement, as described in Annex I. Settio is a separate controller for the data it needs to run its own business: the accounts of authorised users, sign-in and security records, billing, and support, as described in our Privacy Policy.

• The Controller decides which data it puts into Settio and is responsible for having a legal basis for it (Art. 6), and for special categories and criminal-offence data, a condition under Art. 9 or Art. 10 and the national law that applies (in Sweden, the Data Protection Act (2018:218) 3 kap.).
• The Controller informs the people concerned (Art. 13 and 14). The employee portal shows a privacy notice on the Controller’s behalf, which the Controller should check fits its own processing.
• The Controller sets the retention period for closed cases in its workspace settings.
• The Settio content the Controller relies on (plans, steps, thresholds, AI suggestions) is general information, not legal advice; see Information, not legal advice.

• Process Customer Data only on the Controller’s documented instructions, including on transfers. The Principal Agreement, this DPA and the Controller’s use of the Services’ features are those instructions. The Processor tells the Controller at once if, in its opinion, an instruction breaks the GDPR or other data protection law.
• Make sure everyone who can access Customer Data is bound by confidentiality.
• Take the security measures in Annex II (Art. 32). They may change, but the overall level of protection is never lowered.
• Help the Controller, given the nature of the processing, with its duties under Articles 32 to 36 (security, breaches, impact assessments, prior consultation).
• Give the Controller the information it needs to show compliance with Article 28, and allow audits (section 10).
• Never send passports, national ID cards or residence permit cards to an AI provider, and keep no copy of a passport or ID card, only the details read from it.

The Controller gives general written authorisation for the subprocessors listed at /subprocessors. The Processor will:

• give at least 30 days’ notice of a new subprocessor, by email or in the app;
• let the Controller object on reasonable data protection grounds; if the parties can’t resolve it, the Controller may end the affected Service and get back fees paid for the unused period;
• bind each subprocessor by contract to obligations that protect the data at least as well as this DPA, and remain responsible to the Controller for its subprocessors.

Some subprocessors are in the United States or may store data there. For each such transfer, the Processor relies on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the subprocessor is certified under it (Art. 45), and otherwise on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Three (processor to processor), in the subprocessor’s data processing agreement (Art. 46(2)(c)), with a transfer assessment. The Controller may ask for a copy.

The Processor helps the Controller answer requests from data subjects, mainly through the Services’ own tools (export, correction and deletion of a person’s data, and the employee portal’s Your data). If a data subject writes to the Processor, it passes the request to the Controller without undue delay and doesn’t answer it on its own unless the Controller asks.

The Processor notifies the Controller without undue delay, and no later than 48 hours after becoming aware of a personal data breach affecting Customer Data, so the Controller can meet its own 72-hour deadline (Art. 33). The notice describes, as far as known:

• what happened and which categories and roughly how many people and records are affected;
• the likely consequences;
• what has been done or is proposed to deal with it;
• who to contact for more information.

On written request, the Processor gives the Controller documentation of its security measures and answers reasonable security questionnaires. If that is not enough, the Controller (or an auditor bound by confidentiality) may audit the processing of Customer Data, on 30 days’ notice, at its own cost, once a year unless a breach or an authority requires more.

• During the agreement: closed cases are anonymised automatically after the retention period the Controller sets (files deleted, personal fields wiped), except a permit copy the destination’s law requires the employer to keep. The Controller can delete a person’s data at any time.
• At the end: within 30 days, at the Controller’s choice, the Processor returns Customer Data (by export) and deletes it, including from backups in their normal cycle, unless EU or member-state law requires the Processor to keep it.

Liability under this DPA follows the Principal Agreement, without limiting either party’s liability towards data subjects under Article 82 GDPR. This DPA is governed by Swedish law, and disputes are settled by Swedish courts, with Stockholm District Court as the first instance.