Data Processing Agreement

Tuesday, 1 October 2024

Between

Controller: the “User”

Processor: WorkNode Freelance AB

Company registration number: 559156-1294

This Data Processing Agreement (the “Agreement”) is part of the General Terms and applies between WorkNode Freelance AB, company registration number 559156-1294 (“WorkNode”), and you (the “User”). By accepting the General Terms, you also undertake to comply with this Agreement and consent to WorkNode's processing of personal data.

1.1 Both Parties confirm that their signatories are authorised to enter into this Agreement, which is an integral part of the General Terms entered into between the Parties. This Agreement governs the processing of Personal Data under the General Terms in force from time to time.

1.2 WorkNode acts in accordance with its Privacy and Data Protection Policy, available at /en/privacy-policy.

2.1 Personal Data and processing of Personal Data have the same definitions as in applicable data-protection legislation, including the General Data Protection Regulation (GDPR), applicable under this Agreement and in Europe from 25 May 2018, and applicable supplementary national personal-data legislation.

2.2 In this Agreement, the Controller is referred to as the “User” or a “Party”, the Processor as “WorkNode” or a “Party”, and together they are the “Parties”.

3.1 The Agreement governs WorkNode's processing of Personal Data on the User's behalf and describes how WorkNode ensures data protection under applicable Data Protection Legislation.

3.2 This Agreement prevails over conflicting provisions concerning processing of Personal Data in other agreements between the Parties.

4.1 WorkNode may process Personal Data only on behalf of and in accordance with the User's documented instructions. By entering into this Agreement, the User instructs WorkNode to process Personal Data:

i) in accordance with applicable law;

ii) to perform the other agreements contained in the General Terms;

iii) as further specified through the User's normal use of WorkNode's services; and

iv) in the manner stated in this Agreement.

4.2 WorkNode has no reason to believe that any legislation prevents it from following the instructions above. On becoming aware that, in WorkNode's opinion, the User's instructions or processing contravene applicable data-protection legislation, WorkNode must inform the User.

4.3 The categories of Data Subjects and Personal Data covered by Processing under this Agreement are stated in this document.

4.4 WorkNode must ensure the confidentiality, integrity and availability of Personal Data in accordance with applicable personal-data legislation. WorkNode must implement measures to ensure a level of security appropriate to the risk presented by the Processing and the type of Personal Data to be protected.

4.5 Taking account of the nature of Processing and the information available to WorkNode, WorkNode must assist the User, so far as possible, with appropriate measures to meet the User's obligations under applicable data-protection legislation concerning requests from Data Subjects and data protection generally under the GDPR.

4.6 If the User requires information about security measures, documentation or other information about WorkNode's Processing of Personal Data, and the request entails information beyond the standard information WorkNode provides to comply with applicable data-protection legislation as Processor, WorkNode may charge the User for those additional services.

4.7 WorkNode and its personnel must ensure the confidentiality of Personal Data Processed under this Agreement. This condition continues after the Agreement ends.

4.8 By notifying the User promptly and without undue delay, WorkNode must enable the User to meet legal requirements to notify relevant data-protection authorities and Data Subjects of personal-data breaches.

4.9 Furthermore, to the extent possible and lawful, WorkNode must notify the User of:

i) requests received from a Data Subject for disclosure of Personal Data; and

ii) requests from public authorities for disclosure of Personal Data.

4.10 WorkNode may not respond directly to requests from Data Subjects without the User's consent. WorkNode may not disclose content concerning the Agreement, including Personal Data, to authorities such as the Police except where required by law, for example by a court order.

5.1 By signing this Agreement, the User confirms that the User:

i) when using services provided by WorkNode under the General Terms, will Process Personal Data in accordance with applicable data-protection legislation;

ii) has a legal basis to Process and disclose the relevant Personal Data to WorkNode, including any WorkNode subprocessors;

iii) is solely responsible for the accuracy, integrity, content, reliability and lawfulness of Personal Data provided to WorkNode;

iv) has met all mandatory requirements and obligations to notify or obtain permission from relevant authorities for Processing Personal Data;

v) has discharged its obligations to provide relevant information to Data Subjects concerning Processing of Personal Data under Applicable Personal Data Legislation;

vi) agrees that WorkNode has taken security measures sufficient to protect Data Subjects' privacy and Personal Data;

vii) when using services provided by WorkNode under the General Terms, will not transfer to WorkNode any Sensitive Personal Data or data concerning criminal convictions and offences. If such a transfer occurs, WorkNode cannot be held liable for incorrect processing of that Sensitive Personal Data; and

viii) will maintain an up-to-date record of the types and categories of Personal Data it Processes.

6.1 In delivering services to the User under the General Terms and this Agreement, WorkNode may use suppliers as subprocessors. Such subprocessors may be WorkNode affiliates or third-party external suppliers inside or outside the EU. WorkNode must ensure by agreement that suppliers consent to assume responsibility corresponding to the obligations stated in this Agreement.

6.2 The User may at any time request a complete overview and more detailed information about suppliers involved in delivering the service under the General Terms.

6.3 If suppliers are located outside the EU, WorkNode must ensure that transfers take place in accordance with Applicable Personal Data Legislation. The User hereby authorises and empowers WorkNode to establish an appropriate legal basis for transferring Personal Data outside the EU on the User's behalf, for example by signing EU Standard Contractual Clauses on the User's behalf or transferring Personal Data in accordance with the EU–US Privacy Shield.

6.4 The User must be notified before changes are made concerning suppliers that Process Personal Data. If a new supplier demonstrably fails to comply with applicable data-protection legislation and continues to do so after WorkNode has been given reasonable time to ensure compliance, the User may terminate the Agreement. Such termination may include a right to terminate the General Terms. An important part of such assessments must be the extent to which the supplier's Processing of Personal Data is a necessary part of the services provided under the General Terms. A change of supplier does not in itself constitute a breach of the General Terms.

6.5 By signing this Agreement, the User accepts that WorkNode uses suppliers as described above.

7.1 This Agreement remains valid for as long as WorkNode Processes Personal Data on the User's behalf under the General Terms.

7.2 The Agreement ends automatically when the General Terms end. When the Agreement ends, WorkNode will delete or return Personal Data Processed on the User's behalf in accordance with the General Terms. Unless otherwise agreed in writing, the cost of such measures will be based on:

i) WorkNode's hourly rate; and

ii) the complexity of the requested process.

7.3 WorkNode may retain Personal Data after the Agreement ends to the extent required by law.

8.1 This Agreement is governed by the applicable law and jurisdiction stated in the relevant General Terms.

9.1 Because WorkNode's services allow the User to Process arbitrary data within the services, it is not possible to state generally the categories of Data Subjects and Personal Data covered by Processing. The User is responsible for recording this information.

9.2 The User may not transfer any Sensitive Personal Data to WorkNode. If such a transfer occurs, WorkNode cannot be held liable for incorrect processing of that Sensitive Personal Data. Sensitive Personal Data is defined in Applicable Personal Data Legislation as: racial or ethnic origin; political opinions; religious or philosophical beliefs; health data; data concerning a person's sex life or sexual orientation; trade-union membership; genetic data; or biometric data used uniquely to identify a natural person.

9.3 Nor may the User transfer personal data concerning criminal convictions and offences.

10.1 WorkNode's current suppliers that have access or limited access to the User's Personal Data are listed at /en/privacy-policy.