AquaLabs Data Processing Agreement (GDPR Article 28)
This agreement is part of the AquaLabs Terms of Service. It applies when AquaLabs Nordic, org. no. 811010-0511, Birger Velinders Väg 2A, 268 31 Svalöv, Sweden (“Processor”) processes personal data on behalf of a customer (“Controller”) through AquaLabs Virtual Desktop and Smart Data Systems.
1. Subject and duration
The Processor processes personal data only to provide the Service, for as long as the Controller’s subscription runs, plus the 30-day export period in the Terms.
2. What is processed
| Data subjects | The Controller’s customers, their contact people, the Controller’s staff, supplier contact people |
|---|---|
| Personal data | Names, addresses, phone numbers, email addresses, vehicle registration numbers and vehicle data, work orders, invoices and payment status |
| Special categories | None. The Controller must not enter special-category data (Art. 9) |
| Purposes | Receiving and reading supplier invoices, work orders, invoicing, archive, customer and vehicle register, sending drafts to systems the Controller connects |
3. Processor obligations
The Processor will:
- Process personal data only on the Controller’s documented instructions, including these terms and the Controller’s use of the Service.
- Ensure that everyone with access is bound by confidentiality.
- Take appropriate technical and organisational security measures (Art. 32), including access control per company account, encryption in transit, EU data storage and locked audit logs.
- Help the Controller answer data-subject requests and meet its duties under Articles 32–36.
- Notify the Controller without undue delay, and within 48 hours where possible, after becoming aware of a personal data breach.
- At the end of the agreement, return the data (export) and then delete it, unless law requires storage.
- Make available the information needed to show compliance, and allow audits by the Controller or an auditor it appoints, with reasonable notice and no more than once a year unless a breach has occurred.
4. Sub-processors
The Controller gives general authorisation for the sub-processors below. The Processor will notify the Controller at least 30 days before adding or replacing one; the Controller may object on reasonable grounds and, if no solution is found, end the agreement.
| Sub-processor | Purpose | Location of processing | Transfer safeguard |
|---|---|---|---|
| Supabase, Inc. | Database, file storage, sign-in, server functions | EU (Stockholm, Sweden) | Data stays in the EU |
| Vercel, Inc. | Hosting of the web application and its server routes | EU / USA | EU–US Data Privacy Framework, SCCs |
| Postmark (ActiveCampaign, LLC) | Receiving supplier invoices by email into the desk | USA | EU–US Data Privacy Framework, SCCs |
| Anthropic PBC | Automated reading of supplier invoices | USA | SCCs |
Systems the Controller connects itself, such as Visma e-conomic, are not sub-processors. Data sent there on the Controller’s instruction is governed by the Controller’s own agreement with that provider.
5. Transfers outside the EU/EEA
Transfers happen only to the sub-processors listed above and only with a valid safeguard under GDPR Chapter V.
6. Liability and law
Liability follows the Terms of Service. This agreement is governed by Swedish law, with disputes settled by Swedish courts as set out in the Terms.
7. Contact
AquaLabs Nordic · Birger Velinders Väg 2A, 268 31 Svalöv, Sweden · admin@aqualabs.se