Data processing agreement
When your website takes bookings, orders or messages, we handle personal data for you. This agreement says how, in line with the General Data Protection Regulation.
Version 1, 29 October 2026. Draft: to be reviewed by a lawyer before the site launches. This is a translation; the Swedish version applies.
1. Parties and background
This agreement applies between the customer as controller and Stamis Entreprenad AB, org. no. 559283-5903 (Digitalo), as processor, and forms part of the agreement on the website assignment, hosting and maintenance. It meets Article 28 of the General Data Protection Regulation (EU) 2016/679.
2. The processing
Purpose: to build, host, maintain and troubleshoot the customer's website.
Personal data: what visitors provide on the website, such as name, e-mail, phone, address, messages, bookings and orders, and technical data such as IP addresses in logs.
Data subjects: the customer's visitors, customers, members and employees.
Duration: for as long as Digitalo has an assignment, hosting or maintenance for the customer.
3. Digitalo's obligations
Digitalo processes the personal data only on the customer's documented instructions, such as this agreement and the website's settings. If Digitalo considers that an instruction breaks the law, Digitalo says so.
Anyone at Digitalo who processes the data is bound by confidentiality.
Digitalo takes the security measures required under Article 32: encrypted transfer, personal logins with strong passwords, up-to-date software, restricted access and backups.
Digitalo helps the customer, against payment for the time spent, to respond to requests from data subjects and with impact assessments.
4. Sub-processors
The customer agrees that Digitalo engages sub-processors. Today: Automattic Inc. through Pressable (web hosting; the website is in a data centre in Amsterdam) and the services the customer has chosen for e-mail, payment and calendar.
Digitalo informs the customer at least 30 days before a new sub-processor is engaged. The customer may object on reasonable grounds.
If data is transferred to a country outside the EU/EEA, this is done on the basis of an adequacy decision or the European Commission's standard contractual clauses.
5. Personal data breaches
Digitalo informs the customer without undue delay, and no later than 48 hours after Digitalo discovered it, of a personal data breach concerning the customer's data, with the information the customer needs to report the breach to the Swedish Authority for Privacy Protection (IMY).
6. Audit
The customer may check that Digitalo complies with this agreement, by receiving the information needed and, with at least 30 days' notice, through an audit by an independent auditor bound by confidentiality. The customer bears its own costs.
7. When the agreement ends
Within 30 days of the assignment ending, Digitalo returns the personal data to the customer, if the customer asks for it, and then deletes its copies, except where the law requires them to be kept.
8. Liability
The limitation of liability in the general terms and conditions also applies to this agreement, except where the law does not allow it.