1. Parties and Background
This Data Processing Agreement (DPA) supplements the Terms of Service between you (the data subject) and Bilbo Glans AB (the data controller). This agreement governs the terms under which Bilbo Glans processes personal data on your behalf as data controller. This DPA fulfills the requirements of Article 28 of Regulation (EU) 2016/679 (GDPR).
2. Scope and Purpose of Processing
Bilbo Glans processes personal data for the following purposes: providing the booking platform, handling payments, customer support, service communications, and fulfilling legal obligations. The processing covers all personal data required for these purposes as described in the Privacy Policy.
3. Duration of Processing
Personal data is processed for the duration required to fulfill the agreement with you and for the period required to comply with legal obligations, such as accounting law requirements. After processing is completed, the data is deleted or anonymized in accordance with our retention schedule.
4. Categories of Data Subjects and Personal Data
The processing covers the following categories of data subjects: customers, users, partner companies, drivers. The following categories of personal data are processed: identification data, contact data, vehicle data, payment data, usage data, location data, and communications data. A full list is provided in Appendix A of this agreement.
5. Obligations of the Data Processor
Bilbo Glans undertakes to: (a) process personal data only in accordance with documented instructions from the data subject, (b) ensure that persons authorized to process the personal data have committed themselves to confidentiality, (c) implement all security measures required under Article 32 GDPR, (d) not engage another processor without prior written authorization, (e) assist the data subject in fulfilling its obligations to respond to requests for exercising data subjects' rights, (f) assist with compliance with obligations pursuant to Articles 32–36 GDPR, (g) at the end of processing, delete or return all personal data, (h) make available to the data subject all information necessary to demonstrate compliance with the GDPR.
6. Sub-processors
The data subject authorizes Bilbo Glans to engage the following sub-processors: (a) Cloud service providers: Amazon Web Services (AWS) for hosting, Google Cloud Platform for analytics. (b) Payment processors: Klarna AB, Swish (Getswish AB). (c) Communication services: SendGrid (email), Twilio (SMS). A current list of sub-processors is available upon request. Bilbo Glans shall inform the data subject of any intended changes concerning the addition or replacement of sub-processors at least 30 days in advance.
7. Security Measures
Bilbo Glans has implemented the following technical and organizational security measures: (a) Pseudonymization and encryption of personal data, (b) Measures to ensure ongoing confidentiality, integrity, availability, and resilience of processing systems, (c) Measures to restore the availability and access to personal data in a timely manner in the event of an incident, (d) Regular testing and evaluation of the effectiveness of technical and organizational measures, (e) Access control based on the principle of least privilege, (f) Logging and monitoring of access to personal data.
8. Personal Data Breach Notification
Bilbo Glans shall without undue delay and within 48 hours notify the data subject of a personal data breach involving the processed personal data. The notification shall include: (a) a description of the nature of the breach, (b) contact information for the data protection officer, (c) likely consequences of the breach, (d) measures taken to address the breach. Bilbo Glans shall also assist the data subject in fulfilling its obligation to notify the breach to the supervisory authority.
9. Audit
The data subject has the right to audit Bilbo Glans's compliance with this agreement, including on-site inspection, provided that: (a) written notice is given at least 30 days in advance, (b) the audit is conducted during business hours and does not disrupt operations, (c) audit costs are borne by the data subject if no breach of the agreement is found.
10. Governing Law and Dispute Resolution
This agreement shall be governed by Swedish law. Disputes shall be settled by a Swedish court of general jurisdiction, with the Stockholm District Court as the court of first instance.