Data Processing Agreement
Last updated: 2026-10-20
This is an English translation of the Swedish original. If the versions differ, the Swedish version prevails.
Version: 1.0
This data processing agreement (“this DPA”) forms part of the agreement on the JOBBS platform (“the Main Agreement”) and meets the requirements of Article 28(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council (“the GDPR”).
1. Parties
1.1 The Customer, meaning the legal entity that has entered into the Main Agreement with JOBBS, as controller (“the Customer”).
1.2 JOBBS AB, Reg. No. 559378-9083, Mellbygatan 9, 531 31 Lidköping, as processor (“JOBBS”).
1.3 The Customer and JOBBS are referred to together as “the Parties” and individually as a “Party”.
2. Background
2.1 JOBBS provides the JOBBS platform, which consists of the administration interface, checkout and self-service, the JOBBS app, the web app pay.jobbs.se, booking, memberships, punch cards, gift cards, subscriptions, access and door control, and related services (“the Service”).
2.2 When JOBBS provides the Service, JOBBS processes personal data on behalf of the Customer. The Customer is the controller for that processing.
2.3 JOBBS is an independent controller for the processing of data about end customers’ accounts in the JOBBS app (registration, login, account security and the functioning of the app) and for processing that JOBBS carries out for its own purposes, such as invoicing the Customer, contract administration and development of the Service using de-identified or aggregated data. Such processing is not covered by this DPA.
3. Definitions
3.1 Terms used in the GDPR, for example personal data, processing, controller, processor, data subject and personal data breach, have the same meaning in this DPA.
3.2 In addition, the following applies:
- Data Protection Legislation: the GDPR, the Swedish Data Protection Act (dataskyddslagen) (2018:218), which contains supplementary provisions to the EU General Data Protection Regulation, and other applicable legislation on the protection of personal data, as well as binding decisions and regulations issued by the competent supervisory authority.
- Instructions: the Customer’s documented instructions under section 5.
- Sub-processor: another processor engaged by JOBBS to process personal data on behalf of the Customer.
- Third Country: a country outside the EU/EEA.
- End Customer: a natural person who shops, books, is a member or passes through a door at the Customer’s premises using the Service.
- Administrator Settings: the settings that the Customer or the Customer’s authorised users make in the administration interface, for example activated modules, integrations and retention periods.
4. Subject matter, duration, nature and purpose
4.1 Subject matter: processing of personal data required for JOBBS to provide the Service to the Customer under the Main Agreement.
4.2 Duration: for as long as the Main Agreement is in force and thereafter for the time needed to erase or return the personal data under section 15.
4.3 Nature: collection, recording, organisation, storage, adaptation, retrieval, use, transfer to the Customer’s payment and integration partners, combination, restriction, erasure and destruction.
4.4 Purpose: to provide, operate, maintain, troubleshoot and secure the Service, for example sales and receipts, bookings, memberships and cards, access and door control, communication with End Customers on behalf of the Customer, reports and support.
4.5 A more detailed description is set out in Appendix 1.
5. Instructions
5.1 JOBBS may only process the personal data in accordance with the Customer’s documented Instructions. The Instructions consist of:
- this DPA and the Main Agreement,
- Administrator Settings that the Customer makes in the Service, and
- other written instructions agreed by the Parties.
5.2 The Instructions also cover transfers to a Third Country made under section 9 and to the Sub-processors approved under section 8, as well as transfers to external systems that the Customer itself activates (see section 8.7).
5.3 JOBBS may process the personal data without instruction if required to do so by Union law or Swedish law. In that case JOBBS shall inform the Customer of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.
5.4 JOBBS shall immediately inform the Customer if JOBBS considers that an instruction infringes Data Protection Legislation. JOBBS may postpone carrying out the instruction until the Customer has confirmed or changed it.
5.5 The Customer is responsible for ensuring that there is a legal basis for the processing, that data subjects receive information under Articles 13 and 14, and that the Customer’s instructions comply with Data Protection Legislation. This applies in particular to the processing of personal identity numbers (personnummer), which under Chapter 3, Section 10 of the Swedish Data Protection Act (2018:218) may only take place when clearly justified with regard to the purpose, the importance of secure identification or another legitimate reason.
5.6 New instructions that lead to significantly increased costs for JOBBS and that do not follow from Data Protection Legislation are compensated in accordance with JOBBS’ current price list or as otherwise agreed.
6. Confidentiality
6.1 JOBBS shall ensure that all persons who have access to the personal data, such as employees and consultants, have committed themselves to confidentiality or are under a statutory obligation of confidentiality.
6.2 JOBBS shall limit access to the persons who need it to perform their duties.
6.3 Confidentiality continues to apply after this DPA has ended.
6.4 If an authority or other third party requests disclosure of personal data, JOBBS shall refer the request to the Customer and inform the Customer of the request without delay, unless prohibited by law.
7. Security
7.1 JOBBS shall take the technical and organisational measures required under Article 32 of the GDPR, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risks to the rights and freedoms of data subjects.
7.2 The measures are described in Appendix 2. JOBBS may change the measures provided that the level of protection is not reduced.
7.3 The Customer is responsible for security in matters the Customer itself controls, for example assigning permissions to the right persons, protecting administrator login credentials, equipping and protecting the Customer’s premises, cameras and doors, and deactivating users who should no longer have access.
8. Sub-processors
8.1 The Customer gives JOBBS a general prior authorisation to engage Sub-processors.
8.2 The Sub-processors used by JOBBS when this DPA is entered into are set out in the published list of sub-processors, see Appendix 3. The Customer approves them by entering into this DPA.
8.3 JOBBS shall inform the Customer at least 30 days in advance of any intended addition or replacement of Sub-processors, by email to the Customer’s contact person and by updating the list.
8.4 The Customer may object to the change within 30 days of the notice, if the objection is based on reasonable grounds relating to data protection. The Parties shall then try in good faith to find a solution. If they do not, the Customer may terminate the part of the Main Agreement that cannot be delivered without the new Sub-processor, with effect from the date on which the change would have taken effect. The Customer is then entitled to a refund of prepaid fees for the terminated part relating to the period after termination. JOBBS may not use the new Sub-processor for the Customer’s personal data while the objection is being handled.
8.5 In urgent cases, for example if a Sub-processor suddenly ceases operations or a replacement is required for security reasons, JOBBS may replace a Sub-processor at shorter notice. JOBBS shall then inform the Customer as soon as possible, and the Customer has the same right to object as under section 8.4.
8.6 JOBBS shall enter into a written agreement with each Sub-processor imposing on the Sub-processor the same data protection obligations that JOBBS has under this DPA, in particular providing sufficient guarantees of appropriate technical and organisational measures. If the Sub-processor fails to fulfil its obligations, JOBBS remains fully liable to the Customer for the performance of the Sub-processor’s obligations.
8.7 Integrations activated by the Customer. When the Customer activates an integration with an external system with which the Customer itself has an agreement, for example a business system, a membership system or electronic shelf labels, JOBBS transfers data to that system in accordance with the Customer’s instruction. The supplier of the external system is then the Customer’s own processor or an independent controller, and not a Sub-processor of JOBBS. The Customer is responsible for having its own agreement with that supplier.
8.8 Modules that are only used when the Customer activates them, for example certain lock integrations and JOBBS AI, are specifically identified in the list. Sub-processors for such a module process the Customer’s personal data only if the Customer has activated the module.
9. Transfers to third countries
9.1 JOBBS may transfer personal data to a Third Country, or allow a Sub-processor to do so, only if supported by Chapter V of the GDPR, for example:
- an adequacy decision under Article 45, including the EU-US Data Privacy Framework for recipients certified under the framework,
- the European Commission’s 2021 standard contractual clauses (SCCs) (Decision (EU) 2021/914), primarily Module 3 (processor to sub-processor), or
- binding corporate rules (BCRs) under Article 47.
9.2 When the transfer is based on SCCs or BCRs, JOBBS shall ensure that there is an assessment of the transfer’s impact (transfer impact assessment) and, where necessary, supplementary measures, for example encryption. JOBBS shall provide the Customer with a summary of the assessment on request.
9.3 The basis that applies to each Sub-processor is set out in the list in Appendix 3.
10. Assistance with data subjects’ rights
10.1 JOBBS shall, taking into account the nature of the processing, assist the Customer through appropriate technical and organisational measures so that the Customer can respond to requests from data subjects for access, rectification, erasure, restriction, data portability and objection.
10.2 The Customer can do most of this itself in the administration interface, for example search for, correct and erase data about an End Customer and export lists to Excel. If the Customer needs a complete export, JOBBS delivers it on request.
10.3 If JOBBS receives a request directly from a data subject concerning the Customer’s processing, JOBBS shall forward it to the Customer without undue delay and shall not respond to it itself, unless the Customer has instructed it to do so.
10.4 Assistance that goes beyond the functions of the Service is compensated in accordance with JOBBS’ current price list, unless the assistance is needed because JOBBS has breached this DPA.
11. Assistance under Articles 32 to 36
11.1 JOBBS shall, taking into account the nature of the processing and the information available to JOBBS, assist the Customer in fulfilling its obligations under Articles 32 to 36 of the GDPR, namely security, notification and communication of personal data breaches, data protection impact assessments and prior consultation with the supervisory authority.
11.2 JOBBS shall on request provide the information about the Service that the Customer needs for a data protection impact assessment, for example for access control, proximity unlocking using location or camera surveillance in an unmanned store.
12. Personal data breaches
12.1 JOBBS shall notify the Customer without undue delay, and no later than within 48 hours, after JOBBS has become aware of a personal data breach concerning the Customer’s personal data.
12.2 The notification shall, to the extent the information is available, contain:
- a description of the breach, the categories and approximate number of data subjects and personal data records concerned,
- the name and contact details of JOBBS’ contact person,
- the likely consequences of the breach, and
- the measures JOBBS has taken or proposes to address the breach and mitigate its effects.
12.3 If not all information is available at once, it may be provided in phases without undue delay.
12.4 JOBBS shall document the breach and cooperate with the Customer. JOBBS may not itself notify the supervisory authority of the breach or inform the data subjects on behalf of the Customer, unless the Customer has instructed it to do so or the law requires it.
12.5 The fact that JOBBS notifies the Customer does not mean that JOBBS admits liability for the breach.
13. Retention periods
13.1 JOBBS stores personal data in accordance with the Customer’s instruction and the default settings that apply in the Service. Unless the Customer has made another choice, the following applies:
| Category | Retention period |
|---|---|
| Customer log (events linked to an End Customer in the administration interface) | 24 months |
| Troubleshooting logs | 30 days |
| Entry log (access events), including location, Bluetooth signal and motion data on unlocking | 12 months. The Customer can choose 3, 6, 12, 24 or 36 months in the administration interface. |
| BankID evidence in the entry log (IP address, device ID, signature) | 90 days |
| Visitors | 12 months after the most recent visit |
| Messages sent (email and SMS text) | 12 months |
| Customer invitations that have not been used | 90 days |
| Booking guests’ contact details | 12 months after the booking |
| Leads created at entry with BankID | 24 months after the most recent contact |
| Receipts and accounting records | In accordance with the Customer’s bookkeeping obligation, as a rule 7 years after the end of the calendar year in which the financial year ended (Chapter 7, Section 2 of the Swedish Bookkeeping Act (bokföringslagen)) |
| End Customer data (memberships, keys, cards, bookings) | For as long as the End Customer has an active relationship with the Customer, or until the Customer erases it |
| Backups | No more than 35 days |
13.2 The Customer is responsible for ensuring that the retention periods comply with Data Protection Legislation for the Customer’s purposes.
Automatic deletion in accordance with the table applies no later than 1 December 2026.
14. Audits and information
14.1 JOBBS shall make available to the Customer all information necessary to demonstrate compliance with the obligations in Article 28 of the GDPR and this DPA.
14.2 The Customer shall primarily request documentation, for example a description of security measures, policies, third-party certifications or audit reports from JOBBS or Sub-processors.
14.3 If the documentation is not sufficient, or if the supervisory authority requires it, the Customer or an independent auditor appointed by the Customer and bound by confidentiality may carry out an on-site audit, including inspection. The Customer shall notify JOBBS at least 30 days in advance, and the audit shall take place during normal working hours and without unnecessary disruption to JOBBS’ business. In the event of a personal data breach, or if the supervisory authority requires it, the notice period may be shorter.
14.4 The Customer bears its own costs for the audit and reimburses JOBBS for reasonable costs for the time JOBBS spends on the audit, unless the audit shows that JOBBS has materially breached this DPA.
14.5 Audits of Sub-processors are carried out through the documentation and audit reports provided by the Sub-processor, to the extent the Sub-processor’s agreement permits.
15. Erasure and return
15.1 When the Main Agreement ends, JOBBS shall, at the Customer’s choice, erase or return all personal data processed on behalf of the Customer, and erase existing copies.
15.2 The Customer shall communicate its choice no later than 30 days after the agreement has ended. If the Customer does not do so, JOBBS erases the data.
15.3 JOBBS shall complete erasure or return within 60 days after the agreement has ended. Data in backups is erased when the backups are overwritten in the ordinary cycle, and is protected under this DPA until then.
15.4 Return takes place by the Customer exporting the data itself under section 10.2, or through a complete export that JOBBS delivers on request in a common machine-readable format.
15.5 The erasure requirement does not apply if JOBBS is required under Union law or Swedish law to retain the data. JOBBS shall then protect the data and process it only for the purpose required by law.
15.6 JOBBS shall confirm the erasure in writing on request.
16. Liability
16.1 Liability and limitations of liability are governed by the Main Agreement, with the exceptions set out in section 16.2.
16.2 Each Party is liable for compensation to data subjects and for administrative fines under Articles 82 and 83 of the GDPR. If a Party has paid compensation to a data subject for damage caused wholly or partly by the other Party, that Party is entitled to claim back the corresponding part under Article 82(5). The limitation of liability in the Main Agreement also applies to such claims between the Parties.
17. Term and amendments
17.1 This DPA applies from the time the Main Agreement is entered into and for as long as JOBBS processes personal data on behalf of the Customer.
17.2 Amendments shall be made in writing and approved by both Parties. However, JOBBS may update Appendix 2 and Appendix 3 in accordance with sections 7.2 and 8.
17.3 If Data Protection Legislation changes, or if the European Commission or the supervisory authority adopts standard contractual clauses under Article 28(7) or 28(8), the Parties shall in good faith amend this DPA so that it meets the new requirements.
18. Order of precedence
18.1 If this DPA and the Main Agreement conflict on a matter concerning the processing of personal data, this DPA prevails over the Main Agreement.
18.2 If SCCs have been entered into, they prevail over this DPA on matters concerning transfers to third countries.
19. Governing law and disputes
19.1 This DPA is governed by Swedish law.
19.2 Disputes are resolved in the manner set out in the Main Agreement.
Acceptance
This DPA applies as part of the Main Agreement and is accepted when the Customer enters into the Main Agreement. The Parties may also sign this DPA separately.
Appendix 1: Description of the processing
1. Categories of data subjects
- The Customer’s end customers (buyers, customers in unmanned stores, guests)
- The Customer’s members (for example in an association or gym)
- Visitors and persons passing through the Customer’s doors, including persons who have received a shared key or link
- The Customer’s staff and other users of the administration interface and the checkout
- Contact persons at the Customer’s suppliers, to the extent they are registered in the Service
2. Categories of personal data
| Category | Examples |
|---|---|
| Identity | Name, user ID, customer number |
| Contact details | Mobile number, email address, address |
| Personal identity number and BankID evidence | Personal identity number (shown masked in the administration interface), result of BankID identification and age verification |
| Purchases and receipts | Items purchased, amount, time, store, receipt number, discounts, cards and gift cards |
| Bookings | Resource, date, time, status, cancellations |
| Memberships and subscriptions | Type, period, status, payment status |
| Keys | Which doors and times a person has access to, who shared the key |
| Entry log | Time, door, account, opening method (for example app, BankID, proximity unlocking, code) and, for location-based doors, the phone’s location at the time of opening |
| Troubleshooting logs | Technical events, device information, app version, IP address, error messages that may contain user IDs |
| Payment references | Payment reference and transaction ID at Adyen, payment method, masked card details (the last digits). Full card numbers are not processed by JOBBS |
| Communication | Content of SMS and email sent on behalf of the Customer, for example one-time codes, invitations and receipts |
| Staff | Usernames, permissions, checkout events and logins |
Location, Bluetooth signal and motion data are stored in the entry log when an End Customer unlocks using the app.
3. Sensitive personal data
The Service is not intended for special categories of personal data under Article 9 or data relating to criminal offences under Article 10. The Customer shall not register such data in free-text fields.
4. Purpose of the processing
To provide the Service under the Main Agreement, see section 4 of this DPA.
5. Location of the processing
Primarily within the EU/EEA (Microsoft Azure, region North Europe, Ireland). Transfers to third countries take place only in accordance with section 9 and Appendix 3.
Appendix 2: Technical and organisational security measures
1. Operations and storage
- The Service is hosted in Microsoft Azure in the North Europe region (Ireland).
- Microsoft Azure holds certifications including ISO/IEC 27001 and SOC 2.
2. Encryption
- All communication between apps, browsers and servers is encrypted with TLS 1.2 or later.
- Databases and storage are encrypted at rest with Azure’s standard encryption.
- Secrets and keys are stored securely, and access to them is restricted.
3. Access control
- Role-based access in the administration interface. The Customer decides which roles its staff have.
- JOBBS staff have access to the production environment only when needed for operations, support or troubleshooting, using personal accounts.
- Permissions are reviewed regularly and removed when a person leaves.
4. Data minimisation and protection of personal identity numbers
- Personal identity numbers are shown masked in the administration interface.
- Full card numbers are handled only by Adyen and are not stored by JOBBS.
5. Logging and monitoring
- Events in the Service are logged, including logins, administrative changes and access events.
- Monitoring and alerts for operations and errors via Azure Application Insights.
- Troubleshooting logs are deleted after 30 days.
6. Backup and continuity
- Databases are backed up automatically in Azure with point-in-time restore.
7. Development
- Security updates to dependencies and the platform are installed on an ongoing basis.
8. Physical equipment at the Customer’s premises
- Door control boxes are maintained remotely via an encrypted connection (Raspberry Pi Connect).
9. Organisation
- Confidentiality undertaking for all staff and all consultants.
- Procedure for handling personal data breaches.
- Designated contact for data protection: support@jobbs.se
Appendix 3: Sub-processors
The sub-processors used by JOBBS are set out in the published list Sub-processors for the JOBBS platform, available at www.jobbs.se/en/underbitraden.
For each sub-processor, the list states which service it performs, which personal data it processes, where the processing takes place and the basis for any transfer to a third country. The list also states which sub-processors are used only when the Customer has activated a particular module.
The version of the list in effect when this DPA is entered into constitutes the Customer’s approval under section 8.2. Changes are notified in accordance with section 8.3.