Subject matter, duration, nature and purpose Art. 28(3)
Creedcon AB (the ‘Processor’) processes personal data on behalf of the customer (the ‘Controller’) to the extent required to provide Qimbas™: collection of log data from the sources the Controller connects, analysis of detection rules, integrations, log quality and patterns, and production of reports and evidence. The processing continues for the term of the service contract.
Types of personal data and categories of data subjects Art. 28(3)
Personal data that may occur in security logs: user names and email addresses, IP addresses, device identifiers, timestamps and actions in systems, coarse geographic location. Categories of data subjects: the Controller’s employees, consultants and other users of the Controller’s systems, and where applicable external parties communicating with those systems. The Controller is responsible for not connecting sources containing special categories of personal data without first agreeing this with the Processor.
Processing only on documented instructions Art. 28(3)(a)
The Processor processes personal data only on the Controller’s documented instructions. The contract, the service configuration and the Controller’s choice of sources constitute the instructions. The Processor informs the Controller immediately if, in its opinion, an instruction infringes data protection law.
Confidentiality Art. 28(3)(b)
Persons working for the Processor with access to personal data are bound by confidentiality obligations and have access only to the extent required for their work.
Security measures Art. 28(3)(c), Art. 32
The Processor implements technical and organisational measures proportionate to the risk, including:
- isolation of each customer’s data per tenant,
- storage of data within the EU, and AI analysis within the EU where the Controller has chosen this,
- encryption of data in transit and at rest,
- least-privilege permissions in the app registration the Controller creates, and no permissions beyond those the service specifies,
- logging of access to systems that process personal data,
- incident-response procedures and regular review of the measures.
The measures are described further on the Security page.
Subprocessors Art. 28(2), 28(4)
The Controller gives general written authorisation for the Processor to engage subprocessors. Current subprocessors are listed on the Subprocessors page. The Processor informs the Controller of intended changes at least 30 days in advance so that the Controller can object. The Processor imposes the same obligations as in this agreement on its subprocessors and remains fully liable for their processing.
Assistance with data subject rights Art. 28(3)(e)
The Processor assists the Controller, by appropriate technical and organisational measures, in responding to requests from data subjects exercising their rights. Requests received directly by the Processor are forwarded to the Controller without delay.
Assistance with security, breaches and impact assessments Art. 28(3)(f), Art. 33–36
The Processor notifies the Controller without undue delay after becoming aware of a personal data breach, and in any event within 24 hours of becoming aware of it, with the information the Controller needs for its notification to the supervisory authority. The Processor assists with data protection impact assessments and prior consultations to the extent they concern the service.
Deletion or return Art. 28(3)(g)
When the service ends, the Processor deletes all personal data or returns it to the Controller, at the Controller’s choice, no later than 30 days after the end. Data in backups is deleted as the backups expire, no later than twelve months after the end. Until then it is protected like the rest of the service and used for no other purpose; if a backup is restored, the former customer’s data is deleted again. Data is otherwise kept only where Union or Swedish law requires storage.
Audits and information Art. 28(3)(h)
The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations in this agreement and in Article 28 GDPR, and allows for and contributes to audits. Audits take place on written request with at least 30 days’ notice, during office hours and with due regard to keeping other customers’ data isolated. Costs for audits beyond one per year are borne by the Controller unless the audit reveals material deficiencies.
Transfers to third countries Art. 44–49
Personal data is stored within the EU. It is transferred outside the EU/EEA only in the following cases, each under the transfer mechanism stated on the Subprocessors page:
- the AI model in the default setting (Anthropic), which can process data outside the EU/EEA. A Controller that chooses processing within the EU uses a model run within the EU instead;
- Microsoft, which hosts the service within the EU, in the limited cases where its staff or security operations access the data from outside the EU/EEA, for example for support;
- Cloudflare’s network, which carries and decrypts traffic to the service in the data centre that receives it, which can be outside the EU/EEA;
- on the Controller’s documented instruction.
Changes to this follow the rules for subprocessors above.
Liability and term
The agreement applies for as long as the Processor processes personal data for the Controller. The limitation of liability in the terms for Qimbas™ also applies to this agreement to the extent permitted by law.