Data Processing Agreement

1.1Annex to the Terms of Service: This data processing agreement (the "DPA") constitutes an annex to the terms of service (the "Terms of Service") in force between Lubb IT AB (reg. no: 556938-6484) and the Course Organizer regarding the Course Organizer's use of Kursregistrering.se (the "Platform"). The Course Organizer and Lubb IT AB are below jointly referred to as the "Parties".

1.2Roles and scope: This DPA is entered into in accordance with Article 28 of the EU General Data Protection Regulation (EU) 2016/679 (the "GDPR") and governs the Parties' rights and obligations when Lubb IT AB processes personal data on the Course Organizer's behalf within the framework of providing the Platform. For such processing, the Course Organizer is the controller and Lubb IT AB the processor.

1.3Applicable data protection legislation: The Parties shall each ensure compliance with applicable legislation on the processing of personal data, including the GDPR and supplementary national data protection legislation ("Applicable Data Protection Legislation").

1.4Precedence over the Terms of Service: In the event of a conflict between this DPA and the Terms of Service, the DPA shall take precedence in matters concerning Lubb IT AB's processing of personal data on the Course Organizer's behalf.

1.5Annexes to the DPA: The following annexes form an integral part of the DPA:

• Annex: Instructions.
• Annex: Approved Sub-processors.
• Annex: Security Measures.

1.6Definitions under the GDPR: This DPA uses definitions from the GDPR, such as "personal data", "processing", "data subject", "controller" and "processor". These terms have the same meaning as in Article 4 of the GDPR.

2.1The Course Organizer's responsibilities: The Course Organizer hereby represents that it:

• ensures that there is a valid legal basis for the processing and that the data subjects have received the information required under Applicable Data Protection Legislation;
• ensures that the instructions given to Lubb IT AB are lawful, accurate and sufficient for the processing;
• shall without undue delay inform Lubb IT AB if the instructions change or need to be supplemented; and
• shall without undue delay inform Lubb IT AB of such requests from data subjects, supervisory authorities or other third parties that Lubb IT AB needs to know of in order to fulfil its obligations under the DPA.

2.2Assessment of security measures: The Course Organizer confirms that the technical and organizational security measures that Lubb IT AB undertakes to implement, as set out in Annex: Security Measures, are appropriate in view of the processing covered by the DPA, and that Lubb IT AB thereby provides sufficient guarantees in accordance with Article 28(1) of the GDPR.

3.1Lubb IT AB's obligations: Lubb IT AB:

• may only process personal data on documented instructions from the Course Organizer, including with regard to transfers of Personal Data to a third country or an international organization, unless such processing is required under Union law or the national law of a Member State to which Lubb IT AB is subject; in that case, Lubb IT AB shall inform the Course Organizer of that legal requirement before the data is processed, unless such information is prohibited on important grounds of public interest under that law. This DPA and Annex: Instructions constitute the Course Organizer's documented instructions to Lubb IT AB;
• shall immediately inform the Course Organizer if Lubb IT AB considers that an instruction infringes the GDPR or other Union or Member State data protection provisions. While the Course Organizer investigates the objection, Lubb IT AB is entitled to suspend the processing in question;
• ensures that persons authorized to process the personal data have committed themselves to confidentiality by written agreement or are under an appropriate statutory obligation of confidentiality. The duty of confidentiality continues to apply after this DPA has terminated;
• shall, taking into account the nature of the processing, assist the Course Organizer by appropriate technical and organizational measures, insofar as this is possible, so that the Course Organizer can fulfil its obligation to respond to requests for exercising the data subject's rights in accordance with Chapter III of the GDPR;
• shall assist the Course Organizer in ensuring that the obligations are fulfilled concerning security of processing (Article 32 of the GDPR), notification of a personal data breach to the supervisory/data protection authority (Article 33 of the GDPR), communication of a personal data breach to the data subject (Article 34 of the GDPR), data protection impact assessments (Article 35 of the GDPR) and prior consultation with the supervisory authority (Article 36 of the GDPR), taking into account the nature of the processing and the information available to Lubb IT AB;
• shall, at the choice of the Course Organizer, delete or return all personal data to the Course Organizer after the end of the provision of processing services, and delete existing copies unless storage of the personal data is required under Union law or the national law of a Member State. Return and deletion shall take place in accordance with Annex: Instructions; and
• shall, to the extent practically possible and lawful, without undue delay notify the Course Organizer of requests for disclosure of personal data, or of information concerning the processing, received from a data subject, an authority or another third party, and shall in such cases refer the matter to the Course Organizer. Lubb IT AB is not entitled to represent the Course Organizer or act on its behalf towards a supervisory authority or another third party, unless the Course Organizer approves this in writing.
• shall keep a written record, which can be kept in electronic form, of all categories of processing carried out on behalf of the Course Organizer, in accordance with Article 30(2) GDPR. The record shall contain:
  • the name and contact details of us and of the Course Organizer and, where applicable, of the Course Organizer’s or our representative and data protection officer,
  • the categories of processing carried out on behalf of the Course Organizer,
  • where applicable, transfers of personal data to a third country, including the identification of that third country and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards, and
  • a general description of the technical and organizational security measures referred to in Article 32(1).

  We keep the record up to date and make it available on request to the supervisory authority and, insofar as it concerns processing on behalf of the Course Organizer, to the Course Organizer.

4.1General prior authorization: The Course Organizer hereby gives Lubb IT AB a general written prior authorization to engage other processors ("Sub-processors") to carry out specific processing on the Course Organizer's behalf. The Sub-processors approved in advance by the Course Organizer are listed in the version of Annex: Approved Sub-processors in force at any given time.

4.2Requirements on Sub-processors: Where Lubb IT AB engages a Sub-processor to carry out specific processing on the Course Organizer's behalf, the same data protection obligations as set out in the DPA shall be imposed on the Sub-processor by way of a contract or another legal act under Union or Member State law. The Sub-processor shall in particular provide sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing meets the requirements of the GDPR.

4.3Liability for Sub-processors: Where the Sub-processor fails to fulfil its data protection obligations, Lubb IT AB shall remain fully liable to the Course Organizer for the performance of the Sub-processor's obligations.

4.4Changes of Sub-processors: The Course Organizer shall be informed in advance of any intended engagement of a new Sub-processor or replacement of an existing Sub-processor, and be given the opportunity to object in writing to the change. Information about the change can be provided through the Platform a reasonable time before the new or replacement Sub-processor begins processing personal data on the Course Organizer's behalf.

4.5Objection to Sub-processors: If the Course Organizer has justified data-protection-related grounds to object to a new or replacement Sub-processor, the Parties shall seek to find a reasonable solution. If no such solution can be reached, the Course Organizer is entitled to terminate the part of the service affected by the change or, where this is not possible, the agreement under the Terms of Service.

5.1Transfers outside the EU/EEA: If Lubb IT AB, or a Sub-processor engaged by Lubb IT AB, transfers personal data to, or makes personal data accessible from, a country outside the EU/EEA, such transfer shall take place in accordance with Chapter V of the GDPR and only where a valid transfer mechanism exists, such as an adequacy decision, the EU standard contractual clauses or binding corporate rules.

5.2Information about the transfer mechanism: Lubb IT AB shall on request provide the Course Organizer with information about the transfer mechanism applied to the third-country transfers taking place under the DPA.

6.1Technical and organizational security measures: Lubb IT AB undertakes to implement the measures required under Article 32 of the GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks to the rights and freedoms of natural persons. This includes, among other things, that Lubb IT AB shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. In assessing the appropriate level of security, particular account shall be taken of the risks presented by the processing, in particular the risk of accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, the personal data. The technical and organizational security measures that Lubb IT AB undertakes to implement are set out in more detail in Annex: Security Measures.

6.2Changes to the security measures: Lubb IT AB decides how the measures are to be implemented within its operations in order to achieve the required level of protection. Lubb IT AB is entitled to change the implemented measures, provided that the ensured level of security is not lower than the level ensured by the measures in place when the DPA was entered into.

6.3Compliance with security requirements: Lubb IT AB represents that its operations are conducted in a manner that ensures that the provisions and requirements of the GDPR on adequate protection of processing are complied with and achieved.

6.4Evaluation and updating of the security measures: Lubb IT AB shall regularly evaluate the effectiveness of the technical and organizational security measures and update them as needed to ensure a continued appropriate level of protection in accordance with Article 32 of the GDPR.

7.1Information to demonstrate compliance: Lubb IT AB shall give the Course Organizer access to all information, and provide the details and documents, necessary to demonstrate that the obligations of Lubb IT AB under this DPA and Article 28 of the GDPR have been fulfilled.

7.2Audits and inspections: Lubb IT AB shall allow for and contribute to audits and inspections of the processing of personal data covered by this DPA, conducted by the Course Organizer or by an auditor mandated by the Course Organizer, to the extent required under the GDPR.

7.3Audits by the supervisory authority: Lubb IT AB shall allow the competent supervisory authority to carry out the audits required under Applicable Data Protection Legislation concerning the processing of personal data.

7.4Audit conditions: The following practical conditions apply to audits:

• The audit shall be notified to Lubb IT AB at least thirty (30) calendar days in advance;
• The Course Organizer is entitled to conduct no more than one audit per calendar year, unless there are justified reasons, such as a personal data breach or reasonable grounds to suspect a serious deviation from this DPA or applicable data protection legislation;
• The audit shall be carried out at the Course Organizer’s expense, and Lubb IT AB is entitled to charge the Course Organizer for the costs arising from the audit.
• The audit shall only concern the processing of personal data that Lubb IT AB carries out on the Course Organizer's behalf under this DPA;
• The audit must not entail the disclosure of trade secrets or other protected information in breach of applicable law.

8.1Notification of a personal data breach: Lubb IT AB shall inform the Course Organizer in writing without undue delay after becoming aware of a personal data breach concerning personal data covered by this DPA. The written notification shall be sent in writing by e-mail and shall, where possible:

• describe the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned,
• communicate the name and contact details of the data protection officer or another contact point where more information can be obtained,
• describe the likely consequences of the personal data breach, and
• describe the measures Lubb IT AB has taken or proposed to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

8.2Supplementary information: If it is not possible to provide all the information under clause 8.1 at the same time, the information may be provided in phases without further undue delay.

8.3Assistance in the event of a personal data breach: Lubb IT AB shall also assist the Course Organizer with the information necessary for the Course Organizer's potential notification to the supervisory authority and communication to the data subjects concerned.

8.4Documentation of personal data breaches: Lubb IT AB shall document all personal data breaches covered by the DPA, including the circumstances of the personal data breach, its effects and the corrective measures taken.

9.1Liability for damages: For damages arising from incorrect or unlawful processing of personal data which, under a final judgment or a settlement, are to be paid to the data subject due to an infringement of the provisions of this DPA and/or applicable data protection legislation, Article 82 of the GDPR shall apply, including its provisions on the allocation of liability and recourse between the Parties.

9.2Administrative fines: Administrative fines imposed under Article 83 of the GDPR or Chapter 6 of lagen (SFS 2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning (the Swedish act with supplementary provisions to the EU General Data Protection Regulation) shall be borne by the Party on which the fine is imposed. However, if a fine is imposed on a Party as a result of the other Party's infringement of the provisions of this DPA and/or Applicable Data Protection Legislation, the infringing Party shall indemnify and hold the non-infringing Party harmless for the damage the non-infringing Party has incurred as a result of the administrative fine and the infringing Party's conduct.

9.3Exclusive remedy: The obligation of the Party concerned to hold the other Party harmless under clauses 9.1 and 9.2 shall constitute the other Party's sole and exclusive right to compensation in connection with the infringement of applicable data protection legislation.

10.1Term of the DPA: This DPA applies for as long as Lubb IT AB processes personal data on the Course Organizer's behalf and terminates only when such processing has ended in accordance with the DPA and Annex: Instructions.

11.1Governing law: The DPA shall be interpreted in accordance with Swedish law.

11.2Dispute resolution: Disputes arising in connection with this DPA shall be finally settled through the dispute resolution procedure set out in the Terms of Service.