Data processing agreement (PUB-avtal)

Organizations — companies and schools — can sign our data processing agreement (personuppgiftsbiträdesavtal, PUB-avtal). Email support@crdbag.com with your organization’s name and organization number and we send it to you.

Your organization is the controller for the personal data in its workspaces: equipment, packlists, activity, photos, its members and, for schools, its students. Arctiv AB is the processor and processes that data only to provide Propiler, on your documented instructions.

• Subject and duration: providing Propiler for as long as your organization uses it, and the time needed to delete the data afterwards.
• Data subjects: your staff and members, people invited to your workspaces, and — for schools — students.
• Personal data: names, email addresses, roles and group memberships, activity (who, when, where — location only if you allow it), photos, students’ names, classes, login codes and loans.
• Confidentiality: everyone at Arctiv AB with access to the data is bound by confidentiality.
• Security: the technical and organizational measures on the security page.
• Subprocessors: you give general approval to the subprocessors on the subprocessor list; we tell you before we add or replace one, so you can object.
• Transfers: data is stored in the EU (Stockholm). Transfers outside the EU/EEA rely on the EU’s Standard Contractual Clauses, the EU–US Data Privacy Framework or an adequacy decision.
• Helping you: we help you answer requests from data subjects — including data export, account deletion and erasing a student — and with impact assessments.
• Personal data breaches: we tell you without undue delay, and aim to within 24–48 hours of becoming aware of a breach, with what we know so far.
• Your settings: as an organization you can switch off AI photo analysis, access for AI assistants and the API, and location capture. Schools start with all three off.
• When the agreement ends: we delete your organization’s personal data within 30 days, or return it first if you ask. Backups roll off within 35 days.
• Audit: we give you the information needed to show that we meet the agreement, and allow reasonable audits.