Data processing (DPA)
When you use our products, you decide what personal data goes into them. Under the GDPR you are the controller and Code F AB is your processor. Article 28 of the GDPR requires a written agreement between the two. This page summarises our standard Data Processing Agreement (DPA) and contains the full text.
The DPA below applies automatically as part of our terms of service. If you need a signed copy for your records, email info@codefab.dev and we will send you a countersigned version.
Summary
Roles
You are the controller of the personal data in your account. Code F AB is your processor and acts only on your instructions.
EU data residency
The platform runs in a data centre in Germany and your data is stored in the EU.
Security
Encryption in transit, per-customer row-level isolation, two-factor sign-in, encrypted credentials and nightly backups.
Sub-processors
A published list, with advance notice of changes and a right to object.
Breach notification
We notify you without undue delay, and no later than 48 hours after we become aware of a breach.
Deletion and return
Export at any time. When the agreement ends we return or delete your data, normally within 30 days.
Data Processing Agreement
This Data Processing Agreement ("DPA") is entered into between the customer named in the order or account (the "Controller") and Code F AB, org.nr 559385-6338, Metergatan 10, 507 43 Borås, Sweden (the "Processor"). It forms an appendix to the main agreement for the Service (the order, signed agreement or the terms of service, the "Main Agreement").
1. Background and purpose
1.1. The Processor processes personal data on behalf of the Controller when providing the Service. This DPA regulates that processing in accordance with Article 28 of Regulation (EU) 2016/679 (the "GDPR") and supplementary Swedish data protection law.
1.2. If this DPA and the Main Agreement conflict on matters concerning personal data, this DPA prevails.
2. Scope of processing
2.1. Subject matter and duration. The processing needed to provide, support and secure the Service, for as long as the Main Agreement is in force and until the data has been returned or deleted under section 10.
2.2. Nature and purpose. Hosting, storage, organisation, retrieval, analysis, transmission (for example email and SMS that the Controller sends) and deletion of data, including AI-based processing where the Controller uses AI features, for the sole purpose of providing the Service to the Controller.
2.3. Categories of data subjects and personal data, depending on the products used:
| Product | Data subjects | Typical personal data |
|---|---|---|
| CRM | The Controller's customers, leads, subscribers and users | Name, email, phone, address, language, consent and unsubscribe status, orders, custom fields, email and SMS engagement, website activity if tracking is enabled |
| AI Insights | Any person whose data is held in the databases the Controller connects; users | Data returned by the queries the Controller's users run, database structure, chat history, saved questions and dashboards |
| OMS | The Controller's customers and contact persons, staff and users | Names and contact details, worksite addresses, orders and jobs, attachments such as photos and documents |
| Check-in | The Controller's employees and users | Name, email, clock-in and clock-out times, the tag and location used, device information, alerts and corrections |
2.4. The Service is not designed for special categories of personal data (GDPR Article 9) or data about criminal offences. The Controller should not store such data, or personal identity numbers, in the Service unless this has been agreed with the Processor in writing.
3. The Controller's obligations
3.1. The Controller is responsible for having a lawful basis for the processing, for the instructions it gives and for informing data subjects. The Controller's documented instructions consist of the Main Agreement, this DPA and the settings and actions the Controller makes in the Service.
4. The Processor's obligations
4.1. The Processor processes personal data only on the Controller's documented instructions, including with regard to transfers to third countries, unless required to do so by EU or Member State law. In that case the Processor informs the Controller before processing, unless the law prohibits it.
4.2. The Processor informs the Controller without delay if, in its opinion, an instruction infringes data protection law.
4.3. The Processor ensures that everyone authorised to process the personal data is bound by confidentiality, and that access is limited to those who need it to provide and support the Service.
4.4. The Processor does not use the personal data for its own purposes, does not sell it and does not use it to train AI models.
5. Security of processing
5.1. The Processor implements appropriate technical and organisational measures under GDPR Article 32, including:
- encryption of all traffic to and from the Service with TLS;
- isolation of each customer's data in the database with PostgreSQL row-level security, enforced by a database role that cannot bypass it;
- single sign-on with mandatory two-factor authentication in CRM and AI Insights;
- encryption at rest (AES-GCM) of stored credentials such as email, SMS and database passwords, and hashing of API keys;
- role-based access within each account, and audit logging of administrative and data-affecting actions;
- nightly backups of all product databases with 14 days' retention;
- production access restricted to authorised Processor staff using key-based authentication behind a firewall.
5.2. A fuller description is published on the Security & GDPR page. The Processor may update the measures as long as the overall level of protection is not reduced.
6. Sub-processors
6.1. The Controller gives general authorisation for the Processor to use the following sub-processors:
| Provider | Purpose | Location | Used by |
|---|---|---|---|
| Hetzner Online GmbH | Infrastructure hosting: servers, databases, file storage and backups | Germany (Nuremberg), EU | All products |
| Berget AI | AI language model that generates assistant replies, queries and summaries. Only the content needed for the request is sent | Sweden, EU | CRM (AI assistant), AI Insights |
| Amazon Web Services (Amazon SES) | Delivery of system emails such as sign-in invitations, password resets and account notifications | Sweden (Stockholm region), EU. AWS is certified under the EU–US Data Privacy Framework | All products |
| Google (Gmail) | Delivery of order and job emails sent from OMS | EU and USA (EU–US Data Privacy Framework and Standard Contractual Clauses) | OMS |
6.2. The following services receive data only if the Controller enables the integration, using the Controller's own account and agreement with the provider. They act on the Controller's instruction and are not engaged by the Processor:
| Provider | Purpose | Location | Used by |
|---|---|---|---|
| Sinch | SMS and RCS message delivery | EU region by default (a US region can be selected) | CRM |
| Your SMTP email provider | Delivery of the emails and campaigns you send | Depends on your provider | CRM |
| Twilio SendGrid | Email delivery, if chosen instead of SMTP | USA (Standard Contractual Clauses) | CRM |
| Mailchimp (Intuit) | Synchronising contacts and audiences with your Mailchimp account | USA (Standard Contractual Clauses) | CRM |
| Cloudflare Turnstile | Bot protection on public sign-up forms | Global network | CRM |
| Mapbox and geocode.maps.co | Map display and turning worksite addresses into coordinates | USA | OMS |
6.3. The Processor imposes data protection obligations on each sub-processor equivalent to those in this DPA, and remains responsible to the Controller for their processing.
6.4. The Processor informs the Controller by email at least 30 days before adding or replacing a sub-processor. The Controller may object on reasonable grounds within that period. If the parties cannot agree, the Controller may terminate the affected part of the Service without penalty.
7. Location of processing and transfers
7.1. Personal data is stored in the EU. The Service is hosted in Hetzner's data centre in Nuremberg, Germany. The previous version of OMS at codefab.dev/products is still served from a server operated by the Processor in Sweden.
7.2. Personal data is only transferred outside the EU/EEA where a sub-processor listed above does so, and then only with appropriate safeguards under GDPR Chapter V, such as an adequacy decision (including the EU–US Data Privacy Framework) or the European Commission's Standard Contractual Clauses.
8. Assistance and data subject rights
8.1. Taking into account the nature of the processing, the Processor assists the Controller in responding to requests from data subjects (access, rectification, erasure, restriction, portability and objection). CRM includes built-in data export and erasure for individual contacts. If the Processor receives a request directly, it forwards it to the Controller without undue delay and does not respond itself unless instructed to.
8.2. The Processor assists the Controller with security, breach notification, data protection impact assessments and prior consultation under GDPR Articles 32 to 36, as far as it can reasonably do so with the information available to it.
9. Personal data breaches
9.1. The Processor notifies the Controller of a personal data breach without undue delay, and no later than 48 hours after becoming aware of it. The notification describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Information that is not yet available is provided as soon as it is.
10. Deletion and return of data
10.1. The Controller can export its data from the Service at any time while the Main Agreement is in force, including during the notice period.
10.2. When the Main Agreement ends, the Processor, at the Controller's choice, returns the personal data in a common machine-readable format or deletes it, normally within 30 days, unless EU or Member State law requires further storage. Copies in backups are overwritten within the backup retention period of 14 days. On request, the Processor confirms the deletion in writing.
11. Audits
11.1. The Processor makes available to the Controller all information necessary to demonstrate compliance with GDPR Article 28, and allows for and contributes to audits, including inspections, by the Controller or an independent auditor appointed by the Controller.
11.2. Audits are requested at least 30 days in advance, take place during normal business hours, at most once a year unless a breach or a supervisory authority gives cause, and are carried out in a way that does not disrupt the Service or compromise other customers' data. Each party bears its own costs, unless the audit reveals a material breach by the Processor.
12. Liability
12.1. Each party is liable as set out in GDPR Article 82. Otherwise, the limitation of liability in the Main Agreement applies to this DPA, to the extent permitted by mandatory data protection law.
13. Term, governing law and disputes
13.1. This DPA applies for as long as the Processor processes personal data on behalf of the Controller.
13.2. This DPA is governed by Swedish law. Disputes are settled by Swedish courts, with Borås District Court (Borås tingsrätt) as the court of first instance.
Contact
Questions about this DPA, or requests for a countersigned copy: info@codefab.dev.