Data processing agreement

1. Parties

Processor: Hellersjö Consulting AB (reg. no. 556843-5662), which provides the Unispect service (“the Processor”). Unispect is a service and a brand, not a company.

Controller: the club, federation, company or other organisation that has accepted this agreement in Unispect (“the Organisation”), under the name, registration number and postal address recorded at acceptance.

The Organisation enters into the agreement for the processing that concerns its own activities. Where a competition, a sale or another activity is run by a different legal person — a club, a federation or a company — it is that person who determines the purposes and means of the processing and who must accept the agreement for it. A federation does not become the controller of another organisation's activity merely because that organisation is a member of the federation or because the federation sanctions the activity.

The agreement is entered into electronically when a representative authorised to bind the Organisation accepts it on the organisation's page in Unispect. The acceptance is recorded with the version of the agreement (the annexes are part of the version), a checksum of the agreement text, the time, the representative's name and role, and the Organisation's name, registration number, postal address and contact address as they stood at acceptance. It is the written agreement Article 28(9) requires. Later changes on the organisation's page do not change who is party to an agreement already entered into.

Every version of the agreement is kept unchanged at unispect.se/data-processing-agreement/2026-10-05, and the accepted version is linked from the organisation's page. The parties may also sign the agreement on paper; the content is the same.

2. Definitions

Terms such as personal data, processing, controller, processor, data subject and personal data breach have the meaning given in Regulation (EU) 2016/679 (“the GDPR”). Applicable data protection law means the GDPR, the Swedish Act (2018:218) containing supplementary provisions to the GDPR, and regulations issued under them.

3. Subject matter, purpose and duration

The Processor processes personal data on the Organisation's behalf solely to provide Unispect to the Organisation: registration for competitions with accommodation, meals, transport and ice time; consignment and second-hand sales; membership administration; and sponsorship. The nature of the processing, the categories of data subjects and personal data, and the retention periods are set out in Annex 1.

The processing continues for as long as the Organisation uses the service and thereafter until the personal data has been deleted or returned under clause 13.

4. Platform accounts and the Processor's own processing

One Unispect account works for every organisation on the platform. For the accounts the Processor is therefore an independent controller, and that processing is not covered by this agreement but described in the privacy notice. This covers:

• the account: name, email address, the account's identifier and its identifier in the sign-in directory,
• sign-in and authentication, with sign-in logs, in Microsoft Entra External ID,
• operational logs and protection of the platform against misuse, and
• the Processor's own administration of this agreement, such as the record of who accepted it.

For Microsoft Entra External ID, Microsoft is the Processor's own processor, not a sub-processor under this agreement. The sign-in directory holds none of the Organisation's registrations, rosters or other data about its activities.

Which accounts have access to the Organisation and in which role, and the log of access to personal data in the Organisation's activities, are on the other hand processed on the Organisation's behalf under this agreement: it is the Organisation that decides who may access its data, and the log exists to show how its data has been used. The Processor may use the log to investigate security incidents.

5. The Organisation's responsibilities

The Organisation is the controller and is responsible for ensuring that:

• the processing has a legal basis under Article 6, and for health data also a condition under Article 9(2), and that its purposes are specified and legitimate,
• health data about a participant is provided only when the participant — or, for a child who cannot yet judge what it means, a parent or guardian — has given explicit consent, and that the Organisation and the teams' contact people use the service's function for recording who consented; the service does not accept such data without it,
• only the data that is needed is collected; personal identity numbers (personnummer) are collected only when the Organisation needs them and has a legal basis for doing so — a requirement in a federation's statutes or rules is not in itself a legal obligation under Article 6(1)(c), which requires an obligation in Union or Swedish law,
• its name, registration number, privacy contact and postal address are correct on the organisation's page, and competitions and other activities in the service are linked to the organisation that is actually responsible for them, because the privacy notice and the registration confirmations name the controller from there,
• only people who need it are given access to the Organisation in the service, and that access is removed when they no longer need it,
• data the Organisation downloads or exports — rooming lists, meal lists and similar — is handled securely; once a file has left the service it is no longer covered by the Processor's safeguards,
• the Organisation assesses the role of hotels, caterers, transport providers and other recipients when it gives them data — a hotel registering its guests is usually an independent controller, while a supplier that only processes the data on the Organisation's behalf is the Organisation's processor — and enters into the agreements and gives the information that role requires; the recipients are not the Processor's sub-processors, and
• the instructions the Organisation gives the Processor comply with applicable data protection law.

6. Instructions

The Processor processes the personal data only on the Organisation's documented instructions. The instructions are this agreement with its annexes and the choices the Organisation makes in the service — settings, access rights, exports, corrections and deletions. The Organisation instructs the Processor to give data subjects the self-service functions described in the privacy notice: to view and download their data, correct it, delete it and withdraw consent.

If Union or Swedish law requires the Processor to process the data otherwise, the Processor informs the Organisation before the processing begins, unless the law prohibits such information.

The Processor informs the Organisation without delay if, in its opinion, an instruction infringes applicable data protection law.

7. Confidentiality

The Processor ensures that the persons with access to the personal data have committed themselves to confidentiality or are under a statutory obligation of confidentiality, and that they have access only to the extent their tasks require. The Processor does not disclose the personal data to anyone other than sub-processors under clause 9, unless the Organisation has instructed it to or the law requires it.

8. Security

The Processor takes the technical and organisational measures required by Article 32 to protect the personal data, taking into account that it includes, among other things, health data, passport and ID numbers, personal identity numbers and data about children. The measures are described in Annex 2. The Processor may change the measures provided the level of protection is not lowered.

9. Sub-processors

By this agreement the Organisation gives general prior authorisation for the Processor to engage the sub-processors listed in Annex 3.

The Processor notifies the Organisation at least 30 days before a sub-processor is added or replaced, by email to the Organisation's privacy contact and by a new version of Annex 3. The Organisation may object to the change on reasonable grounds within that period. If the parties cannot resolve the objection, the Organisation may terminate the agreement and the service without charge, effective on the day the change takes effect.

The Processor imposes on every sub-processor, by written contract, the same data protection obligations as follow from this agreement. The Processor remains fully liable to the Organisation for the sub-processors' performance of their obligations.

10. Location of processing and transfers to third countries

The Processor stores the Organisation's personal data in Microsoft Azure within the EU/EEA: database, files and backups in the Sweden Central region, and the email service's data in Europe.

Under its terms, Microsoft may to a limited extent process data outside the EU/EEA, for example for support, troubleshooting and security work. Such processing takes place under the safeguards set out in Microsoft's data protection terms: the European Commission's standard contractual clauses and, for transfers to the United States, Microsoft's certification under the EU-US Data Privacy Framework.

Beyond that, the Processor does not transfer personal data to a country outside the EU/EEA unless the conditions of Chapter V of the GDPR are met and the Organisation has been notified under clause 9.

11. Assistance to the Organisation

The Processor assists the Organisation, taking into account the nature of the processing and the information available to the Processor, in:

• responding to requests from data subjects for access, rectification, erasure, restriction, data portability and objection; a request that reaches the Processor directly and concerns the Organisation's processing is forwarded to the Organisation without undue delay, unless it can be met through the service's self-service functions,
• meeting the obligations on security, personal data breach notification, impact assessment and prior consultation under Articles 32–36, and
• providing the information the Organisation needs to answer questions from the Swedish Authority for Privacy Protection (IMY).

Assistance beyond the service's functions and normal support may be charged for as agreed.

12. Personal data breaches

The Processor notifies the Organisation without undue delay, and no later than 36 hours after becoming aware of a personal data breach affecting the Organisation's data, so that the Organisation can meet its own obligation to notify within 72 hours. Notice is given to the Organisation's privacy contact.

The same applies to an incident affecting a Unispect account or sign-in — for example a compromised account with access to the Organisation, or an incident in the sign-in service — if it affects or may affect the Organisation's data, even though the account is processed under the Processor's own responsibility under clause 4.

The notice describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed, and names a contact person at the Processor. What is not known at the first notice is provided as soon as it becomes known.

13. Retention, return and deletion

During the term of the agreement the Processor deletes personal data automatically according to the periods in Annex 1, which are also published in the privacy notice. Other periods may be agreed in writing.

When the agreement ends, the Organisation chooses whether the personal data is to be returned and then deleted, or deleted straight away. For 30 days after the agreement ends the Organisation can take the data out with the service's export functions or ask for an export in a common machine-readable format. If the Organisation has not chosen return when the 30 days have passed, the Processor deletes the data. Deletion is complete no later than 90 days after the agreement ends, and the Processor confirms it in writing to the Organisation's privacy contact.

Accounting records, such as payouts to sellers, are the Organisation's to keep under the Swedish Bookkeeping Act (1999:1078) until the end of the seventh calendar year after the end of the financial year they belong to. During the term of the agreement the Processor keeps them for that long on the Organisation's behalf; when the agreement ends they are handed to the Organisation before deletion. The Processor keeps no data after the agreement ends unless the law requires it to.

Deleted data remains in backups until the backups expire under Annex 2, at most twelve months. The backups are encrypted, are accessible only to the Processor's operations staff and are used only to restore the service. If a backup is restored, the Processor re-applies the deletions and retention made after the backup was taken before the restored data is used.

14. Audits

The Processor makes available to the Organisation the information needed to demonstrate compliance with Article 28, and allows for and contributes to audits, including inspections, conducted by the Organisation or by an independent auditor appointed by the Organisation and bound by confidentiality.

A routine audit may take place at most once a year, on at least 30 days' written notice. In addition, the Organisation may audit, on notice that is reasonable in the circumstances, where this is reasonably necessary because of

• a personal data breach or a well-founded suspicion that this agreement or applicable data protection law is not being complied with,
• an urgent security concern affecting the Organisation's data,
• a material change in the processing, such as a new sub-processor,
• follow-up of shortcomings found by an earlier audit, or
• a requirement of IMY or another supervisory authority.

An audit may cover documentation, interviews and inspection of the Processor's procedures and systems. The sub-processors' operations are audited through the audit reports and certifications they make available. The auditor is not given access to other customers' data or to information that would reveal other customers' affairs or compromise the security of the service; such information may be provided in redacted or summarised form.

The Processor cooperates with the audit and remedies the shortcomings it reveals within a reasonable time, under a remediation plan the Processor provides to the Organisation. Each party bears its own costs of the audit.

15. Liability

Each party is liable for damage it has caused under Article 82 of the GDPR, and for administrative fines imposed on it under Article 83. A party that has paid compensation to a data subject for damage caused by the other party may recover the other party's share.

Otherwise, the Processor's liability to the Organisation under this agreement is limited to an amount equal to the fees the Organisation paid for the service in the twelve months preceding the damage, but no less than one Swedish price base amount (prisbasbelopp). The limitation does not apply in the case of intent or gross negligence.

16. Term and termination

The agreement applies from acceptance for as long as the Processor processes personal data on the Organisation's behalf. Either party may terminate it on 30 days' notice; the Organisation's use of the service for processing covered by the agreement ends at the same time. The provisions on confidentiality, deletion and liability survive termination.

17. Changes

The Processor may publish a new version of the agreement. Material changes are notified to the Organisation's privacy contact at least 30 days before they are to apply, and the new version applies to the Organisation once it has been accepted on the organisation's page. Until then the version the Organisation last accepted applies, and it remains available unchanged at its own address. Changes required by law or by a decision of IMY may apply sooner than 30 days.

18. Precedence and language

In matters of personal data processing this agreement takes precedence over other agreements between the parties. The agreement is written in Swedish; this English version is a translation, and in case of discrepancy the Swedish version prevails.

19. Governing law and disputes

Swedish law governs the agreement. Disputes are settled by the Swedish general courts.

20. Contact

The Processor: Hellersjö Consulting AB · info@hellersjo.com. The Organisation: the contact address recorded at acceptance, or the privacy contact the Organisation later gives the Processor on the organisation's page.

Annex 1 — Description of the processing

The processing consists of collection, storage, compilation, disclosure to the Organisation, export at the Organisation's request, sending email on the Organisation's behalf, rectification, retention-based deletion and erasure.

Annex 2 — Security measures

• Encryption. Health notes, passport and ID numbers, personal identity numbers, phone numbers, the team contact's name and email address, sellers' and invitees' contact details, and flight numbers are encrypted at field level with AES-256-GCM. Other data, such as participants' names and arrival times, is protected by encryption at rest: the database and its backups are encrypted with Azure SQL transparent data encryption. Traffic to the service and between its parts is encrypted with TLS 1.2 or later.
• Keys. The encryption keys are kept in Azure Key Vault, separate from the database. The service retrieves them through managed identities; otherwise only the Processor's operations staff have access to them.
• Sign-in and access. Every user signs in with a personal account and a one-time code sent to the account's email address; the service has no passwords. A registration is accessible to the account that made it and to those the Organisation has given access. The Processor's platform administrators have access where needed for operations, support or carrying out the Organisation's instructions.
• Accountability. Reads of registrations and rosters, changes, exports and deletions are logged with time, account and purpose. Lists for hotels and caterers are logged before the file is released.
• Data minimisation. Health notes are accepted only with consent as described in Annex 1, which is checked by the server and not only in the form. The service does not write the values of personal data to its operational logs; the operational logs contain IP addresses and the addresses of the pages requested and are kept for 90 days. A data subject's copy of their data does not include other participants' passport or ID numbers or health notes.
• Retention. Deletion under Annex 1 runs automatically every day.
• Protection against misuse. Requests to the registration functions are limited per account or network, and denied access attempts are logged.
• Operations and recovery. The service runs in Microsoft Azure, Sweden Central region. The database can be restored to any point in the last 35 days; in addition one backup a week is kept for eight weeks and one a month for twelve months, in the same region.
• Incident handling. A documented procedure for personal data breaches, with notification to the Organisation under clause 12.

Annex 3 — Sub-processors

Microsoft Entra External ID, where Unispect accounts sign in, is not a sub-processor under this agreement: there the Processor is the controller and Microsoft the Processor's processor, see clause 4. The sign-in directory is currently located in the United States; that transfer relies on Microsoft's certification under the EU-US Data Privacy Framework and on the standard contractual clauses in Microsoft's data protection terms.

Hotels, caterers, transport providers and others to whom the Organisation itself gives data are not the Processor's sub-processors; their role is assessed under clause 5.