Data processing agreement

Application and parties

This Data processing agreement applies when incorporated into an agreement between Stockholm IT Academi AB, as processor, and the identified customer, as controller. If the customer is itself a processor, it must have authority from its controller to appoint us. These terms do not cover activities for which DAWN independently acts as controller.

Publication does not execute a customer DPA or authorise every supported provider. Before processing starts, the accepted order and processing schedule must identify the customer, authorised contacts, enabled services, duration, selected recipients and locations, and applicable transfer arrangements. No unidentified supplier is authorised by a generic reference to this page.

Processing description

The subject matter is the customer’s configured recruitment and workforce service. Operations can include collecting, storing, organising, retrieving, displaying, transmitting, analysing, correcting, exporting and deleting information, including AI or speech processing where enabled. The purpose is to deliver the customer’s documented workflows, not to determine independent employment purposes.

Individuals can include applicants, candidates, employees, contractors, managers, referees and authorised users. Data can include identity and contact details, work history, qualifications, applications, employment records, messages, documents, interview media, transcripts, assessments and audit records. Only categories necessary for the agreed service are included. Special category or criminal offence data requires an express lawful instruction and appropriate safeguards; it is not authorised by default.

Processing lasts for the service term and the return or deletion process, subject to a legal retention obligation. The customer retains its rights and duties to issue lawful instructions, review safeguards, exercise audit rights and determine retention.

Instructions and confidentiality

We process personal data only on documented customer instructions, including instructions about transfers, unless applicable law requires otherwise. We inform the customer of a legal requirement before processing unless the law prohibits that notice. We promptly inform the customer if an instruction appears to infringe applicable data protection law and may pause that instruction pending clarification.

Authorised personnel must be bound by confidentiality and have access limited to their work. Customer data must not be sold, used for advertising or repurposed for unrelated model training under this agreement.

Security measures

We maintain measures appropriate to the processing risk. The service schedule must describe the measures actually applicable to the customer, including access and tenant controls, encrypted transport, credential protection, private file access, logging, incident handling and recovery arrangements. Measures are reviewed as the risk and service change and must not be materially reduced during the agreed service without an equivalent protection.

The public Security page describes relevant controls and limitations. It is not a certification or a substitute for a customer security schedule. A particular backup interval, recovery target, dedicated region or encryption key arrangement applies only when expressly documented and agreed.

Subprocessors and transfers

We appoint a subprocessor only with the customer’s prior specific or general written authorisation and impose equivalent data protection duties by contract. We remain responsible for the subprocessor’s performance of those duties. With general authorisation, we give advance written notice of intended additions or replacements and a meaningful opportunity to object on data protection grounds before the new processing begins.

The customer schedule identifies approved providers and the notice process. An unresolved justified objection must be addressed through an appropriate alternative or ending the affected processing under the customer agreement. Transfers outside the EEA require documented instructions and a lawful transfer mechanism. This DPA is not itself an international transfer mechanism or proof that a provider contract has been executed.

Assistance and incidents

Taking account of the nature of processing and available information, we assist the customer with data subject requests, security duties, impact assessments and prior consultation. We forward requests concerning customer-controlled data and do not independently decide an employment record’s lawful retention.

We notify the customer without undue delay after becoming aware of a personal data breach affecting its data. Information is provided as it becomes available and includes the nature of the breach, affected data and individuals where known, likely consequences, mitigation and a contact. The customer remains responsible for its regulatory and individual notifications; our notice does not replace those duties.

Return, deletion and evidence

When the processing service ends, we return or delete personal data at the customer’s choice and delete remaining copies unless applicable law requires retention. The parties document a practical completion schedule covering active data, object versions, backups and providers. Retained copies must be isolated from ordinary use and removed when the lawful retention ends. If a backup is restored, applicable deletion instructions must be reapplied.

We make available information necessary to demonstrate compliance and allow and contribute to audits, including inspections by the customer or its mandated auditor. Reasonable confidentiality, notice and access safeguards may protect other customers and security but must not defeat the audit right. We inform the customer of material deficiencies and address them.