Data processing agreement

Draft

This text is a draft under legal review.

Last updated: 30 October 2026

This data processing agreement (“DPA”) is part of the terms of service between the customer (controller) and NOD³ Solutions AB, org. no. 559596-1706 (processor). It applies when NOD³ processes personal data in the customer’s workspaces. It is accepted together with the terms; customers who want a signed copy can write to privacy@nod3.se.

1. Subject and duration

NOD³ processes personal data to provide WORK³ to the customer, for as long as the customer uses the service and until the data is deleted under section 9.

2. Nature and purpose

Storing, organising, showing, searching, sending (notifications, integrations the customer turns on) and deleting data so that the customer can plan and follow its work.

3. Data and people

• People: the customer’s users, guests and expert partners, and people the customer mentions in its content (for example client contacts).
• Data: names, email addresses, profile pictures, roles, work content (projects, items, comments, chats, files), activity and audit log entries, and references to records in the customer’s CRM.
• The service is not meant for special categories of personal data (such as health data). The customer should not put such data in WORK³.

4. Instructions

NOD³ processes the data only on the customer’s documented instructions: these terms, this DPA and the customer’s settings and use of the service. If NOD³ thinks an instruction breaks data protection law, it tells the customer.

5. Confidentiality and access

Only people at NOD³ who need it for the service have access, and they are bound by confidentiality. NOD³ staff see workspace content only through support access that an owner approves, which ends by itself and shows in the audit log.

6. Security

NOD³ takes appropriate technical and organisational measures (article 32), including:

• hosting in the EU, with all traffic over HTTPS;
• workspace isolation enforced by the database (row level security), checked by automated tests on every change;
• encryption at rest for files, integration credentials and secrets; only hashes of API keys and tokens;
• sign-in without passwords (Google, one-time codes, passkeys), sessions in secure http-only cookies;
• an audit log of sign-ins, changes and access, with retention chosen by the customer;
• nightly backups kept for 14 days, and least-privilege access to production.

See also Security and privacy.

7. Subprocessors

The customer gives general authorisation for the subprocessors listed under subprocessors. NOD³ gives notice at least 30 days before adding or replacing one, by updating that page and emailing workspace owners. The customer may object on reasonable grounds; if we cannot solve it, the customer may end the service. NOD³ binds each subprocessor to the same data protection duties and remains responsible for it.

Services the customer connects itself (such as Slack, a CRM, Claude or ChatGPT) are not subprocessors of NOD³. The customer chooses them and uses them under its own agreement.

8. Transfers outside the EU/EEA

Personal data is stored in the EU. A transfer outside the EU/EEA happens only through a listed subprocessor and relies on an adequacy decision (such as the EU–US Data Privacy Framework) or the EU standard contractual clauses.

9. Return and deletion

The customer can get its data out at any time through the REST API, and NOD³ provides a full export on request. When a workspace is deleted, it is closed at once and kept for 30 days so that an owner can restore it. Then its data is removed from the live system, and from backups within 14 days after that, unless the law requires NOD³ to keep it. On the customer’s request NOD³ removes it sooner.

10. Assistance

NOD³ helps the customer, as far as is reasonable, to answer requests from data subjects, and with impact assessments and prior consultations. Much of this the customer can do directly in WORK³.

11. Personal data breaches

NOD³ tells the customer without undue delay, and at the latest within 48 hours of becoming aware of a breach that affects the customer’s data, with the information the customer needs to report it.

12. Audits

NOD³ provides the information needed to show that it meets this DPA. The customer may audit, at its own cost, with 30 days’ notice and at most once a year, unless a breach or a supervisory authority calls for more.

13. Order of precedence

If this DPA and the terms conflict on data protection, this DPA wins. Swedish law applies.