Data processing agreement

1. Parties and roles

This agreement applies between Enskild Firma Milkevich Valiantsin, e-mail contact@numsolar.com ("Numsolar", "the Processor") and the organisation that accepted the terms for companies ("the Customer", "the Controller"). It is part of those terms and lasts as long as they do.

The Customer is the controller for the personal data the Customer enters into or receives through the Service about its customers, prospects and contacts. Numsolar is the processor for that data and processes it only under this agreement and the Customer's documented instructions.

Numsolar is an independent controller, not a processor, for: visitors of the free estimate at numsolar.com/configure until a request is sent to the Customer; the consent record of such a request; the Customer's users' account data; the installer directory; and anonymous usage statistics. This is described in the privacy policy.

2. Nature, purpose and duration of the processing

• Subject matter: storage and processing of the Customer's customer data in the Numsolar dashboard, in the Customer's embedded calculator, in client links the Customer sends, in generated documents and in the integrations the Customer connected.
• Nature: storage, display to the Customer's users, calculation (roof model, energy, price), document generation, e-mails the Customer requests, backup, support, deletion.
• Purpose: to let the Customer plan, calculate, quote, document and follow up solar and battery installations for its customers.
• Duration: as long as the terms for companies apply, and after that until the data has been deleted or returned under section 11.

3. Categories of data subjects and personal data

Data subjects: the Customer's customers and prospects (homeowners and other property owners), co-applicants on a contract, recipients of client links, the Customer's contact persons, and — where the Customer collects it — people who sign documents.

Personal data: name, e-mail, phone, address, property details (property designation, electricity meter number, grid company), coordinates and satellite images of the building, roof model and panel layout, electricity use and other inputs, offers, prices, documents and signatures, notes, communication and activity history. The Customer may choose to record a personal identity number for the customer and a co-applicant; the Customer is responsible for having a basis for that.

Special categories: the Service is not intended for sensitive personal data (Article 9). The Customer must not enter such data.

4. Instructions

• The Customer's instructions are this agreement, the terms for companies and the functions the Customer uses in the Service. Further instructions are given in writing to contact@numsolar.com; Numsolar may charge for work beyond the Service's functions.
• Numsolar informs the Customer if, in Numsolar's view, an instruction breaches data protection law.
• Numsolar does not process the data for its own purposes, does not use it to train AI models and does not disclose it to third parties, except to sub-processors under section 7 or when the law requires it. If the law requires disclosure, Numsolar informs the Customer in advance where permitted.

5. Confidentiality

Numsolar makes sure that the persons who work for Numsolar and have access to the data are bound by confidentiality and get access only to what they need. Confidentiality continues after the agreement ends.

6. Security measures

Numsolar takes the following technical and organisational measures, appropriate to the risk:

• All traffic is encrypted (TLS). Passwords are stored hashed. Keys and secrets are kept apart from the code, with limited access.
• Data is stored with Hetzner Online GmbH in the EU, on a server Numsolar controls. Access to the server requires personal keys.
• Each organisation's data is separated in the Service: a user sees only their own organisation's data, and every file link is checked against the organisation. Links handed to systems without a login are signed and time-limited.
• Nightly database backups (seven daily and four weekly kept) and a nightly mirror of the files to Hetzner Object Storage in the EU.
• Limits per user and per day against automated access; an activity log of what users do in the organisation.
• Continuous updates of software and dependencies; Numsolar removes data under the periods stated in the privacy policy and this agreement.

Numsolar may change the measures as long as the level of protection is not lowered. The Customer is responsible for its users' passwords and for which data the Customer enters.

7. Sub-processors

The Customer gives a general authorisation for Numsolar to use the following sub-processors:

Stripe processes the Customer's own billing data, for which Numsolar is the controller, and is not a sub-processor for customer data. Services the Customer connects itself (HubSpot, Fortnox, Formify, X) are the Customer's own processors, not Numsolar's sub-processors.

Changes: Numsolar informs the organisation's owner by e-mail and in the dashboard at least 30 days before a new sub-processor starts processing data. If the Customer objects in writing within that time, and the parties find no other way, the Customer may terminate the terms for companies at no cost for the remaining period. Numsolar has an agreement with every sub-processor that gives protection equivalent to this agreement, and is responsible for the sub-processor's work.

8. Transfers outside the EU/EEA

Data is stored in the EU. The transfers that take place are those in the table in section 7, to providers in the United States, under the EU–US Data Privacy Framework where the provider is certified and otherwise the European Commission's standard contractual clauses (Decision 2021/914) with the supplementary measures needed. Numsolar states on request which basis applies to a given provider.

9. Assistance to the controller

• If Numsolar receives a request from a data subject (access, rectification, erasure, objection, portability) concerning the Customer's data, Numsolar forwards it to the Customer within five working days and does not answer itself, except to refer to the Customer.
• Numsolar helps the Customer respond with the functions in the Service (export, correction, deletion) and with reasonable further help.
• Numsolar assists the Customer with the information needed for data protection impact assessments and prior consultations (Articles 35–36) concerning the Service. Help beyond what is documented may be charged per hour.

10. Personal data breaches

Numsolar notifies the Customer without undue delay after becoming aware of a personal data breach concerning the Customer's data, aiming to do so within 48 hours. The notice goes to the organisation's owner by e-mail and contains what Numsolar knows: what happened, which data and data subjects are affected, the likely consequences, measures taken and proposed, and a contact point. Numsolar adds information as more becomes known. The Customer decides on and handles the notification to the Swedish Authority for Privacy Protection and the information to data subjects; Numsolar helps.

11. Deletion and return

• During the term the Customer deletes data in the Service itself. Deleted data leaves the backups within five weeks.
• When the terms for companies end, the Customer may within 30 days request an export of its data (structured data and documents). After that, or earlier on request, Numsolar deletes the data within 30 days and confirms it on request.
• Exceptions: what the law requires Numsolar to keep (accounting records), and consent records for homeowner requests, for which Numsolar is the controller.

12. Audits

• On request, Numsolar provides the information needed to show that the obligations of Article 28 are met: a description of the security measures, the list of sub-processors and answers to written questions within 30 days.
• If that is not enough, the Customer, or an independent auditor appointed by the Customer and bound by confidentiality, may audit the processing on site at most once a year, with 30 days' notice, during office hours, in a way that does not disturb operations and at the Customer's cost. If a supervisory authority requires an audit, those limits do not apply.

13. Changes and validity

This agreement is changed in the same way as the terms for companies (their section 14). If this agreement and the terms conflict, this agreement prevails on personal data matters. Invalidity of one part does not affect the rest. Swedish law applies and disputes are settled as in the terms for companies.

14. Contact

Data protection questions and incidents: contact@numsolar.com, Enskild Firma Milkevich Valiantsin.