Data processing agreement

This agreement covers the personal data hivoo handles for you about your audience. It is part of the terms of service and applies automatically when you use newsletter signups, Instagram automations or advertising pixels and the GDPR applies to you. You do not need to sign anything separately.

1. Who is who

You, the hivoo account holder, are the controller. You decide why your audience’s data is collected and what happens to it.

We, Echoes of Melodic Existence AB, organisation number 559530-5383, Solbacken 14, 139 36 Värmdö, Sweden, are the processor. We handle the data only to provide hivoo to you. Questions about this agreement: [email protected].

What data, about whom and for what is set out in Annex 1.

2. Your instructions

We process your audience’s data only on your instructions. Your instructions are these terms and the settings you choose in hivoo, for example which automations run and what happens to newsletter signups. We do not use the data for our own purposes.

If we think an instruction breaks the GDPR or other data protection law, we will tell you and may refuse to carry it out.

If EU or Swedish law requires us to process the data in another way, we will tell you first, unless that law forbids it.

3. Your responsibilities

You are responsible for having a lawful basis for collecting your audience’s data, for telling them how you use it, and for the instructions you give us.

4. Confidentiality

Everyone at hivoo who can access the data is bound by confidentiality.

5. Security

We protect the data with the technical and organisational measures in Annex 2, and keep them up to date as risks and technology change.

6. Sub-processors

You give us general permission to use sub-processors. The ones we use today are listed in Annex 3.

We will tell you by email before we add or replace a sub-processor that handles your audience’s data, so you have time to object. The current list is always in Annex 3. If you have a reasonable data protection objection, tell us before the change takes effect. If we cannot address it, you may end the parts of the service that use the new sub-processor, and we refund any unused prepaid fees for them.

Every sub-processor is bound by a written agreement with data protection obligations no weaker than ours. We remain responsible to you for their work.

7. Transfers outside the EU/EEA

Where a sub-processor handles data outside the EU/EEA, the transfer relies on an EU adequacy decision, including the EU–US Data Privacy Framework for certified companies, or on the EU Commission’s standard contractual clauses.

8. Helping you

Requests from your audience. If someone in your audience asks us to exercise their rights, we pass the request to you without undue delay and do not answer it ourselves, unless you ask us to. We do not keep data that identifies your audience after passing it on, so there is usually nothing for us to delete; where there is, we help you.

Data breaches. If we become aware of a breach affecting your audience’s data, we tell you without undue delay, and no later than 48 hours after we become aware of it. We give you the information we have, so you can meet your own duty to report to the supervisory authority within 72 hours.

Other obligations. We help you, as far as is reasonable, with data protection impact assessments and consultations with supervisory authorities.

9. Checks and audits

On request, we give you the information you need to show that we meet this agreement. If that is not enough, you or an independent auditor bound by confidentiality may audit us, with 30 days’ notice, during normal working hours and no more than once a year unless there has been a breach. Each party pays its own costs.

10. When the agreement ends

This agreement lasts as long as we process audience data for you. When you delete your account, or stop using the features concerned, we delete the audience data within 30 days, unless law requires us to keep it. Copies in backups are overwritten as the backups rotate.

11. Liability and law

Liability under this agreement follows the terms of service and Art. 82 of the GDPR. If this agreement and the terms of service conflict on data protection, this agreement wins. Swedish law applies.

Annex 1: The processing

No special categories of personal data (such as health or political views) are intended to be processed. Do not set up automations or forms that ask for them.

Advertising events. If you connect your own pixels, for example from Meta, TikTok or Google, we send events about visits to your pages to those platforms. They go from the visitor’s browser and from our servers through the platform’s server connection, such as Meta’s Conversions API. We do this on your behalf and only after the visitor has agreed in our cookie settings. Each platform receives the data under your own agreement with it; the platforms are not our sub-processors.

Annex 2: Security measures

• Data encrypted in transit (TLS)
• Instagram access tokens encrypted at rest
• Database and uploaded files stored in the EU
• Access to production data limited to the people who need it, with individual accounts
• Backups to restore the service after a failure
• Sub-processors chosen for their security and bound by data processing agreements
• Two-factor authentication on all accounts with access to production data

Annex 3: Sub-processors