Data processing agreement, version 1.2

1.1 The parties have an agreement on Playsa's service under the Terms for organisers ("the main agreement").

1.2 When Playsa delivers the service, Playsa processes personal data on behalf of the controller. This agreement governs that processing.

1.3 The agreement is entered into electronically when an administrator at the controller accepts it in the claim or in the portal. It applies from when Playsa has approved the claim, or from the acceptance if the claim is already approved. Playsa stores who accepted, when and which version applied.

1.4 The agreement is based on the European Commission's standard contractual clauses between controllers and processors (Implementing Decision (EU) 2021/915), shortened and adapted.

The terms personal data, processing, controller, processor, data subject, personal data breach and supervisory authority have the same meaning as in the GDPR. In addition:

• The service: Playsa's search page and portal for organisers, and the parts added under the main agreement.
• Sub-processor: a party engaged by Playsa that processes personal data covered by the agreement.
• Instruction: the controller's documented instruction under section 5.1.
• Data protection rules: the GDPR, the Swedish Act (2018:218) with supplementary provisions to the EU General Data Protection Regulation and other applicable data protection legislation.
• The register: the controller's register of members, participants, guardians, contact persons and leaders in the service.
• The family account: a parent's or an adult's account with Playsa, with the children in the family. Playsa is responsible for it.

3.1 For the personal data the controller enters or receives in the service, the controller is the data controller and Playsa the processor. This covers bookings of trial sessions and queue registrations that have been sent to the controller, the queue's entries, offers and deviations, and the controller's photos. When the parts of the club management system open, it also covers the register, the import, enrolments that have been sent to the controller with answers and consents, the fees and the fee basis, the invoices and the payments, the attendance with the check-ins, the status of the criminal record extracts, the basis for grants, and notices, invitations and mailings based on the register or the attendance. The processing is described in annexes 1 and 2.

3.2 Playsa is itself the data controller for the search page, the parents' family accounts, the interest list and the bookings, queue registrations and enrolments that parents and adults make, until the booking, queue registration or enrolment has been sent to the controller. From that moment the controller is responsible for its handling of it, for example who gets a place, and Playsa processes it as a processor under this agreement.

3.2 a The connection between the register and the family account is a handover in the same way. Playsa is responsible for the family account, for the guardian's or the adult's choice to connect and to send changed contact details, and for sending them. From when the change is in the register, the controller is responsible and Playsa is the processor. When Playsa shows the register's data to a connected guardian or sends notices and invitations, Playsa does so as a processor on the controller's instructions. This also covers the groups and sessions in the parent's calendar feed. Playsa is responsible for the calendar feed itself, with its address and the parent's choice to use it.

3.3 Playsa is also itself responsible for:

• a) the controller's users and contact persons, their sign-ins and the invoicing of the subscription,
• b) security logs and operation of the platform, to the extent required to protect the service as a whole,
• c) reports about photos submitted with the button at the photo,
• d) the guardian's and the adult's choices in the family account: which connections they approve, which controllers get changed contact details and which notices they want,
• e) enrolments before they have been sent to the controller.

Which roles and groups the controller gives a user, for example a leader, is the controller's instruction.

3.4 Playsa does not use the controller's data for its own purposes, for example marketing or profiling.

3.5 Playsa does not use the register to find new users for Playsa. Playsa never tells the controller that a person exists at another organiser or has a family account, until the person has approved a connection.

The controller shall:

• have a legal basis for every processing and inform the data subjects, also that Playsa is used,
• only enter the personal data that is needed,
• not enter personal identity numbers, health data or other sensitive data, not even in free text,
• at every import, confirm what is stated in section 9 a of the main agreement,
• keep the register correct, in particular who is the guardian of a child, who is a leader in a group and the children's birth data, since it governs who sees what,
• inform members and guardians about the notices before the controller takes attendance in the service (section 9 c of the main agreement),
• record only that a leader's criminal record extract has been checked, never what the extract contains (section 10 b of the main agreement),
• be responsible for the content of the invoice and for its bookkeeping (section 10 d of the main agreement),
• give people access with the least possible privileges and ask Playsa to remove anyone who should no longer have access,
• protect its sign-ins and notify Playsa immediately on suspicion of unauthorised access,
• for photos, follow section 10 a of the main agreement,
• carry out its own data protection impact assessment when required,
• ensure that the instructions to Playsa comply with the data protection rules.

5.1 Instructions

• Playsa processes the personal data only according to the controller's documented instructions.
• The instructions are this agreement with its annexes, the main agreement and the features and settings the controller chooses in the service.
• The instructions include the controller switching on a part of the club management system, for example attendance with its notices or check-in for a group, and the controller's instruction on when people who have left are to be deleted (annex 5).
• Playsa may process the data without an instruction only when Union or Swedish law requires it. Playsa then informs the controller first, unless the law prohibits it.
• If Playsa considers that an instruction infringes the data protection rules, Playsa informs the controller immediately.

5.2 Confidentiality

Playsa ensures that everyone who processes the data has committed to confidentiality or is under a statutory obligation of confidentiality, and that they only have access to what they need for their task.

5.3 Security

Playsa takes the technical and organisational measures required by Article 32. The measures are set out in annex 4. Playsa may change the measures provided the level of protection is not lowered.

5.4 Sub-processors

• The controller gives Playsa a general authorisation to engage sub-processors. Those engaged today are listed in annex 3.
• Playsa informs the controller's administrators by email at least 30 days before Playsa adds or replaces a sub-processor.
• Annex 3 also lists sub-processors that may be added. Playsa uses none of them until Playsa has sent the notice under the previous point for that particular sub-processor, with the contracting party, the country and the transfer ground.
• The controller may object within 30 days on reasonable grounds. If the parties find no solution, the controller may terminate the main agreement free of charge before the change takes effect.
• Playsa enters into written agreements with the sub-processors with the same obligations as in this agreement.
• Playsa is liable to the controller for the sub-processors' work.

5.5 Transfers to third countries

• Playsa transfers personal data to a country outside the EU and the EEA only on the basis of Chapter V of the GDPR.
• The transfers and their grounds are set out in annex 3. The grounds are the European Commission's Decision (EU) 2023/1795 on the EU-U.S. Data Privacy Framework for certified US recipients, and standard contractual clauses under Implementing Decision (EU) 2021/914.
• Playsa has assessed the consequences of the transfers for Supabase, Vercel and Sentry and shows the assessments to the controller on request. Playsa assesses the transfer before a new sub-processor outside the EU and the EEA is used, and the assessment is sent with the notice under 5.4.
• If the Data Privacy Framework is invalidated, or the conditions change in some other way, Playsa informs the controller and takes measures.

5.6 Assistance with the data subjects' rights

• Playsa helps the controller to show, correct, disclose and delete data about a data subject, on request and free of charge.
• If Playsa receives a request from a data subject concerning the controller's data, Playsa forwards it within five working days. Playsa does not reply itself unless the controller has instructed it to.
• Playsa helps the controller to reply within the time the GDPR requires.
• A connected guardian or adult sees in their account their own and their children's first names, years of birth, groups, terms and status at the controller. This is the controller's instruction. A request to correct a name or anything else in the register goes to the controller.

5.7 Other assistance

Playsa assists the controller with security, personal data breaches, data protection impact assessments and prior consultation under Articles 32 to 36, taking into account the nature of the processing and the information available to Playsa. Playsa's data protection impact assessment may be used as a basis and is provided on request.

5.8 Personal data breaches

Playsa notifies the controller without undue delay and no later than 24 hours after Playsa has become aware of a personal data breach concerning data Playsa processes on behalf of the controller. Times and contents are set out in annex 6. The controller assesses whether the breach is to be reported to IMY and whether the data subjects are to be informed. Playsa assists.

5.9 Deletion and return

When the main agreement ends, Playsa returns and deletes the data under annex 8.

5.10 Audits

Playsa provides the controller with the information needed to demonstrate compliance with Article 28, and allows audits under annex 7.

5.11 Records and contact with IMY

• Playsa keeps records of processing under Article 30.2.
• Playsa cooperates with IMY on request.
• If IMY contacts Playsa about the controller's processing, Playsa informs the controller, where permitted.

5.12 Requests from public authorities

If a public authority, also in a country outside the EU, requests data, Playsa refers it to the controller where possible. Playsa examines the request, discloses only what the law requires and informs the controller unless prohibited.

5.13 Public organisers

If the controller is a municipality or another public authority, the following also applies:

• Playsa assists when the controller has to disclose public records, preserve data under archival rules, for example the register and the attendance, or assess secrecy.
• Playsa processes the data only for technical processing and storage under the agreement.

Playsa's work under the agreement is included in the price under the main agreement. On-site audits under annex 7 are remunerated by agreement.

• The parties' liability towards the data subjects follows Article 82 of the GDPR.
• Between the parties, each is liable for damage caused by its own breaches of the agreement or of the data protection rules.
• An administrative fine is borne by the party it is imposed on.
• The limitation of liability in section 15 of the main agreement also applies to this agreement.

The agreement applies for as long as the main agreement applies and thereafter for as long as Playsa processes data on behalf of the controller.

• Playsa announces changes by email to the controller's administrators at least 30 days before they take effect. A change is accepted in the portal.
• Annex 3 is changed under section 5.4.
• If changed law or a decision by a public authority requires a change, the parties shall negotiate in good faith.

In the event of conflict, this agreement takes precedence over the main agreement in matters of personal data. Standard contractual clauses the parties enter into take precedence over both.

Swedish law applies. Disputes are tried by the ordinary courts with Malmö District Court as the court of first instance.

Annexes:

1. The processing
2. Categories of data subjects and personal data
3. Sub-processors and transfers
4. Security measures
5. Storage and deletion
6. Breach handling with deadlines
7. Audits and reviews
8. Termination and a copy of the data
9. Contact persons

The parts of the service and what Playsa does in them:

• Trial sessions: receives bookings for the controller's sessions, counts the places and shows the bookings to the controller's administrators and office.
• Queue: keeps the queue's entries in order by time and the group's priority rules, sends offers and reminders, records deviations with reasons and shows the queue to the controller's administrators and office.
• Alerts and reminders: emails the controller's administrators and office when a queue and a free place exist at the same time, when a yes is waiting for word and when the places status is old. The alerts contain counts, never names.
• Photos: stores, re-encodes and shows the controller's photos on the search page, hides photos after a report and removes them, under section 10 a of the main agreement.
• Support and troubleshooting: at the controller's request under annex 4, O6.

The parts of the club management system, from when they open:

• The register: stores people, families within the organisation, memberships and groups per term, suggests duplicates and merges them when the controller has chosen it, logs changes and exports at an administrator's request. Shows leaders only the children in their own groups.
• The import: reads the controller's file, interprets the rows, shows errors and duplicates and saves what the controller approves. Never stores the file, and keeps the interpreted rows for at most seven days.
• The connection to the family account: sends the controller's invitation to connect, receives the guardian's approval, writes a changed email address and phone number into the register when the guardian has chosen it, and shows the controller's data about the guardian and the children to the connected person, including the children's groups and sessions in the parent's calendar feed.
• Enrolment: receives enrolments sent to the controller, calculates the price according to the controller's settings, shows the enrolments, the answers and the consents to administrators and office, sends receipts and messages to the family and adds admitted participants to the register.
• Fees: calculates the amounts due per enrolment, and for participants without an enrolment when the controller has chosen it, and produces the fee basis, which the controller invoices in the service or exports to its own invoicing system.
• Invoices: creates invoices with OCR numbers from the amounts due, sends them and at most two reminders to the payer, reads in the file from Bankgirot and marks off the payments, records payments by hand and with Fritidskortet, credits, writes off and splits invoices when the controller has chosen it, and produces the basis for the controller's bookkeeping. The money goes to the controller's bankgiro and never through Playsa.
• Attendance: creates sessions from the groups' schedules, receives the leaders' marks and the families' check-ins, logs corrections and shows the attendance to leaders in the group, administrators and office.
• Self check-in: shows a code for the session on the leader's screen or on a poster, when the controller has switched on check-in for the group, and writes check-ins by connected guardians and adult participants as attendance, which the leader sees and can change.
• Criminal record extracts: stores the status, shows when the check expires soon and closes the leader's access to the children when the check has expired or is missing, under section 10 b of the main agreement.
• The basis for grants: calculates the basis for LOK support and municipal grants from the attendance and exports it.
• Notices, invitations and mailings: sends presence and absence notices to connected guardians according to their choices, sends invitations and reminders and receives replies, sends email to a group with a copy to guardians under section 9 c of the main agreement, and shows whether a message has been opened.
• Roles and support: governs what each user sees according to the role and the groups the controller has given, and logs the controller's permissions for Playsa's support.

New parts are added under section 9.

Data subjects:

• children who have been booked for a trial session or are in a queue at the controller,
• guardians who have booked a trial session or put the child in a queue,
• people who appear in the controller's photos,
• members and participants of all ages in the controller's register,
• guardians and contact persons in the controller's register,
• leaders, assistant leaders and others with a role at the controller,
• children and adults enrolled in the controller's groups, and the person who enrolled them,
• payers of the controller's fees and invoices.

Personal data:

The service processes no personal identity numbers, health data or other sensitive data on behalf of the controller. If an import file contains personal identity numbers, Playsa works out the date of birth and sex and does not store the number.

Sub-processors in use:

Sub-processors that may be added. None of them is used today, and Playsa uses them only after a notice under section 5.4 for each sub-processor. The notice states the contracting party, the country and the transfer ground.

Technical measures:

• T1 Isolation. Authorisation is checked in the service layer at every call. Row Level Security in Postgres on every table with the controller's data is the second line of defence. A table without a policy is closed.
• T2 Isolation tests. A test suite tries to read other organisations' and other families' data, and tests every role: a leader against a group they do not lead, a treasurer against the attendance, a parent against another child and Playsa's staff without a permission. Changes are not merged with red tests.
• T3 Encryption at rest and in transit. Supabase encrypts the database and the backups with AES-256. The connections use TLS, and the database refuses connections without TLS.
• T4 Two-factor authentication. Everyone who uses the portal signs in with two-factor authentication. So does Playsa's staff in the systems where the data is held.
• T5 Audit log. Administrative actions are written to a log that cannot be changed through the service: who, what and when. The controller gets its own log on request.
• T6 Logging without personal data. Playsa's logs mask email addresses, phone numbers and personal identity numbers. Error reports are stripped of IP addresses, cookies and query strings.
• T7 Application protection. Validation at every boundary, CSP, HSTS, secure cookies, CSRF protection and rate limits.
• T8 Region. The database and the server functions are in Stockholm.
• T9 Backups. Daily backups.
• T10 Minimal content in mailings. Email contains at most the child's first name. Presence and absence notices contain the first name, the group and the day, never the place, the time, the leader's name or other children. An invoice by email contains the first name, the group, the term, the amount, the bankgiro, the OCR number and the due date, and no attachment. Alerts to the controller contain counts only.
• T11 Photos. The photos are re-encoded, all metadata is removed and the original is not stored. The photos are delivered only from playsa.se, and search engines are asked not to show them in image search.
• T12 Sensitive data, before it is stored. Personal identity numbers and health data are encrypted per field with AES-256-GCM and a key per organisation, and the master key is kept separate from the database.
• T13 Protected personal data. A person with protected personal data is marked in the register and shown as "Protected identity" without a name in lists and to leaders. Only an administrator can show the name, and every display is logged. An export never contains the person's name. A child with protected personal data may not appear in photos (section 10 a of the main agreement).
• T14 The leader's view. A leader sees only the children in their own groups, with name and year of birth, and only as long as the criminal record extract is valid (section 10 b of the main agreement). The phone number of a connected guardian is shown only when the leader presses Call, and every such display is logged.
• T15 Export. Only an administrator exports personal data. The bookkeeping export, without names, can also be made by the treasurer. Every export is logged with who, when and the number of rows, never the content.
• T16 The register's change log. Every change in the register is logged with the field, who, when and from where, never with the value.
• T17 The connection. Connections are created and removed only through functions that check the code, the custody and the status. The controller cannot read Playsa's id for a person, so that two organisers cannot compare the same child.
• T18 Self check-in. The code on the leader's screen is derived from a secret for the session and changes every 30 seconds. The poster's code is stored only in a form that cannot be read out. No location, no IP address and no picture is stored with the check-in. The limit on the number of attempts uses a code derived from the address, which is kept for at most five minutes.
• T19 Invoices. The bankgiro is changed only by an administrator with two-factor authentication, and all administrators and the treasurer then get an email. The file from Bankgirot is never stored, only the payments in it. Leaders and the board have no access to the invoices, and only the administrator and the treasurer see the amounts paid with Fritidskortet.

Organisational measures:

• O1 Confidentiality. Anyone who works for Playsa and has access to personal data has committed to confidentiality.
• O2 Least privilege. Only those at Playsa who need access to production have it. Secrets exist only in environment variables, never in the code.
• O3 Tested changes. Changes are tested with automated tests, including the isolation tests, before they are merged.
• O4 Penetration test. An external penetration test is carried out before the service stores personal identity numbers or health data.
• O5 Incident routine. Playsa has a written incident plan that is rehearsed. The deadlines towards the controller are set out in annex 6.
• O6 Support access. Playsa reads the controller's data only when needed for support the controller has asked for, to fix an error, to handle an incident or when the law requires it. Playsa reads the data in the club management system for a matter only with a time-limited permission from an administrator, under section 12 of the main agreement. The permission and the reads are logged. In an incident or when the law requires it, no permission is needed, and Playsa informs the controller afterwards unless it is prohibited.
• O7 Training. Anyone given access to personal data goes through the routines for data protection and security.

The service's periods apply to every organiser. If the controller wants something deleted earlier, the controller gets in touch and Playsa deletes it. Deletion runs every night.

• The controller assesses whether the breach is to be reported to IMY and whether the data subjects are to be informed.
• If the breach affects several organisers, each gets its own notification.
• The sub-processors notify Playsa under annex 3. Playsa's deadline runs from when Playsa became aware, also when the breach started at a sub-processor.

• Playsa answers a questionnaire on security and data protection once a year free of charge.
• Playsa provides the sub-processors' audit reports, for example SOC 2, where the sub-processor permits it.
• Playsa provides on request a summary of the penetration test in annex 4, O4, once it has been carried out.
• The controller, or an independent auditor with a confidentiality undertaking, may audit Playsa on site or remotely once a year, with 30 days' notice. More often after a breach or when IMY requires it.
• The controller bears its own costs for the audit. If the audit requires more than one working day of Playsa, Playsa is remunerated by agreement.
• IMY's right to audit is not affected.

• The controller can get a copy of its data at any time. Playsa provides it in CSV or JSON within 30 days, free of charge.
• After the main agreement has ended, the controller can get a copy for 60 days.
• The controller itself exports what law or grant rules require the controller to keep, for example the basis for grants and the invoices, before Playsa deletes the data.
• The connections between the register and the family accounts are removed when the main agreement ends. The family accounts remain.
• After that Playsa deletes the controller's data within 30 days. Deleted data remains in the backups for at most 30 more days.
• Playsa confirms the deletion in writing on request.
• Data that Playsa itself is responsible for, for example the parents' family accounts and their bookings, queue places and enrolments that have not been sent, is handled under Playsa's privacy policy.
• If the law requires Playsa to keep something, Playsa tells the controller what and why.