Data processing agreement

Last updated 16 October 2026

This data processing agreement ("DPA") is part of the agreement between VNTRS Consulting AB, company registration number 559070-8417 ("we", "us", the processor), and the customer that uses Hedda (the controller), under our terms of service. It applies whenever we process personal data on the customer's behalf, and meets the requirements of Article 28 of the General Data Protection Regulation (GDPR). The customer accepts it by accepting the terms, and no separate signature is needed. If the customer wants a signed copy, contact us at hej@hedda.app.

1. Roles and instructions

The customer is the controller of the personal data it and its users put into Hedda. We are its processor. We process that data only on the customer's documented instructions. The terms of service, this DPA, and the customer's configuration and use of Hedda make up those instructions. If we believe an instruction breaches data protection law, we tell the customer immediately. If EU or Swedish law requires us to process the data in some other way, we tell the customer first, unless the law forbids it.

The customer is responsible for having a legal basis for the processing, for the data it chooses to store, and for informing its employees and other data subjects.

2. The processing

• Purpose: to provide, secure and support Hedda for the customer.
• Nature: storage, organisation, retrieval, calculation, display, export and deletion, and exchange of data with the integrations the customer connects.
• Duration: as long as the agreement lasts, and after it until the data has been deleted under section 9.
• Data subjects: the customer's employees and former employees, consultants and other people working for it, its users, and people outside the company it invites to give feedback.
• Categories of personal data: depending on which features the customer uses, the categories below. The examples are not a complete list, and new features add data within these categories:
  • identity and contact details, such as name, work email, phone number, address and Swedish personal identity number;
  • employment details, such as start and end dates, job title, department and employment terms;
  • compensation and payroll, such as salary history, variable pay, pay runs, tax details and bank account details for salary payments;
  • time and absence, such as time reports, project allocations, vacation, parental leave and other leave;
  • development and feedback, such as goals, check-ins, performance reviews, feedback and managers' notes;
  • surveys, such as pulse surveys, whose answers are stored separately from who answered and shown only in aggregate;
  • profile content, such as profile pictures, introductions and internal news;
  • the audit log of changes to the above.
• Special categories: only sick leave and leave to care for a sick child (VAB), which are health data. We will not add another special category without notifying the customer first. The customer must not store other special categories of personal data in free-text fields unless it has a legal basis to do so.

3. Confidentiality

Only people at VNTRS who need it to run, secure or support Hedda can access customer data. They are bound by a duty of confidentiality that continues after their employment ends. We do not access a customer's data except to provide the service, to fix a problem, to handle a support request from the customer, or where the law requires it.

4. Security

We take appropriate technical and organisational measures to protect personal data, in line with Article 32 GDPR. These include:

• All traffic is encrypted with HTTPS, and data is encrypted at rest.
• Each customer's data is kept separate from every other customer's, and every request for data is checked against the user's membership of the company account. Images such as profile pictures are served from unguessable addresses without a sign-in check.
• Access within a company account is role-based. Salaries, bank details and other sensitive information are visible only to people who have been granted that right.
• Changes made in Hedda are recorded in an audit log, which is kept for one year.
• API keys are stored only in hashed form.
• Sign-in requires a verified email address through a supported identity provider.
• Data is backed up with point-in-time recovery for 7 days and weekly backups kept for 14 weeks. We have a documented procedure for restoring from them.

We may change these measures as technology develops, but never so that the overall level of protection is lower.

5. Subprocessors

The customer gives general authorisation for us to use subprocessors. We bind each subprocessor to data protection obligations at least as strict as those in this DPA. We remain responsible to the customer for its work. Our current subprocessors are:

Bug reports and suggestions that users send us with the in-app "Send feedback" button, including any screenshots, are not processed on the customer's behalf. We handle them as controller under our privacy policy, and users are asked not to include other people's personal data in them.

Integrations the customer connects itself, such as Fortnox or Slack, and AI assistants or other applications it authorises to use the API or the MCP server, are not our subprocessors. They process data under the customer's own agreement with them.

We notify the customer at least 30 days before we add or replace a subprocessor, as described for notices in the terms of service. The customer can object on reasonable data protection grounds within that period. If we cannot resolve the objection, the customer may terminate the agreement with effect from the date the change takes effect, and we refund any fees prepaid for the period after that date.

6. Transfers outside the EU/EEA

We transfer personal data outside the EU/EEA only where Chapter V of the GDPR permits it. We rely on the EU–US Data Privacy Framework where the recipient is certified, or on the European Commission's standard contractual clauses, together with any supplementary measures that are needed.

7. Assistance to the customer

• Data subjects' rights: the customer can view, correct and delete data in Hedda itself, and export it as described in section 9. If a data subject contacts us directly about data we process for the customer, we forward the request to the customer without undue delay and tell the data subject we have done so. We do not act on the request ourselves unless the customer instructs us to.
• Authorities: we tell the customer about any request from a supervisory authority concerning its data, unless the law forbids it.
• Impact assessments: we provide the information the customer reasonably needs for a data protection impact assessment, or for prior consultation with a supervisory authority.

8. Personal data breaches

We notify the customer without undue delay, and no later than 48 hours after becoming aware of a personal data breach affecting its data. The notification describes, as far as we know at the time:

• what happened;
• which categories of data and data subjects are affected, and roughly how many;
• the likely consequences;
• what we have done and will do about it.

We add information as it becomes available. Under the GDPR, the customer must report the breach to the supervisory authority within 72 hours where required, and this notification lets it do so.

9. Return and deletion

The customer can export its data at any time through the API and the MCP server, and for 30 days after the agreement ends. On request, we provide a complete export of its data in a machine-readable format. After that period we delete the customer's company account and its data, unless the law requires us to keep it. Deleted data remains in backups until they expire, which takes no more than 14 weeks. We confirm the deletion in writing on request.

10. Audits

On request, we make available the information the customer needs to show that we meet this DPA. This normally means answering a written questionnaire. If that is not enough, the customer, or an independent auditor bound by confidentiality, may audit us once a year. The customer must give us at least 30 days' notice, and the audit must not disrupt our operations or expose other customers' data. Each party bears its own audit costs. After a personal data breach we caused, the customer may also carry out one audit concerning that breach, with reasonable notice, within six months of being notified of it.

11. Liability

Each party is liable for its own failure to meet its obligations under the GDPR and this DPA. The limitations of liability in the terms of service apply to this DPA. Damages and administrative fines are allocated as set out in Article 82 GDPR.

12. Term, changes and governing law

This DPA applies as long as we process personal data on the customer's behalf. If data protection law or guidance from a supervisory authority changes, we may update this DPA to comply, with 30 days' notice or sooner if the law requires. Notices are sent as described in the terms of service. Any other change follows the procedure for changes in the terms of service. Where this DPA and the terms of service conflict about personal data, this DPA takes precedence. It is governed by Swedish law, and disputes are settled as described in the terms of service.