1. Parties, application and precedence
This agreement is between the company accepting the Terms (Customer) and Rojs Software AB, registration number 559573-3501 (Rojs). Version 2026-10-09 is incorporated into Terms version 2026-10-09 and becomes binding through express acceptance by the Customer's authorised representative or a separate written agreement. Publication does not constitute acceptance by existing customers.
The Customer is controller for processing Rojs performs on its documented instructions. This DPA prevails over conflicting data protection terms. The company's identity, representative, accepted Terms version and acceptance time are recorded as agreement evidence.
2. Processing annex and allocation of roles
The services cover storing, organising, displaying, correcting, exporting and deleting consultant, contact, workplace, assignment and time-report data the Customer places in its workspace for staffing and assignment administration. Processing lasts for the service agreement and necessary termination handling under section 9.
Data subjects are the Customer's consultants, employees, representatives and client contacts. Data may include names, contact details, professional roles, workplaces, assignment periods, working time, approvals and administrative correspondence. Patient records, health information and other special-category data must not be entered. Personal identity numbers must not be included in free text or customer material.
Rojs is a separate controller for its own accounts, security, company verification and BankID, consultant-requested matching, public ratings, its own fee calculation and accounting, and legal claims. The privacy notice covers these purposes. Customers independently control their subsequent processing of received enquiries. This DPA alone does not authorise Rojs to reuse customer data for its own purposes.
3. Instructions and customer responsibilities
The Customer determines permitted purposes and data, ensures a lawful basis and notices, and restricts access. This agreement, use of agreed functions and written instructions from authorised representatives constitute documented instructions. Rojs processes only on those instructions, including transfers outside the EEA.
If law requires other processing, Rojs informs the Customer before processing unless prohibited by law. Rojs immediately informs the Customer if it considers an instruction contrary to data protection law and suspends the affected processing until clarified. Material changes require documented agreement before processing begins.
4. Confidentiality and security annex
Access is limited to personnel who need it and are bound by confidentiality commitments or statutory duties. Rojs applies risk-appropriate Article 32 measures: access control and tenant separation, protected communications, protection of secrets and identity evidence, traceable privileged access, minimised logging, backup and recovery, and regular effectiveness checks.
Database access is restricted to authorised services and operators. Scheduled logical backups are encrypted before upload and retained for 14 days. Rojs must maintain appropriate confidentiality, integrity, availability and recoverability and remedy identified deficiencies. Customers may request an up-to-date description of measures and relevant verification results.
5. Subprocessors and transfers
The Customer provides general prior written authorisation for these subprocessors insofar as they process data on its behalf: Vercel (application hosting and technical logs), Neon (database), GitHub (backup, restore verification and encrypted backup files), Resend (service messages) and one.com (support correspondence). GitHub may temporarily process plaintext during database dump and restore verification; only encrypted backups may be stored as artifacts.
Rojs gives written notice at least 30 days before adding or replacing a subprocessor and allows a reasoned data protection objection before the change. The parties seek a solution; if protection cannot be ensured, the affected processing must not move without agreement and the Customer may terminate that service. Rojs imposes equivalent obligations and remains responsible to the Customer for their performance.
Transfers outside the EEA require instructions and an applicable Chapter V safeguard, such as a valid adequacy decision or EU standard contractual clauses with necessary supplementary measures. Customers may request current recipients, processing countries and a copy of relevant safeguards. The BankID provider's independent processing and Rojs's own payment/accounting purposes are outside this subprocessor authorisation.
6. Data subject rights and assistance
Rojs forwards requests concerning customer-controlled processing without undue delay and does not answer substantively without instructions unless required by law. Rojs assists through appropriate technical and organisational measures with access, rectification, erasure, restriction, objection and portability so the Customer can meet legal deadlines.
Taking account of the processing and information available, Rojs also assists with security, incident investigation, impact assessments and prior consultation under Articles 32–36 GDPR. The Customer remains responsible for its decisions and notifications as controller.
7. Personal data breaches
Rojs notifies the agreed customer contact without undue delay after becoming aware of a personal data breach affecting the services. Notification covers known circumstances, categories and approximate numbers of affected people and records where known, likely effects, measures and a contact point. Information is supplied in stages where necessary.
Rojs contains the incident, preserves relevant evidence and cooperates with the Customer. Reporting does not wait for a completed investigation. The Customer decides on notifications to individuals or authorities for its processing.
8. Information and audits
Rojs makes information needed to demonstrate compliance available and allows and contributes to audits, including inspections, by the Customer or its appointed independent auditor. Timing, confidentiality and scope are coordinated to protect other customers without undermining audit rights. Urgent incidents and regulatory requirements are handled promptly.
9. Return, deletion and contact
At the end of processing, Rojs returns data in a usable format or deletes it at the Customer's choice, and deletes existing copies unless EU or Member State law requires retention. The Customer sends its choice and termination instructions to support@vardbemanningsguiden.se. Rojs confirms scope, execution plan and completion without undue delay.
Protected backup copies are isolated from ordinary use until their applicable backup cycle expires. After restoration, earlier deletion instructions must be reapplied before use. Legally required retention is documented and purpose-limited, with deletion when the obligation ends. Rojs's own accounting and other independent purposes are handled separately under the privacy notice.