This Data Processing Agreement (DPA) is part of the agreement between the organization that uses WisqRent (the Customer) and Sandquist Media AB, registration number 559528-0412 (WisqRent; see the Legal Notice). It applies whenever WisqRent processes personal data on the Customer's behalf, and meets Article 28 of the EU General Data Protection Regulation (GDPR). It applies automatically when the Customer uses WisqRent; no signature is needed.
Roles
The Customer is the controller of the personal data it stores in WisqRent. WisqRent is the processor. WisqRent's own handling of account data about the Customer's users is described in the Privacy Policy, where WisqRent is the controller.
What we process
- Purpose: providing WisqRent to the Customer: inventory, orders, quotes, deliveries, the AI assistant and the other features the Customer uses.
- Data subjects: the Customer's customers and their contact persons, people at venues, and anyone the Customer mentions in orders, notes, files or assistant conversations.
- Personal data: names, organization numbers, email addresses, phone numbers, billing and venue addresses, delivery instructions, notes and other free text, and photos and files the Customer uploads.
- Special categories: WisqRent is not designed for special categories of personal data (Article 9 GDPR), and the Customer should not store them.
- Duration: for as long as the Customer uses WisqRent, and until the data is deleted as described under End of the agreement.
Our obligations
WisqRent will:
- process personal data only on the Customer's documented instructions, which are the agreement, this DPA and the Customer's use of WisqRent, and tell the Customer if it believes an instruction breaks data protection law;
- make sure everyone with access to the data is bound by confidentiality;
- protect the data with the security measures listed below;
- help the Customer answer requests from data subjects, mainly through WisqRent's own features;
- help the Customer with security, breach notification, impact assessments and prior consultations, taking into account the information available to WisqRent;
- tell the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data;
- give the Customer the information needed to show compliance with Article 28, and allow audits by the Customer or an auditor it appoints, on reasonable notice and at the Customer's cost.
Subprocessors
The Customer authorizes WisqRent to use the subprocessors on the Subprocessors page. WisqRent binds each subprocessor to data protection terms that offer the same level of protection as this DPA, and remains responsible for them.
WisqRent updates that page before a new subprocessor starts processing the Customer's personal data. The Customer may object on reasonable data protection grounds by emailing privacy@wisqrent.com within 30 days. If we cannot resolve the objection, the Customer may end the agreement.
Transfers outside the EU
Personal data is stored in the EU. Some subprocessors process it in the United States. Those transfers are covered by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses, as listed on the Subprocessors page.
Erasure and data subject requests
The Customer can correct customer, contact and venue details at any time. To erase a customer or venue, an owner archives it and chooses Delete permanently in Settings → Archive; archived customers and venues are also erased automatically 30 days after they are archived. Erasure clears names, contact details, addresses and notes.
Some data is not erased automatically, and the Customer edits it by hand when a request requires it:
- confirmed and completed orders keep the customer and venue details they were issued with, as accounting records;
- free text such as order names, order notes and project names;
- assistant conversations, which WisqRent erases on request.
Backups are kept for 7 days, so erased data leaves the backups within 7 days.
End of the agreement
When the agreement ends, the Customer can ask for a copy of its data by emailing privacy@wisqrent.com. WisqRent then deletes the Customer's personal data within 90 days, unless the law requires it to keep it. Backups expire 7 days later.
Security measures
- All traffic is encrypted with TLS. Uploaded files are stored privately in the EU and are only reachable through links that expire after 15 minutes.
- Passwords are hashed. Users can turn on two-factor sign-in.
- Every organization's data is separated, and access inside an organization follows the roles its owner assigns, checked on every request. Financial data has its own permission. Only owners can erase personal data.
- API keys are stored hashed, are read-only and can expire.
- WisqRent staff tools show organization and member details only, never the Customer's customers, orders or other records. Staff need two-factor sign-in, and every view is logged.
- AI providers do not use the data to train models. The AI assistant runs through providers chosen in our code, so data cannot reach other AI providers.
- Backups run every hour and are stored in the EU for 7 days.
- Logs exclude passwords, codes, tokens and request contents.