Personuppgiftsbitradeavtal -- mall

Detta ar en mall. Den ska granskas av juridisk radgivare och anpassas till det specifika avtalet innan den undertecknas.

Parter

Personuppgiftsansvarig: [KOMMUNNAMN], org.nr [ORG.NR], [ADRESS] ("Kommunen").

Personuppgiftsbitrade: Patch (enskild firma), org.nr [UNDER REGISTRERING], Pitea ("HDS").

1. Andamal och varaktighet

HDS behandlar personuppgifter pa Kommunens uppdrag i syfte att drifta och tillhandahalla Hitta Ditt Sverige-plattformen for Kommunens subdomane. Avtalet galler sa lange tjansteavtalet mellan parterna ar i kraft, plus 30 dagar for dataradering.

2. Behandlingens art och andamal

HDS lagrar, presenterar och administrerar verksamhets-, forenings- och innehallsdata som Kommunen och dess anvandare registrerar pa plattformen. HDS behandlar inte uppgifterna for egna andamal.

3. Kategorier av personuppgifter

Verksamhetsdata: namn, adress, e-post, telefonnummer for foreningar och foretag
Evenemangsinformation: titlar, datum, platser, kontaktuppgifter
Anvandarkonton: e-postadress, hashat losenord
Medlemsdata (om Bli Medlem aktiveras): namn, e-post, medlemsnummer, anpassade falt

4. Kategorier av registrerade

Forenings- och foretagsrepresentanter verksamma i Kommunens geografiska omrade
Invandare och besokare som registrerar konton
Foreningsmedlemmar (om Bli Medlem aktiveras)

5. HDS skyldigheter

Behandla personuppgifter enbart pa Kommunens dokumenterade instruktioner
Sakerstalla att personal med atkomst till personuppgifter ar bundna av sekretess
Vidta lampliga tekniska och organisatoriska sakerhetsatgarder (HTTPS, krypterade backuper, atkomstkontroll)
Bitrida Kommunen att uppfylla de registrerades rattigheter (atkomst, rattelese, radering, portabilitet)
Underratta Kommunen utan ondigt drojsmal, och senast inom 72 timmar, om HDS upptacker ett personuppgiftsincident
Pa Kommunens begaran radera eller returnera all persondata vid avtalets upphorande, inom 30 dagar
Tillhandahalla all information som kravs for att Kommunen ska kunna visa att skyldigheterna uppfylls och tillata revision

6. Underleverantorer

HDS anvander de underleverantorer som framgar av den publicerade underleverantorslistan (subprocessors.html). HDS underrattar Kommunen om planerade andringar med minst 14 dagars varsel. Kommunen har ratt att invanda mot andringen inom den perioden.

7. Kommunens rattigheter

Kommunen har ratt att: (a) begara atkomst till alla personuppgifter som behandlas pa dess uppdrag, (b) begara korrigering eller radering, (c) genomfora eller lat genomfora revision av HDS behandling, (d) begara fullstandig dataexport i maskinlasbart format.

8. Avslut och radering

Inom 7 dagar fran avtalets upphorande: HDS levererar fullstandig dataexport. Inom 30 dagar: all kommunspecifik persondata raderas fran produktionsdatabasen. HDS skickar skriftlig bekraftelse till Kommunens DPO.

9. Styrande lag

Detta avtal regleras av svensk ratt. Tvister ska i forsta hand losas genom forhandling. Om forhandling misslyckas horas tvisten i Lulea tingsratt.

Undertecknat av behorizontal behorizong representant for respektive part:

For Kommunen	For HDS
Namn:___________________ Titel:___________________ Datum:__________________	Namn: Patch Titel: Grundare, HDS Datum:__________________

This is a template. It must be reviewed by legal counsel and adapted to the specific agreement before signing.

Parties

Data Controller: [MUNICIPALITY NAME], reg. no. [ORG NO], [ADDRESS] ("the Municipality").

Data Processor: Patch (sole trader), reg. no. [PENDING], Pitea, Sweden ("HDS").

1. Subject Matter and Duration

HDS processes personal data on behalf of the Municipality for the purpose of operating and providing the Hitta Ditt Sverige platform for the Municipality's subdomain. This agreement remains in effect for the duration of the service agreement between the parties, plus 30 days for data deletion.

2. Nature and Purpose of Processing

HDS stores, displays and administers business, association and content data that the Municipality and its users register on the platform. HDS does not process the data for its own purposes.

3. Categories of Personal Data

Business data: names, addresses, email, phone numbers for associations and businesses
Event information: titles, dates, locations, contact details
User accounts: email address, hashed password
Membership data (if Bli Medlem is enabled): name, email, membership number, custom fields

4. Categories of Data Subjects

Association and business representatives active in the Municipality's geographic area
Residents and visitors who register accounts
Association members (if Bli Medlem is enabled)

5. Obligations of HDS

Process personal data only on the Municipality's documented instructions
Ensure that staff with access to personal data are bound by confidentiality
Implement appropriate technical and organisational security measures (HTTPS, encrypted backups, access control)
Assist the Municipality in fulfilling data subject rights (access, rectification, erasure, portability)
Notify the Municipality without undue delay, and no later than 72 hours, upon discovering a personal data breach
On the Municipality's request, delete or return all personal data upon termination, within 30 days
Provide all information necessary for the Municipality to demonstrate compliance and allow audits

6. Subprocessors

HDS uses the subprocessors listed in the published subprocessor list (subprocessors.html). HDS will notify the Municipality of planned changes with at least 14 days notice. The Municipality has the right to object to the change within that period.

7. Municipality Rights

The Municipality has the right to: (a) request access to all personal data processed on its behalf, (b) request correction or erasure, (c) conduct or commission an audit of HDS processing, (d) request a full data export in machine-readable format.

8. Termination and Deletion

Within 7 days of contract termination: HDS delivers full data export. Within 30 days: all municipality-specific personal data deleted from the production database. HDS sends written confirmation to the Municipality DPO.

9. Governing Law

This agreement is governed by Swedish law. Disputes shall be resolved first through negotiation. If negotiation fails, disputes shall be heard by Lulea District Court.

Signed by authorised representatives of each party:

For the Municipality	For HDS
Name:___________________ Title:___________________ Date:___________________	Name: Patch Title: Founder, HDS Date:___________________

Personuppgiftsbitradeavtal

Data Processing Agreement

Parter

1. Andamal och varaktighet

2. Behandlingens art och andamal

3. Kategorier av personuppgifter

4. Kategorier av registrerade

5. HDS skyldigheter

6. Underleverantorer

7. Kommunens rattigheter

8. Avslut och radering

9. Styrande lag

Parties

1. Subject Matter and Duration

2. Nature and Purpose of Processing

3. Categories of Personal Data

4. Categories of Data Subjects

5. Obligations of HDS

6. Subprocessors

7. Municipality Rights

8. Termination and Deletion

9. Governing Law