Data processing agreement (PUB-avtal)

1. Parties and roles

1.1 This agreement is between the customer, which is the school's education provider (huvudman, for example a municipality or the provider of an independent school), and Viafocus AB, company reg. no. 559547-4882 (we). The customer is the controller and we are the processor.

1.2 This agreement belongs to the customer's agreement for the services, which consists of the terms of service (/en/terms-of-service) and any order (the main agreement). Terms used in the General Data Protection Regulation (GDPR) have the same meaning here.

2. How the agreement is entered into

2.1 The agreement is entered into when an authorised representative of the customer approves it in the Viafocus admin view, before the first pupil is added. It can also be entered into by the parties signing a separate copy.

2.2 Whoever approves the agreement on behalf of the customer confirms that they are authorised to represent the customer.

2.3 The agreement covers processing in Focuspilot and Studio.

3. Nature and purpose of the processing

3.1 We process personal data for the customer to provide the services under the main agreement:

• Focuspilot: letting teachers manage and follow pupils' school computers during lessons and tests.

• Studio: letting teachers create lessons and tests and letting pupils answer them.

• AI features that the customer or the teacher turns on.

• Operating, supporting, securing and troubleshooting the services.

3.2 The processing consists of collection, storage, display to authorised users, transfer between parts of the service, and deletion.

3.3 We never use the data for our own purposes. We do not sell it, show no advertising and do not train AI on it.

3.4 This agreement does not cover data for which we are the controller ourselves, for example customer accounts, invoicing, the website and guardian accounts. Those are described in the privacy policy (/en/privacy-policy).

4. Data subjects and data

4.1 The data subjects are pupils and the staff the customer gives an account in the services, for example teachers and administrators.

4.2 Which data is processed depends on the features the customer uses:

• Name, email, school, class or group, year and role.

• In Focuspilot: which web page or program is open and its title, attempts to open blocked pages, events during tests and details about the computer.

• Screenshots, only while a teacher has the pupil in view. They are not stored.

• In Studio: lessons, answers, results, the teacher's comments and private notes.

• What teachers write to the AI features.

• Optional, only if the customer chooses it: personal identity number and profile picture.

4.3 More about the data is in the privacy policy (/en/privacy-policy) and in Annex 1.

5. The customer's instructions

5.1 We process the data only on the customer's documented instructions. The instructions are this agreement, the main agreement, Annex 1 and the settings the customer makes in the services. Other instructions are given in writing.

5.2 If EU or Swedish law requires us to process the data in another way, we inform the customer first, unless the law prohibits it.

5.3 If we believe an instruction infringes data protection rules, we tell the customer immediately.

5.4 The customer is responsible for its instructions being lawful, for the legal basis and for informing the data subjects.

6. Confidentiality and staff

6.1 Only staff who need it for operations, support or maintenance have access to the data. They are bound by confidentiality through contract or law.

6.2 For customers that are public authorities, the Act (2020:914) on confidentiality when outsourcing technical processing or storage of data also applies.

6.3 If an authority or anyone else asks for the customer's data, we refer them to the customer. We disclose data only when the law requires it, and tell the customer if we are allowed to.

7. Security

7.1 We take appropriate technical and organisational security measures under Article 32 GDPR, taking into account that the data concerns children and pupils.

7.2 All traffic is encrypted, and databases and file storage are encrypted. Each customer's data is kept separate from others'. Commands to pupils' computers are accepted only from accounts the customer has authorised. Our staff have access only when needed for support or maintenance.

7.3 The measures are described in more detail in Annex 1. We may change them as long as the level of protection does not decrease.

7.4 The customer is responsible for security on its side, for example for who gets accounts and permissions.

8. Sub-processors

8.1 The customer gives a general prior authorisation for us to engage sub-processors. Current sub-processors, what they do and where the data is are listed at /en/subprocessors.

8.2 We notify the customer in advance, at least 30 days before a new or replaced sub-processor starts processing the customer's data. The notice is sent by email to the customer's contact person, and the list is updated.

8.3 The customer can object in writing, on reasonable grounds, within that period. We then first try to resolve the objection, for example by not using the sub-processor for the customer's data. If we do not resolve it, the customer may terminate the affected service as of the day the change takes effect, and we refund prepaid fees for the time after that.

8.4 If a replacement is needed immediately for security or operations, we notify the customer as soon as possible. The customer has the same right to object.

8.5 We impose the same data protection obligations as in this agreement on every sub-processor through a written agreement, and we are liable for sub-processors as for ourselves.

9. Transfers outside the EU/EEA

9.1 We transfer data outside the EU/EEA only with safeguards under Chapter V GDPR: the EU–US Data Privacy Framework if the provider is certified, otherwise the European Commission's standard contractual clauses.

9.2 Which sub-processors process data outside the EU/EEA, and with which safeguard, is listed at /en/subprocessors. All AI runs within the EU (Microsoft Azure). The customer can use its own AI key with a provider it has its own agreement with; the questions then go there. The customer can get a copy of the safeguards from us.

10. Assisting the customer

10.1 Data subjects' rights. We help the customer respond to requests from data subjects, for example for access, rectification or erasure. If a request reaches us, we forward it to the customer within five working days. We do not respond ourselves unless the customer asks us to.

10.2 Impact assessment. We provide the information the customer needs for a data protection impact assessment (DPIA) and any prior consultation with IMY, including Annex 1. Our support material for the impact assessment is at /en/dpia.

10.3 Personal data breaches. We notify the customer without undue delay, and within 24 hours of confirming a personal data breach affecting the customer's data.

10.4 The notice describes, as far as we know: what has happened, which and roughly how many data subjects and records are affected, the likely consequences and the measures we have taken or propose. What we do not yet know, we provide as soon as we know it. The customer notifies IMY and informs the data subjects. We help.

11. Deletion and return

11.1 When the main agreement ends, we delete the customer's personal data or return it, at the customer's choice. The customer can request an export up to and including 30 days after the agreement ends. We deliver it in a machine-readable format within 30 days.

11.2 We delete the customer's data within 30 days after the agreement ends, or when a requested export has been delivered. On request, we confirm the deletion in writing. Data the law requires us to keep is kept for as long as the law requires.

11.3 During the agreement, we delete an individual pupil's data within 30 days when the customer asks us to.

12. Information and audits

12.1 We give the customer the information needed to show that we comply with this agreement and Article 28 GDPR, for example Annex 1 and the list of sub-processors.

12.2 The customer, or an independent auditor the customer engages who is bound by confidentiality, may audit our compliance with the agreement, including by inspection. The customer gives written notice of the audit reasonably in advance. The audit is carried out so that it does not disrupt operations or reveal other customers' data.

12.3 We cooperate with the Swedish Authority for Privacy Protection (IMY) when it asks us to.

13. Liability

13.1 Liability and its limitations follow the main agreement, section 20 of the terms of service. For breaches of this agreement or the GDPR, the higher cap there applies. The limitations do not apply to liability towards data subjects under Article 82 GDPR.

13.2 If we process the data in breach of the customer's instructions or for our own purposes, we are considered the controller for that processing.

14. Term and termination

14.1 The agreement applies from when it is entered into and for as long as we process personal data for the customer, that is until the data has been deleted or returned under section 11.

14.2 The agreement cannot be terminated on its own while we process personal data for the customer. It ends when the main agreement has ended and the data has been deleted or returned.

14.3 Confidentiality, and anything that by its nature is meant to apply after the agreement ends, continues to apply.

15. Which agreement comes first

15.1 If the customer and we have signed our own PUB-avtal, for example on the customer's own template, it applies instead of this standard agreement.

15.2 In matters of personal data, this agreement takes precedence over the main agreement. If this agreement and Annex 1 conflict, the agreement prevails.

15.3 Swedish law applies. Disputes are resolved under the main agreement.

16. Contact

Related documents: terms of service /en/terms-of-service, privacy policy /en/privacy-policy, sub-processors /en/subprocessors.