Data processing agreement

Roles

You are the controller, and we are the processor, for the personal data we process to provide Fabella to your organisation. For data we use for our own purposes, such as billing and our own analytics, we’re the controller, as the privacy policy describes.

What we process

• Nature: storing, organising, generating content with, showing and deleting data, as Fabella needs.
• Purpose: to provide Fabella: building, hosting and running your courses, inviting learners, and recording their progress and results.
• People: your users and learners, and people mentioned in the material you put into Fabella.
• Data: names, email addresses, login details, course progress, answers and results, and any personal data in your content.
• Duration: while you use Fabella, and up to 90 days after.

Don’t put sensitive personal data, such as health data, into Fabella unless we’ve agreed on it in writing.

Our commitments

• We process the data only on your documented instructions. This applies to transfers outside the EU/EEA too, unless the law requires otherwise, in which case we tell you first, if we’re allowed to. These terms and your use of Fabella are your instructions. If we think an instruction breaks data protection law, we’ll tell you.
• Everyone who can reach the data is bound by confidentiality.
• We protect the data with appropriate technical and organisational measures, including encryption in transit and at rest, and access control.
• We help you answer requests from the people whose data it is, and with security and impact assessments, as far as we reasonably can.
• We tell you without undue delay, and within 48 hours of finding out, if a personal data breach affects your data.
• We give you the information you need to show that this agreement is followed. You, or an auditor you appoint, may audit us at your own cost, after giving us at least 30 days’ notice.

Sub-processors

You allow us to use sub-processors. The categories are listed in the privacy policy: cloud hosting and databases, AI models, product analytics, payments and billing, and email delivery. Each is bound by data protection terms at least as strict as these. We’ll tell you before we add or replace one, and you may object on reasonable data protection grounds. If we can’t solve the objection, you may end the affected service. We remain responsible to you for our sub-processors. Email us for the current list of named sub-processors.

Transfers outside the EU/EEA

Where a sub-processor processes data outside the EU/EEA, the transfer is covered by the EU-US Data Privacy Framework or the EU Commission’s standard contractual clauses.

At the end

When you stop using Fabella, you can export your data. We delete the personal data within 90 days, unless the law requires us to keep it.

Liability and law

Liability follows the terms of service. This agreement is governed by Swedish law. If it conflicts with the terms on personal data, this agreement applies.

Contact

Write to contact@fabella.io for questions, requests or a signed copy.