Delishift Data Processing Agreement

Version 0.1 - last updated 5 November 2026.

1. Parties

• Controller: the business that creates a company in Delishift (the "Customer").
• Processor: Khan Anwaruzzaman Md, trading as Parliva International (enskild firma), Kvintettvägen 68, 142 43 Skogås, Sweden ("Delishift"). Contact: support@delishift.com.

2. Purpose and precedence

This agreement meets the requirements of GDPR article 28 for the personal data Delishift processes on the Customer's behalf. It forms part of the Delishift Terms of Service. If the two conflict on a question of personal data, this agreement applies. The Delishift Privacy Policy describes the same processing for the people concerned.

3. Details of the processing

• Subject and purpose: workforce management - schedules, clock in and out, timesheets, labor cost, tips, team chat, certificates, employee details and payslip documents.
• Duration: as long as the Customer uses Delishift, and after that until the data is deleted under section 9.
• Nature: storing, organising, retrieving, computing, displaying, sending notifications, exporting and deleting.
• Data subjects: the Customer's owners, managers and employees.
• Categories of data: the data listed in section 2 of the Privacy Policy - account data, membership and permissions, work records, distance at clock in/out (never the position), wage rates, tips, payslip documents, chat messages, certificates and employee details (contact details, employment terms and date of birth).
• Not processed: personal identity numbers (personnummer), bank account numbers and position coordinates are not stored. Delishift is not designed for special categories of data (GDPR article 9), and the Customer must not enter such data.

4. The Customer's responsibilities

The Customer:

• decides the purposes of the processing and has a lawful basis for it. At work, consent is usually not a valid basis;
• informs its staff about the processing before they use Delishift, including the distance check at clock in/out when a workplace location is set;
• gives lawful instructions. Its use of the app and its settings are its documented instructions;
• decides whether a data protection impact assessment is needed and whether to consult employee representatives;
• answers requests from its staff about their rights, with Delishift's help.

5. Delishift's obligations

Delishift:

1. processes the data only on the Customer's documented instructions, unless EU or Swedish law requires otherwise, and then tells the Customer first unless the law forbids it;
2. tells the Customer if, in its view, an instruction breaks data protection law;
3. makes sure everyone authorised to process the data is bound by confidentiality;
4. applies the security measures in section 8;
5. uses sub-processors only under section 6;
6. helps the Customer answer data-subject requests - in the app through "Download my data", "Delete account" and the export and erase functions, and otherwise on request;
7. helps the Customer with security, breach notification, impact assessments and prior consultation (GDPR articles 32-36), taking into account the nature of the processing;
8. notifies the Customer without undue delay after becoming aware of a personal-data breach, with what is known about its nature, the data and people affected, the likely consequences and the measures taken or proposed, and adds details as they become known;
9. deletes or returns the data at the end of the service under section 9;
10. makes available the information needed to show compliance and allows audits under section 10.

6. Sub-processors

The Customer gives general authorisation for these sub-processors:

• Google Ireland Limited / Google LLC (Google Cloud and Firebase): Firebase Authentication, Cloud Firestore (region eur3, EU), Cloud Functions (europe-west1, Belgium), Cloud Storage (EU), Firebase Cloud Messaging and Firebase Hosting. Delishift binds each sub-processor to data protection obligations at least as strict as this agreement and remains responsible for them. Delishift tells the Customer at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that time. If no solution is found, the Customer may cancel the service before the change takes effect.

7. Location and transfers

Application data is stored in the EU. Push notification content may pass through Google's global delivery service, and Google may give support from outside the EU/EEA. Any transfer outside the EU/EEA relies on the EU-US Data Privacy Framework where Google is certified, or on the Standard Contractual Clauses in Google's data processing terms.

8. Security measures

• Encryption in transit (TLS) and at rest (Google Cloud).
• Each company's data is separated; access follows role and permissions and is enforced both in database rules and in server code.
• Sensitive data such as wage rates and employee details is written and read only through server functions, never directly by the app.
• Audit records of consequential changes, including every reveal of a date of birth.
• Verified e-mail required to create or join a company; passwords of at least 8 characters.
• Administrative access across companies is limited to one administrator account, used only for support the Customer asked for and for operating the service. Delishift reviews these measures as the service develops and does not reduce their overall level.

9. Deletion and return

• The Customer can export its data in the app while the company is active and after it closes.
• Data of a closed company is deleted 90 days after it closes, except records the Customer must keep by law (Sweden: bookkeeping records 7 years), which stay as anonymised records.
• When a person is removed, their name is replaced by "Deleted user" in the working-time and pay records and their other personal data is deleted, as described in the Privacy Policy.

10. Audits

Delishift answers reasonable written questions about its compliance. The Customer may audit once a year, or after a breach or when an authority requires it, with at least 30 days' notice, at its own cost and through an auditor bound by confidentiality. An audit must not give access to other customers' data or weaken security.

11. Liability, term and law

• Liability follows the Terms of Service and GDPR article 82; nothing here limits liability that cannot be limited by law.
• This agreement applies as long as Delishift processes personal data for the Customer. Confidentiality and deletion duties continue after that.
• Swedish law applies. Disputes are settled as set out in the Terms of Service.