Data Processing Agreement (DPA)

1. Why there is one

Start audits, Build projects and Run subscriptions often mean we get read access to inboxes, CRMs, spreadsheets or other systems that contain personal data. Under the GDPR, that makes you the data controller and us the data processor, and Article 28 requires a written agreement between us. In Sweden it's usually called a personuppgiftsbiträdesavtal, or PUB-avtal. We don't start work without it, and we don't ask you to argue about it either: it's the same document for every client, accepted with a tick at checkout or on your order.

2. What it says, in plain language

Purpose and instructions. We process personal data only to deliver the service you bought, and only on your documented instructions. No other use.

No training. Nothing from your systems is used to train AI models, ours or anyone else's. Our AI providers are bound by the same rule in their terms with us.

Where the data is. Processing takes place in the EU/EEA. Where a sub-processor is outside it, transfers rest on the EU-US Data Privacy Framework and/or Standard Contractual Clauses, and the sub-processor is listed.

Sub-processors. Annex C of the agreement lists every one: hosting, email, AI processing, and any tool specific to your project. We tell you 14 days before adding a new one, and you can object.

Access. Read access by default; write access only where the work needs it, only to the systems named in the agreement, and revoked when the work ends. Access is per named person, with two-factor authentication, never shared accounts.

Security. Encryption in transit and at rest, access logging, and a human approving every action our agents take in your systems.

Breaches. If something goes wrong, we tell you without undue delay, with what happened, what data was involved, and what we are doing about it, so you can meet your own 72-hour obligation.

Your rights. We help you answer data subject requests that concern data we process, and we support audits and inspections on reasonable notice.

End of work. When the agreement ends, we delete or return the personal data, at your choice, and confirm in writing. Only what the Bookkeeping Act forces us to keep stays.

Confidentiality. Everyone who works on your project is bound by confidentiality, including freelancers.

3. Public sector

For public sector clients the DPA is written to sit under direktupphandling and to answer the questions procurement officers ask first: data residency in the EU, no training, sub-processor list, deletion on termination, and GDPR documentation you can file. If your organisation has its own DPA template, we usually accept yours, and that is the one case where a signature happens.

4. Get the document

The full agreement is at minimumeffort.io/dpa/agreement, and it's what you accept at checkout when you buy the Audit or the MVP. If you'd rather have it as a PDF, email hello@minimumeffort.io with "DPA" in the subject and it's in your inbox the same working day. No call required, no sales pitch attached.