Data Processing Agreement

Scope and roles

This agreement applies when a customer uploads financial documents or employee-related data to a company workspace and Bilagsmappa processes that data solely to provide the service.

The customer is the controller. Bilagsmappa is the processor.

Processing instructions

We process personal data only on documented instructions from the customer, including through use of the product, support requests and this agreement.

We will inform the customer if an instruction appears to conflict with applicable data protection law.

Security measures

• Access controls and role-based workspace membership.
• Encryption in transit and at rest within Google Cloud infrastructure.
• Operational logging without document bodies or attachment content.
• Documented incident response and deletion procedures.

Subprocessors

We use subprocessors listed on the Subprocessors page. We impose data protection obligations consistent with this agreement.

We will notify customers of material subprocessor changes through the Subprocessors page before engagement where required.

International transfers

Customer workspace data is stored in the EU by default. Where processing outside the EU is necessary, we rely on appropriate safeguards such as Standard Contractual Clauses.

Assistance and deletion

We assist customers with data subject requests where feasible and where the customer cannot fulfil the request without our help.

On termination, customers may export data through the product and request deletion through in-product controls or support.

Contact

Privacy and DPA requests should be sent with Contact us in the footer. Enterprise customers may request a countersigned copy before paid onboarding.