Data Processing Agreement

For organizations on a Team plan, this agreement covers the personal data in your team models.

1. Who this agreement is between

This agreement is between the company or other organization that buys a Team plan (“you,” the controller) and Lantz Hedström Consulting AB, company registration number 559215-6557, VAT number SE559215655701, Fiskarfjärdsstranden 36, 127 41 Skärholmen, Sweden (“we,” the processor). Your “Team manager” is the person who manages your Team plan in toro4n, and your “members” are the people with a seat on it. This agreement is part of our Terms of Service, and you accept it in writing, in electronic form, by using Team. If it conflicts with the Terms of Service on personal data, this agreement takes precedence.

We're the processor only for team models. We remain the controller for accounts, sign-ins, plans, payments, and everything else our Privacy Policy describes.

2. What we process

Subject matter and purpose

Storing team models, making them available to the people your Team manager and members invite, keeping earlier versions and backups, and relaying changes while people edit together.

Nature

Storage, transmission, retrieval, copying, and erasure.

Duration

As long as you have a Team plan, and after that until the data is returned or deleted under section 10.

Types of personal data

The email addresses of your Team manager, your members, and anyone a team model is shared with; who changed a model and when; and any personal data people add to a team model.

Data subjects

Your Team manager, your members, the people a team model is shared with, and anyone whose personal data is added to a team model.

3. Your responsibilities

You decide why and how personal data in team models is processed, and you make sure you have a legal basis for it. You have the rights of a controller under this agreement and the GDPR. Don't put special categories of personal data (Article 9 of the GDPR) in a team model unless the law allows it and you've confirmed that our security measures are adequate for that data.

4. Your instructions

We process personal data only on your documented instructions, including for transfers outside the EU. This agreement, the Terms of Service, and what your Team manager and members do in toro4n are your instructions. If EU or Swedish law requires us to do anything else, we'll tell you first, unless the law forbids it. If we believe an instruction breaks the GDPR or other data protection law, we'll tell you immediately.

5. Confidentiality

Everyone we authorize to process the personal data has committed to confidentiality or is under a legal duty of confidentiality.

6. Security

We take the security measures required by Article 32 of the GDPR. Our security page describes them, including encryption in transit and at rest, access checks on every request, storage in the EU, and backups. If we learn of a personal data breach affecting your team models, we'll notify you without undue delay and give you the information you need to meet your obligations.

7. Sub-processors

You give us general written authorization to use sub-processors. The current ones are listed on our sub-processors page. We'll email your Team manager at least 30 days before we add or replace one, and you can object on reasonable data protection grounds within 14 days of that email. If we can't find a solution together, you can cancel the Team plan before the change takes effect, and we'll refund what you've paid for the remaining time on your plan.

Each sub-processor is bound by a written contract with the same data protection obligations as this agreement, and we remain fully liable to you for its performance.

8. Transfers outside the EU

Stored team models stay within the EU. Requests can pass through data centers outside the EU, as our sub-processors page explains, and each transfer relies on the legal basis stated there. We won't start a new kind of transfer without notifying you under section 7.

9. Helping you

We'll help you answer requests from data subjects, as far as we can, and we'll pass on any request we receive that concerns a team model. We'll also help you with your obligations under Articles 32 to 36 of the GDPR: security, breach notification, data protection impact assessments, and prior consultation.

10. When the plan ends

When your Team plan ends, your team models stay in toro4n under the Terms of Service, unless you ask us to return or delete the personal data in them. Email hello@toro4n.com to tell us which you'd like, and we'll do it within 30 days. Backup copies are deleted within 35 days after that. We keep a copy only if EU or Swedish law requires it. You can also export your models as JSON in toro4n whenever you want a copy.

11. Audits

We'll give you all the information you need to demonstrate compliance with Article 28 of the GDPR, and we'll allow and contribute to audits and inspections by you or an auditor you appoint. Give us reasonable notice, and keep what you learn confidential.

12. Liability, changes, and governing law

Liability under this agreement follows the Terms of Service and Article 82 of the GDPR. Swedish law applies, and disputes are resolved as set out in the Terms of Service. We may update this agreement as described in the Terms of Service, and we'll email your Team manager at least 30 days in advance.

Last updated November 1, 2026.