Data processing agreement

Calco processes personal data on behalf of the Data Controller for the purpose of delivering the Calco service, including quote generation and related features. Processing takes place solely to make the service's features available to the Data Controller and in accordance with the terms and this Agreement. Processing lasts for as long as the Data Controller uses the service.

When Calco uses combined patterns across customers to improve the service (e.g. which wholesaler product matches a quote line), it does so as an independent data controller and only with patterns confirmed by at least three independent companies. Prices and end customers' names and addresses are not included. See Calco's privacy policy.

• End customers' and contacts' personal data: name, address and contact details (email, phone)
• Quote content, including task descriptions as well as images and documents uploaded by the Data Controller, which may contain personal data
• End customers' responses to quote links: time and IP address on acceptance or rejection, any reason for rejection and acknowledgement of the information about the right of withdrawal
• Emails in a connected inbox (Microsoft 365 or Google Workspace), if the Data Controller connects it: sender's name and email, subject, text and information about attachments
• Information shared with or received from a partner company via Calco Connect, as well as name, email, phone and CVR of invited companies
• The Data Controller's own employees (users): name, email, phone and user activity in the service, including IP address and browser details in the audit log
• Access keys and tokens for systems the Data Controller connects (order management, accounting and inbox), encrypted with AES-256

Calco processes personal data only on documented instructions from the Data Controller, including with regard to transfers to third countries, unless required to do so by EU or Danish law. The instructions are constituted by this Agreement, the terms and the Data Controller's use of the service. Calco immediately informs the Data Controller if Calco considers that an instruction infringes data protection law.

Calco ensures that the persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access is granted only to persons for whom it is necessary in order to fulfil Calco's obligations.

Calco implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32, including encryption in transit (TLS 1.2 or later), encryption of API keys and other sensitive credentials via AES-256 (pgcrypto), access control and row-level security in the database, and logging of access and events.

The Data Controller hereby gives general authorisation for Calco to use the following sub-processors:

• Supabase Inc. (database, login and file storage - data stored in the EU, Frankfurt)
• Cloudflare Inc. (hosting, network and anonymous statistics - USA, global network)
• Anthropic PBC (quote calculation and assessment of inbox emails - USA)
• Resend Inc. (sending email - USA)
• Stripe (payment - Ireland/USA)
• Expo / 650 Industries Inc. (push notifications and app updates - USA)
• Telegram (internal operational alerts to Calco's team - United Arab Emirates)
• Google (calendar invitation for onboarding and reading Gmail, only if connected - Ireland/USA)
• Microsoft (reading the Outlook inbox, only if connected - Ireland/USA)
• The order management and accounting systems the Data Controller chooses to connect: Apacta, Minuba, Ordrestyring, Kompas4, e-conomic, Dinero, Billy or Fortnox

Address lookups for travel calculation: Danish addresses are looked up at Dataforsyningen (the Danish state), Norwegian ones at Kartverket (the Norwegian state) and Swedish ones at the OpenStreetMap Foundation (Nominatim, United Kingdom - EU adequacy decision). Only street, house number, postcode and town are sent - never names or other customer information.

Calco gives at least 30 days' notice of changes in the use of sub-processors, and the Data Controller may object to the change. Transfers to third countries are made on the basis of the European Commission's Standard Contractual Clauses (SCC) and, where the recipient is certified, the EU-US Data Privacy Framework. Calco enters into a written agreement with each sub-processor imposing the same data protection obligations as in this Agreement, and Calco is liable for the sub-processors' compliance.

Calco assists the Data Controller, insofar as this is possible, by appropriate technical and organisational measures, in responding to requests from data subjects exercising their rights, including access, rectification, erasure, restriction, data portability and objection.

Calco assists the Data Controller in ensuring compliance with the obligations under Articles 32-36, including security of processing, notification of personal data breaches to the supervisory authority and the data subjects, data protection impact assessments (DPIA) and prior consultation of the supervisory authority, taking into account the nature of the processing and the information available to Calco.

Calco notifies the Data Controller without undue delay after becoming aware of a personal data breach. The notification contains the relevant information about the breach, including the nature of the breach, the categories of data and data subjects affected, the likely consequences and the measures taken or proposed to be taken.

On termination of the service, Calco, at the choice of the Data Controller, deletes or returns all personal data no later than 30 days after termination and deletes existing copies, unless EU or Danish law requires continued storage of the personal data.

Calco makes available to the Data Controller all information necessary to demonstrate compliance with the obligations in this Agreement and allows for and contributes to audits, including inspections, conducted by the Data Controller or another auditor mandated by the Data Controller.