How we handle your team’s data.

1. Parties and subject matter

This agreement is between the business or school that uses Checklisted (“the Customer”, controller) and Grido AB, c/- Dockplatsen 16, 211 19 Malmö, Sweden, org. no. 559480-1945, [email protected] (“we”, processor).

We provide Checklisted (checklisted.me): checklists that staff tick on their phones through a link or QR code, and the dashboard that shows who ticked what, when and where. When staff tick the Customer’s checklists, we process their personal data on the Customer’s behalf. This agreement governs that processing and forms part of the Customer’s use of Checklisted. Where it conflicts with other terms, this agreement prevails on data protection.

2. Nature, purpose and duration

We store and display personal data so the Customer can run shift checklists and see who completed which task, when and where. Processing lasts as long as the Customer uses Checklisted and ends as described in section 3.

Data subjects: the Customer’s staff, or other people the Customer gives a checklist link or QR code to, who tick its checklists.

Personal data: the name a person types to tick (usually a first name); for each tick or untick, the task, the time and, when a place’s QR code was used, the place’s name; technical data needed to deliver pages (IP address, browser, time).

Special categories: none intended. The Customer must not put data under Art. 9 GDPR (for example health data) into checklist lines unless it has a legal basis and has told us in writing.

Retention: until the Customer deletes the checklist or its account. The name typed on a phone also stays in that phone’s browser until the person changes it or clears the browser’s data.

3. Our obligations

Instructions: we process the personal data only on the Customer’s documented instructions. The Customer’s settings and actions in Checklisted, and this agreement, are those instructions. We tell the Customer if we believe an instruction breaks data protection law.

Confidentiality: everyone at our company who can access the data is bound to confidentiality.

Security: we take the technical and organisational measures in Annex 1 (Art. 32 GDPR) and may improve them, as long as the level of protection does not drop.

Data subject requests: we help the Customer answer requests from data subjects (access, correction, deletion, objection). The log of every checklist is visible in the dashboard; deleting a checklist deletes its log. If a request reaches us, we forward it to the Customer without delay.

Other assistance: we help the Customer, as far as we reasonably can, with security, breach notifications, data protection impact assessments and consultations with authorities (Art. 32–36 GDPR).

Records and contact: we keep a record of processing activities. Our contact for data protection is [email protected].

End of the service: on request we give the Customer an export of its checklists and logs. We delete the personal data within 30 days after the account is deleted (the Customer can ask for this by email), unless law requires us to keep them. Backups are overwritten in their normal cycle.

Audits: we give the Customer the information needed to show compliance with this agreement. The Customer may audit, or have an auditor bound to confidentiality audit, with reasonable notice, at most once a year unless there has been a breach. Each party bears its own costs.

4. Sub-processors and transfers

The Customer gives general authorisation for the sub-processors in Annex 2. We give notice of new or replaced sub-processors at least 30 days in advance by email to the account address. The Customer may object on reasonable data protection grounds; if no solution is found, the Customer may stop using Checklisted before the change takes effect. We put the same data protection obligations on each sub-processor as this agreement puts on us, and remain responsible for them.

Personal data of data subjects is stored in the EU. Where a sub-processor may access data from outside the EU or EEA, the transfer is covered by an adequacy decision (including the EU-US Data Privacy Framework) or the EU standard contractual clauses.

5. Personal data breaches

We inform the Customer without undue delay, and within 48 hours of becoming aware, of a breach affecting the Customer’s data. The notice says what happened, which data and how many people are likely affected, the likely consequences and what we have done or propose. We send further details as they become known.

6. Liability, term and law

Liability towards data subjects follows Art. 82 GDPR. Between the parties, the liability terms of the Checklisted plan apply.

This agreement runs as long as we process personal data for the Customer. Changes must be in writing (email is enough). If a clause is invalid, the rest stays in force.

This agreement is governed by the laws of Sweden; the courts of Malmö have jurisdiction, without prejudice to the data subjects’ rights under the GDPR.

7. Acceptance

This agreement takes effect when the Customer creates a Checklisted account or subscribes, and applies without a separate signature (Art. 28(9) GDPR allows electronic form). The current version is published on this page. Customers who need a signed copy for their records can ask at [email protected].

Annex 1: Technical and organisational measures

Encryption: all traffic over HTTPS (TLS); data encrypted at rest by the database provider.

Access to customer data: database row-level security, so each account sees only its own checklists, places and logs.

Staff pages: checklist and place pages never read tables directly; they go through fixed database functions that return only what that page needs. Ticks are checked in the database (real task, current shift, a name) and a run accepts a limited number of events. Links and QR codes use long random tokens.

Log integrity: ticks are only ever added, never changed; unticking adds a new entry, so the log shows every change.

Sign-in: passwordless email links and codes, or Google or Apple sign-in. We store no passwords. Staff need no account.

Staff access: production access limited to the people who run the service, with individual accounts.

Availability: hosting on managed EU infrastructure with regular database backups.

Data minimisation: staff give only a name; no email addresses, no location, no analytics or tracking on any page.

Deletion: Customers can delete checklists (with their logs) and places in the dashboard; data is deleted on account deletion (section 3).

Annex 2: Sub-processors

Supabase Inc.: database and sign-in. Data stored in the EU (Ireland); standard contractual clauses for any access from the USA.

Vercel Inc.: hosting and delivering pages, on an EU and global edge network. EU-US Data Privacy Framework and standard contractual clauses.

Stripe (payments) is not a sub-processor under this agreement: it never receives data about the Customer’s staff.