This Data Processing Addendum ("DPA") forms part of every agreement between a Client and an MWM company that refers to it (the "Agreement"). It sets out how the MWM company processes personal data on the Client's behalf when it delivers MWM Print365, MWM CopyTrack, MWM Data365 and related services (the "Services"). If the DPA and the Agreement differ on the processing of personal data, the DPA prevails.
1. Parties and roles
The "Supplier" is the MWM company that signed the Agreement:
- MWM Group AB, Swedish corporate ID no. 556638-6354, c/o The Works, Medborgarplatsen 25, 118 72 Stockholm, Sweden; or
- MWM System Inc., 1721 Cochran Road, Suite 200, Pittsburgh, PA 15220, United States.
The Client is the controller (or "business") and decides why and how personal data is processed. The Supplier is the processor (or "service provider") and processes personal data only to deliver the Services.
2. Applicable law
"Data Protection Laws" means the laws that apply to the processing in each case, including Regulation (EU) 2016/679 (GDPR) and Swedish supplementary legislation, and, where applicable, US state privacy laws such as the California Consumer Privacy Act as amended (CCPA).
3. The processing
- Purpose: hosting, operating, supporting, maintaining and securing the Services under the Agreement.
- Duration: the term of the Agreement, and afterwards until the data is returned or deleted under section 9.
- Data subjects: the Client's employees, contractors and other users of the Services, and contact persons at the Client's customers and suppliers whose details the Client enters into the Services.
- Personal data: limited business contact information (company e-mail addresses and company telephone numbers) and the user account and login data of the Client's users.
- Special categories: none. The Services are not designed for sensitive personal data, and the Client does not enter it.
4. Instructions
The Supplier processes personal data only on the Client's documented instructions. The Agreement, this DPA and the Client's use of the Services' functions are those instructions. If the Supplier believes an instruction breaks Data Protection Laws, it tells the Client. Where the CCPA applies, the Supplier does not sell or share the personal data, and does not retain, use or disclose it for any purpose other than delivering the Services.
5. Confidentiality and security
Everyone at the Supplier who has access to personal data is bound by confidentiality through their employment or consultancy agreement, and access to personal data processed for Clients is granted to employed personnel only, limited to what their tasks require. The Supplier maintains technical and organisational measures appropriate to the risk, aligned with ISO/IEC 27001 and NIST. The measures are described in full in MWM's Technical and Organisational Measures (TOMs) published at mwm.se/legal/toms, as updated from time to time, provided that updates do not reduce the overall level of protection. They include:
- hosting in Microsoft Azure data centres in the European Union for Clients contracting with MWM Group AB, and in the United States for Clients contracting with MWM System Inc.;
- separate production and test environments, and tenant-based separation of each Client's data;
- encryption of data at rest and in transit;
- role-based access control, with authentication requirements, IP restrictions and multi-factor authentication configurable by the Client;
- logging of user logins and administrative access;
- backups through Microsoft Azure, with restore procedures tested regularly;
- controlled change management, with changes tested outside production where applicable.
6. Sub-processors
The Client authorises the Supplier to use the following sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Microsoft (Azure) | Hosting and operation of the Services | European Union (Ireland and the Netherlands) for Clients of MWM Group AB; United States (East and West) for Clients of MWM System Inc. |
| Atlassian (Jira Service Management) | Support portal and ticket handling | European Union |
| MWM Group AB | Development, operation and support, where MWM System Inc. is the Supplier | Sweden |
The Supplier binds each sub-processor to data protection terms no less protective than this DPA and remains responsible for its sub-processors. The Supplier announces a new or replaced sub-processor on this page and by e-mail to the Client's contact person at least 30 days before it starts processing. The Client may object on reasonable data protection grounds within that period, and the parties then work in good faith to find a solution.
7. Transfers outside the EU/EEA
Where personal data subject to the GDPR is transferred to a country without an adequacy decision, the Supplier ensures an appropriate safeguard, such as the EU Standard Contractual Clauses or certification under the EU-US Data Privacy Framework.
8. Assistance and personal data breaches
The Supplier helps the Client, taking into account the nature of the processing, to respond to requests from data subjects, and with security, impact assessments and consultations with supervisory authorities. The Supplier notifies the Client without undue delay, and normally within 24 hours, after becoming aware of a personal data breach affecting the Client's personal data, and gives the Client the information it reasonably needs to meet its own obligations.
9. Return and deletion
When the Agreement ends, the Supplier makes the Client's data available for export on request, and deletes the personal data within 90 days, unless the law requires the Supplier to keep it.
10. Audits
The Supplier makes available the information the Client reasonably needs to verify compliance with this DPA. The Client may carry out an audit, itself or through an independent auditor bound by confidentiality, once a year with at least 30 days' notice, during normal working hours and at its own cost.
11. Liability and governing law
The limitations of liability in the Agreement apply to this DPA. The DPA is governed by the law that governs the Agreement.
12. Versions
The Supplier may update this DPA to reflect changes in law or in its sub-processors. Each version is published on this page with its date. A new version applies to an existing Agreement 30 days after the Client has been notified, unless the Agreement names a specific version.
13. Contact
Data protection and personal data incidents: MWM Group AB, Medborgarplatsen 25, 118 72 Stockholm, Sweden. E-mail info@mwm.se, telephone +46 8 5000 87 70.