Data Processing Addendum
This DPA forms part of the terms between the customer and Consumeit AB and applies to personal data processed on the customer's behalf under GDPR.
Processing
CloudSaver reads Microsoft 365 and Azure metadata to compute aggregates and recommendations. Approved remediation actions are performed only on documented customer instruction. The service is designed not to process file or message content.
Processor obligations
Consumeit processes data only on documented instructions, applies appropriate security measures, assists with data-subject requests where applicable, and deletes or returns data at the end of the service subject to legally required retention.
Sub-processors and transfers
Microsoft Corporation is the current hosting sub-processor. CloudSaver uses Sweden Central by default. The current list is available on request from privacy@consumeit.se.
Security and incidents
Controls include encryption in transit and at rest, tenant isolation, role-based access, audit logging and managed identities. If Consumeit becomes aware of a personal-data breach affecting customer personal data, Consumeit will notify the controller without undue delay and provide information reasonably available to assist the controller with its obligations. The controller remains responsible for determining whether notification to a supervisory authority or affected data subjects is required.
Liability
Liability under this DPA is subject to the limitation of liability in the Terms of Use, except where applicable law requires otherwise. Nothing in this DPA limits obligations that cannot be limited by law.