ALLOCATE
VERSION 1.1

Data Processing Agreement

How we process the personal data your company puts into Allocate, as required by Article 28 of the GDPR. This agreement is part of the Terms of Service and applies when your company accepts them.

1. Parties, roles and scope

This Data Processing Agreement ("DPA") is between the Customer under the Allocate Terms of Service (the controller) and Joakim Svärd, sole trader, trading as Allocate (the processor, "we"). It meets the requirements of Article 28 of the GDPR.

What it covers.Personal data that the Customer and its users put into their Allocate workspace, and that we process to provide Allocate to the Customer: bookings, equipment, the team list and invitations, including sending service emails on the Customer's behalf, such as invitations and notices about team changes. The Customer decides whom to invite and is responsible for informing its users and the people it invites.

Acceptance.The Customer accepts this DPA when it accepts the Terms of Service; no signature is needed. A user who is not an admin does not accept this DPA on the Customer's behalf.

What it does not cover. Personal data for which we are the controller ourselves: user accounts and sign-in, billing, support requests, the emails we send for our own purposes (such as account and billing emails) and our security logs. Our Privacy Policy describes those.

Instructions.The Terms, this DPA and the Customer's use of Allocate's features are the Customer's complete instructions. They include an instruction to create anonymised, aggregated statistics about how Allocate is used, which identify neither the Customer, its users nor its projects, and which we may then use freely. Further instructions must be in writing and fit the service; if they cost us extra work, we may charge for it after agreeing the price with the Customer.

2. The processing

Subject and purposeProviding Allocate, an equipment booking service, to the Customer: storing, showing and organising bookings, equipment and team information, sending invitations and notices about team changes, and support.
NatureStorage, retrieval, display, change, transmission by email, backup and deletion, all automated in a cloud service.
Data subjectsThe Customer’s users (employees, freelancers and contractors), people the Customer invites, people shown in uploaded images, and anyone the Customer mentions in free text.
Personal dataNames, work email addresses, roles and memberships; who booked, approved, cancelled or changed a booking or an item of equipment, and when; invitation details; images the Customer uploads, for example of equipment; any personal data the Customer types into free-text fields such as booking notes and project names.
Special categoriesNone intended. The Terms forbid putting sensitive data into free-text fields.
DurationFor as long as the agreement lasts, and then until the data is deleted as described in section 8.

3. Our obligations

We will:

  • 1. process the personal data only on the Customer’s documented instructions, unless EU or Swedish law requires otherwise, in which case we tell the Customer first unless the law forbids it;
  • 2. tell the Customer if we believe an instruction breaks data protection law;
  • 3. make sure everyone who can access the data is bound by confidentiality;
  • 4. take appropriate security measures, as described in the Annex;
  • 5. use sub-processors only as described in section 4;
  • 6. help the Customer answer requests from data subjects, mainly through the features in Allocate (for example export and deletion), and pass on any request we receive directly;
  • 7. help the Customer with security, breach notifications, data protection impact assessments and prior consultation (Articles 32–36), taking into account what we know about the processing;
  • 8. at the end of the agreement, delete or return the data as described in section 8;
  • 9. give the Customer the information needed to show compliance with Article 28, and allow audits as described in section 7.

The Customer's part. The Customer is responsible for having a legal basis for the personal data it puts into Allocate, for informing its own users and staff, and for the instructions it gives.

4. Sub-processors

The Customer gives general permission for us to use sub-processors. We bind each of them by written contract to data protection obligations at least as strict as this DPA, and we remain responsible to the Customer for their work.

Current sub-processors

Google Cloud / Firebase (Google Ireland Ltd, Google LLC)What they do: Hosting, database, file storage, servers, scheduled jobs, logs, backups. Where: EU (database eur3; uploaded files in Belgium; servers in Belgium and the Netherlands; logs in Belgium).
Resend (Plus Five Five, Inc.)What they do: Sending service emails on the Customer’s behalf, such as invitations and notices about team changes, which contain the recipient’s email address and the content of the email. Where: United States.

Stripe is not a sub-processor under this DPA: it handles only our own billing of the Customer, where we are the controller.

Changes. The list above is the current list of sub-processors. We email admins in advance, before we add or replace a sub-processor, and publish an updated version of this DPA. The Customer may object in writing before the change takes effect, on reasonable data protection grounds. If we cannot solve the concern, the Customer may end the agreement before the change takes effect.

5. Transfers outside the EU/EEA

We keep the Customer's workspace data in the EU. The only transfer outside the EU/EEA under this DPA is email delivery through Resend in the United States, which relies on the EU Commission's Standard Contractual Clauses in Resend's data processing terms, and also on the EU-U.S. Data Privacy Framework while Resend is certified under it.

User accounts and sign-in (Firebase Authentication, which runs in the United States) are our own data as controller and are described in our Privacy Policy.

We will not transfer the Customer's personal data to any other country outside the EU/EEA without an adequate safeguard and without the notice in section 4.

6. Personal data breaches

If we become aware of a breach affecting the Customer's personal data, we email the Customer's admins without undue delay after we become aware of it. The notice includes, as far as we know it at the time:

  • what happened and when;
  • the kinds and approximate number of people and records affected;
  • the likely consequences;
  • what we have done and propose to do to limit the harm;
  • a contact for further information.

We send the rest as soon as we have it. Notifying the supervisory authority and the people affected remains the Customer's decision, and we help with what we know.

7. Audits

Documentation first.We meet the Customer's audit right in the first place by answering written questions within a reasonable time and by providing this DPA, the Annex, and our sub-processors' certifications and audit reports (for example Google Cloud's ISO 27001 and SOC 2 reports) where we may share them.

Inspections. If that is not enough to show compliance, or a supervisory authority requires it, or after a breach, the Customer or an independent auditor it appoints may carry out an inspection, on these terms:

  • at least 30 days’ written notice, and at most once a year unless a supervisory authority requires more;
  • during normal business hours, without unreasonably disturbing our work;
  • the auditor is bound by confidentiality and is not a competitor of ours;
  • the auditor never gets access to other customers’ data;
  • the Customer pays its own costs and our reasonable time.

All data is hosted by our sub-processors, mainly Google, so an inspection is a review of documents and settings, which can be done remotely. Google's data centres cannot be visited; Google's own audit reports cover them.

8. End of the agreement

When the subscription or trial ends, or when an arrangement we have agreed with the Customer ends, the workspace is locked and then deleted, as described in the Terms of Service. Where such an arrangement applies, the periods below start on the day it ends, not before, and the period for an ended paid subscription (90 days) applies from that day:

A paid subscription has endedDeleted at the earliest 90 days after
A trial ended without a subscriptionDeleted at the earliest 30 days after
A company never started a trial or subscriptionDeleted at the earliest 30 days after creation
An admin deletes the companyDeleted after 7 days (the deletion can be cancelled until then)
The only member deletes their own accountDeletion starts at once, without the 7-day window

Return. Before the deletion date, the Customer may ask at support@allocate.at for a copy of its bookings and equipment in a common file format, and we send it.

Deletion.Deleted data can remain in our backups for about 37 days, in our email send queue for about 30 days, and in Google's internal backups for up to 180 days. Backups are used only to restore the service after an error. After that we keep none of the Customer’s workspace data, unless EU or Swedish law requires it.

9. Liability, term and law

Liability.We are liable to the Customer only for damage caused by our breach of this DPA or of the obligations the GDPR places on processors. The limits on liability in the Terms of Service also apply to claims under this DPA and data protection law, to the extent the law allows. The Customer is responsible for, and covers our reasonable costs of, claims from data subjects, authorities or others that arise from the Customer's instructions, from personal data the Customer or its users put into Allocate, or from the Customer lacking a legal basis. Nothing here limits either party's liability towards data subjects under Article 82 of the GDPR.

Term. This DPA applies for as long as we process personal data for the Customer, including after the agreement has ended until the data is deleted.

Order of precedence. On personal data, this DPA wins over the Terms of Service. If the EU Standard Contractual Clauses apply to a transfer, they win over both.

Changes.We may update this DPA when the law or our sub-processors change, with notice by email in advance; changes of sub-processors follow section 4. Changes do not materially reduce the overall protection of the Customer's personal data.

Law. Swedish law applies, and disputes are settled as described in the Terms of Service.

Version 1.1

10. Annex: Security measures

EncryptionAll traffic uses HTTPS (TLS). Data is encrypted at rest by Google Cloud. Passwords are stored only as hashes by Firebase Authentication.
Separation of customersEach company’s data lives under its own company record. Database security rules and server-side checks allow access only to members of that company, based on the company in the user’s signed-in session.
Access within a companyRole-based access: each user gets the role the Customer gives them, and a role sees and changes only what it needs. Managing members, the team list and company settings require admin rights or a role the Customer has given those rights. Removing a member revokes their sessions.
Sign-in and sessionsSession cookies are HTTP-only and expire after 14 days. Signing out clears the session in the browser. Invitations can be accepted only by an account with a verified email address that matches, and invitation links are stored only as hashes.
Our own accessOperator access (our support and administration area) is given only to named people we authorise, through a separate allowlist, and only for support, billing and security. Sign-ins to the operator area are logged. Secrets are kept in Google Secret Manager, not in the source code. We use two-factor sign-in on the accounts with access to our cloud, code and payment systems.
Data minimisationFree-text fields and uploaded images are the only places where users can add data we did not ask for.
Availability and backupsPoint-in-time recovery of the database for 7 days. Alerts on failed scheduled jobs and failed deletions.
DeletionAutomatic deletion jobs with monitoring (see section 8 and the Privacy Policy).
LoggingApplication logs are kept for 30 days in the EU (logs from before 16 October 2026 are stored outside the EU until 15 November 2026 at the latest) and contain IDs rather than names or email addresses where possible. The audit logs Google Cloud keeps of administrative actions in our account contain no customer data and are kept for 400 days.
PeopleEveryone who can access customer data is bound by confidentiality, through their employment or engagement terms or by law.