Processing customer project data on documented instructions.

Processing follows the service lifecycle.

Processing continues for the duration of the EURtracker subscription and for any limited period necessary to return, export, securely delete or expire residual data in accordance with the agreement, customer instructions, applicable law and provider backup lifecycles.

Project administration and reporting support.

Processing may include receiving, storing, organising, structuring, retrieving, displaying, reviewing, exporting, securing and deleting customer project data, and generating AI-assisted drafts when an authorised user requests that function.

Data follows what the customer places in the workspace.

• User identifiers, names, organisational affiliation, roles and business contact information.
• Project updates, activity notes, reporting content, milestones, responsibilities and related metadata.
• Authentication, security and audit-related metadata associated with service use.
• Content selected by authorised users for AI-assisted drafting.

EURtracker is not designed to require special-category personal data or criminal-offence data.

Primarily organisational project participants.

Data subjects may include customer employees, project leaders, partner-organisation users, contractors and business contacts referenced in project material. Customers should minimise personal data and avoid unnecessary personal details in project reporting.

Appropriate technical and organisational measures.

• Authenticated access to private workspaces.
• Role- and project-based access controls.
• Encryption in transit using HTTPS/TLS.
• Browser security controls and restricted cross-origin behaviour.
• Separation of normal production sign-in from generated preview environments.
• Security logging, provider controls and documented operational procedures appropriate to the service.

Security measures may evolve as the service changes, provided the overall level of protection is not materially reduced.

Specialist providers support the service.

The customer grants general authorisation for Glimit AB to use subprocessors needed to provide EURtracker. Glimit AB will maintain a current subprocessor description in its compliance documentation and will provide notice of intended material additions or replacements through the designated customer channel sufficiently in advance to allow a reasonable objection on substantiated data-protection grounds.

Glimit AB will impose data-protection obligations on subprocessors that are no less protective for the relevant processing than those required by applicable law and this DPA.

Transfers require a lawful mechanism.

Where personal data is transferred outside the EEA, Glimit AB will rely on an applicable lawful transfer mechanism such as an adequacy decision, Standard Contractual Clauses or another mechanism permitted by data-protection law, together with supplementary measures where required.

Customer-specific region and transfer evidence may be documented in the procurement or security pack.

Glimit AB assists the customer as controller.

Taking into account the nature of the processing, Glimit AB will provide reasonable assistance through appropriate technical and organisational measures so the customer can respond to requests relating to access, rectification, erasure, restriction, portability, objection and other applicable rights.

If Glimit AB receives a request relating to customer-controlled project data, it will direct the requester to the customer where appropriate and will not independently act on the request except on documented instruction or where required by law.

Processor incidents are escalated without undue delay.

Glimit AB will notify the customer without undue delay after becoming aware of a personal-data breach affecting customer data and will provide information reasonably available to support the customer's assessment, notification and documentation duties.

Notification does not constitute an admission of fault or liability.

Customers receive information needed for their own assessment.

Taking into account the nature of the processing and information available to Glimit AB, Glimit AB will reasonably assist with data-protection impact assessments, prior consultation and other controller obligations relevant to EURtracker. The customer remains responsible for determining whether a DPIA or consultation is legally required.

Compliance evidence is available without exposing other customers.

Glimit AB will make information reasonably necessary to demonstrate compliance with Article 28 available to the customer. Where that information is insufficient, the customer may request a reasonable audit or inspection subject to appropriate confidentiality, security and access restrictions.

Unless required by a regulator, law or a verified incident, audits should be coordinated in advance, occur no more than once in a twelve-month period and avoid unreasonable disruption or access to another customer's data.

The customer controls the end-of-service instruction.

At the end of the processing services, Glimit AB will, at the customer's choice and subject to applicable law and technical feasibility, return or delete customer personal data. Residual copies in backups or security systems may persist until expiry under the relevant provider lifecycle and will remain protected and isolated from ordinary use.

The customer determines purpose, lawful basis and authorised use.

The customer is responsible for the lawfulness of its instructions, the personal data placed in EURtracker, transparency to data subjects, lawful basis, data minimisation, role assignments and any programme- or records-management duties applying to the customer.