Data processing agreement for CabSight Business
This agreement applies between your company (controller) and Kiatar AB, company registration number 559608-8574 (processor), when your company uses CabSight Business. It follows Article 28 of the General Data Protection Regulation (GDPR) and is accepted when the company is created in the service. Liability between your company and Kiatar AB under this agreement follows the "Liability" section of the terms, with the same limit of SEK 1,000 per calendar year and the same exceptions.
Last changed: 29 October 2026
What, and for how long
Kiatar AB stores and calculates on the data your company enters, so that your company can follow up its finances. The agreement applies for as long as your company uses the service and until the data has been deleted.
Which data and which people
People: your company's drivers and the users of the account. Data: name, phone number and email address if given, type of employment, pay terms, revenue and costs linked to a driver or a vehicle, registration numbers, and documents your company uploads.
Instructions
Kiatar AB processes the data only on your company's documented instructions, including as regards transfers to countries outside the EU/EEA. The instructions are these terms and what your company does in the service. If Kiatar AB considers that an instruction breaks data protection rules, we will say so immediately.
Confidentiality
Only people at Kiatar AB who need it to run the service have access to the data, and they have committed themselves to confidentiality.
Security
The data is stored in Stockholm. Each company's data is kept apart from other companies' data by access rules in the database. Traffic is encrypted and sign-in is required. The database is backed up daily and the copies are kept for 7 days. Uploaded documents are not included in the backups.
Sub-processors
Your company approves these sub-processors: Supabase (database and sign-in, Stockholm), Vercel (hosting, USA), Resend (sign-in email, USA) and Zoho (email to support, stored in the EU). We announce additions or replacements of sub-processors by email at least 30 days in advance, and your company may object during that time. If we cannot meet the objection, your company may close its account. The sub-processors have the same data protection obligations as Kiatar AB under this agreement, and Kiatar AB is liable to your company for their work as for its own. Transfers outside the EU/EEA are protected by the European Commission's standard contractual clauses.
Help for your company
Kiatar AB helps your company respond when a driver or another person wants to use their rights, and with security, personal data breaches, impact assessments and contacts with the Swedish Authority for Privacy Protection, as far as the service is concerned.
Personal data breaches
Kiatar AB notifies your company without undue delay after becoming aware of a personal data breach that concerns your company's data, and never later than 48 hours after that. The 48 hours are an outer limit, not a target: we do not wait until we know everything. The notice goes by email to the company's owner in CabSight and contains what we know at that point about what happened, the kinds of people and data affected and roughly how many, the likely consequences, and what we are doing or propose. We send further information as it becomes available. Your company decides whether the breach is reported to the Swedish Authority for Privacy Protection or communicated to the people affected; we prepare the material but do not report in your company's name unless you ask us to.
When the agreement ends
When your company stops using the service, your company chooses whether the personal data is returned or deleted. Returned: you download the data as CSV or SIE files and the uploaded documents, or ask us for a copy. Deleted: we delete the data and the documents within 30 days of your request and confirm it in writing. If your company has made no choice, everything is deleted 90 days after the account was closed; until then you can get a copy. Database backups expire on their own after 7 days, and if we ever had to restore one, we would delete again what should already have been deleted. Data is kept longer only if EU or Swedish law requires it; we will then tell you which data and why. Your company's own duty to archive accounting records under the Swedish Bookkeeping Act is met with your own copies: CabSight is not your archive.
Audits
On request, Kiatar AB gives your company the information needed to show that this agreement and Article 28 of the GDPR are followed. Your company may also carry out audits, itself or through an independent auditor bound by confidentiality, and Kiatar AB contributes. A routine audit takes place with reasonable notice, normally 30 days, and at most once a year. An extra audit may take place at shorter notice after a personal data breach that concerns your company's data, when there are signs that the agreement is not being followed, or when a supervisory authority asks for it. Every audit is carried out so that other customers' data and the security of the service are protected. Your company bears its own costs. Sub-processors such as Supabase and Vercel are audited through their own certifications and audit reports.
Questions about your data or the terms: support@cabsight.com