N
NIVO
All legal documents

Data processing agreement

Last updated 27 October 2026

This agreement is part of the Terms of service between the Customer (the workshop, controller) and Shanova AB (processor). It applies when Shanova AB processes personal data on the Customer's behalf in NIVO, and is accepted together with the terms. It follows Article 28 of the General Data Protection Regulation (GDPR).

1. Subject, duration and purpose

Shanova AB processes personal data to provide NIVO to the Customer, for as long as the agreement is in force and the period after it described in section 9. The processing consists of storing, organising, displaying, sending, translating and deleting data, as the Customer uses the service.

2. Categories of data and data subjects

  • Data subjects: the Customer's customers and their contact people, the Customer's employees and other users, and people who contact the Customer through NIVO.
  • Personal data: names, phone numbers, email addresses, postal addresses, vehicle registration numbers and vehicle details, bookings, job and damage descriptions, photos and documents, messages, quotes and invoices, and employees' working time and assignments.
  • The service is not intended for special categories of personal data (such as health data). The Customer should not store them in NIVO.

3. Instructions

Shanova AB processes personal data only on the Customer's documented instructions: these terms, this agreement and the Customer's use of the service's functions. Approving a car owner's request in NIVO to share a car's service history (dates, work and parts, no prices or personal details) with another workshop is such an instruction, and withdrawing the approval ends it. If Shanova AB considers an instruction to break the law, it tells the Customer. Shanova AB may process data otherwise only where EU or Swedish law requires it, and then tells the Customer first unless the law forbids it.

4. Confidentiality

Everyone who processes the data on Shanova AB's behalf is bound by confidentiality and has access only to what their task requires.

5. Security

Shanova AB takes the technical and organisational measures Article 32 requires, among them: encryption in transit and at rest, separation of each workshop's data enforced in the database itself, limited and logged access, backups, and regular testing of the separation. The measures are described under Security.

6. Subprocessors

  • The Customer gives general authorisation for Shanova AB to use subprocessors: the providers it uses for cloud, messaging and AI. The current list is published under Subprocessors.
  • Shanova AB gives the Customer's administrators at least 30 days' notice by email before adding or replacing a subprocessor. The Customer may object on reasonable grounds; if the parties cannot agree, the Customer may end the agreement before the change.
  • Each subprocessor is bound by a written agreement with the same data protection obligations as this agreement. Shanova AB remains responsible to the Customer for its subprocessors.

7. Transfers outside the EU/EEA

Personal data is stored within the EU. Data is transferred outside the EU/EEA only where Chapter V of the GDPR is met, for example through the EU Commission's standard contractual clauses or an adequacy decision such as the EU-US Data Privacy Framework.

8. Assistance

  • Shanova AB helps the Customer, as far as reasonably possible, to answer requests from data subjects, much of which the Customer can do itself in NIVO (finding, correcting, exporting and deleting a person's data).
  • Shanova AB helps the Customer with impact assessments and prior consultation where the processing calls for it.
  • Shanova AB tells the Customer about a personal data breach without undue delay, and at the latest within 48 hours of becoming aware of it, with the information the Customer needs to meet its own obligations.

9. When the agreement ends

The Customer can export its data for 30 days after the agreement ends. Shanova AB then deletes the personal data within 90 days, and copies in backups disappear as the backups rotate, unless EU or Swedish law requires them to be kept.

10. Audits

Shanova AB makes available the information needed to show that this agreement is followed. The Customer may, at its own cost and with at least 30 days' notice, have an audit carried out by an independent auditor bound by confidentiality, no more than once a year unless a breach gives reason for more.

11. Liability and precedence

Liability follows the Terms of service. If this agreement and the terms conflict on the processing of personal data, this agreement prevails.