Privacy notice for Danadot Version 4, drawn up on 14 September 2026.
This notice is given under Articles 13 and 14 of the General Data Protection Regulation (EU 2016/679). It covers the personal data that WeOffice AB processes as controller in the Danadot service.
1. WHAT THIS NOTICE COVERS — AND WHAT IT DOES NOT
It covers data about you as a user of Danadot: your account, your orders, the agreements you have accepted, email we have sent you, and the log of what has been done in the service. WeOffice AB is the controller for that data.
Three things fall outside it, and each has its own information:
Survey answers. If you answer a workplace survey commissioned by your employer, your employer is the controller for those answers, not us. We process them as a processor on your employer's instructions. The information about that processing is given by your employer, and you receive it at the start of the survey. An explanation of how the tool works is at danadot.com/for-respondents. Two things apply equally to every customer: the file that holds individual answers, without name or email address, exists only in the separate survey environment and is destroyed no later than three months after the last answer in the collection. If your employer has chosen to produce its own benchmark for its organisation, it contains only aggregated figures per organisation, department and unit, and a department or unit with fewer than five answers is not stored as a group of its own.
The contents of a customer organisation's project workspace. The figures and calculations a customer enters into its workspace are processed by us as a processor for that customer, under the data processing agreement. What applies there is set out in that agreement, not here.
Registrations of interest on danadot.com. If you have registered an interest in forthcoming offerings, the information shown at that form applies. WeOffice AB is the controller there too, but it is a different processing operation with a different purpose and a different retention period.
2. WHO IS RESPONSIBLE
WeOffice AB, company number 556906-2382 Hagaesplanaden 96, 113 69 Stockholm, Sweden info@danadot.com
Danadot is a product name, not a legal person of its own. The counterparty and the controller is WeOffice AB.
We have not appointed a data protection officer. Whether we are required to do so will be settled in the legal review of this notice.
3. WHAT WE PROCESS, WHY, AND FOR HOW LONG
3.1 Account details
Name, email address and password (never stored in the clear, but as a cryptographic digest). If you fill them in: telephone number, job title, postal address, time zone, profile picture and language preference. Whether you have enabled two-factor authentication and, if so, the secret and recovery codes that belong to it. The time of your last sign-in. Purpose: to give you access to the service and to be able to contact you about it. Retained: for as long as the account exists. See section 7 for what happens when it is removed.
3.2 Orders, receipts and invoicing records
What was ordered, amounts, VAT, payment status and invoice reference. Purpose: to deliver what was ordered and to meet our bookkeeping obligations. Retained: seven years, under chapter 7 of the Swedish Bookkeeping Act.
3.3 Agreement acceptances
Which version of an agreement you accepted, when, and the IP address and browser string at the time. Purpose: to be able to show what was actually accepted, should it be disputed. Retained: IP address and browser string for 24 months. The acceptance itself is retained for as long as the financial or legal record requires.
3.4 Event log
Who did what in the service — orders, permission changes, delivery steps — with time, actor and IP address. Purpose: traceability and security, and to be able to investigate a dispute or misuse. Retained: the IP address for 24 months. The remaining fields are retained for as long as the financial or legal record requires.
3.5 Email log
Subject, content and recipients of messages sent from the service. Purpose: to be able to see whether a message got through. Retained: recipient details for 12 months.
3.6 Payment events
The events our payment provider sends back to us about a payment. We never receive, display or store card numbers or bank account numbers. Retained: 13 months for processed events, at most 25 months for events that require investigation.
4. LEGAL BASIS
The processing described in section 3 rests mainly on the agreement you have accepted yourself — Article 6(1)(b) of the General Data Protection Regulation, performance of a contract. Two elements also rest on a legal obligation, Article 6(1)(c).
That you are a party to an agreement with us is not an interpretation but something recorded when the account is created. Registration cannot be completed without the terms being accepted, and the acceptance is stored in your own name together with the version you accepted, the time, and a checksum of exactly the wording that was shown to you — in the language you chose. The commercial agreement for the service is entered into with your organisation; the terms for your own account you accept yourself.
The basis for each processing operation:
Account details (3.1) — Article 6(1)(b). The account is what the agreement is for; without the details there is no service to give you access to.
Orders, receipts and invoicing records (3.2) — Article 6(1)(b) to deliver what was ordered, and Article 6(1)(c) to retain the records for seven years, which the Swedish Bookkeeping Act requires.
The acceptance record itself (3.3) — Article 6(1)(b). Which version you accepted, and when, is what makes the agreement demonstrable.
Payment events (3.6) — Article 6(1)(b) to carry out the payment, and Article 6(1)(c) for the bookkeeping.
Three elements are not carried by the agreement, and for those the basis has not yet been settled:
The IP address and browser string recorded with an acceptance (3.3). They are not needed to perform the agreement — they are stored so that a dispute can be investigated, and that is our need, not the agreement's.
The event log (3.4). It is kept for traceability and security, not in order to deliver the service to you.
The retention of the email log (3.5). Sending the message belongs to the agreement; keeping the subject, content and recipients for twelve months afterwards is an operational control.
For those three, the basis will be settled in the continuing legal review and written in here in a new version. A decision that covers the other processing operations must not quietly be taken to cover these as well.
5. WHO RECEIVES THE DATA
We do not sell data on. The following parties process data on our behalf:
Hetzner Online GmbH — hosting of the servers, Germany and Finland. The data processing agreement has been entered into and archived. Hetzner Finland Oy is Hetzner's own subcontractor for the server location in Finland.
Stripe — card payment. The data processing agreement, the storage location and Stripe's own sub-processors are established from Stripe's published terms. What remains is an act of ours: that somebody with the mandate accepts those terms on behalf of WeOffice AB.
An email provider for messages sent from the service. The party has not yet been settled in our register of sub-processors.
An accounting system for invoicing. The system has not yet been chosen.
Stripe also processes data for its OWN purposes, and is then not our processor but a controller in its own right: fraud prevention, know-your-customer and anti-money-laundering obligations, and relationships with other payment service providers. For that processing Stripe alone determines the purposes and the means. We can neither instruct it away nor contract it away, and it does not end if the processor relationship ends. What Stripe does as a controller is set out in Stripe's own information to data subjects.
That the open rows above are open does not mean the processing happens without an agreement — it means the agreements have not been reviewed and archived by us, and that should be stated here until they have been. A complete list, with country, role and agreement status for each party, will be published on the sub-processors page once every row is confirmed.
Beyond these, data may be disclosed to a public authority where we are required by law to do so.
6. TRANSFERS OUTSIDE THE EU/EEA
The servers that carry the service are within the EU.
Card payment is an exception. Stripe processes data globally, and data is transferred to Stripe in the United States. The transfer rests on an addendum to the data processing agreement invoking the EU-US Data Privacy Framework and the EU standard contractual clauses under Commission decision 2021/914. For transfers to the United Kingdom, the UK International Data Transfer Addendum applies.
The basis for the transfer is therefore documented. What remains is our own assessment of whether it is sufficient for the purpose, and that assessment forms part of the legal review mentioned in section 11.
7. WHEN AN ACCOUNT IS REMOVED
Where there is a financial or legal record tied to the account, a request for erasure is answered by anonymisation rather than deletion. That is supported by Article 17(3)(b) (legal obligation, chapter 7 of the Swedish Bookkeeping Act) and Article 17(3)(e) (legal claims).
What is removed or anonymised: name, email address, authentication credentials, two-factor secret and recovery codes, all sessions, and verification and reset tokens.
What is kept: an internal identity carrying no name or address, so that the chain between an order, an accepted agreement and the event log is not broken, together with orders, receipts and invoice references for the bookkeeping period.
You receive an answer setting out what was removed, what is kept, and on what basis.
8. YOUR RIGHTS
You have the right to be told what data we process about you and to receive a copy of it, to have inaccurate data corrected, to request erasure, and to request that processing be restricted.
You also have the right to data portability. Because the processing rests on the agreement you accepted and is carried out by automated means, you may ask for the data you have provided yourself in a structured, commonly used and machine-readable format, and to have it transmitted to another provider where that is technically feasible.
Requests go to info@danadot.com. We reply within one month of receiving the request, under Article 12(3). If we need longer, we will say so within that month, and why.
We do not take automated decisions producing legal effects concerning you, and we do not profile you.
9. WHERE THE DATA COMES FROM
The data normally comes from you, when you register or fill it in within the service. If your account was created for you by an administrator in your organisation, we received your name and email address from there instead.
10. COMPLAINTS
If you believe we are handling your data wrongly, we would like to hear it at info@danadot.com. You also have the right to complain to the Swedish Authority for Privacy Protection (IMY), which is the supervisory authority in Sweden.
11. CHANGES
A published version of this notice is never edited. If something is to change, a new version is published with a new version number. The legal basis in section 4 has been settled following legal review. The text as a whole has not yet been reviewed; that review takes place after launch and results in a new version.