Customer Agreement for Danadot
Agreement version 5 · 9 September 2026
The Agreement covers the Customer's order of Danadot for its operations. It comprises the order below, the general terms and conditions, the data processing agreement and Appendices 1–3. Appendix 3 governs benchmarking, research, development and AI. The Customer may restrict the uses set out there by giving written notice to WeOffice.
Parties
Supplier: WeOffice AB, company number 556906-2382, Hagaesplanaden 96, 113 69 Stockholm. Contact: info@danadot.com. Danadot is WeOffice's product name.
Customer: the organisation stated in the order confirmation, with the legal name, the company number and the invoicing address that the Customer registered in Danadot before the purchase. The contact person with ordering authority is the user at the Customer who placed the order and accepted this Agreement in Danadot; that user's name and email address appear from the order confirmation and from the Customer's list of users in the service. Under clause 1 the Customer is responsible for ensuring that the user is entitled to represent the Customer.
Order
| Item | Agreed |
|---|---|
| Project and scope | The project is identified by the project name and the project ID that Danadot has registered and that is stated in the order confirmation. The organisation, the business sites concerned, the staff group, the number of people and the purpose of the change are the details registered on the project in Danadot at the time of the order; the size band purchased and the number of business sites appear from the order lines of the order confirmation. |
| Service and deliverables | The package, options, modules and deliverables are those that appear from the order lines of the order confirmation. The survey version and the optional blocks are those frozen in the project's survey plan in Danadot when the order is confirmed. Whether the order concerns the free calculator or a paid project appears from the same order lines. |
| Performance | The timetable and the Customer's participation are agreed within the project and followed in Danadot's delivery view. Survey results within ten working days under clause 2. The method of distribution, personal invitations sent by WeOffice or a shared link that the Customer distributes itself, and the agreed reminders appear from the project's frozen survey plan in Danadot. |
| Licence and read-only mode | One year from the start date under clause 4. The start date and the end date appear from the project's details in Danadot, and from the order confirmation where payment had been verified before it was sent. Read-only mode for three years after the end of the licence, unless another period is stated in the order confirmation. The last day for standard export appears from the order confirmation. |
| Price and payment | Amount and currency as stated in the order confirmation, excluding applicable VAT The method of payment, card or invoice, appears from the order confirmation. Where payment is made by card, payment takes place in connection with the purchase. Where payment is made by invoice, the payment term and the Customer's reference appear from the invoice, which is handled outside the service. Paid before distribution and activation. |
| Extension and changes | No more than one year's extension per additional purchase. The price, the method of calculation and the rights concerned appear from the additional order's own order confirmation. The price of an extension is EUR 500 excluding VAT per year in accordance with the current price list. No automatic extensions. |
| Data protection | The Customer: the incident contact with name, email address and telephone number that the Customer has registered in Danadot WeOffice: info@danadot.com and 0739793663 |
| Specific restrictions | None, unless the Customer has given notice concerning external AI or concerning benchmarking and model development under Appendix 3 point 6. Restrictions given are registered by WeOffice on the project in Danadot and apply from the time WeOffice has confirmed the notice. |
The parties accept the same completed version of the Agreement by signature or by documented electronic acceptance. A receipt does not retrospectively alter what the parties have agreed.
For the Customer: an authorised representative signs, or accepts the Agreement electronically in Danadot. An electronic acceptance is recorded with the user, the organisation, the time and the checksum of the agreement text.
For WeOffice AB: an authorised representative signs, or confirms the order in Danadot. The order confirmation, with its order number, is WeOffice's confirmation.
General terms and conditions
1 Agreement and users
The Agreement is entered into with the Customer as a company, organisation or public body. The person placing the order must be entitled to represent the Customer. A user does not become personally liable for the organisation's purchases merely by creating an account.
The order takes precedence over the general terms and conditions. The data processing agreement and its appendices take precedence in matters concerning processing carried out on the Customer's instructions. A separate data processing agreement replaces that part only if the parties have agreed so in writing.
The Customer is responsible for its users' access rights and their use of the service. Accounts are personal. Access to one project does not confer access to other projects. The Customer shall report suspected unauthorised access without delay.
2 Delivery and the Customer's participation
WeOffice provides the functions and deliverables set out in the order and performs the work in a professional manner. Functions described only as planned are not included. Material delays and their causes shall be notified to the Customer without undue delay.
The Customer provides accurate and necessary information, reviews the order and participates in accordance with the timetable. If a delay on the Customer's part affects delivery, the parties shall adjust the timetable. Additional work or an increased scope requires the Customer's approval of price and terms before it begins. Survey delivery takes place within ten working days after the collection has closed and the Customer has provided the complete material needed for the agreed analysis.
Survey-based functions are opened once payment has been verified and the delivery has been checked and activated by WeOffice. Comparison against WeOffice's benchmark figures forms part of the delivery only once the benchmark material meets the requirements in Appendix 3 as to the number of respondents per collection and the number of organisations. Where there is insufficient material, the comparison is omitted and the Customer is notified; the other parts of the delivery are unaffected. The Spaces function is included only if it has been ordered. Access purchased separately earlier and still valid is retained, but does not give access to survey results that have not yet been activated.
3 Price, payment and change of package
The price is the price the Customer has approved in the order. VAT is added under the applicable rules. New prices do not alter an agreement already entered into. Invoicing, and electronic invoicing where applicable, follows the details in the order.
Payment shall have been received and verified before surveys are distributed or paid services are activated. Where payment is made by invoice, an authorised administrator at WeOffice records that payment has been received. Approval of the order does not confer a right of access before payment. In the event of late payment, statutory default interest and permitted charges may be levied. The Customer shall notify a substantiated dispute without delay and pay the undisputed part. An overdue invoice does not automatically pause a project that has already been activated. WeOffice may pause a project within the limits of the Agreement. An amount disputed on substantiated grounds is not in itself a ground for suspension.
A change between Danadot's packages is made by a change order that is confirmed by WeOffice. On a change to a more expensive package, the Customer pays the difference stated in the change order before the additional services are activated. Where the Customer voluntarily changes to a cheaper package, the price difference is not refunded.
The change order shall state which earlier payments are credited, the amount to be paid, which services are included and any change to the end date of the licence. No separate administrative charge is levied for the change of package. A survey that has been carried out cannot retrospectively change its content or its survey version. The Customer's right to a price reduction or a refund in the event of a defect, a failure to deliver as agreed or under mandatory law is unaffected.
4 Licence and project boundary
The Customer may use the purchased functions for the project, the number of people and the business sites concerned that are set out in the order. Further business sites may be purchased. Projects may also be quoted for separately.
The same project is delimited by the organisation, the business sites concerned, the staff group and the purpose of the change. The Customer may correct data, alter the characteristics of the premises and try different scenarios within the project. Business sites may not be replaced in such a way that the licence is in practice used for another project. An increased scope is agreed separately. A purchase for one project confers no rights in another project.
The licence runs for one year from the start date. The start date is the day on which payment has been verified: where payment is made by card, the day the purchase was completed, and where payment is made by invoice, the day an authorised administrator at WeOffice records that payment has been received. Activation of the survey delivery is a separate condition of use and does not in itself move the start date of the licence. The start date and the end date shall be clearly stated and apply to all the services ordered under the order. When the licence ends, the Customer's access changes to read-only mode for three years, unless another period is stated in the order. In read-only mode the Customer can read and print the published survey results and analyses that have already been delivered. Retention of material does not in itself confer a continued right to edit.
An additional purchase may extend the project's licence by no more than one year per additional purchase. The additional order shall state the new end date, the method of calculation, which rights are covered and the price before the Customer approves the purchase. There is no automatic extension and no recurring charge. The free calculator is a separate project and may be used, and new free calculators created, after a purchase as well, within the stated limits of the free tier. A free project may not be used to move paid rights between projects.
5 Deliverables and rights
The service provides decision-making material based on the data available and on the assumptions and settings used. The Customer is responsible for its input data, its own changes and its decisions on application. WeOffice does not guarantee any particular financial or operational outcome. The Customer's reviewing, altering, printing or using the report does not limit WeOffice's liability for defects in the agreed service.
The Customer retains the rights to its own material and may use the delivered results in its operations and share them with advisers and contractors for the purposes of the project. That right survives the end of the licence for results already delivered. The Customer is responsible for ensuring that any disclosure of personal data is lawful.
WeOffice retains the rights to software, calculation models, survey questions and other background material of its own. The Customer may use the questions in the survey ordered, but may not copy the instrument for new surveys, resell it or make it publicly available without permission. Any statutory obligation to disclose documents is unaffected.
6 Defects and interruptions
The Customer shall report defects in writing without unreasonable delay after the defect is discovered. WeOffice shall remedy defects for which WeOffice is responsible within a reasonable time. If a material defect or a material delay is not remedied following a written request and a reasonable period, the Customer may terminate the part concerned and obtain a refund for the part that could not be used. Where a minor defect remains, the Customer is entitled to a reasonable price reduction.
WeOffice may carry out necessary maintenance and shall, where possible, give advance notice of planned interruptions. No particular guaranteed availability level applies unless it is stated in the order. The rules on defects also apply to interruptions for which WeOffice is responsible.
7 Liability for damages
Where WeOffice is liable in damages under this Agreement for the standard delivery or for use of the service, that liability covers substantiated direct loss only. WeOffice's aggregate liability is limited to 25 per cent of the agreed order value excluding VAT for the order to which the loss relates. Where the loss relates to more than one order, the cap is calculated on the combined value of the orders concerned. The limitation is an aggregate cap and does not apply afresh for each claim or calendar year.
No compensation is payable for indirect loss, such as loss of profit or business interruption. The limitations do not apply in cases of intent or gross negligence, or to the extent that mandatory law precludes them. Price reductions, refunds and the obligation to remedy defects under clause 6 do not count as damages and are not covered by the liability cap.
The Customer shall submit a claim for damages in writing within six months after the Customer discovered or ought to have discovered the circumstances on which the claim is based, and no later than twelve months after the end of the licence period of the order concerned. Both time limits shall be met. The time limit concerns notification to WeOffice, not that proceedings must be brought within the same period. The time limits do not apply to liability under the data processing agreement or to the extent that mandatory law precludes them.
Data subjects' right to compensation under the General Data Protection Regulation may not be limited by the Agreement. Liability between the parties for data protection breaches is governed by the data processing agreement.
8 Confidentiality and personal data
Each party shall protect the other's non-public business, operational and security information and use it only to perform the Agreement. It may be disclosed to persons who need it and who are bound by equivalent confidentiality. The obligation continues after the Agreement ends, but does not cover information that has lawfully become public or that must be disclosed under law or a decision of a public authority.
A public sector customer determines questions of public access to documents and secrecy itself. The Agreement does not guarantee confidentiality for prices, survey answers or other documents. WeOffice processes data for account administration, invoicing and its own security as controller in its own right, under a separate privacy notice. Customer material may be used for benchmarking, research, development and AI only under Appendix 3.
WeOffice uses Microsoft's products for the internal administration of agreements, invoicing and business contacts, as controller in its own right. Respondent data, original survey answers and Danadot's project and analytical material are not stored in Microsoft's cloud services.
9 Termination of the Agreement and disputes
Either party may terminate the part concerned in the event of a material breach that is not remedied within 30 days of a written request. WeOffice may temporarily restrict access where this is necessary to stop a specific security threat or unlawful use. The measure shall be proportionate, the Customer shall be informed as soon as possible and access shall be restored once the reason has ceased.
Deleting an account does not end the Customer's orders. Paid projects are archived so that the order history and the delivery history are preserved. Necessary payment and audit history is linked to the Customer and to the order and is accessible to authorised administration. Material and personal data are erased in accordance with Appendix 1 and the law. Necessary accounting and claims data may be retained as required by law and by a documented need, but not survey answers generally.
Amendments to the Agreement require the approval of both parties, with the exception of updates within the express scope of Appendix 3 and changes of sub-processors under the data processing agreement. In the event of a discrepancy between the language versions, the Swedish version prevails. Swedish law applies. Disputes shall be determined by the Swedish general courts, with Stockholm District Court as the court of first instance.
10 Export, switching and voluntary termination
The Customer can print the service's results and analyses itself during the agreed period of access. On request, WeOffice provides a CSV file with the Customer's project settings to supplement the report. Only an authorised WeOffice administrator may produce and release the file, after checking the recipient's authority to represent the Customer.
Export concerns the release of existing data. The production of new analyses or customised reports is not included unless this has been specifically agreed. This does not limit the Customer's rights under mandatory law.
In the standard service and in the customer export, survey results are released only in aggregated form at group level, applying the agreed privacy suppression rules. Individual respondents' answers and raw survey data are not included. Aggregated and anonymised benchmark figures are, however, included in the delivery, because comparison against them is part of what the Customer has ordered. They are reported within Appendix 3's limits on the number of respondents and the number of organisations, so that neither an individual participant nor another customer organisation can be identified. The shared benchmark material as such, other customers' identifiable data and the program's source code are not included in the standard customer export. This does not limit obligations under mandatory law or under the applicable data processing agreement.
For services covered by mandatory rules on switching data processing services, WeOffice shall provide the assistance, the exportable data and the time limits required by law. No specific switching charge is levied.
The price of the service appears from the order. No specific charge is levied for switching or for early termination. If the Customer voluntarily terminates a paid service that has been provided in accordance with the Agreement, or chooses not to use it, that does not confer a right to a refund for unused licence time. This does not affect the Customer's right to rectification, to a price reduction or to a refund in the event of a defect, a failure to deliver as agreed or under mandatory law.
Data processing agreement
1 Scope and roles
The Customer is the controller and WeOffice AB is the processor for personal data that WeOffice processes on the Customer's instructions in Danadot. This covers survey assignments, the agreed AI-based analysis and personal data in the Customer's project workspace. The Customer's order and Appendix 1 set out the subject matter, scope and duration of the processing. Appendix 2 sets out security and the approved sub-processors.
The agreement applies from the parties' acceptance and for as long as WeOffice or its sub-processors process such data, including during any agreed read-only mode and until backups have been erased. If the Customer itself acts as a processor for another party, that assignment and the further processing chain must be agreed before processing begins.
2 The Customer's responsibilities and instructions
The Customer determines the purposes, assesses and documents the legal basis, ensures that data may be disclosed to WeOffice and is responsible for informing the data subjects. The Customer decides which users are given access to projects and results and which retention periods are needed. The Customer shall provide only data that is covered by the instruction.
WeOffice may process data only in accordance with the documented instructions in this agreement and subsequent written instructions from the Customer's authorised contact person. Instructions given in the service shall be capable of being followed up. If WeOffice considers that an instruction infringes the data protection rules, the Customer shall be informed immediately and the processing concerned shall be paused until the matter has been resolved.
Where processing is required by Union law or the applicable law of a Member State, WeOffice shall inform the Customer before processing, unless that law prohibits it. WeOffice may not use the Customer's data for its own purposes on the basis of this data processing agreement. Use under Appendix 3 takes place under the allocation of responsibility and the conditions set out there.
3 Confidentiality and security
WeOffice shall ensure that all persons with access to the data are bound by a confidentiality undertaking or a statutory duty of confidentiality and process the data only in accordance with their authorisation and the instruction. Access shall be limited to what the task requires and withdrawn when the need ceases.
WeOffice shall implement and maintain the technical and organisational measures required by Article 32 of the General Data Protection Regulation, taking account of the risks to the data subjects. Appendix 2 shall be completed and the measures implemented before the processing concerned begins. The level of protection may not be lowered during the term of the agreement.
4 Sub-processors and country of processing
The Customer gives general written prior authorisation for the engagement of the sub-processors listed in the completed Appendix 2. WeOffice shall impose equivalent data protection obligations on them by contract and remains fully liable to the Customer for their performance of those obligations.
WeOffice shall inform the Customer in writing in advance of the addition or replacement of a sub-processor, including changes further down the chain, and give the Customer a genuine opportunity to object on data protection grounds. The agreed minimum period of notice is 7 calendar days. If a justified objection cannot be resolved, the Customer may terminate the part concerned without additional charge and obtain a refund of prepayments for the unused part. A change may not be implemented unless the conditions of the agreement are met.
Processing, storage and access shall take place within the EU/EEA countries listed in Appendix 2. Access or transfer outside the EU/EEA requires the Customer's documented prior approval and compliance with the requirements of Chapter V of the General Data Protection Regulation. This applies to remote support and sub-processors as well.
5 Data subjects' rights
WeOffice shall assist the Customer by appropriate measures in handling data subjects' rights under Chapter III of the General Data Protection Regulation, taking into account the nature of the processing and in so far as this is possible. Requests received directly are forwarded without undue delay. WeOffice responds on the Customer's behalf only on instruction or where the law requires it.
The assistance shall be given so that the Customer can meet the time limits laid down by law.
6 Incidents and support in data protection work
WeOffice shall notify the Customer's incident contact without undue delay and no later than 48 hours from the time WeOffice has established that the incident concerns the Customer's data. The first notification may not be delayed because the investigation is incomplete.
The notification shall, where the information is available, describe what has happened, the categories of data and of persons affected, the approximate number of persons affected, the likely consequences, the measures taken or planned, and a point of contact. Missing information shall be supplied without undue delay. WeOffice shall document the incident, limit the damage and assist in the investigation.
WeOffice shall assist the Customer in complying with the obligations under Articles 32–36, including security assessment, data protection impact assessment, incident handling and prior consultation, taking into account the nature of the processing and the information available. The Customer decides whether notification to the supervisory authority and communication to the data subjects are required. Each party is responsible for its own obligations under the law.
7 Information and audits
WeOffice shall make available the information needed to demonstrate compliance with Article 28 and shall allow for and contribute to the Customer's audits and inspections, whether conducted by the Customer or by an authorised independent auditor. The parties shall plan the audit proportionately and protect other customers' data. Reasonable prior notice is used where the circumstances permit. That does not limit an audit that is necessary in the event of an incident, a specific suspicion or a requirement of a public authority.
8 Return and erasure
When the processing service ends, WeOffice shall, at the Customer's choice, return or erase the data and erase existing copies. An agreed read-only mode is continued processing on the Customer's instructions. Appendix 1 sets out periods, export and the erasure of backups. Where the law requires continued storage, WeOffice shall state the basis and the extent, protect the data and not use it for other purposes. Completed erasure shall be capable of written confirmation.
9 Liability
The parties' liability towards data subjects and the apportionment of such compensation between them follows Article 82 of the General Data Protection Regulation. Each party bears the administrative fines imposed on it. Other liability in damages between the parties for breach of this data processing agreement: WeOffice's aggregate liability for breach of this data processing agreement is limited to 100 per cent of the agreed order value excluding VAT for the order to which the loss relates, calculated in the same way as in clause 7 of the general terms and conditions, and covers substantiated direct loss. The limitation does not apply in cases of intent or gross negligence, nor to recourse claims under Article 82(5) concerning compensation to data subjects, nor to the extent that mandatory law precludes it. The liability cap in the general terms and conditions does not apply here automatically and may never limit mandatory rights or obligations.
Appendix 1 Processing instruction
Assignment and purposes
The assignment covers collection, storage, analysis, AI-based processing, reporting and export for the project ordered, together with the agreed participant administration and survey distribution. Data is provided by the Customer, the users and the participants.
The instruction covers comparing the Customer's aggregated results against WeOffice's aggregated benchmark figures at overall level and at sector and industry level. They are reported within Appendix 3's limits on the number of respondents and the number of organisations, so that other customer organisations and individual participants are not identified. Where there is insufficient material, the comparison is omitted and the Customer is notified; the other parts of the delivery are unaffected. The use of the Customer's data for the shared benchmark material and for WeOffice's other own purposes is governed by Appendix 3.
Persons and data
The data subjects are the Customer's employees, other agreed participants and persons appearing in the project material. The types of data are the agreed background data, organisational affiliation, survey answers, the measured time taken to complete the survey and derived analytical data and, where personal invitations are used, work-related contact details, participant code and distribution status. Exact list of questions and attributes: the survey version frozen in the project's survey plan in Danadot and the question-code list belonging to the project's data binding. The list is provided to the Customer on request and is not changed for a collection that has already been carried out. Response times linked to individuals, IP addresses and referring addresses shall not form part of the survey's answer material. Separate technical security logs are governed separately and may not be used to circumvent this delimitation.
Where the Customer distributes a shared survey link itself, no participant list containing employees' email addresses is provided to WeOffice. Employees' email addresses are not requested in that survey flow. Where personal invitations are used, the participant list is kept separate from the answers and the survey's anonymous answer mode is used. That does not in itself mean that the other answers and background data are anonymous in law.
Sensitive personal data, for example concerning health, and data relating to criminal offences may not be requested without a specific agreement, a legal assessment and adapted safeguards. Free text is limited and participants are informed not to provide such data. If it nevertheless occurs, WeOffice restricts access and notifies the Customer for instructions.
Results and distribution
The standard delivery is aggregated results, not survey answers linked to individuals. Participant lists and distribution are handled in the separate survey environment. Where the Customer distributes the survey itself, it uses the agreed link. The Customer is responsible for the legal basis and for informing participants before collection. WeOffice provides material about its own processing.
Groups with fewer than ten respondents are not reported separately. Before the result is shown, such a group is merged with another group, forms a new group together with others, or is included only at a higher level. Whatever the grouping, a value based on fewer than five respondents is never reported, and where such a value is suppressed, whatever would otherwise make it derivable from a total or from a complementary group is suppressed as well. The same limits apply to filters, comparisons over time and reports.
Retention and termination
The end of the licence means the end date in the current approved order. The periods below are maximum periods on the Customer's instruction and presuppose a continuing lawful need. Earlier erasure may be instructed. Where several time limits apply to the same material, the earliest shall be applied. An extended licence does not revive erased data and does not move the time limit for the raw material, which is counted from the last answer.
| Category of data | Latest erasure |
|---|---|
| Participant list, original survey answers and identifying keys | Three months after the last answer in the collection concerned. |
| Processed individual-level data | Three months after the end of the licence, or earlier under the rules for a cancelled, non-activated or abandoned delivery. |
| Published survey results | Three years after the end of the licence. The read-only mode under clause 4 runs for the same period, so that the Customer can read the results for as long as they remain. |
| Project material entered manually by the Customer | Three years after the end of the licence, or earlier at the Customer's request. |
| Material for a cancelled or non-activated delivery | No later than three months after the Customer's notice of cancellation or that the delivery is not to be activated. A shorter time limit that already applies continues to apply. |
| Material for an abandoned order without notice | No later than six months after the Customer's most recent action in the project, once WeOffice has sent two written reminders to the contact person and to the incident contact, the last of them at least 30 days before erasure. |
| Access logs and distribution logs for the assignment | Access and change log in the service: 24 months from the event. Email distribution and delivery log: 12 months from the attempt to send. Delivery status files between the operating environments: 90 days from publication. Technical security logs: 12 months from the event; they are governed by Appendix 2 and may not be used to link a survey answer to a person. |
| Backups and images | Erasure takes place in two steps. In the systems WeOffice operates itself, the data is erased no later than seven days after the period above has expired. From backups, snapshots and server images it disappears when the copy falls out of the retention order, no later than 90 days after the ordinary erasure. |
The standard results and the supplementary CSV of project settings are provided under clause 10. Return under the data processing agreement covers the personal data processed on the Customer's instructions in a structured, commonly used and machine-readable format, currently CSV or JSON, and is not limited to a printed report. A request shall be made no later than the day read-only mode ends, that is three years after the end of the licence unless another period has been agreed. Data that has already been erased under the table above cannot be returned; rights under mandatory law are unaffected. The Customer's choice of return or erasure is carried out within 30 days. Absent other notice, the Customer instructs erasure at the end dates stated. Individual items of data are not removed from an existing backup; such a copy is not altered after the event. The protection lies instead in the fact that, until it is erased, the copy may be used only for restoration, and that earlier erasures are applied again before the material is used normally. Material for benchmarking and for WeOffice's own development purposes may be produced and retained only under Appendix 3.
Appendix 2 Security and sub-processors
Security measures
The measures shall be implemented and verified before the Customer's personal data is processed. Current documentation shall be capable of being provided to the Customer in an audit.
Access and separation. Personal accounts, least necessary privilege, multi-factor authentication for privileged access and regular review of access rights. Customers' projects are kept separate. Participant lists and individual-level survey answers are kept in a separate survey environment. Only checked aggregations may be transferred to the project environment.
Protection and traceability. Encrypted transmission and encrypted backups. Protection of stored data and keys: all backups are encrypted with keys owned by WeOffice and not held by the storage provider. Sensitive fields in the survey environment are encrypted within that environment with a key that does not leave it. Operational secrets, such as keys, passwords and access tokens, are stored with restricted access and backed up in encrypted form. The linking key between participant and answer is kept separate from the answers and destroyed in accordance with Appendix 1. Authorised access and administrative actions shall be logged, and logs shall be protected and reviewed. Software shall be maintained, vulnerabilities addressed and unauthorised access detected.
Restoration and verification. Backups are taken regularly of all environments, more frequently for the service's database and for the survey environment during an ongoing collection. Restoration is tested regularly and after material changes to the operating environment. Erasure also covers images and test copies in accordance with Appendix 1. The effectiveness of the security measures is evaluated regularly. Real customer data is not used in development and is not passed to other services without a lawful and agreed basis.
AI environment. AI processing in the Customer's project and model development shall be separate flows. External network access, telemetry, logging of inputs and outputs and any automatic fallback to an external AI provider shall be switched off or specifically approved and documented. A project in which the Customer has objected to external AI may not use an external fallback provider.
Protection in reporting. Small or identifiable groups are suppressed. Filters, differences and comparisons over time may not reveal individuals. The group thresholds in Appendix 1 do not prove the anonymity of the benchmark material.
Aggregations and coded individual-level records shall be treated as personal data until a documented assessment shows that no person can reasonably be identified, directly or indirectly. Data may not be presented as anonymous merely because a name or a linking key has been removed.
Approved list of sub-processors
The list covers processing carried out on the Customer's instructions, including relevant sub-supplier tiers and support access. The details shall be completed and verified before the Agreement is used in a binding manner.
| Legal entity and contact | Assignment and data | Countries and chain |
|---|---|---|
| Hetzner Online GmbH Industriestrasse 25, 91710 Gunzenhausen, Germany. Data processing agreement version 1.2 (16 February 2026), signed on 5 September 2026 by WeOffice AB, customer number K0950154926. A copy, the sub-supplier annex and the independent review of the security measures are held by WeOffice and are provided in an audit. | Operation, storage, backup and protection of Danadot's server environments, including the running and any training of AI models that WeOffice installs and controls. The processing may cover project and analytical material, aggregated survey results and technical security and operating logs. | Germany and Finland. Processing, storage and backup take place in Hetzner's data centres in those two countries. Hetzner's data centres outside the EU/EEA are not used, either for operation or for backups. Support is performed from Germany. Hetzner's own sub-supplier for server space in Finland is Hetzner Finland Oy, for premises and technical support. Hetzner Finland Oy is not a contracting party. |
| Loopia Loopia AB, company number 556633-9304, Kopparbergsvägen 8, 722 13 Västerås, Sweden. The data processing agreement is Annex A to Loopia's general terms and conditions and applies, under clause 7.11 of those terms, to all the services the customer uses. | Email for invitations and reminders, and the processing of addresses and distribution data. | Country of storage: Sweden, which is also Loopia's country of establishment. Support and development with access to customer data take place in Sweden and at two sister companies: Loopia D.o.o in Serbia and Websupport S.R.O in Slovakia, whose development teams, according to Loopia's list, have access to certain customer data in Loopia's development environment for troubleshooting and product development. Loopia's current sub-suppliers with access to personal data are set out in full in the company's published list, which under Annex A clause 6.5 is updated at least one month before a change is implemented, and which WeOffice monitors. Serbia is outside the EU/EEA. WeOffice has requested Loopia's answer as to whether that access may cover data in the Customer's distributions. |
| Mistral AI SAS, Paris, France, the La Plateforme service. Scaleway SAS, Paris, France, the Generative APIs service. Data processing agreement under each provider's terms for business customers. | Production of the agreed AI-based analytical texts from aggregated and delimited project data. No survey answers at individual level and no participant lists are provided to the provider. | France; processing within the EU/EEA. The provider does not retain the data after the call and does not use it for its own models or its own purposes. Which provider is used for the Customer's project appears from the project's details in Danadot. Anthropic PBC, USA, may be used for a project only after the Customer's express written approval and with the safeguards required by Chapter V of the General Data Protection Regulation, and is then stated on the project. |
AI processing of the Customer's project data takes place either at the approved AI providers above or with open models in WeOffice's own server environment. A change or addition of an AI provider is made under clause 4 of the data processing agreement. Appendix 3 point 6 sets out what the Customer may restrict.
A model publisher does not become a sub-processor merely because WeOffice installs an open model in its Hetzner environment, provided that no customer data, logs, telemetry or support material is transferred to the model publisher.
Payment services, accounting and the use of Microsoft for WeOffice's own administrative purposes are not included in this list. Card payment is made through Stripe Payments Europe, Ltd. in Ireland with Stripe, Inc. in the USA. Stripe processes the payer's contact, invoicing and payment data under WeOffice's own controllership and as an independent controller for its own purposes, and processes neither survey answers, participant lists nor project and analytical material. If a supplier also processes the Customer's data on instructions, that part shall be stated here.
Appendix 3 Benchmarking, research, development and AI
This Appendix governs WeOffice's use of material for shared benchmark figures, research, product development and WeOffice-controlled model development. Such use may take place only within the limits on content, the anonymisation requirements and the customer restrictions set out below.
1 Purposes and responsibility
The datasets may be used for studies of what contributes to workplaces functioning well and of related workplace questions, for the development of benchmark figures, for the improvement of survey questions and of the platform, and for the adaptation of WeOffice's products to customers' needs. They may also be used to produce aggregated benchmark figures at overall level and at sector and industry level. Individual assessment of staff and marketing to participants are not covered.
WeOffice is an independent controller for its own processing for those purposes where the material constitutes personal data. The Customer is responsible for ensuring that disclosure is permitted. WeOffice is responsible for the legal basis, information, security and data subjects' rights in its processing. If the parties in fact jointly determine the purposes and means, responsibility shall be governed by Article 26 before the processing begins. The datasets are produced in WeOffice's own environment, once the link to the Customer's project has been broken, and under WeOffice's own controllership.
2 Datasets A and B
Dataset A contains minimised respondent-based records. It may contain role in documented clustered form, the permitted background categories, the Workplace Adequacy Index (WAI), Size correctly, Diversify, Improved usability and Facilitate collaboration, together with the agreed question scales that have not been placed in Dataset B.
The permitted background categories in Dataset A are sector, industry, year of data collection, before or after the change, country and age in five-year bands, to the extent that the documented minimisation and risk assessment allows. Names, email addresses, participant identifiers, exact age, organisation, organisational unit, organisation code, free text and individual response times may not be included.
Dataset B contains the complete fixed answer categories of the role question, together with the activity analysis where those questions form part of the survey. The proportions in the activity analysis are retained in steps of five percentage points. The free text in the answer option Other is not included.
Other complete question scales may be allocated differently between A and B for different survey versions and collections. For the same respondent's answers in the same collection, a scale, its sub-questions or derived equivalent answer content may appear in only one of the datasets. The role data in complete and in clustered form is the only decided exception.
Before each collection, WeOffice establishes a version-controlled content description. It states the questions and sub-questions per dataset, the role grouping and which collections the version applies to. A changed allocation applies to new collections and does not mean that older answers are copied to the other dataset.
3 Dataset C
Dataset C may contain the participant's fixed tick-box choice in the role question and a separate free-text answer in which the participant describes their role and their activities. The free text may be taken in only once it has been anonymised so that neither a natural person nor an organisation can reasonably be identified. Answers that cannot be sufficiently anonymised shall be excluded. The free text in the answer option Other in the standard role question is not transferred to C or to any other Dataset A–E.
Dataset C is used for the development of Danadot and is not normally reported externally. Where the Customer has ordered an overall summary of the role and activity free text, it shall be produced within the customer project before the link to the organisation is broken. Other free-text questions requested by the Customer are used only for the Customer's ordered analysis, are not transferred to A–E and are erased as original survey answers.
4 Dataset D
Dataset D may contain only the survey version and the measured time taken, in order to evaluate and reduce the survey's completion time. Survey version means the version of the form and may not identify the Customer or an individual collection. The dataset may not contain role, background attributes, answers, exact start or end times, record order or keys that link it to other datasets.
5 Dataset E
Dataset E shall be designed so that it contains no data relating to an identified or identifiable natural person. A collection may be taken in only where at least 30 people have given answers in it. The dataset contains one record per collection and covers only a coded collection, sector, industry, year of data collection and the collection's mean values for the Workplace Adequacy Index (WAI), Size correctly, Diversify, Improved usability and Facilitate collaboration. Where a collection covers several organisations with different sectors or industries, those fields are left blank.
The code key that links the coded collection to the Customer's project shall be stored separately, be access-restricted and be used only for correction, opt-out, the handling of measurement occasions and duplicate checking.
Charts in which each point is a collection may be shown only where at least 15 collections remain after all selections and filters. Codes and other labels are not shown. Exact values are not shown on hover where that creates a risk of identification, and the underlying points may not be exported. The same limit applies to sector-filtered and industry-filtered charts.
The Customer may request that the point for its own collection is not shown. The collection's values may nevertheless contribute to averages, percentiles and other aggregated benchmark measures, unless the Customer has separately objected to future contribution to the benchmark material.
6 AI
WeOffice may use AI to produce the agreed analyses in the Customer's project and may use anonymised datasets for benchmarking and for WeOffice-controlled model development. The AI processing may be carried out with approved external AI providers within the EU/EEA or with open AI models operated in WeOffice's controlled server environment. External providers are stated in the list of sub-processors and may not use the material for their own models or their own purposes.
Before the project is activated, the Customer may contact WeOffice in writing and request that external AI is not used in the project or that material from the project is not used for benchmarking and WeOffice-controlled model development. A later notice applies to future processing from the time WeOffice has confirmed the notice. The notice does not affect material that has already been anonymised and incorporated into a shared dataset, or model development already carried out. WeOffice shall inform the Customer where a restriction affects the service's functions, delivery time or price.
The two restrictions are handled separately. A notice concerning external AI applies to the AI provider in the Customer's project. A notice concerning benchmarking and model development applies to future contributions of project material to those purposes. Model training may take place only with material that has passed WeOffice's documented anonymisation process.
7 Safeguards and conditions before use
Material from a collection may be transferred to Datasets A–E only where the collection contains at least 30 answers that may be used for those purposes. The threshold is tested per collection and before the transfer, and applies to all the datasets, including Dataset E. The datasets may not contain shared respondent identifiers or other retained linking keys. Identifying record order, file names and other technical metadata shall be removed or handled so that they do not restore the link. Before each new composition, WeOffice shall document the risks of identification, of linkage and of inferences about individuals, including as against earlier versions, raw material, backups and other reasonably available data. Division into files does not in itself prove anonymity.
Before processing for its own purposes, the Customer shall have documented its legal basis and, where required, the compatibility of purposes and an assessment of secrecy. WeOffice shall have documented that the processing is supported by a legitimate interest under Article 6(1)(f), together with its assessment of the risk of re-identification. Data subjects shall have been given the necessary information and the contact route info@danadot.com. The Customer's agreement is not consent from the employees.
8 Retention and access
Minimised individual-level records are protected as personal data until anonymity has been documented. Such material may be retained for no more than three months from the day it was transferred to the dataset. Material that has not been verified as anonymous within that period shall be erased. It may not be used as an exception to Appendix 1 without a specific permitted basis. Genuinely anonymised Datasets A–D may be retained for longer than ten years for as long as the purpose remains and anonymity persists. The continuing need and the risk of identification shall be reviewed at least annually. Where the protection is no longer sufficient, the use shall be restricted and the data protected, reworked or erased.
Dataset E may be retained for as long as the purpose remains and the conditions in point 5 are met. The code key shall have its own documented access and erasure rule. The datasets may be accessible only to authorised persons and approved processors. Disclosure to an external research institution requires a separate assessment and agreement. Publication may cover only aggregations that comply with the Agreement's publication limits.