Subject and duration: providing Propiler for as long as your organization uses it, and the time needed to delete the data afterwards.

Data subjects: your staff and members, people invited to your workspaces, and — for schools — students.

Personal data: names, email addresses, roles and group memberships, activity (who, when, where — location only if you allow it), photos, students’ names, classes, login codes and loans.

Confidentiality: everyone at Arctiv AB with access to the data is bound by confidentiality.

Security: the technical and organizational measures on the security page.

Subprocessors: you give general approval to the subprocessors on the subprocessor list; we tell you before we add or replace one, so you can object.

Transfers: data is stored in the EU (Stockholm). Transfers outside the EU/EEA rely on the EU’s Standard Contractual Clauses, the EU–US Data Privacy Framework or an adequacy decision.

Helping you: we help you answer requests from data subjects — including data export, account deletion and erasing a student — and with impact assessments.

Personal data breaches: we tell you without undue delay, and aim to within 24–48 hours of becoming aware of a breach, with what we know so far.

Your settings: as an organization you can switch off AI photo analysis, access for AI assistants and the API, and location capture. Schools start with all three off.

When the agreement ends: we delete your organization’s personal data within 30 days, or return it first if you ask. Backups roll off within 35 days.

Audit: we give you the information needed to show that we meet the agreement, and allow reasonable audits.