Data processing agreement

This agreement is Appendix 1 to the terms for Skillflow. It applies when Skillflow ApS processes personal data for a customer.

Data controller: the customer named in the order.
Data processor: Skillflow ApS, Transformervej 29, 1. sal, 2860 Søborg, CVR 44175762.

Effective from: October 6, 2026.

This agreement ensures that Skillflow ApS processes personal data in accordance with Article 28 of the General Data Protection Regulation (GDPR) and the Danish Data Protection Act. Appendix A describes the processing. Appendix B lists the sub-processors. Appendix C describes the security measures.

The customer is responsible for ensuring that the processing is lawful and that there is a legal basis for entering the data into Skillflow. The customer must inform its employees and other users about the processing.

The customer may not enter sensitive data under Article 9 of the GDPR or data relating to criminal offenses into Skillflow, for example in free-text fields or files.

Skillflow ApS processes the data only according to the customer's instructions. The instructions consist of this agreement, the terms, and the choices the customer makes in the platform. If the law requires us to process data in another way, we notify the customer first, where the law permits it.

If we believe an instruction violates the rules, we say so immediately.

Only employees who need it for their work are given access to the data. They are bound by confidentiality, also after they have left.

Skillflow ApS has technical and organizational measures appropriate to the risk, cf. Article 32 of the GDPR. The most important ones are listed in Appendix C. We review them continuously and improve them when needed.

The customer grants a general authorization for us to use sub-processors. The ones we currently use are listed in Appendix B.

If we want to add or replace a sub-processor, we give notice at least 30 days in advance. The customer may object. If we cannot find a solution, the customer may terminate the agreement immediately.

We enter into a written agreement with each sub-processor. It provides at least the same protection as this agreement. We are accountable to the customer for the sub-processors.

Skillflow's database, files, and backups are located in Germany. Some sub-processors have entities in the United States. Transfers there only take place with a valid basis under Chapter V of the GDPR, for example the EU-US Data Privacy Framework or the EU's standard contractual clauses. The basis is stated in Appendix B.

We assist the customer in responding when a person exercises their rights, for example access, rectification, and erasure. The customer can handle much of this directly in the platform. If a request comes directly to us, we forward it to the customer.

We also assist with security, breaches, impact assessments, and dialogue with the Danish Data Protection Agency (Datatilsynet) when the customer needs it.

If we discover a security breach affecting the customer's data, we notify the customer without undue delay and no later than 48 hours after we have discovered it. We describe what has happened, which data and persons are affected, and what we are doing. This allows the customer to report the breach to the Danish Data Protection Agency (Datatilsynet) within 72 hours.

When the agreement ends, the customer can download its data for 30 days. After that, we delete the data, unless the law requires us to retain it. Copies in backups are deleted when the backup expires.

During the agreement, the customer can delete or anonymize users in the platform themselves.

We provide the customer with the information needed to demonstrate that we comply with this agreement. The customer may arrange an inspection with 30 days' notice. The customer pays its own costs and our reasonable time spent, unless the inspection shows that we have not complied with the agreement.

Authorities with a legal right to access can always be given access.

This agreement applies for as long as we process data for the customer. The liability provisions in the terms also apply to this agreement.

Purpose: to deliver Skillflow so the customer can assign courses, track progress, document completion, and send notifications to users.

Who: the customer's employees and other users the customer grants access, for example consultants and partners.

What data:

• Name, email, mobile number, username, and photo.
• Department, location, position, job title, direct manager, employment type, pay type, working hours, and planned departure date, if the customer uses those fields.
• Microsoft ID and Microsoft status, if the customer connects Skillflow to Microsoft.
• Assigned courses, deadlines, progress, test answers, results, and certificates.
• Login, two-factor authentication, IP address, device, and activity logs.

Duration: for as long as the agreement runs, plus 30 days.

• Hetzner Online GmbH, Germany. Servers, database, files, and backups. Data is located in data centers in Germany.
• Cloudflare, Inc., USA. Protection against attacks, DNS, page delivery, and bot control. Sees IP address and traffic. Basis: Data Privacy Framework and the EU's standard contractual clauses.
• Intuit Mailchimp (Mailchimp Transactional), USA. Sending all emails from the platform. Sees name, email, and the email's content. Basis: Data Privacy Framework and the EU's standard contractual clauses.
• CPsms ApS, Denmark. Sending SMS. Sees mobile number and the message's content.
• ElevenLabs, Inc., USA. Produces audio that reads course text aloud. Receives only course text, no information about users. Basis: Data Privacy Framework and the EU's standard contractual clauses.

If the customer connects Skillflow to Microsoft, we retrieve data from the customer's own Microsoft account. Microsoft is then the customer's supplier, not our sub-processor.

If the customer uses an AI assistant with access to Skillflow, the customer chooses the assistant. Its provider is the customer's supplier, not ours.

• All connections are encrypted with TLS.
• Each customer's data is separated from other customers', and access is controlled by roles.
• Login can be secured with two-factor authentication, passkeys, and Microsoft sign-in.
• Sessions can be bound to device and IP address, and repeated intrusion attempts are blocked.
• Traffic passes through Cloudflare, which stops known attacks.
• Selected fields are encrypted in the database.
• When our support logs in as a user to assist, it is logged.
• Hetzner takes regular backups of the servers. We also take a copy of the database before every platform update.
• Only a few employees at Skillflow ApS have access to the servers and database.
• We review the security of the code before new features are released.

Questions about data processing should be sent to hello@skillflow.dk.