1. Parties and scope
Yuna is the product name of the business operated by Leif Peter Billekvist, trading as Hoffstedts, Sweden. Contact: yuna@hoffstedts.se. The support address recorded for Yuna in Stripe is Hoffstedtsgatan 4, 602 41 Norrköping, Sweden.
The customer company is the proposed controller for personal data it supplies in company knowledge and website conversations; Yuna is the proposed processor when acting on that company’s documented instructions. Yuna’s own account, security and statutory accounting purposes require a separate role assessment.
This draft is not an executed agreement. It needs a completed party schedule, acceptance mechanism and legally approved obligations before it can be relied on as an Article 28 agreement.
2. Processing schedule
Subject matter: hosting company workspaces, storing/retrieving approved knowledge and supporting AI conversations. Operations: collection, storage, indexing/embedding, retrieval, AI inference, access, technical tracing and billing-related linkage where instructed.
Potential data subjects: website visitors, customers/prospects, employees and company workspace users. Potential data: messages, voluntarily provided contact details, company documents, conversation memory and technical identifiers. Sensitive data is not an intended requirement; customers should minimise personal data and avoid unnecessary special-category information.
Duration is tied to the provision of the service and any approved return/deletion procedure, which is not yet finalised.
Requires approval / verification
Complete exact categories, purposes, frequency, retention and special-category safeguards for the customer’s use case.
3. Instructions and confidentiality
Proposed obligation for review: Yuna processes controller data only on documented instructions, including lawful transfer instructions, unless law requires otherwise; it informs the controller of an instruction it considers unlawful. Authorised personnel must be subject to appropriate confidentiality obligations.
Workspace actions to submit/review content are operational instructions, not a complete substitute for the written agreement. The controller is responsible for lawful collection, notices and instructions.
Requires approval / verification
Validate these obligations against staffing, provider contracts and actual instruction handling.
4. Technical and organisational measures
Implemented measures include company-scoped access checks, membership roles, private knowledge storage, signed visitor sessions, verified website origins and rate limits. Internal testing is separated from public activation. Contact purpose and marketing consent are treated separately.
This list is not a complete security annex. It does not claim a specific certification, recovery time, encryption-key arrangement, penetration-test result or availability guarantee.
Requires approval / verification
Complete Annex II covering encryption, personnel access, authentication, backups, recovery, monitoring, vulnerability handling, incident response and regular review.
5. Subprocessors and transfers
Known technical integrations are Lovable Cloud, the Lovable AI connection and Stripe; actual legal entities and downstream AI/hosting providers must be verified. Stripe’s role may differ between payment processing and controller-instructed processing.
Proposed terms must specify subprocessor authorisation, advance change notices, objection handling, equivalent protection and international transfer safeguards. No final subprocessor authorisation or transfer mechanism is established by this page.
Requires approval / verification
Complete Annex III with names, addresses, activities, locations, agreements and transfer safeguards. Verify actual downstream model providers, not only the connection name.
6. Assistance, incidents and audits
Proposed obligations for review: appropriate assistance with data-subject requests, security duties, breach assessment, impact assessments and supervisory consultations; notification of a personal-data breach without undue delay after awareness; sufficient compliance information and legally appropriate audit cooperation.
Specific contacts, incident handling, audit arrangements and assistance costs are not yet agreed. No fixed notification SLA is promised.
Requires approval / verification
Confirm the operational ability to meet Article 28/32–36 duties and approve the incident/audit procedure.
7. Return, deletion and approval
Proposed end-of-service obligation: return or delete personal data at the controller’s choice, subject to lawful retention requirements, including an agreed approach to backups. The actual export/deletion process must be completed and tested.
No effective date, signature or legal approval is asserted. Contact yuna@hoffstedts.se to arrange review of this draft and its schedules.
Requires approval / verification
Finalise return format, deletion/backup timing, legal retention exceptions, hierarchy with service terms and acceptance/signature process.