Data Processing Agreement – navichain Service
This Data Processing Agreement is Annex B to the navichain Tenant Agreement (General Terms) and applies to every navichain tenant agreement, including the Free Plan. It applies from 1 November 2026 to every agreement entered into from that date. Existing tenants are notified of it and it applies to them 30 days after the notice. A Swedish translation is available at /sv/legal/dpa/; if the versions differ, the English version prevails.
| Document ID | NC-DPA-TENANT |
| Version | 1.3 |
| Applies from | 1 November 2026 |
| Applies to | Every navichain tenant agreement. This DPA forms part of it. |
1. Parties and roles
1.1 The Customer (the tenant named in the tenant agreement) is the controller of the personal data it enters into, or generates in, the navichain Service.
1.2 Navilog Solutions AB, org. no. 556647-3848, Långvägen 35, 756 52 Uppsala, Sweden (“Navilog”) processes that personal data on the Customer’s behalf as processor.
1.3 This DPA meets the requirements of Article 28 of the GDPR (EU 2016/679). If this DPA and the tenant agreement conflict on data protection, this DPA prevails.
2. Subject matter, duration and instructions
2.1 Navilog processes personal data only to provide, support and secure the Service, as described in Annex 1, and only on the Customer’s documented instructions. The tenant agreement, this DPA, and the Customer’s configuration and use of the Service are the Customer’s instructions.
2.2 If Navilog believes an instruction breaches the GDPR or other data protection law, it will inform the Customer without delay.
2.3 Navilog does not process the personal data for its own purposes. Two exceptions apply:
- aggregated, anonymised statistics that cannot identify any person or the Customer;
- processing that Swedish or EU law requires. In that case Navilog informs the Customer beforehand, unless the law prohibits it.
2.4 This DPA applies as long as Navilog processes personal data for the Customer.
3. Confidentiality
Navilog ensures that everyone authorised to process the personal data is bound by confidentiality and only accesses the data as needed for their tasks.
4. Security
4.1 Navilog implements appropriate technical and organisational measures (Article 32), as described in Annex 2.
4.2 Navilog may update the measures, provided the overall level of protection is not reduced.
5. Sub-processors
5.1 The Customer gives Navilog general authorisation to use sub-processors. The current sub-processors are listed in Annex 3.
5.2 Navilog will inform the Customer at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service without penalty.
5.3 Navilog imposes data protection obligations on each sub-processor that are equivalent to this DPA, and remains liable to the Customer for its sub-processors.
6. Location and transfers
6.1 Personal data is stored in the EU: on Navilog’s own servers in Sweden, and on a replica node of the database cluster hosted by a provider in Finland. Database backups are kept on Navilog’s own storage in Sweden for at most 35 days. Email that the Service sends is delivered through an email-delivery provider in the EU; text messages through a provider in Sweden. Navilog’s own mailboxes, used for support correspondence, are with a provider in Switzerland, which has an EU adequacy decision.
6.1a AI functions in the Service (booking import, cargo checks, border-wait estimates and the Ask assistant) run on Berget AI’s infrastructure in Sweden (EEA). Berget applies zero data retention: prompts and outputs are not stored after the call, and nothing is used to train models. No other AI provider receives Customer personal data.
6.1b Navilog’s technical team includes two individual contractors in Sri Lanka. They act under Navilog’s authority and access the systems remotely for development, operation and support. Personal data stays on the servers in Sweden and is not stored in Sri Lanka. The access is covered by the EU standard contractual clauses (Modules 2 and 3), a transfer impact assessment and the measures in Annex 2. By entering into this DPA, the Customer authorises this access.
6.2 Map, route and weather lookups send only an address or coordinates to the mapping, routing and weather providers in Annex 3. Some of them are established in the United States or may process data there under the EU standard contractual clauses; others are in the EU or the United Kingdom (EU adequacy decision). No user, account or company identity is sent.
6.2a Push notifications to the navichain 365 mobile app are delivered through Expo’s push service and then Google’s or Apple’s notification services in the United States, under the EU standard contractual clauses or the EU–US Data Privacy Framework. They receive the notification text (for example an order number and a status) and a device token. The Customer controls which notifications its users receive.
6.2b Map screens in the Service and the mobile app load map images and icon fonts from the providers in Annex 3, part 3, which see the user’s IP address.
6.3 Navilog will not transfer personal data to any other country outside the EU/EEA without the Customer’s prior written consent and a valid transfer mechanism under Chapter V of the GDPR.
6.4 Integrations the Customer connects (Annex 3, part 4) are the Customer’s own agreements with those providers. Navilog passes data to them only on the Customer’s instruction. Where such a provider is outside the EU/EEA, the Customer is responsible for the transfer mechanism.
7. Assistance to the Customer
7.1 Taking into account the nature of the processing, Navilog assists the Customer with:
- requests from data subjects (access, rectification, erasure, restriction, portability, objection). The Service provides self-service export and deletion functions where possible;
- security, breach notification, data protection impact assessments and prior consultation (Articles 32–36).
7.2 Navilog forwards any data subject request it receives directly to the Customer without undue delay and does not answer it itself unless instructed.
7.3 Assistance covered by the Service’s standard functions, and assistance needed because of Navilog’s own breach, is free of charge. Other assistance, such as extensive impact assessments or customer-specific audits, is charged at Navilog’s current hourly rates after the Customer has been told the estimated cost.
8. Personal data breaches
8.1 Navilog notifies the Customer without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach that affects the Customer’s data.
8.2 The notification includes, as far as known:
- the nature of the breach;
- the categories and approximate number of data subjects and records;
- likely consequences;
- the measures taken or proposed.
9. Audits
9.1 Navilog makes available all information needed to demonstrate compliance with this DPA.
9.2 The Customer may audit Navilog once a year, or after a breach, with at least 30 days’ notice, during normal business hours. The audit is carried out by the Customer or an independent auditor bound by confidentiality, and the Customer pays its own costs.
9.3 Where possible, Navilog may answer an audit request with written information or third-party reports.
10. Return and deletion
10.1 When the tenant agreement ends, the Customer can export its data using the Service’s export functions for 30 days. After that, Navilog deletes the Customer’s personal data from the production systems within 30 days. Backups are kept for at most 35 days and are never restored for any purpose other than recovery, so the data leaves them within that time. If a restore happens, data that should already have been deleted is deleted again.
10.1a Timeline in short: export window 30 days, then production deletion within 30 days, then backup expiry within at most 35 days. All data is gone within 95 days after the agreement ends. Exceptions: the eCMR Canonical Records (General Terms §12.8) and data Navilog must keep by law. On request, Navilog confirms the deletion in writing.
10.2 This applies unless Swedish or EU law requires Navilog to keep the data.
11. Liability
11.1 Each party is liable for damage it causes by breaching this DPA or the GDPR, under Article 82 of the GDPR.
11.2 Navilog’s total liability under this DPA is limited, per contract year, to the greater of (a) the fees paid in the 12 months before the event or (b) SEK 250,000. This cap is separate from, and in addition to, the cap in the tenant agreement. On the Free Plan the cap is SEK 50,000.
11.3 The caps do not apply to damage caused intentionally or by gross negligence.
11.4 Administrative fines are borne by the party they are imposed on. Neither party may recover its own fines from the other.
11.5 If a data subject is compensated for damage both parties caused, they share the cost in proportion to their responsibility (Article 82.5).
12. Governing law
This DPA is governed by Swedish law. Disputes are resolved as set out in the tenant agreement.
Annex 1 – Description of the processing
| Purpose | Providing the navichain Service (transport, warehouse, fleet tracking, production, service and related modules, the navichain 365 mobile app and the customer portal), support, operations and security |
| Categories of data subjects | The Customer’s employees and users; drivers; the Customer’s own customers’, suppliers’ and partners’ contact persons; consignees and other people named in bookings and documents |
| Categories of personal data | Names, work contact details, user IDs and login data, roles; booking, transport, delivery and warehouse data that relates to persons; vehicle and driver position and status data; signatures (e.g. e-CMR); documents uploaded by the Customer; push-notification device tokens; support communication; logs |
| Special categories | None intended. The Customer must not enter special categories of personal data unless agreed in writing. |
| Nature of processing | Storage, organisation, retrieval, display, transmission within the Service, email and SMS sent on the Customer’s behalf, push notifications, route calculation, AI-assisted import and assistance functions, backup, deletion |
| Duration | The term of the tenant agreement, plus the return and deletion period in section 10 |
Annex 2 – Technical and organisational measures
Navilog applies the measures below. They are reviewed regularly. A detailed description, including measures under implementation, is made available to the Customer on request (section 9) and is not published.
| Area | Measures |
|---|---|
| Organisation | A named person is responsible for information security. Everyone with access to personal data is bound by confidentiality. Access rights follow the task and are removed when an assignment ends. |
| Access control | Personal, named accounts for staff and for the control plane. Role-based permissions per tenant. Each Customer’s data is held in its own database and logically isolated in the application. Passwords are stored hashed, sessions expire, and repeated failed sign-ins lock the account temporarily. Sign-ins and platform-level access to a Customer’s workspace are logged. |
| Encryption | All traffic is encrypted in transit, including between the application and the database cluster. |
| Network and operations | Firewalled servers; the database cluster is reachable only over private networks; administration over an encrypted private network. Security updates are applied regularly. |
| Monitoring | Application and sign-in logging; an availability monitor with alerting. |
| Backups and recovery | Regular exports of every Customer database and of the control plane to Navilog’s own storage in Sweden, kept for a bounded period of at most 35 days. |
| Physical security | Servers in locked, access-controlled premises; access limited to named people. |
| Development and release | Development uses synthetic data. Changes go through review and a staged release process before they reach production. |
| AI and data location | Customer data reaches AI functions only through the EEA provider named in Annex 3, with no retention and no training. Customer data is never sent to AI, search or other services outside the EU/EEA and Switzerland. |
| Incidents | An incident procedure with roles and logging. The Customer is notified within 48 hours (section 8). |
| Deletion | Deletion on termination per section 10 through the platform’s offboarding procedure, with a written record. |
| Sub-processors | Each sub-processor in Annex 3 is bound by its data-processing terms, which Navilog keeps on file and reviews. |
Annex 3 – Approved sub-processors
Current as of 1 November 2026. Changes are announced 30 days in advance (section 5). The same list, kept current, is published at navichain.se/legal/sub-processors.
Part 1 – Receive Customer personal data on Navilog’s instruction
| Sub-processor | Service | Data | Location / transfer |
|---|---|---|---|
| Hetzner Online GmbH, Germany (data centre in Finland) | Hosting of one database cluster node holding replicas of Customer databases | The Customer databases replicated to that node | EU |
| Berget AI AB, Sweden (org. no. 559504-7522) | AI inference for the Service’s AI functions; zero data retention; no training on customer data | Prompts containing the data the function needs (documents for import, cargo descriptions, questions to the Ask assistant where enabled) | Sweden (EEA) |
| Lettermint, Netherlands | Delivery of email the Service sends (invitations, invoices, offers, consignment notes, tracking links, reminders) | Recipient address and name, mail content | EU |
| 46elks AB, Uppsala, Sweden | Delivery of text messages the Service sends | Phone number, message text | Sweden |
| Expo, Inc., USA; Google LLC (Firebase Cloud Messaging), USA; Apple Inc. (APNs) | Delivery of push notifications to the navichain 365 app | Device token, notification title and text | USA; SCCs / EU–US Data Privacy Framework |
| HERE Global B.V., Netherlands | Geocoding, routing, traffic, map display | Address or coordinates only | EU; may process outside the EEA under SCCs |
| HeiGIT gGmbH (openrouteservice), Germany | Routing and isochrones | Coordinates only | EU |
| OpenStreetMap Foundation (Nominatim), UK | Reverse geocoding | Coordinates only | UK adequacy decision |
| FOSSGIS e.V. (Overpass API), Germany | Rest areas and border crossings along a route | Route geometry only | EU |
| OpenWeather Ltd, UK | Weather along a route | Coordinates only | UK adequacy decision |
| Migadu-Mail GmbH, Switzerland | Navilog’s mailboxes: support correspondence with the Customer’s staff | Support emails | Switzerland (adequacy decision) |
| Navilog’s individual technical contractors (2 people) | Remote development, operation and support under Navilog’s authority; no local storage | All of the above as needed for the task | Sri Lanka, remote access only (EU SCCs Modules 2 and 3) |
Part 1b – Independent controller receiving coordinates
| Provider | Service | Data | Terms |
|---|---|---|---|
| Google LLC / Google Ireland Limited (Google Maps Platform) | Directions and reverse geocoding for the Service; the map component in the mobile app | Coordinates only, no user, account or company identity | Google processes this data as an independent controller under its controller-to-controller data protection terms (EU standard contractual clauses, adequacy decisions or the EU–US Data Privacy Framework). It is therefore not a sub-processor under this DPA. The Customer authorises these lookups by using the routing and address functions. |
Part 2 – Navilog’s own infrastructure (not sub-processors)
Servers, two of the three database cluster nodes, document storage and backups: Navilog Solutions AB, Uppsala, Sweden; the third node: Hetzner (part 1). Route snapping, telematics server and per-tenant Nextcloud: hosted by Navilog in Sweden.
Part 3 – Hosts the user’s browser or phone contacts directly (IP address only)
HERE (map display), Esri Inc., USA (map tiles), OpenStreetMap Foundation, UK (map tiles), jsDelivr (icon fonts and stylesheets), Google LLC / Apple Inc. (map components inside the mobile app). These receive the user’s IP address when a map or page loads. Navilog does not use them to track users.
Part 4 – Integrations the Customer connects itself (the Customer’s own agreements)
Fortnox AB (SE), Visma (NO/SE), Intuit Inc. (QuickBooks Online, USA), LogTrade Technology AB (SE), Fraktjakt AB (SE), Opter AB (SE), Gurtam (Wialon, LT) and KloudIP (FIOS, LK) for external sensors, Stripe Connect and Mollie B.V. (NL) for the Customer’s own payments, EDI partners, external sensor URLs and webhooks. The Service passes data to these only on the Customer’s instruction (§6.4).
Payment provider for Navilog’s own billing. Navilog uses Stripe (Stripe Payments Europe, Ltd., Ireland, with US affiliates under SCCs and the EU–US Data Privacy Framework) to bill subscription fees. That concerns the customer relationship, where Navilog is controller, so Stripe is not a sub-processor under this DPA.
Change log
| Version | Date | Change |
|---|---|---|
| 1.3 | 1 November 2026 | Google Maps Platform reclassified as an independent controller (Annex 3, part 1b) after reading its terms |
| 1.2 | 1 November 2026 | Annex 2 published at category level; the detailed measures and the improvement plan are provided to customers on request |
| 1.1 | 1 November 2026 | Storage location states the database replica node hosted in Finland; Hetzner added to Annex 3 |
| 1.0 | 1 November 2026 | First published version |