Legal
Última actualización: 2026-10-16 · Versión 1.1
Este documento está disponible en inglés y sueco. Svenska
This agreement is entered into between the customer that operates a store in the hosted Komisio service ("the Controller") and Inority AB, company registration number 559142-6720 ("the Processor"), and forms part of the terms of service. It governs the Processor’s processing of personal data on the Controller’s behalf under Article 28 of the General Data Protection Regulation (EU) 2016/679.
The Processor provides a store system for consignment sales. Processing consists of storing, displaying, computing and transmitting the personal data the Controller records in the service, in order to receive goods, record sales, keep seller ledgers, produce statements and vouchers, send notifications and pay consignors.
Data subjects: the Controller’s consignors, staff and, where the Controller records them, customers. Categories: name, e-mail address, phone number, agreement evidence, items handed in with photos and descriptions, sales, ledger entries, payout requests, payment references, statements, communication log entries and the access log of staff actions. Photos may show people; the Controller is responsible for what it photographs. No special categories of data are intended to be processed.
For as long as the Controller’s store exists in the service and during the export period after closure, after which personal data is anonymised except where the Processor must keep records under law.
Process personal data only on the Controller’s documented instructions, which are given through the service’s functions and this agreement, unless required by Union or Member State law, in which case the Processor informs the Controller before processing where the law permits.
Ensure that persons authorised to process the data are bound by confidentiality.
Implement the technical and organisational measures in section 8.
Engage sub-processors only under section 7.
Assist the Controller in answering data subject requests, by providing the seller data export and erasure functions in the service and by helping on request.
Assist the Controller with security, breach notification and impact assessments, taking into account the nature of the processing and the information available.
Delete or return all personal data at the end of the service as the Controller chooses, and delete existing copies unless law requires storage.
Make available the information necessary to demonstrate compliance and allow audits by the Controller or an auditor mandated by it, on reasonable notice and at most once a year unless a breach has occurred.
The Controller is responsible for the lawfulness of the processing, for informing its data subjects, for having a seller agreement that covers the processing, and for the instructions it gives. The Controller shall not record special categories of data in the service.
The Controller authorises the following sub-processors: Supabase Inc. (database, authentication and storage, hosted in Stockholm, Sweden); Vercel Inc. (application hosting, EU region); Resend Inc. (transactional e-mail); MailerLite UAB, Vilnius, Lithuania (onboarding and service e-mail to the Controller’s store owner; consignor and customer data is not sent to MailerLite); OpenAI Ireland Ltd (the built-in AI assistant when the Controller switches it on and it runs on the Processor’s key: the photos and text the Controller chooses to send; off by default); Stripe Payments Europe Ltd (subscription billing of the Controller; consignor data is not sent to Stripe). Providers the Controller connects itself (PayPal POS (formerly Zettle), Fortnox AB, and OpenAI when the Controller connects its own key) act under the Controller’s own agreements with them and are not the Processor’s sub-processors.
The Processor informs the Controller of intended changes to sub-processors at least 30 days in advance by e-mail to the store owner and on komisio.com. The Controller may object; if the objection cannot be resolved, the Controller may terminate the service.
Row-level security in the database so that every store only reaches its own data; encrypted transport (TLS) and encryption at rest; multi-factor authentication enforced in the database once enrolled; role-based access with an append-only access log; credentials for connected providers sealed with a key held only by the application; daily backups with point-in-time recovery on the hosted database; a tested restore procedure; and an open code base with automated tests of the access rules run on every change.
The Processor notifies the Controller without undue delay, and at the latest within 48 hours after becoming aware of a personal data breach, with the information the Controller needs to meet its own notification duties.
Personal data is stored within the EU/EEA. Where a sub-processor processes data in a third country, the Processor ensures appropriate safeguards, currently the European Commission’s standard contractual clauses.
Liability follows the terms of service. Swedish law applies.
