Qslip

Data processing agreement

Draft translation

This English version is an unofficial draft for information only. The Swedish version applies, and prevails if the texts differ. Qslip is the English name of Kö(l)appen.

Last updated October 21, 2026

This agreement governs how Qslip processes personal data about the Customer's Visitors. It is part of the terms of use and applies as long as the Customer uses the Service, including on the Start plan.

1. Parties

2. Background

The Customer uses Qslip to manage queues in its business. The Processor then processes personal data about Visitors on the Customer's behalf. This agreement meets the requirements of Article 28 of the General Data Protection Regulation (GDPR).

In case of conflict, this agreement takes precedence over the terms of use in matters of personal data.

3. Definitions

Terms such as personal data, processing, personal data breach and third country have the same meaning as in the GDPR. Other terms have the same meaning as in the terms of use.

4. The Customer's responsibilities

The Customer is responsible for ensuring there is a legal basis for the processing and that Visitors are informed, for example through a link to Qslip's privacy policy by the QR code. The Customer may not use the Service to collect data other than what the Service is made for. For example, the Customer may not ask for sensitive data in free-text fields or in offers.

5. The Processor's obligations

The Processor shall:

  1. only process personal data according to the Customer's documented instructions in Appendix 1, unless the law requires otherwise,
  2. inform the Customer if the Processor considers that an instruction infringes the GDPR,
  3. ensure that persons processing the data are bound by confidentiality,
  4. help the Customer respond to Visitors' requests to exercise their rights, insofar as possible given the nature of the processing,
  5. help the Customer with impact assessments and prior consultations when needed,
  6. give the Customer the information needed to show that the agreement is complied with, and allow audits upon written request with at least 30 days' notice. The Customer bears its own costs for the audit.

6. Security

The Processor takes appropriate technical and organizational measures under Article 32 GDPR, including:

7. Sub-processors

The Customer gives general prior authorization for the Processor to engage the sub-processors listed in Appendix 2. The Processor shall notify the Customer by email at least 30 days before a sub-processor is added or replaced. The Customer may object on reasonable grounds. If the parties do not agree, the Customer may terminate the agreement at no cost before the change takes effect.

The Processor shall enter into written agreements with sub-processors that provide the same protection as this agreement. The Processor is liable to the Customer for the sub-processors' processing.

8. Transfers to third countries

Personal data may be transferred outside the EU/EEA only if supported by Chapter V GDPR, for example the European Commission's decision on the EU–US Data Privacy Framework or standard contractual clauses with supplementary safeguards.

9. Personal data breaches

The Processor shall notify the Customer without undue delay, and at the latest within 48 hours after becoming aware of a personal data breach. The notification shall, if possible, describe what happened, which data and how many Visitors are affected, likely consequences and what measures have been taken. The Customer reports to the supervisory authority if required.

10. Termination of the agreement

When the Customer closes its account, or when a queue on the Start plan is deleted, the Processor deletes all personal data about the Customer's Visitors within 30 days. Backups are overwritten within a further 30 days. The queue statistics consist only of counts and times per hour and contain no personal data. They are deleted together with the queue.

11. Liability

Each party is liable for damage under Article 82 GDPR. The limitation of liability in the terms of use also applies to this agreement, unless mandatory law provides otherwise.

Appendix 1: Processing instructions

PurposeManage virtual queues: assign queue numbers, show queue status, notify Visitors when it's their turn, show the Customer's offers and produce queue statistics for the Customer
Categories of data subjectsVisitors who take a queue ticket at the Customer
Categories of dataQueue number, queue, times. Optional: first name or nickname, web push subscription and phone number. Technical logs (IP address, browser)
Sensitive dataNot processed
Processing operationsCollection, storage, display, sending notifications and text messages, anonymization, deletion
RetentionQueue tickets, with name, phone number and push subscription, are deleted 24 hours after the number was taken. Push subscriptions are deleted as soon as the visit is done. Technical logs are kept for at most 30 days
LocationEU/EEA primarily. Third countries according to section 8

Appendix 2: Sub-processors

Sub-processorTaskLocationTransfer safeguards
Vercel Inc.Hosting and operationsGermany (Frankfurt, EU)The functions run within the EU. Vercel is a US company: EU–US Data Privacy Framework, standard contractual clauses
Upstash Inc.Storage of queue and account dataGermany (Frankfurt, EU)Data is stored within the EU. Upstash is a US company: EU–US Data Privacy Framework, standard contractual clauses
46elks ABSending text messagesSweden (EU)No transfer outside the EU/EEA
Browsers' push services (Google, Apple, Mozilla)Delivery of web push to the Visitor's browserGlobalChosen by the Visitor's browser. The content of notifications is encrypted

Stripe only processes data about the Customer, not about Visitors, and is therefore not a sub-processor under this agreement.

HomePricingFAQGuideTerms of usePrivacy policyData processing agreement