Skip to main content
← Trust & Compliance

Data Protection Policy

1. Purpose and scope

Swiftmade OÜ builds custom software whose systems often hold personal data about our clients' staff, customers and other users. When we handle that data while building, testing or supporting a system, we act as a processor on behalf of our client, who is the controller. This policy sets out how we do that. How we handle data about our own website visitors and contacts is covered separately in our Privacy Notice.

This policy applies to everyone who works on client projects, whether employee or contractor, and Swiftmade OÜ is accountable for their compliance with it.

2. Principles

We follow the GDPR and Estonian data protection law, and apply the same standard for clients outside the EU unless their local law requires more. In practice this means:

  • Client instructions only. We process client personal data only to deliver the agreed work and only on the client's documented instructions.
  • Data minimisation. We prefer to build and test with synthetic or anonymised data. We ask for access to real personal data only when a task genuinely requires it, and only for the people who need it.
  • Confidentiality. Everyone who may access client data is bound by a written confidentiality obligation.
  • Security. Data is protected according to our Information Security Policy.

3. Data Processing Agreements

We sign a Data Processing Agreement (DPA) with every client whose personal data we may access, covering the points required by Article 28 GDPR. We are happy to use the client's own DPA or provide ours, which is based on the European Commission's Article 28 Standard Contractual Clauses.

4. Hosting and location of data

  • Production systems and personal data are hosted with reputable cloud providers, with EU regions preferred or as agreed with the client.
  • Where the client owns the hosting account, the client decides the provider and region. Where we manage hosting, we agree the provider and region with the client in writing.
  • Production data is not copied to personal devices or local environments unless agreed with the client, and then only in minimised or anonymised form.

5. Contractors and subprocessors

  • All developers are engaged under written contracts that include confidentiality (NDA), data protection and security obligations that continue after the engagement ends.
  • Some team members are located outside the EEA. Where they need access to personal data, we limit it to what the task requires and cover it with the European Commission's Standard Contractual Clauses (SCCs).
  • We keep a list of the third-party services (subprocessors) used on each project, such as hosting, email delivery or error monitoring, share it with the client on request, and give notice before adding new ones so the client can object.

6. Supporting the client

We help clients meet their own obligations by, for example, building features for data export and deletion, assisting with data subject requests, and providing information for Data Protection Impact Assessments. We notify the client within 48 hours of becoming aware of a personal data breach affecting their data, so they can meet the 72-hour notification deadline to their supervisory authority.

7. Retention and deletion at project end

When a project or support contract ends, we return client data in an agreed format and then delete it from our systems, including copies held by contractors, within 30 days, unless the law requires us to keep it. Source code and documentation are handled according to the contract. Access to client systems is revoked at the same time. We confirm deletion in writing on request.

8. Training and awareness

New contractors are briefed on this policy, the Information Security Policy and the Safeguarding Policy before they get access to client systems, and confirm in writing that they have read them.

9. Breaches of this policy

Suspected data breaches or breaches of this policy must be reported immediately to the Managing Director at [email protected]. Breaches by contractors may lead to removal from the project and termination of their contract.