Data Processing Agreement

This agreement is between you, the customer, and Koenig Consulting AB (Swedish company, reg. no. 559116-2267), operating Wellstreak.

For personal data inside your Odoo, you are the controller and we are the processor. We act only on your instructions. For the data you send us through this website, we are the controller, and our Privacy Policy applies instead.

Subject matter. Building, changing and supporting your Odoo: reports, automations, workflows, customisations and data fixes you ask for.

Duration. As long as you have a subscription and we have access. Access ends when you disable our user.

Data subjects. Your employees and users, your customers and their contacts, your suppliers and their contacts, and anyone else recorded in your Odoo.

Categories of data. Contact details, roles, user accounts, and business records that reference people: orders, invoices, payments, deliveries, timesheets, messages. We don’t ask for special categories of data. If your Odoo contains them, tell us so we can limit our access.

Your instructions are the requests you put in your backlog and the approvals you give in writing. We process personal data only to carry them out. If we believe an instruction breaks data protection law, we say so before acting.

Everyone who works on your Odoo for us is bound by confidentiality. We use what we see only to deliver your requests. We don’t use your data for our own purposes, and we don’t share it except as set out here.

A named user per customer with rights limited to the task. Two-factor authentication where your Odoo supports it. Test copy before production. No production writes without your written approval. A database check before every write. An internal note on every record we change. Saved previous state before bulk changes. No export of your database to our systems. Extracts needed for a task are deleted when it is done. The full working method is on our Security and access page.

Your Odoo data stays in your Odoo. Its host, Odoo S.A. for Odoo Online or your own provider, is your processor, not ours. Our own sub-processors are:

AI-assisted tooling. We use AI models as a working tool when analysing and building your requests. A task may send the excerpts it needs, and nothing more, to the provider listed above. If you don’t want that for your data, tell us and we work without it for you.

We give you at least 30 days’ notice before adding a sub-processor. If you object on reasonable grounds, you can end the subscription without penalty.

If a data subject exercises a right, such as access or deletion, and the request concerns something we did, we help you answer it. We also help with data protection impact assessments where our work is in scope.

If we become aware of a breach affecting personal data we process for you, we notify you without undue delay and no later than 48 hours after we know. The notice says what happened, which data and people are likely affected, what we have done, and what we recommend. We then assist you with your own notifications.

We work from Sweden. Your Odoo data is processed where your Odoo is hosted. Our sub-processors for website data are listed above. We don’t transfer personal data outside the EU/EEA unless a lawful transfer mechanism is in place.

When the subscription ends, or when you disable our user, our access ends. We delete any extracts we still hold within 30 days, unless the law requires us to keep them. Everything we built stays in your Odoo.

On request we provide the information needed to show that we follow this agreement, including the log notes and delivery records for your Odoo. Once a year, or after an incident, you may audit our processing of your data, at reasonable notice and at your own cost.

If this agreement conflicts with the Terms of Service, this agreement wins for personal data. It is governed by the laws of Sweden and the EU General Data Protection Regulation. Questions or a signed copy: use the contact page.