This Data Processing Agreement (‘DPA’) is the Data Processing Agreement referenced in the Joy Terms of Use between Joy solutions AB (referred to as “Joy” in this DPA) and the customer as identified during the registration process (referred to as “Customer” in this DPA).
The defined terms in the Terms of Service shall apply to this DPA.
In addition, the following definitions shall apply:
“‘Data Protection Laws’ means all laws and regulations that apply to or govern the processing of personal data under the EU General Data Protection Regulation ((EU) 2016/679) ('GDPR'), the UK GDPR, any national data protection laws and regulations implementing the EU Electronic Communications Privacy Directive (2002/58/EC), and the UK Privacy and Electronic Communications Regulations (PECR), as well as any amendments to or replacements of such laws and regulations.
Terms used in this DPA shall have the same meaning as in the Data Protection Laws.
Under the Terms of Service, Joy will be processing personal data on behalf of the Customer. This DPA sets out the details of that processing and the DPA is effective for so long as the Terms of Service is in force.
1. The processing shall be carried out in accordance with the Data Protection Laws.
2. Obligations of the Customer
2.1 In relation to the data subjects, the Customer is responsible for the processing’s compliance with the Data Protection Laws.
2.2 The Customer warrants that the processing is carried out in accordance with the purpose for which the personal data have been collected.
2.3 It is the Customer’s responsibility to ensure that Joy, at any time, is duly informed of the Customer’s written instructions regarding the processing. If the Customer provides additional instructions which deviate from the instructions that follow from the Terms of Service, and such additional instructions entail that the scope of the Services is materially changed, the matter must be handled under the Terms of Service.
2.4 All instructions provided by the Customer must be in writing.
3. Obligations of Joy
3.1 The processing is described in detail in Appendix A. Joy undertakes to only process personal data necessary for the performance of the Services, in accordance with the Terms of Service, this DPA or according to specific and documented instructions provided by the Customer in connection with the conclusion of the Terms of Service, which have been approved by Joy.
3.2 Upon receipt of written instructions from the Customer regarding the processing, such as provided for in Appendix A or additional written instructions, Joy must, within a reasonable period of time, take appropriate measures to ensure that the processing is carried out in accordance with the instructions.
3.3 Joy undertakes to ensure that any natural person acting under the authority of Joy, and who has access to personal data, is informed of the content of this DPA and processes the personal data only in accordance with the DPA and the Customer’s documented instructions.
3.4 Joy is required to assist the Customer with appropriate technical and organisational measures for the fulfilment of the Customer’s obligation to respond to requests from data subjects regarding access to and rectification or erasure of personal data.
3.5 Joy must, without undue delay, notify the Customer after becoming aware of a personal data breach. Joy shall assist the Customer by providing information necessary for the fulfilment of the Customer’s obligation to notify the competent supervisory authority of a personal data breach and, when applicable, the Customer’s obligation to communicate the personal data breach to the affected data subjects.
3.6 Joy is required to assist the Customer in connection with any data protection impact assessments and prior consultations carried out by the Customer, as well as to assist in any
investigations carried out by the competent supervisory authority regarding a personal data breach.
4. Engagement of Sub-Processors
4.1 By accepting this DPA, the Customer approves and acknowledges that Joy may engage subcontractors for the purpose of carrying out the processing (“sub-processors”). Should Joy’s engagement of a sub-processor involve the transfer of personal data to a third country, such sub-processor may only be engaged by Joy if the requirements set forth under section 5.1 are met.
4.2 When engaging a sub-processor for the purpose of carrying out the processing, Joy undertakes to enter into an agreement with the sub-processor regarding the processing activities, pursuant to which the sub-processor shall be bound by the same obligations as is Joy under this DPA.
4.3 The parties agree that the Customer, by accepting this DPA, is deemed to have been informed of, and to have approved, Joy’s engagement of the sub-processors listed in Appendix B at the time of acceptance. Later additions and replacements follow section 4.5.
4.4 Any transfer of personal data to the sub-processors is made at Joy’s risk and does not alter the allocation of responsibility between Joy and the Customer.
4.5 Joy gives the Customer at least 14 days’ notice before a new sub-processor starts processing personal data under this DPA, or before an existing sub-processor is replaced. The notice is given as set out in section 9.1, shown on the Home screen until the Customer dismisses it and on the Account page for the whole notice period, and names the sub-processor, where it processes the personal data and what it does for the Services. The Customer may object to the change within the notice period by writing to Joy, on reasonable grounds relating to data protection. Joy and the Customer then work in good faith to resolve the objection, for example by Joy not using that sub-processor for the Customer’s personal data where that is possible. If the objection is not resolved within 14 days of Joy receiving it, the Customer may terminate the Terms of Service in respect of the affected Services by written notice, without any termination fee, and Joy refunds fees already paid for the period after termination. If the Customer does not object within the notice period, the change is accepted, and the Customer’s continued use of the Services after that date confirms it. The new sub-processor does not process the Customer’s personal data before the notice period has ended or, where the Customer has objected, before the objection is resolved or the Terms of Service have ended.
4.6 Where a sub-processor must be replaced urgently, because of a security incident or because it ceases to provide its service, Joy may give shorter notice and states the reason. The Customer’s right to object under section 4.5 applies from the day of that notice.
5. Transfers of personal data outside of the EU/EEA
5.1 Joy undertakes not to transfer personal data to a third country (i.e. a country outside of the EU/EEA), unless the Customer has approved of such transfer in writing, and at least one of the following requirements are met:
(i) the receiving country has an adequate level of security;
(ii) the data subject has given its consent to the transfer;
(iii) the Data Protection Laws provide a legal ground for the transfer; or
(iv) agreements including the standard contractual clauses adopted by the European Commission (Decision (EU) 2021/914) or, for a Customer subject to the UK GDPR, the UK International Data Transfer Agreement or Addendum, have been entered into, without any conflicting changes or amendments.
5.2 Provided that at least one of the relevant actions set forth in section 5.1 has been taken, the Customer may not unreasonably withhold its approval regarding the transfer.
5.3 For a Customer subject to the UK GDPR, a third country means a country outside the UK. Processing within the EU/EEA, where Joy and its sub-processors operate, is covered by the UK’s adequacy regulations for the EEA.
6. Disclosure of information
6.1 Joy may not disclose any personal data to third parties without the Customer’s prior written consent, unless the disclosure or transfer is required by applicable law or under any court judgments or official orders. Notwithstanding the above, Joy is always entitled to transfer personal data to sub-processors in accordance with section 4.
6.2 Joy shall without undue delay notify the Customer in writing if it is approached by a supervisory authority with any matters regarding, or which may be of relevance for the processing. If Joy by operation of law or injunction is obligated to disclose personal data, section 8.2(iv) shall apply.
7. Technical and organisational security measures
7.1 Joy is required to implement appropriate technical and organisational measures in accordance with the Data Protection Laws in order to ensure a level of security appropriate to the risk, including risks relating to unauthorised access, destruction and alteration of personal data covered by the processing. Joy shall determine how such measures are to be implemented in order to reach an appropriate level of security.
7.2 If the Customer makes probable that new security measures are required or that existing security measures must be altered in order to achieve compliance with the legal requirements regarding an appropriate level of security, or in order to achieve compliance with any court judgments or official orders, the parties shall discuss the implementation of such new measures or alterations of existing measures. Any implementation of extended or additional security measures requires that the Parties have agreed on such implementation in writing. Joy is entitled to reasonable compensation for any extended or additional security measures taken.
7.3 If Joy lacks any instructions from the Customer that Joy deems necessary in order to carry out the processing, or if Joy deems the Customer’s instructions, wholly or partly, be in breach of the Data Protection Laws, Joy shall without delay notify the Customer, and await any further instructions that the Customer deems necessary.
8. Confidentiality
8.1 Joy and the persons working under its authority must maintain confidentiality in all respects when carrying out the processing. This means that personal data may not be unduly disclosed to a third party. Joy undertakes to ensure that the individuals working under its authority and who will process personal data observe and comply with Joy’s confidentiality undertaking according to this section 8.
8.2 Joy undertakes not to disclose to any third party such information which Joy, in its capacity as data processor, has received from the Customer or any other such information which Joy processes in its capacity as data processor under this DPA. Joy undertakes to ensure that all persons acting under its authority have undertaken to observe confidentiality in accordance with this section 8. However, this confidentiality obligation shall not apply to:
(i) information which is generally known or becomes generally known other than as a result of a breach of the Terms of Service or this DPA;
(ii) information which Joy can prove was in Joy’s possession prior to being provided to Joy under the Agreement;
(iii) information which Joy, lawfully and without restrictions regarding the right to transfer such information, receives from any third party outside the scope of the Terms of Service or this DPA; or
(iv) information which Joy is obligated to disclose under law or any court judgment or public authority decision. In such a case, Joy must without undue delay inform the Customer in writing about the disclosure and request that the personal data are kept confidential by the recipient.
8.3 This confidentiality undertaking shall survive the termination of this DPA.
9. Changes to this DPA
9.1 Joy announces changes to this DPA, including changes to the sub-processors listed in Appendix B, on the Customer’s Account page in the Services, with the date of the change. Joy may also show the announcement elsewhere in the Services, such as the Home screen. For a new or replaced sub-processor, the announcement is made at least 14 days before the change takes effect, as set out in section 4.5.
9.2 Section 9.1 is in addition to, and does not replace, any notice Joy gives under the Terms of Service, such as an email about a significant change.
9.3 A change to this DPA that does not reduce the Customer’s rights or Joy’s obligations takes effect on the date announced. Any other change takes effect 14 days after the announcement. The Customer’s continued use of the Services after that date is acceptance of the change; a Customer who does not accept it may end the Terms of Service before that date as the Terms of Service provide.
APPENDIX A
Instructions regarding the processing
Joy shall, in addition to complying with the provisions in this DPA and the Terms of Service, carry out the processing in accordance with the instructions below.
Purpose
The processing may only be performed in order to provide the Services under the Terms of Service, including (i) facilitating communication between Users and (ii) operating booking pages through which the Customer’s clients request appointments with the Customer. The personal data may not be processed or used for Joy’s own or any other purposes, except as expressly set out below.
The Services include client agreements: at the Customer’s instruction Joy emails one of the Customer’s clients a link to documents the Customer has authored (for example a therapy or coaching agreement, a privacy notice, a consent to recording and AI-assisted notes), shows the documents to the client, records the client’s act on each document (agreed, read, consent given, consent declined, consent withdrawn), and gives the client a copy. Joy records the delivery of the link (the address it was sent to, when it was sent and delivered, when it was opened) as evidence for the Customer. The documents, their content and the lawful basis for the processing they describe are the Customer’s. Joy does not use agreement or consent records for its own purposes. The Customer is responsible for the content of the documents it sends and for the lawful basis of the processing they describe. Joy’s record evidences delivery and the act taken on the Customer’s documents; it is not a verification of the signer’s identity.
Types of processing
Joy may use any types of processing which are necessary in order to provide the Services, including, but not limited to, sorting, administering, storing, returning and erasing personal data.
Types of personal data
Joy may process personal data and health information provided by the Customer as required to provide their services, including contact details, appointment details, and any free-text content submitted by the Customer’s clients through a booking page, which may include health information. The platform/technical layer operated by Joy as controller does not process the content of such free-text or any clinical reason for visit.
Agreement and consent records: the text and version of each document as shown to the client; the client’s act and the statement confirmed; the name the client typed, and for a child the role and relationship of the parent or guardian who agreed; the client’s name as held on the Customer’s client record; the email address the link was sent to, with the send, delivery and open times; the time of the act and the client’s time zone; the browser family (for example “Safari on iOS”), never the network address. Such a record can reveal that the client receives therapy or counselling and is treated as health information.
Categories of data subjects
The personal data processed by Joy may only concern the Users, such as healthcare professionals, patients and customers.
The Customer’s clients, and a parent or guardian who agrees on behalf of a client under 18.
Duration of the processing
The personal data must be erased by Joy at the time of termination of the Terms of Service, as set forth in the Terms of Use. Furthermore, personal data shall be erased from time to time, in accordance with the Customer’s documented instructions.
Booking data shall be erased when the Customer ends or closes the relationship with the relevant data subject. Where a booking does not result in an appointment proceeding, the booking data shall be erased after the period documented in the Customer’s instructions, so that data relating to non-converting bookings is not retained indefinitely. On withdrawal of a data subject’s consent to health information, the relevant special-category content shall be erased unless the Customer is under a legal obligation to retain it.
Agreement and consent records are kept with the Customer’s client record and erased when the Customer erases the client, when the Customer merges the client (the records move to the surviving record), or when the Terms of Service end. Link keys are stored as hashes only. A key to the signing page is erased within 30 days after it expires or is replaced; a key to the client’s copy is kept with the client record, so that the client can always ask for a new copy link, and is erased with it.
Location of the processing
The processing may only be performed within the EU/EEA, using such equipment and/or infrastructure that Joy is in direct or indirect (through approved subcontractors) control over.
Aggregated statistics
Joy may aggregate personal data across bookings and Customers to a standard where re-identification of any individual is not reasonably likely, including by suppressing any group small enough to risk identifying an individual. Data aggregated to this standard is not personal data and is not subject to this DPA, and Joy may use it to operate, maintain, secure and improve the Services. Joy shall not use identifiable personal data for its own purposes.
Customer transparency (Article 13)
Joy makes available a generic Booking Privacy Notice covering the booking page. The Customer, as controller, may rely on this notice to satisfy its obligation to provide information to data subjects under Article 13 GDPR / UK GDPR in respect of the booking page, and remains responsible for ensuring the notice is presented to data subjects at the point of collection.
The Customer informs its clients of this processing in its own privacy notice. Joy publishes a description of what it records on the visitor privacy notice linked from the agreement page.
APPENDIX B
Sub-Processors approved by the Customer
The Customer accepts and recognizes that Joy engages the following sub-processors in accordance with section 4.3 of this DPA. Additions and replacements are notified under section 4.5, and the current list is always published at joy.day/data-processing-agreement.
Google Cloud Platform (Sweden/EU, https://cloud.google.com/privacy/gdpr), for the operation and maintenance of the platform, including storage of encrypted data.
Google Identity Platform (Google Cloud; global service, processing may take place outside the EU/EEA under Google Cloud’s data processing addendum and the EU standard contractual clauses, Decision (EU) 2021/914), for the authentication of the Customer’s own user account: the Customer’s sign-in email address and credentials. No client personal data is processed by this service.
NLPCloud (https://nlpcloud.com/#security), for speech-to-text and other services.
Berget AI AB (Sweden/EU, https://berget.ai/en/dpa), for speech-to-text transcription of recordings. Berget AI processes the audio of the recording and returns the transcript, and the processing takes place in the EU/EEA.
Daily.co (https://www.daily.co/legal/data-processing-addendum/), Daily.co provides the infrastructure for the secure video conferencing in the app.
Mailchimp (https://mailchimp.com/legal/data-processing-addendum/), email and name of our Customers for email updates.
Paddle (https://www.paddle.com/legal/data-processing-addendum), for payments, invoices and subscriptions.
Typeform (https://typeform.com), email and name and survey answers.
Website Toolbox LLC (https://www.websitetoolbox.com) community platform, email and any details provided by the user in the forum.
Stripe (https://stripe.com/en-se/legal/dpa), for payments, invoices and subscriptions.
Sentry (https://sentry.io/legal/dpa/), for error tracking and performance monitoring of our application.
Scaleway (France/EU, https://www.scaleway.com/en/contracts/), for sending transactional emails from Joy Notes to the Customer and the Customer’s clients, such as session invitations, booking notifications, and links for a client to read and sign the Customer’s agreements and consent forms. Scaleway processes the recipient’s email address and the content of the email, and the processing takes place in the EU.