GDPR Commitment

Hilma (operated by Mindtrack AB, Sweden) is committed to complying with the General Data Protection Regulation (GDPR). This page outlines our GDPR commitment and your rights as a data subject.

1. Our Role Under GDPR

• Data Controller: Your organization (the Slack workspace or Teams organization) is the Data Controller for employee data processed through Hilma.
• Data Processor: Mindtrack AB acts as a Data Processor, processing data on behalf of your organization according to your instructions.
• Sub-processors: We use carefully vetted sub-processors listed on our Sub-processors page.

2. Lawful Basis for Processing

We process personal data based on the following lawful bases:

• Contract performance: Processing necessary to provide the Hilma service as agreed with your organization.
• Legitimate interests: Processing for service improvement, security, and fraud prevention, balanced against individual rights.
• Legal obligations: Processing required to comply with applicable laws.

3. Your Rights Under GDPR

As a data subject in the EU/EEA, you have the following rights:

• Right of access: Request a copy of your personal data.
• Right to rectification: Request correction of inaccurate data.
• Right to erasure: Request deletion of your personal data.
• Right to restriction: Request limited processing of your data.
• Right to data portability: Receive your data in a portable format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

4. Data Location & Transfers

• Primary data storage: EU (AWS eu-central-2, Zurich) via Supabase.
• Application hosting: Global edge network with functions in Stockholm, Frankfurt, and Washington D.C. via Vercel.
• AI processing: United States via OpenAI and Anthropic APIs (zero retention).

For transfers outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and supplementary technical measures including encryption and access controls.

5. Data Protection Measures

• Encryption at rest (AES-256) and in transit (TLS 1.3)
• Role-based access controls
• Workspace-level data segregation
• Regular security assessments
• Employee security training
• Incident response procedures

6. Data Processing Agreement

We offer a Data Processing Agreement (DPA) that meets GDPR requirements for customers who need one. To request a DPA, contact us at [email protected].

7. Data Retention

We retain personal data for the duration of your subscription to enable historical analysis and AI-powered insights. Upon workspace disconnection or deletion request, data is deleted within 30 days. For full details, see our Data Retention Policy.

8. Breach Notification

In the event of a personal data breach, we will notify affected Data Controllers within 72 hours as required by GDPR Article 33, and provide all information necessary for them to fulfill their own notification obligations.

9. Data Protection Officer

For data protection inquiries, contact us at [email protected].

10. Supervisory Authority

You have the right to lodge a complaint with a supervisory authority. As Mindtrack AB is based in Sweden, our lead supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).