MavaMava Terms of Service
Version 2026-09-24-v4. Effective 2026-09-24. The Swedish text governs; this English version is a translation for convenience.
1. Parties and formation
1.1 These terms apply between Burntbay AB, reg. no. 559317-5374, ("Mava", "we") and the organisation that creates an account in the Mava service ("the Client", "you").
1.2 The agreement is formed when an authorised representative of the Client accepts the terms in the service, either at registration or when choosing a paid plan. Acceptance is logged with name, email address, IP address, time and version number. The person accepting confirms they are authorised to bind the Client.
1.3 Annex 1 (Data Processing Agreement) and Annex 2 (Sub-processors) form part of the agreement.
2. The service
2.1 Mava is a web service for onboarding and security vetting of candidates and employees: collection of identity documents, certificates, criminal-record extracts and questionnaires, a timeline of the person's history, booking and documentation of security and reference interviews, compilation of the dossier, and continuous follow-up ("Mava Watch").
2.2 Mava provides tools. Assessments, decisions on security-class placement, applications for register checks to the Swedish Security Service and all employment decisions are made by the Client. Mava gives no recommendations about individuals.
2.3 Mava may develop and change the service. Material reductions of features the Client pays for are announced at least 30 days in advance.
3. Account, trial and plans
3.1 The trial covers three (3) checks free of charge and without Mava Watch. A paid plan is then required to open further candidates and to use Mava Watch. Mava may extend the trial case by case.
3.2 The Starter, Professional and Enterprise plans are described, with contents and prices, on mava.solutions at the time the plan is chosen. Where the Client and Mava have agreed other prices or terms in writing, for example in an order confirmation, those take precedence over the price list. The chosen plan applies from that moment.
3.3 The Client is responsible for its users' permissions and for ensuring only authorised people access the account. Sign-in uses a one-time code by email or a passkey; passwords are not used.
4. Prices and payment
4.1 Prices are in SEK excluding VAT and consist of a monthly platform fee, a price per candidate and, for Mava Watch, a price per employee per year invoiced monthly at one twelfth.
4.2 A candidate is charged the first time the Client opens the candidate's dossier after the candidate has started their check. Invited candidates who never start are not charged. Each candidate is charged at most once.
4.3 The Client pays either by invoice or by card. By invoice, the platform fee and usage are invoiced monthly in arrears with 30-day payment terms; the first month's platform fee runs from the day the plan was chosen. By card, the platform fee is paid in advance: at plan choice the fee for the rest of the current month is paid, and the card is then charged automatically on the first of each month for that month's platform fee. Usage, meaning candidates and Mava Watch, is charged at the same time in arrears for the previous month. Clients established outside Sweden pay by card.
4.4 Annual prepayment gives a 10 percent discount on the platform fee.
4.5 Late payment carries statutory interest and reminder fees. After more than 30 days' delay Mava may, following a written reminder, suspend the account until payment is made. Data is not deleted because of a suspension.
4.6 Mava may change prices with 60 days' written notice. Price changes do not apply during a prepaid period.
5. Client responsibilities
5.1 The Client is responsible for the lawful basis of processing candidates' and employees' data, for being the operator or otherwise authorised to conduct security vetting, background checks or register checks for the positions concerned, and for informing candidates as required by the GDPR. Mava provides templates for information and consent; the Client is responsible for their correctness for its business.
5.2 The Client may not use the service to process data about people without a factual connection to a recruitment or employment, to systematically check people outside its own operations, or in breach of law.
5.3 The Client is responsible for the content of its own processes, questionnaires and interview guides.
6. Mava's responsibilities
6.1 Mava provides the service with reasonable care and skill. The availability target is 99.5 percent per calendar month excluding announced maintenance. Enterprise has the service level stated in the plan.
6.2 Support is provided via hello@mava.solutions on business days, with response times per plan. The support address is for questions about the service and the agreement, not for information about candidates or employees; such information is handled in the service.
6.3 Mava applies the technical and organisational security measures in Annex 1.
7. Personal data
7.1 The Client is the controller for data about candidates, employees and references processed in the service. Mava is the processor and processes the data under Annex 1.
7.2 For data about the Client's users, billing and support, Mava is the controller under the privacy policy at mava.solutions/en/privacy.
8. Intellectual property and data
8.1 Mava owns all rights to the service. The Client receives a non-exclusive right to use the service during the term.
8.2 The Client owns its data. Mava uses Client data only to provide the service and for anonymised, aggregated statistics that cannot be attributed to the Client or individuals. Client data is not used to train AI models.
8.3 The Client may export dossiers at any time in machine-readable form and as PDF.
9. Confidentiality
9.1 Each party keeps the other's confidential information secret and uses it only to perform the agreement, during the term and five years after, and for personal data without time limit.
9.2 Mava does not access the content of the Client's dossiers beyond what operation, Client-requested support and troubleshooting require, and then only by staff bound by confidentiality.
10. Limitation of liability
10.1 Mava's total liability in any twelve-month period is limited to the fees paid by the Client for that period.
10.2 Mava is not liable for indirect loss, lost profit, loss of data the Client could have exported, or loss resulting from the Client's decisions based on material in the service.
10.3 The limitations do not apply to intent or gross negligence, breach of confidentiality, or liability that cannot be limited under the GDPR.
11. Term and termination
11.1 Starter runs monthly and may be terminated to the end of the current month. Professional and Enterprise run for twelve months and renew for twelve months at a time unless terminated at least 30 days before the end of the period.
11.2 Either party may terminate with immediate effect if the other materially breaches the agreement and fails to remedy within 14 days of written notice.
11.3 On termination the Client may export its data for 30 days. Thereafter Mava deletes the Client's data under Annex 1 unless law requires longer retention. People in Mava Watch are ended at the same time.
12. Changes to the terms
12.1 Mava may change the terms with 30 days' written notice by email to the Client's administrators. A Client that does not accept a change may terminate as of the effective date. Continued use after the effective date constitutes acceptance.
13. General
13.1 Neither party is liable for failure caused by circumstances beyond its control (force majeure).
13.2 The Client may not assign the agreement without Mava's written consent. Mava may assign it to a group company or in connection with a transfer of the business.
13.3 Swedish law applies. Disputes are settled by Stockholm District Court.
Annex 1: Data Processing Agreement
This agreement is made between the Client (controller) and Mava (processor) under Article 28 of Regulation (EU) 2016/679 ("GDPR") and forms part of the Mava Terms of Service.
1. Subject matter, nature and purpose
Mava processes personal data on the Client's behalf to provide the service: collection, storage, structuring, automated reading, compilation, reminders, booking, documentation of interviews and continuous follow-up within the Client's security vetting, background checks and onboarding of candidates and employees. Processing lasts for the term and until deletion under section 9.
2. Categories of data subjects and data
Data subjects: candidates, employees, references and the Client's users.
Data: identity and contact details, personal identity number, identity documents, citizenship, employment and education history, certificates and licences, questionnaire answers, notes from security and reference interviews, bookings, logs.
Special categories and criminal-offence data: criminal-record extracts (Article 10 GDPR) uploaded by the candidate and verified by the Client with the Police; medical certificates (Article 9) for positions that require them; information candidates give in questionnaires and interviews about finances, relationships and contacts with foreign bodies. The Client is responsible for the lawful basis. Mava applies specific safeguards: these documents are stored encrypted, are never read by AI services, and are accessible only to the Client's authorised users.
3. Instructions
Mava processes personal data only on the Client's documented instructions. This agreement, the Terms of Service and the Client's settings in the service (processes, retention period, enabled features) constitute the instructions. Mava informs the Client if, in Mava's opinion, an instruction infringes the GDPR.
4. Confidentiality
Mava staff with access to personal data are bound by contractual confidentiality. Access is granted only to the extent required for operation, troubleshooting and Client-requested support, and is logged.
5. Security measures
Mava applies at least the following:
- Encryption in transit (TLS) and at rest: uploaded documents are encrypted individually (AES-256-GCM); personal identity numbers are encrypted at column level. Keys are stored separately from data.
- Operations in the EU (Germany) with an ISO 27001-certified provider, on a separate cloud server for Mava, with firewall, automatic security updates and key-only administrative access.
- Passwordless sign-in: one-time code by email or passkey (WebAuthn). Lock-out after repeated failed attempts.
- Full access and event log per candidate and user, available to the Client in the service.
- Automatic deletion per the period the Client sets; export and deletion on request.
- Daily encrypted backups to separate storage in the EU, with 14 daily, 8 weekly and 12 monthly versions, and regularly tested restores.
- Health monitoring with alerting.
- Identity documents are read by machine on Mava's own servers; criminal-record extracts and medical certificates are not read by machine at all; CVs and licences are read by an AI model running in AWS's regions within the EU, without the data being shared with the model provider or used for training.
6. Sub-processors
The Client gives general prior authorisation for the sub-processors in Annex 2. Mava notifies the Client's administrators by email at least 30 days before engaging a new sub-processor. The Client may object within that time; failing agreement, the Client may terminate with immediate effect at no cost for the remaining period. Mava imposes equivalent obligations on sub-processors and remains liable for their processing.
7. Transfers outside the EU/EEA
Data in the service, meaning what candidates and employees submit and what the Client documents, is stored and processed within the EU/EEA.
Some sub-processors in Annex 2 belong to groups with companies in the United States and may process certain data there: Cloudflare for forwarding email to Mava's support address, and Stripe for the Client's billing details. Such transfers rely on the European Commission's adequacy decision for companies certified under the EU–US Data Privacy Framework, or on the European Commission's standard contractual clauses. Mava's support address is not used to process information about candidates or employees on the Client's behalf. If such information is sent there anyway, Mava deletes the message and refers the sender to the service.
8. Assistance to the controller
Mava assists the Client with appropriate technical and organisational measures to respond to data-subject requests (access, rectification, erasure, portability: functions exist in the service), and with security, incident handling, impact assessments and prior consultation. Assistance beyond the service's built-in functions is charged at Mava's current hourly rate where caused by the Client's circumstances.
9. Deletion and return
On termination Mava deletes all personal data processed for the Client no later than 30 days after the Client's export period ends, including backups within their rotation (at most 12 months for monthly copies), unless law requires continued storage. During the term data is deleted per the Client's retention setting.
10. Personal data breach
Mava notifies the Client's administrators without undue delay and at the latest within 24 hours of becoming aware of a personal data breach affecting the Client's data, with the information the Client needs for its notification to the Swedish Authority for Privacy Protection, and supplements it as information becomes available.
11. Audit
Mava provides on request the documentation needed to demonstrate compliance with Article 28. The Client, or an independent auditor appointed by the Client and bound by confidentiality, may audit once per year with 30 days' notice at the Client's cost, in a manner that does not disrupt operations or expose other clients' data. The once-a-year limit and the 30-day notice do not apply where the audit is prompted by a personal data breach, by a justified suspicion that Mava is not complying with this agreement, or by a requirement from a supervisory authority. In those cases the audit takes place with the notice the circumstances allow.
12. Liability
Liability between the parties is governed by the Terms of Service. Each party bears administrative fines imposed on it.
Annex 2: Sub-processors
Effective 2026-09-24.
| Sub-processor | Established | Processing location | Function | Data |
|---|---|---|---|---|
| Hetzner Online GmbH | Germany | Germany/Finland (EU) | Servers, storage, backups | All service data, encrypted |
| Amazon Web Services EMEA SARL | Luxembourg | AWS's regions within the EU | AI reading of CVs and certificates | Contents of CVs and non-medical licences/certificates |
| Mailjet SAS (Sinch) | France | EU | Email delivery | Name, email address, message content |
| 46elks AB | Sweden | Sweden | SMS delivery | Name, phone number, message content |
| Cloudflare, Inc. | USA | Global network, including the USA | DNS and forwarding of email to hello@mava.solutions | Email sent to Mava's support address, while forwarded |
| Stripe Payments Europe Ltd | Ireland | EU and USA | Invoicing and card payment | The Client's billing details (not candidate data) |
Changes are notified under Annex 1 section 6. The current list is published at mava.solutions/en/terms.