Annex C — Data Processing Agreement (DPA)

Annex to the General Terms — SaaS Services Human Syntax AB

This Data Processing Agreement (“DPA”) governs Human Syntax AB’s processing of personal data in the role of data processor for the Customer, who is the data controller.

The DPA applies to all SaaS services where Human Syntax acts as processor, and service-specific information is in the associated appendices.

Appendices to this DPA:

• Appendix 1A — Record of Processing Vepino
• Appendix 2 — Subprocessor List
• Appendix 3 — Technical and Organisational Security Measures (TOMs)

1.1 In the role of data processor, the Supplier processes Personal Data on behalf of the Customer in delivery of the Service in accordance with the Agreement.

1.2 The DPA applies from the entry into force of the Agreement and for as long as the Supplier processes Personal Data on behalf of the Customer.

The following definitions apply in this DPA. Terms not defined have the meaning set out in GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council).

“Personal Data” means personal data as defined in Article 4(1) GDPR that the Supplier processes on behalf of the Customer under the Agreement.

“Standard Contractual Clauses” or “SCC” means the standard contractual clauses adopted by the EU Commission through Decision 2021/914.

“Applicable data protection legislation” means GDPR and other applicable data protection legislation, including national legislation of EU Member States.

“Third Country” means a country outside the European Economic Area (EEA).

“Subprocessor” means a third party engaged by the Supplier to process Personal Data on behalf of the Customer.

3.1 Nature and purpose: The Supplier processes Personal Data to provide the Service in accordance with the Agreement (collection, storage, use, analysis, organisation, transmission, erasure and similar processing).

3.2 Duration: Processing continues for as long as the Agreement is in force, and during the wind-down period that follows from §14.

3.3 Types of personal data and categories of data subjects: Specified per service in Appendix 1.

4.1 The Supplier processes Personal Data only in accordance with the Customer’s documented instructions. The Agreement, the Service’s functions and the Customer’s configuration choices in the Service together constitute the Customer’s documented instructions.

4.2 Additional instructions must be provided in writing and be consistent with the Agreement.

4.3 If, in the Supplier’s normal use of the Customer’s instructions, it becomes apparent to the Supplier that an instruction violates applicable data protection legislation, the Supplier shall without undue delay inform the Customer. The Supplier is not obliged to actively review or make a legal assessment of the Customer’s instructions.

4.4 If the Supplier is required under EU law or a Member State’s national law to process beyond the Customer’s instructions, the Supplier shall inform the Customer of this requirement, unless such information is prohibited by law.

5.1 The Customer warrants that the data has been collected lawfully and that the Customer has legal basis to process it and to allow the Supplier to process it.

5.2 Choice of legal basis in the Service: Where applicable (including Vepino), the Service requires the Customer to specify the legal basis for each processing (consent, contract or legitimate interests under Article 6 GDPR). The Customer is responsible for the chosen basis being correct and lawfully applicable and for fulfilling related requirements (e.g. documented consent, balancing of interests or information to Data Subjects).

5.3 The Customer is responsible for informing Data Subjects in accordance with Articles 13–14 GDPR and for handling consents where required.

5.4 The Customer is responsible for the accuracy of the data entered into the Service.

5.5 Special categories and criminal data: If the Customer chooses to collect personal data in special categories (Article 9 GDPR) or relating to criminal convictions (Article 10) through the Service — e.g. through custom fields for food allergies, health information or similar — the Customer is solely responsible for fulfilling the special requirements applicable to such processing. This includes obtaining explicit consent from Data Subjects under Article 9(2)(a) or another applicable basis, and providing correct information under Articles 13–14.

6.1 The Supplier ensures that persons with access to Personal Data have entered into confidentiality undertakings or are subject to statutory professional secrecy.

6.2 Access to Personal Data is limited to personnel who need access to perform their work duties.

7.1 The Supplier takes appropriate technical and organisational measures to ensure a security level adapted to the risk, in accordance with Article 32 GDPR.

7.2 Appendix 3 specifies the technical and organisational measures taken by the Supplier at the entry into force of the Agreement. The Supplier may update the measures as long as the security level is not materially reduced.

8.1 The Customer gives general approval for the Supplier to engage Subprocessors for processing of Personal Data.

8.2 Current Subprocessors are listed in Appendix 2. At the entry into force of the Agreement, the approved Subprocessors are those listed there.

8.3 On change or addition of a Subprocessor, the Supplier notifies the Customer at least 30 days in advance via email or via the Service. The list in Appendix 2 is kept current.

8.4 The Customer has the right within 30 days from the notification to object in writing to a new Subprocessor on objective grounds. If the Supplier and the Customer cannot find a solution, the Customer has the right to terminate the Agreement without cost as of the day the new Subprocessor is put into use.

8.5 The Supplier enters into written agreement with each Subprocessor with at least equivalent data protection commitments as in this DPA.

8.6 The Supplier is responsible to the Customer for Subprocessors’ processing as for its own.

9.1 The Service contains functions that enable the Customer to handle Data Subjects’ rights (access, rectification, erasure, data portability, etc.) under Articles 15–22 GDPR.

9.2 If a Data Subject contacts the Supplier directly with a request, the Supplier shall without undue delay forward the request to the Customer. The Supplier may acknowledge receipt to the Data Subject and inform them that the request is being forwarded to the Customer, but refrains from responding substantively unless the Customer has explicitly authorised it.

9.3 The Supplier assists the Customer reasonably through the Service’s functions. For extensive or repeated assistance beyond what the Service directly enables, the Supplier is entitled to reasonable compensation at the prevailing hourly rate.

10.1 The Supplier reports Personal Data Breaches to the Customer without undue delay after they have become known to the Supplier, however no later than 48 hours.

10.2 The report shall include, to the extent the information is available:

• description of the incident and its nature
• categories and approximate number of Data Subjects and records affected
• likely consequences
• measures taken or proposed
• contact person at the Supplier for further information

10.3 The Supplier assists the Customer with information reasonably needed for the Customer’s own notification obligation under Articles 33–34 GDPR.

11.1 The Supplier assists the Customer with any data protection impact assessment (DPIA) and with prior consultation with the supervisory authority, to the extent reasonably needed and relating to processing performed by the Supplier.

11.2 For extensive assistance, the Supplier is entitled to reasonable compensation at the prevailing hourly rate.

12.1 The Supplier may transfer Personal Data to Third Countries only if a valid transfer mechanism under Chapter V GDPR is in place.

12.2 At the entry into force of the Agreement, the following transfer mechanisms apply for Personal Data to Third Countries:

• EU-U.S. Data Privacy Framework (primary)
• Standard Contractual Clauses under EU Commission Decision 2021/914 (Module 3) as backup

Current Subprocessors covered by Third Country Transfers, their location and the applicable mechanism per Subprocessor are stated in Appendix 2.

12.3 As the applicable transfers take place under the DPF adequacy decision, no separate Transfer Impact Assessment is required from the Customer. On lapse of the DPF, transfers revert to SCC and the Supplier provides TIA information on request.

12.4 If a transfer mechanism ceases to be valid, the Supplier without undue delay takes measures to restore a lawful transfer basis or cease the transfer.

13.1 The Customer has the right to verify the Supplier’s compliance with the DPA.

13.2 Verification takes place primarily through written requests, which the Supplier responds to within a reasonable time (target value: 30 days), and through provision of any relevant certifications or third-party reports the Supplier holds.

13.3 Physical audit on site at the Supplier may be performed no more than once per calendar year, on at least 30 days’ notice, during normal business hours and without disrupting the Supplier’s operations. In case of a Personal Data Breach at the Supplier, the Customer may, on objective grounds, request additional audit beyond this cap.

13.4 The Customer bears its own costs for audit. For extensive audits requiring substantial work from the Supplier, the Supplier is entitled to reasonable compensation at the prevailing hourly rate.

14.1 On termination of the Agreement, the Supplier erases or returns all Personal Data according to the Customer’s written choice, unless continued retention is required under EU law or a Member State’s national law.

14.2 If the Customer has not stated a choice within 30 days after termination of the Agreement, the Personal Data is erased.

14.3 The Customer’s read and export access under §8.5 of the General Terms — SaaS Services applies in parallel during this period.

14.4 Total erasure takes place within 90 days of termination of the Agreement, with the following exceptions: statutory retention requirements (accounting, tax, legal proceedings) and backups subject to a rotation schedule that are overwritten within a reasonable time.

14.5 The Supplier confirms erasure in writing on the Customer’s request.

15.1 The limitation of liability in §12 of the General Terms — SaaS Services applies also to breach of this DPA, including any administrative fines from the supervisory authority.

15.2 Clarification on fines from supervisory authority: If a supervisory authority imposes an administrative fine on the Customer or the Supplier for a violation to which both parties contributed, the parties shall allocate responsibility according to their respective share of the negligence in accordance with Article 82 GDPR.

15.3 Nothing in this DPA affects Data Subjects’ rights to make claims directly against either party under GDPR.

16.1 In the event of conflict between this DPA and the General Terms — SaaS Services or any other part of the Agreement, this DPA takes precedence in matters relating to personal data processing.

17.1 Swedish law applies to this DPA, with due regard to mandatory provisions in applicable data protection legislation.

17.2 Disputes are resolved as stated in the General Terms — SaaS Services (Helsingborg District Court as first instance).

18.1 Amendments to the DPA are made as stated in §18 of the General Terms (30 days’ notice).

18.2 The DPA replaces all prior agreements between the parties regarding personal data processing under the Service.