Data Processing Agreement

1. Background and aim

1.1 Under the Agreement (as defined in the GTCs), Abundly provides the Services to the Subscriber. In performing the Agreement, Abundly will process personal data contained in Subscriber Content on behalf of the Subscriber. With respect to such personal data, the Subscriber acts as controller and Abundly acts as processor.

1.2 This DPA forms part of the Agreement. In the event of any conflict between this DPA and any other part of the Agreement in respect of matters relating to the processing of personal data, this DPA shall prevail.

1.3 This DPA aims to ensure that the processing of personal data is carried out in accordance with applicable data protection legislation, including the requirements of Article 28(3) of the GDPR.

1.4 The types of personal data and the categories of data subjects are set out in Appendix 1.

1.5 The Subscriber determines, through its configuration and use of the Services (including the data sources, integrations, Agents and features it enables), which personal data within the scope of Appendix 1 is actually processed.

1.6 This DPA does not apply to personal data that Abundly processes as a controller for its own purposes, namely (a) account, registration, billing and contact information relating to the Subscriber and its administrators and end users; (b) Usage Data; and (c) personal data that Abundly needs to process to comply with its legal obligations or to protect the security and integrity of the Services. Abundly processes such personal data in accordance with its privacy policy and applicable data protection legislation.

2. Definitions

2.1 Capitalised terms used but not defined in this DPA have the meanings given in the GTCs, including "Agent", "Agreement", "Effective Date", "Enterprise Agreement", "Input", "Output", "Sensitive Personal Data", "Services", "Subscriber", "Subscriber Content", "Term", "Third-Party Services" and "Usage Data". The terms "controller", "processor", "data subject", "personal data", "personal data breach", "processing" and "supervisory authority" have the meanings given in Article 4 of the GDPR. In addition, the following definitions apply:

• "Applicable data protection legislation" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "GDPR"), the Swedish Act (2018:218) with Supplementary Provisions to the GDPR, the Swedish Ordinance (2018:219) with Supplementary Provisions to the GDPR, and any other laws and regulations supplementing or replacing the foregoing as may be in force from time to time.
• "Documented Instructions" has the meaning given in clause 4.3.
• "Standard Contractual Clauses" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission by Implementing Decision (EU) 2021/914, as amended or replaced from time to time.
• "Sub-processor" means a natural or legal person, public authority, agency or other body engaged by Abundly to process personal data on behalf of the Subscriber.
• "Sub-Processor List" has the meaning given in clause 7.1.
• "Third country" means a state that is not a member of the European Union (EU) or a party to the European Economic Area (EEA) agreement.

3. The Subscriber's obligations

3.1 The Subscriber is responsible for the lawfulness of the processing of personal data that it submits to, or makes available through, the Services. This includes ensuring that it has a legal basis for the processing, providing information to data subjects, and obtaining data subjects' consent where required.

3.2 The Subscriber shall ensure that its Documented Instructions comply with applicable data protection legislation.

3.3 The Services are not specifically designed for the processing of Sensitive Personal Data or personal data relating to criminal convictions and offences. Where the Subscriber nevertheless submits such data as Input, or configures an Agent to process such data, the Subscriber is responsible for ensuring that the processing is permitted under Articles 9 or 10 of the GDPR, and for assessing whether the security measures described in clause 5 are appropriate for that data.

4. Abundly's obligations

4.1 Abundly shall ensure that all processing of personal data is carried out in accordance with the purposes of this DPA, the GDPR, the Swedish supplementary data protection legislation, and other applicable laws, regulations and industry standards. Abundly shall keep itself informed of data protection legislation and amendments to it.

4.2 Abundly, and the persons working for it, may only process personal data in accordance with the Documented Instructions, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which Abundly is subject. In such a case, Abundly shall inform the Subscriber of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

4.3 The Subscriber's documented instructions to Abundly for the processing of personal data consist of (a) the Agreement, including this DPA and Appendix 1; (b) the Subscriber's configuration and use of the Services, including the Agents, integrations and features it enables; and (c) any other written instructions from the Subscriber that are consistent with the Agreement and that Abundly has accepted in writing (together, the "Documented Instructions"). Abundly shall immediately inform the Subscriber if, in its opinion, an instruction infringes applicable data protection legislation or is vague, erroneous or missing, and await new instructions.

4.4 If a data subject, the Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten), any other competent authority or any other third party requests information from Abundly concerning the processing of personal data under this DPA, Abundly shall refer the request to the Subscriber. Abundly may not disclose personal data or other information about the processing without the Subscriber's express approval, unless required to do so by Union or Member State law, in which case clause 4.2 applies correspondingly.

4.5 Abundly shall support the Subscriber in providing information requested by a supervisory authority, any other competent authority or a data subject, so that the Subscriber can fulfil its obligation to respond to requests to exercise data subjects' rights under Chapter III of the GDPR.

4.6 Abundly shall without delay inform the Subscriber of any contact from a supervisory authority or other competent authority that concerns, or may be of importance for, the processing of personal data. Abundly is not entitled to represent the Subscriber or act on its behalf towards any supervisory authority or other third party.

4.7 Abundly shall assist the Subscriber in performing its obligations under Articles 32–36 of the GDPR (security of processing, personal data breach notifications, data protection impact assessments and prior consultation), considering the nature of the processing and the information available to Abundly.

4.8 Abundly shall make available to the Subscriber all information necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits, including inspections, conducted by the Subscriber or an independent auditor mandated by the Subscriber, as follows:

(a) Abundly shall, on request, make available a description of its technical and organisational measures, its current ISO 27001 certificate and reasonable written answers to the Subscriber's security questionnaires. The Subscriber agrees that such information will normally be sufficient to demonstrate Abundly's compliance with this DPA.

(b) Where the information under (a) is not sufficient to demonstrate compliance, where an audit is required by a competent supervisory authority, or following a confirmed personal data breach, the Subscriber may conduct an audit, including an inspection. Such audits shall be conducted no more than once per twelve-month period (unless required by a competent supervisory authority or following a confirmed personal data breach), on no less than thirty (30) days' prior written notice, during normal business hours and in a manner that minimises disruption to Abundly's operations. Any auditor shall be bound by confidentiality obligations and shall not be a competitor of Abundly.

(c) Each party shall bear its own costs in connection with an audit. Abundly may charge the Subscriber reasonable costs for time spent supporting an audit under (b) in excess of one (1) business day, unless the audit is required by a competent supervisory authority, follows a confirmed personal data breach, or reveals a material breach of this DPA by Abundly.

4.9 Abundly shall notify the Subscriber without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a personal data breach. The notification shall be sent to the email address associated with the Subscriber's account and shall, to the extent then available, contain the information referred to in Article 33(3) of the GDPR.

5. Security

5.1 Abundly shall, during the term of this DPA, maintain appropriate security for the personal data and protect it against destruction, alteration, unauthorised distribution and unauthorised access.

5.2 Abundly shall, in accordance with Article 32 of the GDPR and the Documented Instructions, take the technical and organisational measures required to protect the personal data.

5.3 A description of the technical and organisational measures implemented by Abundly is set out in Appendix 3.

5.4 The measures shall ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risks of varying likelihood and severity for the rights and freedoms of natural persons, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

5.5 The Subscriber may verify that Abundly implements the security measures required under this clause in accordance with clause 4.8.

6. Confidentiality

6.1 Abundly shall limit access to personal data to individuals who need it to fulfil the obligations under the Agreement and shall ensure that persons authorised to process personal data have committed themselves to confidentiality.

6.2 Abundly shall ensure that all staff, consultants and others for whom it is responsible and who process the personal data are bound by confidentiality agreements. Abundly shall also enter into appropriate confidentiality agreements with its sub-processors.

6.3 Abundly shall not disclose to third parties information about the processing of personal data under this DPA, or any other information received under this DPA or in its role as processor. Abundly shall not process the personal data for its own purposes and, in accordance with clause 9.2 of the GTCs, shall not use it to train, fine-tune or otherwise improve any AI model.

6.4 The first sentence of clause 6.3 does not apply to (a) information which a party can show was generally known at the time of receipt, or (b) information which a party is obliged to disclose by law or to an authority.

6.5 The confidentiality obligations continue to apply after the termination of this DPA.

7. Sub-processors

7.1 Abundly may engage sub-processors. The Subscriber hereby grants Abundly a general authorisation to engage the sub-processors listed in the sub-processor list available at abundly.ai/subprocessors (the "Sub-Processor List") to process personal data in connection with the Services. Abundly shall inform the Subscriber of any intended addition or replacement of a sub-processor at least thirty (30) days before the new sub-processor begins to process personal data, by email to the address associated with the Subscriber's account, by notification within the Services, or by other reasonable means. Where a sub-processor must be replaced urgently to protect the security or continuity of the Services, for example because it stops providing its services or suffers a security incident, Abundly may engage a replacement before the notice period has expired, if it notifies the Subscriber as soon as possible. Clause 7.2 then applies correspondingly, except that the objection period runs from that notification, the parties shall seek a resolution within fifteen (15) days of any objection, and termination takes effect on the date stated in the termination notice.

7.2 The Subscriber may object to the engagement of a new sub-processor on reasonable grounds relating to data protection by notifying Abundly in writing within fifteen (15) days of receiving such notification. Abundly will then use reasonable efforts to address the Subscriber's concerns, for example by recommending a change to the Subscriber's configuration that avoids processing of personal data by the new sub-processor. If no resolution has been reached before the date on which the new sub-processor is to begin processing the Subscriber's personal data, either party may terminate the Agreement by written notice to the other with effect from that date or a later date stated in the notice. This is the Subscriber's sole remedy. Termination under this clause shall not constitute a breach of the Agreement or this DPA by either party, and neither party shall be liable to the other for any termination fee, compensation or damages arising from it. Notwithstanding clause 4 of the GTCs, the Subscriber shall not be obliged to pay fees for the period after termination, and Abundly shall refund any prepaid fees for that period. If the Subscriber does not object within the period set out above, the new sub-processor shall be deemed authorised.

7.3 A sub-processor that is not designated as a core sub-processor on the Sub-Processor List shall not process the Subscriber's personal data until the Subscriber activates the relevant feature. Such activation constitutes the Subscriber's express authorisation of that sub-processor, and no objection period as specified in clause 7.2 applies.

7.4 Each sub-processor shall, by written agreement, be required to perform the same data protection obligations as set out in this DPA. If a sub-processor fails to fulfil its obligations, Abundly remains fully liable to the Subscriber for the performance of the sub-processor's obligations.

7.5 Where the processing involves a transfer of personal data to a third country, Abundly shall ensure that the transfer complies with Chapter V of the GDPR, either because the third country (or, where applicable, the sub-processor's certification under a recognised framework) is covered by an adequacy decision of the European Commission, or because the transfer is subject to appropriate safeguards, such as the Standard Contractual Clauses entered into between Abundly and the relevant sub-processor. On request, Abundly shall inform the Subscriber of the transfer mechanism relied on for each sub-processor.

8. Remuneration

8.1 Abundly is not obliged to follow instructions that require changes to the Services as generally made available to its subscribers. If the Subscriber's instructions impose requirements regarding the processing of personal data that do not follow from Abundly's commitments under the Agreement, that Abundly could not reasonably have anticipated, and that cause Abundly additional costs, the Subscriber shall compensate Abundly for those costs, provided that Abundly has informed the Subscriber of the expected costs in advance.

9. Liability

9.1 Administrative fines imposed under Article 83 of the GDPR or equivalent provisions of applicable data protection legislation shall be borne by the party on which the fine is imposed.

9.2 Consistent with clause 3.4 of the GTCs, Abundly shall have no liability for any processing of personal data carried out by Third-Party Services selected and connected by the Subscriber through the Services, following transmission in accordance with the Documented Instructions. The Subscriber shall indemnify and hold Abundly harmless from any claims, losses or liabilities arising from or relating to such processing.

9.3 Subject to clause 9.1 and to the extent permitted by law, the limitations and exclusions of liability in clauses 7.2 and 7.3 of the GTCs apply to all liability under this DPA.

10. Consequences of termination

10.1 Until termination or expiry of the Agreement takes effect, the Subscriber may export Subscriber Content using the export functionality available in the Services or by request to support@abundly.ai.

10.2 Within ninety (90) days after termination or expiry of the Agreement, Abundly shall permanently delete all personal data processed under this DPA. If the Subscriber, before termination or expiry takes effect, requests in writing that the personal data be returned, Abundly shall instead return the personal data in a structured, commonly used and machine-readable format and thereafter delete it. On the Subscriber's request, Abundly shall confirm the deletion in writing. Personal data may be retained where retention is required by applicable law, in which case Abundly shall inform the Subscriber of the legal basis and duration of such retention.

10.3 Notwithstanding clause 10.2, copies of personal data held in backup systems shall be deleted in the ordinary course of Abundly's backup cycle, and in any event no later than nine (9) months after deletion from live systems for database backups and no later than 180 days for file backups. Until deleted, such copies remain subject to this DPA, shall be protected by the security measures set out herein, and shall not be restored or otherwise processed except where necessary for disaster recovery.

11. Term

11.1 This DPA applies from the Effective Date (or, if earlier, the date on which Abundly first processes personal data on behalf of the Subscriber) and for as long as Abundly processes personal data on behalf of the Subscriber, including after the termination or expiry of the Agreement.

12. Miscellaneous

12.1 Abundly may amend this DPA in accordance with the procedure for changes set out in clause 12.5 of the GTCs, which applies correspondingly to this DPA. Abundly shall not make any amendment that materially reduces the level of protection of personal data under this DPA, unless required by applicable law or by a decision of a competent supervisory authority or court. Updates to the Sub-Processor List are made in accordance with clause 7 and do not constitute amendments to this DPA.

12.2 Notices under this DPA shall be given in accordance with clause 12 of the GTCs. Notices to the Subscriber may be sent to the email address associated with the Subscriber's account. Security incidents and suspected personal data breaches relating to the Services shall be reported to security@abundly.ai.

12.3 This DPA is governed by Swedish law, and disputes arising in connection with it shall be resolved in accordance with clause 13 of the GTCs.

Appendix 1 – Instructions for the processing of personal data

1. Purposes of the processing

Abundly shall only process personal data under this DPA for the purpose of providing the Services under the Agreement.

2. Processing activities

The following processing activities may be carried out: collection, organisation, structuring, registration, storage, access, use, disclosure, making available, erasure or destruction, and creation of logs of the processing.

3. Categories of data subjects

• The Subscriber's administrators and end users of the Services
• Customers (including former customers)
• Employees (including former employees, interns and trainees)
• Family members of employees
• Prospective employees
• Vendors, suppliers, business partners and subcontractors (including their representatives)
• Other individuals whose personal data is contained in Input or who interact with Agents deployed by the Subscriber

4. Categories of personal data

• Contact and identification data: name, email address, telephone number, username, personal contact details, date of birth or age, gender, nationality
• Technical data: IP address, MAC address, cookie information, website history, geolocation information
• Customer and transaction data: customer ID, order number, tracking ID, buying history, payment history, purchasing tendencies, billing address, delivery address
• Employment data: time tracking and annual leave, salary, employment terms (including benefits), educational and training history, references or background checks, travel and expenses
• Family data: family information and family contact information
• Media and social data: photo, video and audio; social media information (account, history or similar)
• Input and Output exchanged with third-party AI models, and the associated processing logs

The categories above represent the maximum scope permitted under the Services. Actual processing is limited to the data sources, integrations and features the Subscriber has enabled in the Services. The processing of Sensitive Personal Data is subject to clause 3.3 of this DPA.

5. Places where the processing is carried out

The EU (hosting, databases and backups); and other countries, including the United States, as specified for each sub-processor in the Sub-Processor List.

6. Retention and deletion during the term

6.1 Personal data shall be deleted as soon as the purposes of the processing for which it was collected have been fulfilled.

6.2 Deletion of personal data on termination or expiry of the Agreement is governed by clause 10 of this DPA.

6.3 The Subscriber may delete personal data directly using the functionality of the Services. Where the Subscriber cannot do so, and following a request from a data subject, Abundly shall delete the relevant personal data within thirty (30) days of receiving the request from the Subscriber; backup copies may remain for the periods set out in clause 10.3 of this DPA. Requests shall be sent to support@abundly.ai.

7. Other data subject rights

Abundly has implemented the technical and organisational measures necessary to enable the Subscriber to comply with data subject rights within the time period specified in the GDPR.

Appendix 2 – Sub-processors

The current Sub-Processor List is available at abundly.ai/subprocessors.

Appendix 3 – Technical and organisational measures

Abundly maintains an information security management system certified under ISO/IEC 27001. The measures below apply to the Services and are reviewed at least annually.

1. Hosting and separation. The Services are hosted on Google Cloud Platform in the EU. No production systems or customer data are hosted on Abundly's premises. Production and non-production environments are separated, and customer workspaces are logically separated from each other.
2. Encryption. Data is encrypted in transit using TLS 1.2 or higher and encrypted at rest using AES-256.
3. Access control for users. Users sign in through Google, Microsoft Entra ID or one-time codes sent by email; Abundly stores no user passwords. Access within a workspace is role-based.
4. Access control for staff. Staff access follows least privilege and is role-based, with single sign-on and multi-factor authentication wherever possible. Access to production databases is limited to a small named group, and no direct connections from staff devices are permitted. Access rights are reviewed quarterly and revoked within three days after a person leaves.
5. Change management. Changes to production require approval by two engineers, are tested in a separate staging environment and are subject to automated dependency scanning. Credentials are never stored in source code.
6. Vulnerability management. Code dependencies, infrastructure and container images are scanned automatically, and the internet-facing perimeter is scanned every working day. Findings are remediated within set timelines by severity. An independent security assessment is carried out at least annually.
7. Monitoring and incidents. The Services are monitored continuously. Incidents are handled under a documented procedure with defined severity levels and post-incident review. Personal data breaches are notified in accordance with this DPA.
8. Backups and continuity. Databases are backed up continuously with point-in-time recovery, and files are backed up to separate storage in two EU regions. Database backups are kept for no more than nine months and file backups for no more than 180 days. Restoration and the business continuity and disaster recovery plan are tested at least annually.
9. Deletion. Deleted content is permanently removed from live systems within the periods set out in clause 10 and from backups when they expire.
10. Personnel and devices. Staff are bound by confidentiality obligations, complete security awareness training on joining and annually, and are background-checked where the law permits. Work devices must have disk encryption, screen lock, current updates and anti-malware, and compliance is monitored.
11. Sub-processors. Sub-processors are assessed and reviewed under a vendor management process. AI model providers may not use customer data to train their models and are configured for the shortest retention they offer, no longer than 30 days.