Agency Addendum to the Data Processing Agreement

Version 1.0 | Last updated: 2026-10-06

This is a translation of the Swedish original, Byråtillägg till Personuppgiftsbiträdesavtalet. If the two differ, the Swedish original governs.

This addendum applies together with the Data Processing Agreement (the "DPA") between the Agency and the Provider for personal data in the Clients' environments, and takes precedence over the DPA in the event of conflict.

1. Roles

The Client is the controller, the Agency a processor for the Client, and the Provider a sub-processor for the Agency. The Agency certifies that its engagement agreement with each Client permits the Provider as a sub-processor, imposes obligations on the Agency that at least correspond to those in the DPA, and that the Client has been informed of the Provider and its sub-processors in the sub-processor list (Schedule 1) of the DPA. The Provider may ask to see the relevant parts of the engagement agreement.

2. Instructions

The Provider processes on the Agency's documented instructions, given on behalf of the Client. The fact that the Client's users use the Service is not an instruction from the Client to the Provider.

3. The Provider's own purposes

The Provider is the controller for metering, invoicing, access history and product analytics under the Privacy Policy. These do not cover the content of the Client's data.

4. Incidents

Notice to the Agency without undue delay and no later than within 72 hours, one per affected Client, with the content required by the DPA. The Agency passes the notice on to the Client without undue delay. The Provider assists the Agency and, through the Agency, the Client.

5. Sub-processors

The Agency's general authorisation also applies on behalf of the Clients. Notice at least 30 days in advance; the Agency passes it on within seven (7) days and puts forward Clients' objections within the DPA's 14 days. Unresolved objection: the Agency may remove the Client, in which case section 8 applies.

6. Data subjects' rights and audit

Handled by the Client with the assistance of the Agency and, at the Agency's request, the Provider. The right of audit is exercised by the Agency, which may share the result with the Client.

7. Logging

Access to a Client's environment is logged per person, including the Agency's and the Provider's staff, and kept for at least 90 days. The Client's users can read the history in the Service.

8. Deletion

Thirty (30) days after a Client has been removed or the Agency Agreement has ended, the Client's environment is deleted under the DPA. During those days, the Client's takeover period under section 7 of the Agency Terms, the Client is the controller with the Provider as processor directly on the DPA's terms. Before then, the Agency may export what it needs for its documentation obligations.

9. Suspension

Suspension under section 6 of the Agency Terms is not deletion; the DPA and this addendum apply in full during suspension.

10. AI

The DPA's provisions on AI, tenant isolation and the prohibition on model training apply to the Clients' data and bind sub-processors.

See also the Agency Terms and the Agency Price List.