Data Processing Agreement

Version 2.7 | Last updated: 2026-09-30 | Effective from: 2026-10-31

Changes in version 2.7

• Background checks (Schedule 2): identity verification, references where applicable and a written confidentiality undertaking.
• Logs (3.3, Schedule 2): kept for 90 days; users and client applications cannot modify or delete them.
• Backups (Schedule 2): daily, encrypted and stored separately from the live database, within the EU.
• Deletion (3.6): Customer Data is deleted within 30 days after termination, or earlier on request; deleted data may remain in encrypted backups until they expire.
• Bank data (2.3, Schedule 3): account details, balances and transactions, where the Customer has connected a bank.
• Amendments (14): new versions are announced at least 30 days in advance, with the right to object and terminate the affected services.
• Other: clarifications on encryption, access, security testing, sub-processor data locations and absence data from HR systems.

Parties

Data Processor: Fintower AB
Organisation number: 559468-3913
Address: Stampgatan 14, 411 01 Göteborg, Sweden
(hereinafter "Fintower" or "Processor")

Data Controller: The Customer entity that has entered into a subscription agreement with Fintower
(hereinafter "Customer" or "Controller")

1. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the GDPR.

"Processing" means any operation performed on Personal Data, as defined in Article 4(2) of the GDPR, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, or erasure.

"Controller" means the natural or legal person which determines the purposes and means of Processing of Personal Data. In this DPA, the Controller is the Customer.

"Processor" means the natural or legal person which Processes Personal Data on behalf of the Controller. In this DPA, the Processor is Fintower.

"Sub-processor" means any entity engaged by the Processor to Process Personal Data on behalf of the Controller, as defined in Article 28(2) of the GDPR.

"Data Subject" means the individual to whom Personal Data relates.

"GDPR" means Regulation (EU) 2016/679.

"Supervisory Authority" means an independent public authority designated by a Member State.

"Security Incident" means any confirmed or suspected breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Data.

"Customer Data" means all Personal Data uploaded to, stored on, or Processed by the Service on the Customer's behalf.

"Service" means the AI-powered SaaS platform for business planning, performance monitoring and reporting provided by Fintower.

"Data Protection Act" means the Swedish Data Protection Act (Dataskyddslagen, 2018:218).

2. Scope and purpose of processing

2.1 Purpose and instruction

Fintower shall Process Personal Data solely for the purpose of providing the Service as described in the subscription agreement. Fintower shall Process Personal Data only on the documented instructions of the Customer, unless required to do so by EU law or Swedish law.

2.2 Categories of data subjects

• Employees and contractors of the Customer
• Clients and suppliers of the Customer (indirectly, as named parties in financial records, invoices, payroll data, and accounting records)

2.3 Categories of Personal Data

• Names and identification numbers of individuals
• Financial transaction data and records
• Payroll data (including salary and benefits information), only where the Customer has connected a payroll system
• Bank account data (account details, balances and transactions), only where the Customer has connected a bank through Enable Banking
• Invoice references and financial document data
• Contact details of the Customer's counterparties (email addresses, telephone numbers)
• User account information (usernames, email addresses)

2.4 Duration of processing

Processing shall continue for the duration of the subscription agreement. Upon termination, Personal Data shall be handled in accordance with Section 3.6 of this DPA.

3. Processor obligations

3.1 Instruction-only processing

Fintower shall Process Personal Data only on documented instructions from the Controller. If Fintower is required to Process Personal Data by law, it shall, to the extent permitted by law, notify the Controller without undue delay.

3.2 Confidentiality

Fintower shall ensure that any person authorised to Process Customer Data is placed under a binding obligation of confidentiality or is otherwise under an appropriate legal obligation of confidentiality.

3.3 Technical and organisational security measures

Fintower shall implement and maintain appropriate technical and organisational security measures to protect Personal Data in accordance with Article 32 of the GDPR. Specific measures include:

• Encryption in transit: TLS 1.2 minimum for all data in transit
• Encryption at rest: AES-256 encryption of stored Personal Data in Fintower's databases and storage
• Access controls: Role-based access control; principle of least privilege; multi-factor authentication for administrative access to production infrastructure
• Tenant isolation: Logical separation of Customer Data; no cross-tenant data access
• Regular security reviews: Vulnerability assessments; penetration testing
• Backup and recovery: Automated backups; tested and documented recovery procedures
• Personnel security: Confidentiality obligations; security awareness training
• Incident response: Documented incident response plan; 24-hour notification SLA
• Audit logging: Access and system logs retained for 90 days; users and client applications cannot modify or delete them, and write access is limited to restricted privileged roles

3.4 Assistance with data subject rights

Fintower shall assist the Controller by appropriate technical and organisational measures in fulfilling the Controller's obligation to respond to Data Subject rights requests, including requests for access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and objection (Art. 21).

3.5 Assistance with controller obligations

Fintower shall assist the Controller in ensuring compliance with Articles 32–36 of the GDPR, including assisting with DPIAs, breach notification, and making available all information necessary to demonstrate compliance.

3.6 Return or deletion of Personal Data

Upon termination, the Customer may request that Fintower either delete or return all Customer Data and Personal Data. Fintower deletes Customer Data within 30 days after termination, or earlier on the Customer's request, unless retention is required by law. Deleted data may remain in encrypted backups until those backups expire.

3.7 Compliance and audits

Fintower shall make available all information necessary to demonstrate compliance with this DPA and the GDPR, and shall allow for audits and inspections conducted by the Controller or an independent auditor designated by the Controller, subject to the following conditions:

• The Controller shall provide at least 15 business days' written notice before any audit
• Audits shall be limited to once per calendar year, unless required by a Supervisory Authority
• The auditor shall sign a non-disclosure agreement acceptable to Fintower before accessing any systems or documentation
• Audits shall be conducted during normal business hours and shall not unreasonably disrupt Fintower's operations

3.8 Notification of security incidents

Fintower shall notify the Controller without undue delay, and in any event within 24 hours of becoming aware of a confirmed or suspected Security Incident. Notification shall include:

• A description of the nature and scope of the Security Incident, including the systems and services affected
• The categories of Personal Data concerned and the approximate number of Data Subjects and records affected
• The likely consequences of the Security Incident for the affected Data Subjects
• The measures taken or proposed to address the Security Incident, including measures to mitigate its adverse effects

4. Controller obligations

4.1 Warranty and authority

The Customer warrants that it has obtained a lawful basis for Processing the Personal Data in accordance with the GDPR and that it is authorised to instruct Fintower to Process Personal Data on its behalf.

4.2 Accuracy and legality of Customer Data

The Customer is responsible for ensuring that all Customer Data uploaded to the Service is accurate, complete, and lawfully obtained.

4.3 Data subject information

The Customer shall ensure that all Data Subjects are informed of the Processing of their Personal Data in accordance with Articles 13 and 14 of the GDPR.

5. Sub-processors

5.1 General authorisation

The Customer grants general authorisation for Fintower to engage Sub-processors to assist in providing the Service.

5.2 List of current sub-processors

A list of current approved Sub-processors is set out in Schedule 1. The Customer may request an up-to-date list at any time.

5.3 Changes to sub-processor list

Fintower shall notify the Customer of any addition or removal of Sub-processors with at least 30 days' prior written notice. The Customer may object within 14 days of receiving notification. If the parties cannot reach agreement, the Customer may terminate the affected subscription services without penalty.

5.4 Liability for sub-processors

Fintower shall remain fully liable to the Customer for the performance of any Sub-processor's obligations under this DPA.

6. International data transfers

6.1 EU-based infrastructure

Fintower's primary infrastructure is based within the European Union.

6.2 Transfers outside the EEA

For any transfers outside the EEA, Fintower shall ensure an adequate level of data protection by relying on:

• EU–US Data Privacy Framework (DPF): For transfers to the United States (Google LLC and Microsoft Corporation)
• Standard Contractual Clauses (SCCs): For other transfers outside the EEA (Module 3 – Processor-to-Processor transfers)

6.3 No unauthorised transfers

Fintower shall not transfer Customer Data to any jurisdiction outside the EEA without first updating Schedule 1 and notifying the Customer with at least 30 days' prior notice.

7. Artificial intelligence and model training

7.1 AI-powered analysis features

Fintower provides AI-powered financial analysis features using Anthropic Claude models via Amazon Bedrock in the AWS EU region. Customer Data is used to generate insights, forecasts, and analyses specific to the Customer's business.

7.2 Tenant isolation

Customer Data is Processed solely within the Customer's isolated environment and tenant. No cross-tenant data access is permitted.

7.3 No model training

Customer Data is never used to train, fine-tune, retrain, or otherwise improve any artificial intelligence or machine learning model, whether operated by Fintower, Amazon, or any other Sub-processor, without the prior explicit written consent of the Customer.

7.4 AI-generated outputs

All AI-generated outputs, analysis, and recommendations are based exclusively on the Customer's own Customer Data and are generated in real time within the Customer's isolated environment. No outputs are shared across Customers.

8. Confidentiality

Both Fintower and the Customer shall keep each other's confidential information strictly confidential. Neither party shall disclose the other party's confidential information to any third party without prior written consent, except as required by law or to professional advisors bound by confidentiality obligations.

9. Security incidents

9.1 Notification obligation

Fintower shall notify the Controller without undue delay upon becoming aware of any confirmed or suspected Security Incident affecting Customer Data.

9.2 Content of notification

Each notification shall include a description of the nature and scope of the incident, the categories and approximate volume of data affected, likely consequences, and measures taken or proposed to address the incident.

9.3 Incident response plan

Fintower maintains a documented incident response plan. Notification of Security Incidents follows Section 3.8.

10. Liability

Each party's liability under this DPA is subject to the limitations of liability set out in the main subscription agreement. Nothing in this DPA shall limit or exclude either party's liability for fraud, wilful misconduct, gross negligence, breach of confidentiality obligations, violation of data protection laws, or any liability that cannot be excluded by applicable law.

11. Term and termination

This DPA is effective as of the date of the subscription agreement and continues for its duration. This DPA terminates automatically upon termination of the subscription agreement. Upon termination, the Customer may request that Fintower delete or return all Customer Data in accordance with Section 3.6.

12. Governing law and dispute resolution

This DPA is governed by Swedish law, without regard to conflicts of law principles. Any dispute shall be resolved by the courts of Sweden, with the District Court of Gothenburg (Göteborgs tingsrätt) serving as the court of first instance.

13. Order of precedence

In the event of any conflict between this DPA and the subscription agreement, this DPA shall prevail with respect to the Processing of Personal Data.

14. Amendments

14.1 Fintower may amend this DPA by publishing a new version on fintower.ai and notifying the Customer in writing, including by email, at least 30 days before the new version takes effect. The notice shall state the date from which the new version applies and where the changes are described.

14.2 The Customer may object to a change by replying to the notice before the new version takes effect. If the parties cannot reach agreement, the Customer may terminate the affected subscription services without penalty with effect from that date.

14.3 Changes required by applicable law or by a supervisory authority may take effect with shorter notice where the law so requires.

14.4 Changes to the list of Sub-processors follow Section 5.3.

14.5 Where a written agreement signed by both parties sets out other terms for amending this DPA, that agreement prevails.

Schedule 1: Approved sub-processors

Enable Banking Oy was added to this list in version 2.5. It processes account data only for Customers who connect a bank account in the Service. Affected Customers are notified separately and may object within fourteen days in accordance with Section 5.3.

Schedule 2: Technical and organisational security measures

Security practices are informed by ISO 27001 principles.

Encryption

• In transit: TLS 1.2 or higher for all communications
• At rest: AES-256 encryption of Personal Data in Fintower's databases and storage

Access controls

• Role-based access control (RBAC)
• Multi-factor authentication (MFA) for administrative access to production infrastructure
• Access and system logs retained for 90 days; users and client applications cannot modify or delete them, and write access is limited to restricted privileged roles

Tenant isolation

• Logical separation of Customer Data
• No cross-tenant access
• Encryption at rest applied at the storage layer using AES-256

Vulnerability management

• Regular security reviews and vulnerability assessments
• Prompt security patch management

Backup and recovery

• Automated, regular backups
• Tested recovery procedures
• Automated, encrypted daily backups stored separately from the live database, within the EU

Personnel security

• Proportionate background checks (identity verification, references where applicable, and a confidentiality undertaking) for employees with access to Personal Data
• Confidentiality agreements
• Regular security awareness training

Incident response

• Documented incident response plan
• 24-hour notification SLA
• Post-incident review process

Schedule 3: Details of processing

Subject matter: Provision of an AI-powered SaaS platform for business planning, performance monitoring and reporting.

Duration: For the term of the subscription agreement.

Nature and purpose: Fintower shall store, organise, structure, display, analyse, and manipulate Customer Data to provide planning, forecasting, budgeting, and financial analysis capabilities.

Type of Personal Data:

• Names and identification numbers
• Financial transaction data and records
• Payroll data (salary, benefits, deductions), only where the Customer has connected a payroll system
• Bank account data (account details, balances and transactions), only where the Customer has connected a bank through Enable Banking
• Invoice references and financial document data
• Contact details (email addresses, telephone numbers)
• User account information (usernames, email addresses, IP addresses)

Categories of data subjects:

• Employees and contractors of the Customer
• Clients and suppliers of the Customer

Special categories: Fintower does not intentionally Process any special categories of Personal Data (Article 9, GDPR). Where the Customer connects an HR or payroll system that transmits absence data, that data may include health-related information, and the Customer is responsible for the legal basis for its Processing. The Customer warrants that it will not upload any special categories of Personal Data without obtaining prior written consent of Fintower.