Data processing agreement

This Data Processing Agreement (the "DPA") governs the processing of Customer Personal Data by Observata Sweden AB ("Observata") on behalf of the Customer. It supports the Standard Web MCA, a negotiated Observata MCA and Customer Paper. It becomes binding when incorporated by a Governing Agreement or Order Form, or when separately executed by the parties.

1 Definitions

1.1 Applicable Data Protection Law. Means the data protection and privacy laws that apply to the relevant processing, including the GDPR, the UK GDPR and applicable national laws implementing or supplementing them.

1.2 Controller Processor and Personal Data. Have the meanings given by Applicable Data Protection Law. The terms include equivalent concepts under that law.

1.3 Customer Personal Data. Means Personal Data that Observata processes on behalf of Customer in connection with the Services. It excludes Personal Data for which Observata determines the purposes and means of processing as an independent Controller.

1.4 Governing Agreement. Means the Observata Master Customer Agreement or other master or customer agreement that governs the relevant Services and incorporates this DPA.

1.5 Personal Data Breach. Means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data processed by Observata.

1.6 Restricted Transfer. Means a transfer of Personal Data that requires an approved transfer mechanism under Chapter V of the GDPR, the UK GDPR or other Applicable Data Protection Law.

1.7 SCCs. Means the standard contractual clauses in the Annex to European Commission Implementing Decision (EU) 2021/914, as amended or replaced by the European Commission.

1.8 Sub-processor. Means a third party appointed by or for Observata to process Customer Personal Data on behalf of Customer.

2 Scope contracting paths and roles

2.1 Application. This DPA applies only to processing of Customer Personal Data by Observata as Processor or Sub-processor in providing the Services. It does not assume that every Service processes Personal Data; Schedule 1 and the applicable downstream documents identify the processing that actually occurs.

2.2 Contracting paths. This DPA may be incorporated into the Standard Web MCA, incorporated into a negotiated Observata MCA, incorporated into Customer Paper, or signed as a standalone agreement. A separate signature is not required where the DPA is validly incorporated.

2.3 Roles. Customer is the Controller or, where Customer processes Personal Data for another Controller, a Processor. Observata is the corresponding Processor or Sub-processor. Each party will comply with the obligations that Applicable Data Protection Law assigns to its role.

2.4 Independent Controller activities. Each party acts as an independent Controller for Personal Data it processes for its own account administration, contracting, billing, business communications, fraud prevention and legal compliance. This DPA does not govern those activities.

2.5 Narrow precedence. If this DPA conflicts with the Governing Agreement, this DPA prevails only to the extent necessary to resolve the conflict concerning processing of Customer Personal Data. It does not amend pricing, payment, intellectual property, service scope, general confidentiality, warranties or other commercial terms.

3 Processing and instructions

3.1 Processing details. The subject matter, duration, nature and purpose of processing, categories of Personal Data and Data Subjects are described in Schedule 1 and, where more specific, the Order Form, Service Agreement, Service Description or Project Specification.

3.2 Documented instructions. Observata will process Customer Personal Data only on Customer's documented instructions, including the Governing Agreement, Order Form, Service Agreement, Service Description, Project Specification, authorised service requests and other written instructions consistent with those documents, unless Applicable Data Protection Law requires otherwise.

3.3 Legal requirement. If law requires Observata to process Customer Personal Data beyond Customer's documented instructions, Observata will inform Customer before processing unless the law prohibits notice on important grounds of public interest.

3.4 Unlawful instruction. Observata will inform Customer without undue delay if, in Observata's reasonable opinion, an instruction infringes Applicable Data Protection Law. Observata may suspend the affected processing until the parties resolve the issue.

3.5 Changed instructions. An instruction that materially changes the agreed scope, security requirements, delivery method or cost is subject to the change process in the Governing Agreement or Order Form. Observata need not perform the changed processing until the parties agree the operational and commercial impact.

4 Customer obligations

4.1 Lawfulness and transparency. Customer is responsible for the lawfulness of Customer Personal Data, its instructions and disclosures to Observata, including any required legal basis, notices, consents and authorisations.

4.2 Data quality and minimisation. Customer will provide accurate Customer Personal Data that is relevant and limited to what is necessary for the Services, configure Customer-controlled settings appropriately and avoid submitting data not required for the agreed processing.

4.3 Sensitive and regulated data. Customer will not provide special-category data, criminal-offence data, formally classified information or other highly regulated data unless the applicable Order Form or Project Specification specifically identifies the data and the parties agree appropriate safeguards.

4.4 Customer as Processor. Where Customer is a Processor, Customer warrants that the relevant Controller has authorised Customer to appoint Observata and issue the documented instructions. Customer will communicate any Controller instruction or restriction relevant to Observata's processing.

5 Personnel and confidentiality

5.1 Confidentiality. Observata will ensure that persons authorised to process Customer Personal Data are bound by confidentiality obligations or an appropriate statutory duty and receive relevant privacy and security instructions.

5.2 Access control. Observata will limit access to Customer Personal Data to personnel and Sub- processors who need access to provide, secure or support the Services and will remove access when it is no longer required.

6 Security

6.1 Appropriate measures. Taking account of the state of the art, implementation cost, processing context and risks to individuals, Observata will maintain technical and organisational measures appropriate to the risk as required by Article 32 GDPR. The current measures are described in Schedule 2.

6.2 Security evolution. Observata may update its technical and organisational measures to reflect changes in technology, risk and the Services, provided that the updates do not materially reduce the overall protection of Customer Personal Data during the relevant Order term.

6.3 Customer requirements. Observata will comply with Customer security requirements that are documented in advance and reasonably applicable to the Services. Requirements that materially change scope, delivery or cost must be agreed in the Order Form or Project Specification.

7 Personal Data Breaches

7.1 Notification. Observata will notify Customer without undue delay after becoming aware of a Personal Data Breach and will use the notice route in the Governing Agreement or another operational security contact designated by Customer.

7.2 Available information. The notice will describe, to the extent reasonably available, the nature of the breach, affected categories of Data Subjects and Personal Data, approximate number of affected records or individuals, likely consequences, measures taken or proposed, and an appropriate contact. Observata may provide information in phases as it becomes available.

7.3 Response cooperation. Observata will take reasonable steps to contain, investigate and remediate the Personal Data Breach and will provide reasonable information needed for Customer's legally required notifications. Notice does not constitute an admission of fault or liability.

8 Data Subject rights and compliance assistance

8.1 Requests from individuals. Taking account of the nature of the processing, Observata will provide reasonable assistance through appropriate technical and organisational measures so Customer can respond to requests to exercise Data Subject rights.

8.2 Direct requests. If Observata receives a request relating to Customer Personal Data directly from a Data Subject, it will notify Customer without undue delay and will not respond substantively unless Customer authorises it or law requires it.

8.3 Articles 32 to 36. Taking account of the nature of processing and information available to Observata, Observata will reasonably assist Customer with security obligations, breach notifications, data protection impact assessments and prior consultations under Articles 32 to 36 GDPR or equivalent Applicable Data Protection Law.

8.4 Assistance costs. Customer will reimburse Observata's reasonable fees and costs for material assistance beyond standard Service functionality where permitted by law, unless the assistance is required because Observata breached this DPA. Observata will give advance notice of material chargeable work where practicable.

9 Sub-processors

9.1 General authorisation. Customer gives Observata general written authorisation to appoint Sub processors for the Services. Observata will maintain a current register at https://observata.com/observata-trust-centre/sub-processor-directory/. The register will identify each Sub-processor's identity, processing function and processing location or transfer basis where relevant.

9.2 Advance notice. Observata will give Customer at least fourteen days' advance notice of an intended addition or replacement of a Sub-processor where reasonably practicable. If an urgent change is necessary for security, legal compliance or service continuity, Observata may give shorter advance notice and will explain the reason. Customer's objection rights continue to apply.

9.3 Objection. Customer may object during the notice period on reasonable and documented grounds relating to protection of Customer Personal Data. The parties will discuss the objection in good faith and consider a commercially reasonable mitigation or alternative.

9.4 Unresolved objection. If the parties cannot resolve a legitimate objection, Observata may decide not to use the proposed Sub-processor, offer a reasonable alternative, cease the affected processing or permit Customer to terminate the affected Service. Any financial consequences are governed by the Governing Agreement and the relevant Order Form.

9.5 Flow-down and responsibility. Observata will impose on each Sub-processor data protection obligations that are no less protective in substance than the obligations applicable to that processing under this DPA. Observata remains fully liable to Customer for the performance of the Sub processor's data protection obligations to the extent required by Applicable Data Protection Law.

10 International transfers

10.1 Lawful mechanism. Observata will not make a Restricted Transfer unless it uses an applicable lawful mechanism, such as an adequacy decision, the SCCs, the UK Addendum, the UK International Data Transfer Agreement or another mechanism recognised by Applicable Data Protection Law.

10.2 European Union SCCs. Where a Restricted Transfer directly between the parties requires the SCCs, the parties enter into the SCCs by reference with the selections in Schedule 3. Module Two applies when Customer is a Controller and Observata is a Processor; Module Three applies when Customer is a Processor and Observata is a Sub-processor.

10.3 United Kingdom transfers. For a Restricted Transfer governed by the UK GDPR, the parties will use the then-current ICO-approved UK Addendum to the SCCs where the SCCs otherwise apply, or the then-current ICO-approved International Data Transfer Agreement where more appropriate. Schedule 1 and Schedule 2 supply the corresponding processing and security information to the extent applicable.

10.4 Mandatory text. Nothing in this DPA modifies the mandatory text of an incorporated transfer mechanism. If this DPA conflicts with that mechanism for the Restricted Transfer, the mechanism prevails for that transfer.

11 Government access requests

11.1 Notice and challenge. Unless legally prohibited, Observata will notify Customer promptly of a binding request by a public authority for Customer Personal Data. Where reasonable and lawful, Observata will challenge an unlawful or disproportionate request and seek protective treatment.

11.2 Minimum disclosure. Observata will disclose only Customer Personal Data legally required by the request and will document the response as required by Applicable Data Protection Law. More specific obligations in an applicable transfer mechanism remain controlling.

12 Return deletion and retention

12.1 Customer choice. At the end of the relevant Services, Observata will, at Customer's choice, return or make available Customer Personal Data in a reasonably accessible format and delete remaining copies, unless Applicable Data Protection Law requires retention.

12.2 Backups and residual copies. Customer Personal Data in routine backups, archives, security logs or residual systems may remain until overwritten or deleted in the ordinary course, provided that it remains protected under this DPA, is not restored except for continuity or recovery, and is deleted when no longer required.

12.3 Service-specific rules. The applicable Service Description, Project Specification or documented configuration may state retrieval procedures and retention periods for particular Services. Those rules apply to the relevant data without creating a universal retention period for all Services.

13 Information audits and regulators

13.1 Compliance information. Observata will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA, subject to confidentiality, security and third-party restrictions.

13.2 Existing assurance. Customer will first use relevant current audit reports, certifications, questionnaires, summaries and other assurance information that Observata makes available. Observata need not provide source code, vulnerability details that would create security risk, other customers' data, privileged material or third-party confidential information.

13.3 Customer audit. If available assurance is insufficient for a specific and reasonable compliance concern, Customer may conduct an audit itself or through an independent auditor that is not a competitor of Observata and is bound by confidentiality. The audit must be limited to relevant systems, records and personnel.

13.4 Audit conditions. Except after a material Personal Data Breach, a material suspected breach of this DPA or a regulator's requirement, audits are limited to once in any twelve-month period, on at least thirty days' notice, during normal business hours and with minimal disruption. Customer bears its audit costs and Observata's reasonable assistance costs unless the audit identifies Observata's material breach or law requires otherwise.

13.5 Supervisory authorities. Observata will cooperate with a competent supervisory authority and comply with binding lawful requests relating to Customer Personal Data. Customer may disclose this DPA and relevant compliance information to such an authority where required.

14 Liability and commercial boundaries

14.1 Governing liability regime. The exclusions, limitations, procedures and caps in the Governing Agreement apply to this DPA to the maximum extent permitted by law. This DPA does not create a separate liability cap or duplicate recovery.

14.2 No commercial amendment. Except for the specific data protection rights and remedies stated here, this DPA does not change fees, payment obligations, service levels, intellectual property rights, warranty remedies or termination rights under the Governing Agreement.

15 Term versioning and survival

15.1 Effective date. This DPA becomes effective for the parties when the identified version is incorporated into a binding Governing Agreement or Order Form, or on the date of the last signature if separately executed.

15.2 Duration. This DPA continues while Observata processes Customer Personal Data on Customer's behalf, including any limited return, migration, backup or deletion period after the Services end.

15.3 Version control. The version identified in the applicable Order Form, Governing Agreement or signature page governs that relationship. Publication of a later version does not overwrite the incorporated version except as the Governing Agreement expressly permits.

15.4 Survival. Obligations concerning confidentiality, security, return or deletion, audits, transfers and liability survive termination for as long as Observata retains Customer Personal Data or as otherwise required by Applicable Data Protection Law.

Processing details

This Schedule forms the Article 28 processing description. More specific information in an applicable Order Form, Service Agreement, Service Description or Project Specification supplements this Schedule for the relevant processing.

Processing description: Processing Customer Personal Data as necessary to provide, secure, support and administer the Services ordered by Customer.

Processing description: For the period described in clause 15.2, subject to the return, deletion, backup and legal-retention rules in clause 12.

Processing description: As applicable to the ordered Services: collection, receipt, access, recording, organisation, structuring, hosting, storage, retrieval, consultation, transmission, analysis, configuration, troubleshooting, support, security monitoring, restriction, export, return and deletion.

Processing description: Providing, securing, supporting, administering and improving the reliability of the ordered Services in accordance with Customer's documented instructions. Service improvement uses Customer Personal Data only where instructed or otherwise permitted by Applicable Data Protection Law.

Processing description: As applicable: Customer personnel, contractors, users, authorised representatives, customers, end users, business contacts and other individuals whose Personal Data Customer submits to or makes accessible through the Services.

Processing description: As applicable: names and contact details; account, identity and authentication data; business and professional information; device, network, log, telemetry and usage data; support and service records; Customer content; and other Personal Data identified in downstream documents.

Processing description: None expected. Special-category data, criminal-offence data, formally classified information and other highly regulated data may be processed only where specifically identified and agreed under clause 4.3, with appropriate safeguards.

Processing description: Continuous, periodic, project-based or one-off, as determined by the ordered Services, Customer's use and the applicable downstream documents.

Processing description: The period stated in the applicable Service Description, Project Specification or configuration, or otherwise for the Service term and a reasonable return and deletion period. Clause 12 applies to backups, residual copies and legal retention.

Processing description: The locations stated in the Order Form, Service Description, Project Specification or current Sub-processor register, subject to clause 10. No EEA-only, Sweden-only or other localisation commitment applies unless expressly agreed.

Processing description: Customer retains the rights and duties of Controller, or of Processor acting for its Controller, including determining the purposes and essential means of processing, issuing lawful instructions and meeting the obligations in clause 4.

Technical and organisational measures

Observata applies the measures below as appropriate to the risk, processing context and ordered Services. A measure applies to the extent relevant to systems under Observata's control; equivalent provider controls may apply to managed infrastructure.

Measures: Documented security and privacy responsibilities, policies and risk-based review of systems and processing; management of identified risks; confidentiality commitments and relevant awareness training forauthorised personnel.

Measures: Unique user identities where practicable; role-based and least-privilege access; approval and prompt removal of access; periodic access review; multi-factor authentication for privileged or remote administrative access where supported and appropriate.

Measures: Encryption in transit using current secure protocols where supported. Encryption at rest for Customer Personal Data in Observata-managed systems where supported by the relevant platform and appropriate to risk, with compensating controls where it is not. Controlled handling of credentials, keys and secrets.

Measures: Secure configuration, logical separation, change controls, malware protection where relevant, vulnerability identification, risk-based remediation and security patching appropriate to the affected system and exposure.

Measures: Logging of relevant administrative, security and service events where supported; protection of logs; proportionate monitoring and alerting; investigation and escalation of material anomalous activity.

Measures: Availability, continuity and recovery measures proportionate to the Service. Where the Service includes Observata-managed storage, backups or equivalent recovery capabilities are maintained and restoration procedures are tested at risk-appropriate intervals.

Measures: Documented processes to identify, triage, contain, investigate, remediate and learn from security incidents, including escalation and Customer notification procedures for Personal Data Breaches.

Measures: Data minimisation, purpose limitation and retention controls appropriate to the Service; controlled export and deletion processes; logical separation of customer environments or data where relevant.

Measures: Risk-based assessment and contractual control of Sub-processors; confidentiality, security, incident, deletion and transfer requirements appropriate to the processing; ongoing review proportionate to supplier risk.

Measures: For Observata-developed software: proportionate secure design, peer or automated review, dependency and vulnerability management, testing and controlled deployment. For configuration and professional services: documented change and approval practices appropriate to the engagement.

Measures: Physical access restrictions appropriate to Observata-controlled premises. For hosted infrastructure, reliance on the hosting provider's physical and environmental safeguards subject to supplier assurance.

Restricted transfer mechanisms

This Schedule applies only where a Restricted Transfer directly between the parties requires the SCCs or a UK transfer mechanism. It does not create a Restricted Transfer where none exists.

Agreed completion: SCC Module Two for Controller-to-Processor transfers. SCC Module Three for Processor-to-Processor transfers. The parties' actual roles for the relevant transfer control.

Agreed completion: The optional docking clause applies.

Agreed completion: Option 2, general written authorisation, applies. The advance notice period is fourteen days. The urgent-change rule in clause 9.2 of this DPA does not reduce a mandatory notice requirement under the SCCs.

Agreed completion: The optional independent dispute resolution wording does not apply.

Agreed completion: The competent supervisory authority is determined under Clause 13 of the SCCs and identified from the data exporter's establishment, representative or relevant Data Subjects, as applicable.

Agreed completion: Option 1 applies. The SCCs are governed by the law of Sweden.

Agreed completion: The courts of Sweden are selected, without limiting a Data Subject's rights under Clause 18(c).

Agreed completion: The parties and contact details are those in the Governing Agreement, Order Form or optional signature page. Customer is the data exporter and Observata is the data importer where the selected module so provides. Activities and roles are described in this DPA and the applicable downstream documents.

Agreed completion: Schedule 1 supplies the categories of Data Subjects and Personal Data, sensitive-data safeguards, frequency, nature, purpose and duration of processing. The relevant Order Form and downstream documents supplement those details.

Agreed completion: Schedule 2 supplies the technical and organisational measures.

Agreed completion: The current Sub-processor register identified in clause 9.1 records the list used for the general written authorisation and applicable processing information. It does not modify any mandatory SCC annex requirement.

Agreed completion: Where the UK Addendum applies, the SCC selections and Schedules in this DPA populate the corresponding tables to the extent applicable. If the IDTA is used, the parties will complete any additional mandatory information required by its current form.

Agreed completion: The mandatory terms of the SCCs, UK Addendum or IDTA prevail for the applicable Restricted Transfer if they conflict with this DPA.