Your data, processed only on your instructions.

00Cover · Parties

The parties to this DPA are Newox Group AB (the "Provider") and the Customer entering the Agreement. If Customer is itself acting as a Processor on behalf of one or more third-party Controllers, Customer represents that it has the required authority to engage Provider as Subprocessor, and Provider will act as Customer's Subprocessor for the Customer Personal Data subject to that role.

0.1Governing law & forum

• Governing law: Sweden.
• Forum for disputes under the EEA SCCs: Sweden — Stockholm District Court as court of first instance.
• UK Transfers governing law: England and Wales, only where the UK Addendum applies.

0.2Liability cap

The aggregate liability of each party under this DPA is subject to the limitations and exclusions set out in the Agreement. No separate or enhanced liability cap applies to claims under this DPA. Section 8.3 (mandatory statutory exceptions) continues to apply.

01Processor & Subprocessor relationships

1.1Provider as Processor

Where Customer is the Controller of Customer Personal Data, Provider acts as a Processor and will Process such data only on documented instructions from Customer as described in this DPA.

1.2Provider as Subprocessor

Where Customer is itself a Processor for a third-party Controller, Provider acts as Customer's Subprocessor and will Process Customer Personal Data on Customer's documented instructions, which Customer represents accurately reflect the instructions of the underlying Controller.

02Processing

2.1Processing details

The subject matter, nature, purpose and duration of Processing, the categories of Personal Data, and the categories of Data Subjects are described in Annex I.

2.2Processing instructions

Customer instructs Provider to Process Customer Personal Data to provide, operate, secure, support and maintain the Service, and as further documented (i) through Customer's use of the Service (including the natural-language questions and SQL generated by Customer's users), (ii) in the Agreement and this DPA, and (iii) in any additional written instructions issued by Customer that Provider agrees in writing to follow. Provider will notify Customer without undue delay if, in Provider's reasonable opinion, an instruction infringes Applicable Data Protection Laws.

2.3Provider Processing

Provider Processes Customer Personal Data only in accordance with this DPA. Provider may update the description of Processing in Annex I where Service functionality materially changes, by giving Customer prior written notice and a reasonable opportunity to object.

2.4Customer Processing

Customer is responsible for ensuring that its Processing, and its instructions to Provider, comply with Applicable Data Protection Laws, including by establishing a lawful basis for Processing and by providing required notices to Data Subjects.

2.5Consent to Processing

Customer represents and warrants that it has provided all required notices and obtained all required consents or other lawful bases necessary for Provider to Process Customer Personal Data as contemplated by the Agreement and this DPA.

2.6Subprocessors

1. Customer provides general written authorisation for Provider to engage the Subprocessors listed in Annex III. Provider maintains an up-to-date list at aidalabs.io/subprocessors, which is the authoritative version. Provider will give Customer at least 10 business days' prior written notice of the addition or replacement of any Subprocessor, by updating the published list and notifying Customer at the notice email above. Customer may object on reasonable data-protection grounds within 30 days. If the parties cannot agree on a resolution, Customer's exclusive remedy is to terminate the affected portion of the Service.
2. Provider will impose data-protection obligations on each Subprocessor by written contract that are no less protective than those in this DPA, including, where GDPR or UK GDPR applies, the obligations required by Article 28.
3. Where Customer Personal Data is transferred to a Subprocessor located outside the EEA, UK or Switzerland and no adequacy decision applies, Provider will implement an appropriate transfer mechanism (see Section 3).
4. Provider remains responsible for the acts and omissions of its Subprocessors in connection with this DPA to the same extent as for its own acts and omissions.

03Restricted transfers

3.1Authorisation

Customer authorises Provider and its Subprocessors to transfer Customer Personal Data outside the EEA, UK or Switzerland as reasonably necessary to provide the Service, subject to the safeguards set out in this Section 3.

3.2EEA Transfers

Where Restricted Transfers from the EEA are made under the GDPR and no adequacy decision applies, the parties are deemed to have entered into the EEA Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (Controller-to-Processor) or, where Customer acts as Processor, Module Three (Processor-to-Processor), with the following selections:

3.3UK Transfers

Where Restricted Transfers from the UK are made under the UK GDPR and no adequacy decision applies, the parties are deemed to have entered into the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B.1.0, issued by the UK Information Commissioner), with the EEA SCCs above forming the "Approved EU SCCs" under the Addendum, governed by the law of England and Wales.

3.4Swiss Transfers

Where Restricted Transfers are subject to the Swiss Federal Act on Data Protection ("FADP"), references in the EEA SCCs to the GDPR are read as references to the FADP, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner, and the governing law is Switzerland to the extent required by the FADP.

04Security incident response

4.1Notification

Provider will notify Customer of a confirmed Security Incident affecting Customer Personal Data without undue delay and in any event within 72 hours after Provider becomes aware of it. Notification will be sent to the Customer notice email and will include, to the extent then known: the nature of the incident, the categories and approximate volume of Customer Personal Data and Data Subjects concerned, the likely consequences, and the measures taken or proposed to address it. Provider will update Customer as additional information becomes available.

4.2Investigation and mitigation

Provider will promptly investigate, contain and remediate the Security Incident, and will cooperate reasonably with Customer's own investigation.

05Audit & reports

5.1Audit rights

Provider will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by Customer or an independent auditor mandated by Customer, subject to reasonable confidentiality and security restrictions, no more than once per 12-month period unless required by a supervisory authority or following a Security Incident. Provider will retain compliance records for three (3) years after termination of this DPA.

5.2Security reports

On Customer's written request, Provider will provide a summary copy of its then-current third-party audit Report(s) (to the extent obtained — see Annex II) on a confidential basis under the Agreement.

5.3Security due diligence

Provider will respond to reasonable security-due-diligence questionnaires once per 12-month period, sent to privacy@aidalabs.io.

06Coordination & cooperation

6.1Inquiries and Data Subject requests

Provider will, without undue delay, notify Customer of any inquiry, complaint or request from a Data Subject or supervisory authority relating to Customer Personal Data, and will not respond except on Customer's instruction or as required by Applicable Law. Provider will, taking into account the nature of the Processing, provide reasonable assistance to Customer in responding to Data Subject requests under Applicable Data Protection Laws, at Customer's expense to the extent permitted by law.

6.2DPIAs and TIAs

Provider will provide Customer with reasonable assistance with data-protection impact assessments and transfer impact assessments required under Applicable Data Protection Laws, taking into account the nature of the Processing and the information available to Provider.

07Deletion of Customer Personal Data

7.1Deletion during the term

Provider will provide functionality enabling Customer to delete Customer Personal Data from the Service. Provider will comply with documented deletion instructions as soon as reasonably practicable, except where retention is required by Applicable Law.

7.2Deletion at termination

Within 60 days of expiration or termination of the Agreement, Provider will, at Customer's election, return or delete Customer Personal Data, including from backups in the ordinary course, except where retention is required by Applicable Law. Where deletion is impracticable (for example, encrypted backups pending rotation), Provider will isolate the data, prevent further Processing, and continue to protect it under this DPA until deletion. Provider will provide written certification of deletion on Customer's written request.

08Limitation of liability

8.1Caps and damages waivers

Each party's total cumulative liability arising out of or related to this DPA is subject to the waivers, exclusions and limitations of liability stated in the Agreement. No separate or enhanced cap applies to claims under this DPA.

8.2Related-party claims

Claims against Provider arising out of or related to this DPA may only be brought by the Customer entity that is party to the Agreement, and not by any Affiliate of Customer.

8.3Exceptions

Nothing in this DPA limits or excludes either party's liability where such limitation or exclusion is prohibited by Applicable Data Protection Laws, including in respect of obligations owed to Data Subjects under the GDPR, UK GDPR or the EEA SCCs / UK Addendum.

09Conflicts & term

9.1Order of precedence

In the event of any conflict, the following order applies, in descending order: (1) the EEA SCCs and/or UK Addendum (where they apply); (2) this DPA; (3) the Agreement.

10.1Term

This DPA takes effect on the date Customer accepts the Order Form incorporating it, and continues for as long as Provider Processes Customer Personal Data under the Agreement. Sections that by their nature should survive termination (including Sections 5, 7, 8 and 11) will survive.

11Definitions

The following capitalised terms have the meanings given below when used in this DPA.

Applicable Law

Laws, rules, regulations, court orders and other binding requirements of a relevant government authority that apply to a party.

Applicable Data Protection Laws

All data-protection and privacy laws applicable to the Processing of Customer Personal Data under the Agreement, including the GDPR, the UK GDPR, the Swedish Data Protection Act (2018:218), and, where applicable, the Swiss FADP, CCPA/CPRA and other US state privacy laws.

Controller, Processor, Data Subject, Personal Data, Processing

Have the meanings given under the GDPR.

Customer Personal Data

Personal Data that Provider Processes on behalf of Customer in connection with the Service, including (i) the warehouse data and metadata that Customer connects to the Service, (ii) natural-language messages and SQL queries submitted by Customer's authorised users, and (iii) telemetry derived from Customer's use of the Service.

EEA SCCs

The standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.

GDPR

Regulation (EU) 2016/679.

Restricted Transfer

A transfer of Personal Data to a country outside the EEA, UK or Switzerland that is not subject to an adequacy decision under Applicable Data Protection Laws.

Security Incident

A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data Processed by Provider.

Service

Aida, Provider's AI data analyst SaaS available at aidalabs.io, including its Slack interface and web application, as described in the Agreement.

Subprocessor

Any third party engaged by Provider to Process Customer Personal Data on Provider's behalf.

UK Addendum

The International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018.

UK GDPR

The GDPR as incorporated into UK law under the European Union (Withdrawal) Act 2018.

A · List of parties

As set out on the Cover Page (Section 00).

B · Description of processing

C · Competent supervisory authority

The Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, "IMY") where Customer is established in the EEA; otherwise, the supervisory authority of the EU Member State in which Customer's EU representative is established, or as otherwise determined under Clause 13 of the EEA SCCs.

• 01Encryption Customer Personal Data is encrypted in transit using industry-standard TLS, and at rest using industry-standard algorithms. Warehouse credentials and API keys are stored using a secrets manager.
• 02Access control Access to production systems is restricted to authorised personnel on a least-privilege basis. MFA required. Access rights reviewed periodically.
• 03Network & infrastructure Production workloads run in hardened cloud environments with network segmentation, change control, and automated monitoring of security-relevant events.
• 04Backups & continuity Encrypted backups are taken regularly and a documented recovery process is maintained.
• 05Read-only query enforcement SQL generated by the Service and executed against Customer's warehouse is validated to reject non-read-only statements before execution.
• 06Vulnerability management Regular vulnerability scanning and dependency monitoring of the Service.
• 07Personnel Personnel with access to Customer Personal Data are bound by confidentiality obligations and receive security awareness guidance appropriate to their role.
• 08Physical security Hosting provided by reputable cloud providers (see Annex III) whose facilities are covered by recognised physical-security attestations.
• 09Incident response A documented incident-response process supports the notification obligations in Section 4.
• 10Subprocessor diligence Subprocessors are selected and contracted in accordance with Section 2.6.
• 11Compliance programme Provider is implementing an information security management system aligned with ISO 27001. ISO 27001 certification is in progress; Provider provides updates on certification status on Customer's reasonable request.
• 12Data minimisation & deletion Provider supports Customer-driven deletion under Section 7.
• 13Privacy contact privacy@aidalabs.io
• 14No training on Customer Personal Data Provider does not use Customer Personal Data — including conversations, queries, results or warehouse data — to train, fine-tune, or otherwise improve any machine learning model, except where Customer has expressly opted in through a separate written agreement. Provider's LLM Subprocessors are engaged in inference-only mode under terms that prohibit training on Customer content.