Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") constitutes an appendix to the Terms of Use ("Main Agreement") between the Customer ("Data Controller") and Verca AB, reg. no. 559564-2629, registered in Malmö, Sweden ("Data Processor").

This DPA governs Verca AB's processing of personal data on behalf of the Customer in connection with the provision of the Platform, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council ("GDPR"), Article 28.

In the event of a conflict between this DPA and the Main Agreement, this DPA shall take precedence regarding the processing of personal data.

In addition to the definitions in the Main Agreement, the following apply:

"Data Controller" — the Customer, who determines the purposes and means of the processing of personal data.

"Data Processor" — Verca AB, which processes personal data on behalf of the Data Controller.

"Data Subject" — an identifiable natural person whose personal data is processed, for example the Customer's Users or contact persons.

"Personal Data" — any information relating to an identified or identifiable natural person, insofar as such data is processed within the scope of the Platform.

"Processing" — any operation performed on personal data, including collection, recording, storage, adaptation, transfer, and erasure.

"Sub-processor" — a third party engaged by Verca AB to carry out certain processing of personal data on behalf of the Customer.

Verca AB processes personal data on behalf of the Customer for the purpose of providing and maintaining the Platform. The processing covers:

Categories of data subjects:

• The Customer's Users (employees and consultants with account access)
• Contact persons registered by the Customer in the Platform

Categories of personal data:

• Name and email address
• Organisational affiliation and role
• Login credentials (hashed) and session data
• IP address and technical device information
• Activity logs and timestamps for actions in the Platform

Nature and purpose of processing:

• Authentication and access control
• Provision of Platform functionality
• Communication (notifications, email)
• Technical operations, troubleshooting, and security monitoring
• Audit logging

Duration of processing: Processing continues for the duration of the Main Agreement and ceases in accordance with section 8 of this DPA.

Verca AB undertakes to:

Instructions — Process personal data solely in accordance with the Customer's documented instructions, including those set out in the Main Agreement and this DPA. If Verca AB considers that an instruction infringes GDPR or other applicable data protection legislation, the Customer shall be informed without delay.

Confidentiality — Ensure that personnel processing personal data have committed to confidentiality or are subject to a statutory obligation of secrecy.

Technical and organisational measures — Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data at rest (AES-256) and in transit (TLS 1.2+)
• Role-based access control following the principle of least privilege
• Multi-factor authentication (MFA) for all administrative access to production environments
• Dual attestation for security-critical operations (e.g. deletion or mass export of customer data)
• Tenant isolation at database level
• Complete audit trail of data access
• Regular security reviews
• Incident response process with defined escalation paths

Assistance — Assist the Customer in fulfilling its obligations regarding data subject rights, data protection impact assessments, and prior consultation with supervisory authorities, to the extent reasonable and possible.

The Customer hereby grants general prior authorisation for Verca AB to engage sub-processors for the processing of personal data. Verca AB shall inform the Customer in writing before engaging a new sub-processor or replacing an existing one. The Customer has the right to object within 30 days of receiving such notification.

Verca AB ensures that each sub-processor is bound by data protection obligations equivalent to those set out in this DPA. AI sub-processors process data only when the Customer has enabled AI for its organization and an authorized user starts an AI capability.

Current sub-processors:

Verca AB assists the Customer, through appropriate technical and organisational measures, in fulfilling the Customer's obligation to respond to requests from data subjects exercising their rights under GDPR Chapter III, including:

• Right of access (Art. 15) — information about which data is processed
• Right to rectification (Art. 16) — correction of inaccurate data
• Right to erasure (Art. 17) — deletion of data under applicable conditions
• Right to restriction (Art. 18) — restriction of processing
• Right to data portability (Art. 20) — export of data in a structured format

If Verca AB receives a request directly from a data subject, Verca AB shall without delay refer the data subject to the Customer, unless otherwise required by law.

Personal data breaches: In the event of a confirmed or suspected personal data breach, Verca AB shall notify the Customer without undue delay and no later than within 36 hours. The notification shall contain information about the nature of the breach, the categories and approximate number of affected data subjects, likely consequences, and measures taken or proposed.

Verca's primary platform data is processed and stored within the EU/EEA. Verca AB's primary data centres are located in Frankfurt, Germany (EU). When the Customer enables an AI capability, personal data submitted to that capability may be transferred to AI sub-processors in the United States.

Transfer of personal data to third countries outside the EU/EEA occurs only if:

• The European Commission has adopted an adequacy decision for the receiving country or organization, or
• Appropriate safeguards have been implemented in accordance with GDPR Chapter V, including EU Standard Contractual Clauses (SCCs) pursuant to Commission Implementing Decision (EU) 2021/914

Before any transfer commences, Verca AB implements:

• EU Standard Contractual Clauses (SCCs) or another transfer instrument under GDPR Chapter V
• Supplementary technical and organizational measures under applicable EDPB recommendations, including data minimization, encrypted transfer and restricted access
• A documented assessment of the receiving country's legal protection (Transfer Impact Assessment) where such an assessment is required

AI is disabled by default. The Customer may select strict EU-only mode, which blocks the current external AI sub-processors. Commercial customer data is not used for provider model training under the applicable provider terms.

This DPA is valid for the entire duration of the Main Agreement and terminates automatically when the Main Agreement expires.

Upon termination of the Agreement, Verca AB shall, at the Customer's choice:

• Delete all personal data processed on behalf of the Customer, including any copies, within 30 days of termination, or
• Return the personal data to the Customer in a structured, machine-readable format before deletion takes place

The Customer has the opportunity to export data during a period of 30 days after the Agreement's end date. After this period, deletion is carried out automatically.

Verca AB may retain personal data to the extent required by applicable legislation, including the Swedish Bookkeeping Act. Such data shall continue to be processed in accordance with the terms of this DPA and GDPR.

Liability for GDPR violations: To the extent that Verca AB, in its capacity as data processor, has directly caused damage to a data subject through processing in violation of the GDPR, Verca AB shall be liable in accordance with Article 82 GDPR, independently of the limitation of liability in the Main Agreement.

Audit: The Customer has the right, at its own expense and with at least 30 days' notice, to conduct or commission an audit of Verca AB's compliance with this DPA, no more than once per calendar year — unless a supervisory authority requires otherwise. Verca AB shall provide relevant documentation within 10 business days of a formal request. For Customers with documented enterprise needs, expanded audit rights may be agreed separately.