Data Processing Agreement

Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Use between Reinversed AB ("Reinversed") and Customer and applies where Reinversed processes personal data on Customer's behalf.

Roles

For Customer Personal Data included in Customer Data, Customer acts as controller or processor, as applicable, and Reinversed acts as processor or sub-processor, as applicable, unless otherwise agreed in writing.

This DPA does not govern personal data Reinversed processes as controller for its own business purposes, which is described in the Privacy Policy.

Scope of processing

The subject matter of the processing is Reinversed's provision, security, maintenance, and support of the Service.

The duration of processing is the subscription term plus any agreed export period and any backup or statutory retention period.

Data subjects may include Customer's users, employees, contractors, contacts, prospects, and End Users. Data categories may include account details, identifiers, contact details, communications, files, prompts, logs, metadata, integration data, and AI outputs.

Special categories of personal data and children's data are not intended for processing unless lawfully handled.

Customer obligations

Customer is responsible for complying with applicable data-protection law, ensuring a valid legal basis and required notices, ensuring instructions are lawful, configuring permissions and retention appropriately, and responding to data-subject and regulatory requests.

Reinversed obligations

Reinversed will:

• process Customer Personal Data only on documented instructions unless otherwise required by law;
• ensure authorised personnel are bound by confidentiality obligations;
• implement appropriate technical and organisational measures;
• assist with data-subject rights requests, breach response, DPIAs, and prior consultation where reasonably required; and
• impose substantially similar data-protection obligations on sub-processors.

Security measures

Reinversed maintains technical and organisational measures appropriate to the risks of the Service, which may include role-based access controls, multi-factor authentication, encryption in transit and at rest where appropriate, credential management, segregation of environments where practicable, logging and monitoring, vulnerability management, backup procedures, supplier review, incident response and staff confidentiality controls. Reinversed may update these measures from time to time provided the overall level of protection is not materially reduced for the relevant Service.

Sub-processors

Customer generally authorises Reinversed to use sub-processors for hosting, infrastructure, AI model services, support, communications, analytics and payment processing. Reinversed maintains an up-to-date sub-processor list at www.reinversed.com or an equivalent public location. Reinversed will give prior notice of material new or replacement sub-processors by reasonable means, such as email, in-product notice or website update. Customer may object on reasonable data-protection grounds within 14 days after notice. If the parties cannot resolve the objection in good faith, Customer may terminate the affected Service before the new sub-processor is used for that Service.

International transfers

Where Customer Personal Data is transferred outside the EU or EEA, Reinversed will rely on an adequacy decision or appropriate safeguards such as Standard Contractual Clauses and supplementary measures where required.

Data-subject requests and breaches

Reinversed will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data and will provide information reasonably available to Reinversed regarding the nature of the breach, the categories of data affected, likely consequences, mitigation measures taken or proposed, and available contact details for follow-up. Reinversed will provide reasonable further updates as material information becomes available.

Audits

Reinversed will make available information reasonably necessary to demonstrate compliance. Customer may request an audit no more than once per year, except where more frequent review is required by a breach, regulator, or law.

Return and deletion

Customer may export Customer Personal Data during the Subscription Term and for 30 days after termination or expiry unless access has been lawfully restricted. After that period, Reinversed will delete or return Customer Personal Data unless retention is required by law. Unless otherwise agreed in writing, active production data will be deleted within 60 days after the end of the export period, and deletion from backups will occur in the ordinary course of backup rotation within a reasonable period thereafter. Reinversed may retain minimal records necessary for security, fraud prevention, legal compliance, accounting, or the establishment, exercise or defence of legal claims.

Government requests

If Reinversed receives a legally binding request from a public authority for Customer Personal Data, Reinversed will notify Customer where legally permitted and provide reasonable assistance.

Liability and precedence

The liability provisions in the Terms apply to this DPA except where prohibited by applicable law. This DPA prevails over the Terms for processor obligations.

Changes

Reinversed may update this DPA from time to time. Material changes affecting processor obligations will be notified in advance where required.

Contact

Questions about this DPA may be sent to privacy@reinversed.com.