Data processing agreement

The agreement is between the company that holds an account in Kalvsvik (the Customer, the controller) and XMarginAI AB, Swedish company registration number 559567-6239, which operates Kalvsvik (Kalvsvik, the processor). The Customer and Kalvsvik are each a Party and together the Parties.

The agreement governs Kalvsvik's processing of personal data on behalf of the Customer when Kalvsvik provides the service under the terms of use (the Customer Agreement). Its purpose is to meet the requirements of Article 28(3) of the GDPR and to protect the rights and freedoms of data subjects.

The agreement is based on the European Commission's standard contractual clauses between controllers and processors under Implementing Decision (EU) 2021/915, adapted to the Service. The agreement consists of this document and Annexes 1 to 3, which form part of it. In case of conflict, the document prevails over the annexes.

The agreement is part of the Customer Agreement. In matters concerning the processing of personal data, the agreement prevails over the terms of use and any other arrangements between the Parties.

Terms used in the agreement have the meaning given in the GDPR. In addition, the following applies.

Kalvsvik processes the Personal Data only to provide the Service to the Customer under the Customer Agreement, that is, to store, read and display documents the Customer uploads or connects, analyse them with AI and send notifications to the Customer's users. The subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex 1.

The processing continues for as long as the Customer Agreement is in force and thereafter for the period stated in section 14.

Kalvsvik does not use the Personal Data for its own purposes and does not train AI models on it. Statistics on how the Service is used are produced only in aggregated and anonymised form, as the Customer Agreement states.

The Customer is responsible for having a legal basis for the processing, for the data subjects having received the information required by Data Protection Law, and for being permitted to provide the Personal Data to Kalvsvik.

The Customer is responsible for the Instructions being lawful and notifies Kalvsvik without delay of changes to the processing that affect Kalvsvik's obligations under the agreement.

The Customer does not let Kalvsvik process special categories of personal data under Article 9 or data relating to criminal convictions and offences under Article 10 of the GDPR unless the Parties have agreed in writing on this and on the additional safeguards then required. If such data appears in a document the Customer uploads, the Customer is responsible for the processing being permitted.

The Customer is responsible for its users' accounts, roles and permissions in the Service and for the choices its users make, for example which documents are uploaded and which connections are set up.

Kalvsvik processes the Personal Data only on the Customer's documented Instructions, including with regard to transfers to a Third Country, unless required to do so by Union or Swedish law. In that case Kalvsvik informs the Customer of the legal requirement before processing, unless the law prohibits this.

If Kalvsvik considers that an Instruction infringes Data Protection Law, Kalvsvik informs the Customer without delay and may suspend the processing until the Customer has confirmed or changed the Instruction.

Kalvsvik processes the Personal Data only for the purposes stated in Annex 1 and ensures that the persons processing the Personal Data do so only on Kalvsvik's behalf, have the training needed and have committed to confidentiality under section 6.

Kalvsvik grants access to the Personal Data only to staff who need it to provide, operate or support the Service. Support access to the Customer's account takes place through a viewing session that is logged and visible to the Customer's users.

Kalvsvik keeps itself informed of Data Protection Law and supervisory practice relevant to the processing, keeps records of processing under Article 30(2) of the GDPR and can demonstrate on request that the obligations under the agreement are met.

If a data subject, an authority or anyone else requests information about the processing directly from Kalvsvik, Kalvsvik refers them to the Customer and informs the Customer without delay, unless the law prohibits this. Kalvsvik does not disclose Personal Data to third parties without the Customer's written approval, except where required by law or by a decision of an authority.

Kalvsvik and everyone working under Kalvsvik's direction keep the Personal Data confidential. The Personal Data may not be used or disclosed for purposes other than those of the agreement, during its term or after it has ended.

Kalvsvik ensures that its staff are bound by confidentiality undertakings and that equivalent confidentiality applies at the Sub-processors.

Kalvsvik implements the technical and organisational measures required under Article 32 of the GDPR to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs and the nature, scope, context and purposes of the processing. The measures are described in Annex 2.

Kalvsvik may develop and change the measures, but not so that the level of security falls below what Annex 2 states. A current overview is on the page Security and data, and material changes are notified to the Customer under section 15.

If the Customer requests additional security measures beyond Annex 2, this counts as a new Instruction. The Parties then agree on implementation and any compensation before the measure is introduced.

Kalvsvik assists the Customer with appropriate technical and organisational measures so that the Customer can respond to data subjects' requests for access, rectification, erasure, restriction, data portability and objection under Chapter III of the GDPR. The Customer's administrator can do most of this directly in the Service, for example export the company's data or remove a user.

Kalvsvik assists the Customer with the information available to Kalvsvik so that the Customer can meet its obligations under Articles 32 to 36 of the GDPR, that is, security, notification of personal data breaches, data protection impact assessments and prior consultation.

Assistance under 8.1 and 8.2 is included free of charge to the extent normal for the Service. If a request requires substantial work not caused by Kalvsvik, Kalvsvik is entitled to reasonable compensation for the work, after the Customer has approved a cost estimate.

Kalvsvik notifies the Customer without undue delay, and at the latest within 24 hours, after becoming aware of a Personal Data Breach concerning the Personal Data. The notification is sent by email to the Customer's administrators.

The notification describes the nature of the breach, where possible the categories and approximate number of data subjects and personal data records concerned, the likely consequences, the measures taken or proposed and a point of contact at Kalvsvik. If all the information is not available at the first notification, it is provided in phases without undue further delay.

Kalvsvik assists the Customer with the information the Customer needs to notify the breach to IMY within 72 hours and to inform the data subjects, documents the breach and takes measures to limit the damage and prevent a recurrence.

Kalvsvik can restore access to the Personal Data in a timely manner in the event of a physical or technical incident, using the backups described in Annex 2.

The Customer gives Kalvsvik a general written authorisation to engage Sub-processors for the processing. The Sub-processors engaged when the agreement takes effect are listed in Annex 3, with service, location of processing and the basis for any transfer to a Third Country.

Before Kalvsvik engages a new Sub-processor or replaces an existing one, Kalvsvik notifies the Customer's administrators by email or in the Service at least 30 days in advance, with the Sub-processor's name, service, location of processing and the basis for any transfer.

The Customer may object in writing within 30 days of the notification, on reasonable grounds relating to data protection. The Parties then try in good faith to find a solution, for example that Kalvsvik refrains from using the Sub-processor for the Customer's data. If that is not possible, the Customer may terminate the Customer Agreement as of the day the change takes effect, at no cost beyond the fees up to that day. If the Customer does not object within the period, the change is deemed approved.

Kalvsvik enters into a written agreement with each Sub-processor imposing obligations substantially equivalent to Kalvsvik's obligations under this agreement, in particular on confidentiality, security and assistance. Kalvsvik remains fully liable to the Customer for the Sub-processor's processing.

At the Customer's request, Kalvsvik provides a copy of the parts of the agreement with the Sub-processor that concern data protection. Trade secrets and prices may be redacted.

Hosting, database and files are located in Sweden. Kalvsvik transfers Personal Data to a Third Country, or lets a Sub-processor do so, only where needed for the Service and only to the Sub-processors listed in Annex 3 or notified under section 10.

Every transfer to a Third Country takes place in accordance with Chapter V of the GDPR, on the basis of an adequacy decision, the European Commission's standard contractual clauses for transfers to third countries under Implementing Decision (EU) 2021/914 or another valid transfer mechanism, and after an assessment of whether the law of the receiving country affects the protection. Where required, Kalvsvik applies supplementary measures, for example encryption and transferring only the excerpts needed for the task.

If a transfer mechanism is declared invalid, Kalvsvik ensures without delay that the processing in the Third Country is based on another valid mechanism, or ceases.

The Customer mandates Kalvsvik to enter into standard contractual clauses with Sub-processors in Third Countries on the Customer's behalf where needed.

Kalvsvik makes available to the Customer the information needed to demonstrate compliance with Article 28 of the GDPR and with the agreement, primarily through Annex 2, the page Security and data, the Customer's own data export and answers to written questions.

The Customer, or an independent auditor appointed by the Customer and bound by confidentiality, may audit Kalvsvik's compliance with the agreement, including by inspection, at most once a year and in addition where a Personal Data Breach or a requirement from a supervisory authority gives reason to. The Customer gives written notice at least 30 days in advance stating scope and timing. The audit takes place on weekdays during office hours, does not disrupt operations more than necessary and gives no access to other customers' data.

If an independent auditor has audited the controls the Customer wishes to audit within the last twelve months and Kalvsvik provides the report, the Customer accepts the report instead of its own audit of the same controls.

Each Party bears its own costs of the audit. If the audit reveals material deficiencies on Kalvsvik's part, Kalvsvik bears the Customer's reasonable costs.

Kalvsvik allows IMY and other competent authorities to carry out supervision under the law and informs the Customer of supervision concerning the Personal Data, unless the law prohibits this.

For compensation to a data subject for processing that infringes Data Protection Law, Article 82 of the GDPR applies. A Party that has paid compensation to a data subject is entitled to recover from the other Party the part corresponding to the other Party's responsibility for the damage.

Administrative fines under Article 83 of the GDPR or Chapter 6 of the Swedish Act (2018:218) are borne by the Party on which the fine is imposed.

Between the Parties, each Party is liable for damage caused by its own breach of the agreement or of Data Protection Law. The exclusion of indirect damage in the section Limitation of liability in the terms of use applies here as well. The cap on the amount in that section does not, however, apply to liability under this agreement, as the terms of use state. The limitations do not apply in case of intent or gross negligence.

If a Party becomes aware of anything that may cause damage to the other Party, it informs the other Party without delay and helps to limit the damage.

The agreement takes effect on the day the Customer's administrator accepts it in the Service, or on the day the Customer starts using the Service if earlier, and remains in force for as long as Kalvsvik processes Personal Data on the Customer's behalf. The agreement ends when the Customer Agreement ends, except for the obligations that by their nature survive, among them confidentiality, liability and deletion.

Before the Customer Agreement ends, the Customer's administrator can export everything that belongs to the company as a zip file in the Service. The Customer thereby chooses whether the Personal Data is returned in that way.

At the latest 30 days after the Customer Agreement has ended, Kalvsvik deletes the Personal Data and all copies, including at the Sub-processors, unless Union or Swedish law requires continued storage. Copies in backups are overwritten within 90 days and are used for nothing other than restoration. After a pilot that does not continue, the account is deleted 30 days after the end of the pilot, as the Customer Agreement states.

At the Customer's request, Kalvsvik confirms in writing that the deletion has been carried out. Data that must be kept by law, for example invoicing records under the Swedish Accounting Act, is kept only for as long as the law requires and is not processed for other purposes.

If a Party materially breaches the agreement and does not remedy the breach within 30 days of a written demand, the other Party may terminate the Customer Agreement with immediate effect. The Customer may also instruct Kalvsvik to suspend the processing until the deficiency has been remedied.

Kalvsvik may change the agreement when Data Protection Law, supervisory practice, the Sub-processors or the Service require it. The Customer is notified in the Service or by email to its administrators at least 30 days before a change takes effect, except where a change is required by law or by a decision of an authority at shorter notice.

If a change reduces the protection of the Personal Data and the Customer does not accept it, the Customer may terminate the Customer Agreement as of the day the change takes effect. A new version is accepted by the Customer's administrator at the next sign-in. The date at the top shows which version applies, and earlier versions are available from Kalvsvik.

Other changes and additions must be in writing and approved by both Parties.

The agreement is accepted electronically by the Customer's first administrator when the company's account is created, together with the terms of use. The time, the user and the version are logged in the Service and shown to the Customer's administrators under Settings. The person accepting confirms that they are authorised to do so on the Customer's behalf.

The agreement is available in Swedish and English. In case of discrepancies, the Swedish version prevails.

Swedish law governs the agreement. Disputes that the Parties cannot resolve through discussion are settled by the Stockholm District Court, as the Customer Agreement states.

Notices under the agreement are sent in writing, to the Customer in the Service or to the administrators' email addresses, and to Kalvsvik at contact@kalvsviklabs.com.

The Customer's Instructions on the subject matter, nature and purpose of the processing, the categories of personal data and data subjects, and the duration and location of the processing.

The technical and organisational measures Kalvsvik implements under section 7. They apply to the Service today and are developed continuously. A current overview is on the page Security and data.

The Sub-processors Kalvsvik engages when the agreement takes effect. Kalvsvik engages sub-processors for hosting and storage, AI models, email, sign-in, error monitoring and support. They process the data only on Kalvsvik's behalf, under written data processing agreements and with access only to the data needed for their task.

The Sub-processors are bound by written agreements under section 10. Kalvsvik engages no other sub-processors for the Personal Data. Changes are notified at least 30 days in advance, and the current list is always in the latest version of this agreement.

Questions about the agreement, new Instructions, objections to sub-processors and audit requests are sent to contact@kalvsviklabs.com