Data processing agreement

1. Background and acceptance

1.1 This data processing agreement (the "DPA") forms part of the agreement between [Bolagsnamn AB], organisation number [Organisationsnummer] (the "Processor"), and the customer (the "Customer") under ekonomimcp's Terms of service (the "Main Agreement").

1.2 The DPA is accepted when the Customer accepts the Main Agreement, that is, when the Customer creates an account, connects a company or starts using the service. It applies as long as the Processor processes personal data on the Customer's behalf. Customers who need a signed copy can request one at support@ekonomimcp.se.

1.3 Terms such as personal data, processing, controller, processor, data subject and personal data breach have the same meaning as in Regulation (EU) 2016/679 of the European Parliament and of the Council (the "GDPR").

2. Roles

2.1 The Customer is the controller and the Processor is the processor for the personal data described in section 3.

2.2 If the Customer is itself a processor, for example an accounting firm working for its clients, the Processor is a sub-processor to the Customer. The Customer is then responsible for having the client's permission to engage the Processor and for passing on the information the client needs, and the DPA applies, where relevant, in relation to the Customer.

2.3 The Processor is an independent controller for data about the Customer's users, account and billing, as described in the Privacy policy. The DPA does not apply to that processing.

3. The processing

4. Instructions

4.1 The Processor processes personal data only on the Customer's documented instructions. The Customer's instructions consist of the Main Agreement, this DPA, the choices the Customer and its users make in the service (connected companies, access level and approval mode) and the calls the Customer's AI clients make within these limits.

4.2 The Processor shall inform the Customer without delay if the Processor considers that an instruction infringes the GDPR or other data protection legislation, and is then entitled to wait before carrying out the instruction.

4.3 The Processor may process the personal data without instructions only when required to do so by Union law or Swedish law, and then informs the Customer unless this is prohibited.

5. Obligations of the Processor

The Processor shall:

• ensure that persons who process the personal data have committed themselves to confidentiality,
• take the technical and organisational security measures set out in Annex 1, in accordance with Article 32 GDPR,
• taking into account the nature of the processing, assist the Customer in responding to requests from data subjects, as far as possible through appropriate technical and organisational measures,
• assist the Customer in complying with the obligations under Articles 32–36 GDPR, taking into account the nature of the processing and the information available to the Processor,
• keep a record of the processing in accordance with Article 30(2) GDPR,
• not process the personal data for its own purposes, not use it to train AI models and not sell it.

The Processor is entitled to reasonable compensation for assistance under this section that goes beyond what is included in the service, unless the parties have agreed otherwise.

6. Sub-processors

6.1 The Customer gives the Processor a general written authorisation to engage sub-processors. The sub-processors engaged when the agreement is entered into are listed in Annex 2 and on the Sub-processors (in Swedish) page.

6.2 The Processor shall inform the Customer of planned additions or replacements of sub-processors at least 30 days in advance, by e-mail to the account's address and on the Sub-processors page. The Customer has the right to object to the change on reasonable grounds within that time. If the parties cannot agree, the Customer has the right to terminate the Main Agreement, at no cost, with effect from when the change is implemented.

6.3 The Processor shall, by written agreement, impose on each sub-processor the same data protection obligations as follow from this DPA, and is liable to the Customer for the sub-processor's processing.

6.4 Fortnox AB is the Customer's provider of the business system and not a sub-processor of the Processor. The provider of the AI client the Customer uses, for example Anthropic, OpenAI, Microsoft or Google, is chosen and contracted by the Customer and is not a sub-processor of the Processor either. Data is transferred to them on the Customer's instructions.

7. Transfers to third countries

7.1 The Processor stores the personal data within the EU/EEA. Transfer to, or access from, a country outside the EU/EEA may only take place if there is an adequacy decision, including the EU–US Data Privacy Framework for certified recipients, or appropriate safeguards under Article 46 GDPR, for example the European Commission's standard contractual clauses, together with the supplementary measures needed.

8. Personal data breaches

8.1 The Processor shall notify the Customer of a personal data breach without undue delay and no later than 48 hours after the Processor has become aware of it.

8.2 The notification shall, as far as the information is available, describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed, and give contact details. Information that is not available at the first notification shall be provided as soon as it is available.

8.3 The Processor shall take reasonable measures to limit the consequences of the breach and assist the Customer in notifying the breach and informing data subjects.

9. Audits

9.1 The Processor shall provide the Customer with the information needed to demonstrate that the obligations in Article 28 GDPR and this DPA are met.

9.2 The Customer, or an independent auditor appointed by the Customer who is bound by confidentiality, has the right to audit the Processor's processing. An audit shall be announced at least 30 days in advance, may take place at most once a year unless an incident or a supervisory authority justifies it, shall be carried out without disrupting operations or giving access to other customers' data, and is paid for by the Customer.

10. Deletion and return

10.1 When the Main Agreement ends, the Processor shall revoke the service's authorisations in Fortnox and delete the personal data processed on the Customer's behalf within 30 days, unless storage is required by Union law or Swedish law.

10.2 Before the agreement ends, the Customer may request a copy of the event log in a machine-readable format. The bookkeeping itself remains in the Customer's Fortnox and does not need to be returned.

10.3 Data in backups is overwritten within the retention period that applies to the database provider's restore points, at most 30 days, and is used in the meantime only for restoring after faults.

11. Liability

The parties' liability under the DPA follows the limitation of liability in the Main Agreement, to the extent compatible with Article 82 GDPR. Administrative fines imposed on a party by a supervisory authority are borne by that party.

12. Validity and changes

12.1 The DPA applies as long as the Processor processes personal data on the Customer's behalf. Changes are made in the same way as changes to the Main Agreement. Changes required by law or by a decision of a supervisory authority may take effect at shorter notice.

12.2 In the event of conflict between the DPA and the Main Agreement, the DPA prevails in matters concerning the processing of personal data.

12.3 Swedish law applies. Disputes are settled in accordance with the Main Agreement.

Company

[Bolagsnamn AB]

Organisation number

[Organisationsnummer]

VAT registration number

[Momsregistreringsnummer]

Address

[Postadress]

E-mail

support@ekonomimcp.se

Annex 1: Technical and organisational security measures

Encryption

• All traffic to and from the service is encrypted with TLS. The website sends HSTS so that browsers only connect over an encrypted connection.
• Fortnox authorisations are encrypted with AES-256-GCM before they are stored. The keys are kept separate from the database and can be rotated without interruption.
• The database is encrypted at rest by the database provider.
• Access tokens for AI clients, sign-in sessions and one-time codes are stored only as SHA-256 hashes. Passwords, where used, are stored with scrypt.

Least privilege and access control

• The service asks Fortnox only for the permissions the tools need, and never for payroll, deletion of vouchers or the developer API.
• Each call is checked against the companies, the access level and the subscription that apply to the connection.
• In the default mode, irreversible actions require approval by the user who owns the connection. The approval is bound to a checksum of exactly the action that was shown, can be used once and is valid for at most 30 minutes.
• Forms that change something check that the request comes from the service's own website.
• Staff access to operations and database environments is limited to named persons with two-factor authentication.

Data minimisation

• No copy of the bookkeeping is stored. Data for reports is held in working memory for at most two minutes.
• Suppliers' bank details are not stored; only a checksum to detect changes.
• The event log stores arguments in a cleaned and shortened form, without secrets.

Traceability and integrity

• Each tool call and each approval decision is logged with time, user, company, AI client and result.
• Vouchers are checked before they are written: balance, accounts, financial year, locked periods, VAT and suspected duplicates.
• Identical write calls repeated within a short time are stopped.

Operations and continuity

• Servers and database run in the EU (Frankfurt) with providers that have their own security programmes.
• The database has automatic backups with restore points.
• Rate limiting protects against abuse and overload, both of the service and of Fortnox.
• Security headers protect sign-in and approval pages against being embedded in other sites (clickjacking).

Organisation

• Dependencies are kept up to date and security updates are prioritised.
• There is a procedure for incident management, and security vulnerabilities can be reported to security@ekonomimcp.se.
• Staff with access to personal data are bound by confidentiality.

Annex 2: Sub-processors