Data Processing Agreement

In connection with the provision of the Services, Emfas may process certain personal data on behalf of the Customer. Therefore, the Parties have entered this Data Processing Agreement (the "DPA") which constitutes a part of the Agreement between the Customer (hereinafter, the "Controller") and Emfas (hereinafter, the "Processor"). For the purposes of this DPA, the Controller is data controller and the Processor is a data processor.

In this DPA, capitalized terms shall have the meanings set out below or if not defined herein, the meanings set forth in Applicable Legislation or in the Agreement.

The Processor shall process the Data solely for the purposes of providing the Services in accordance with the Agreement and this DPA. The Parties shall update https://emfas.ai/sub-processors in the event of additional or amended instructions. The Processor will promptly comply with all such instructions to the extent necessary for it to (i) comply with its Processor obligations under Applicable Legislation; or (ii) assist the Controller to comply with Controller obligations under Applicable Legislation relevant to the Services. The Processor is entitled to charge additional fees if it expects to incur additional costs or charges to comply with the Controller’s additional or amended instructions.

Notwithstanding the above, the Processor may undertake reasonable day-to-day actions with the Data without having received specific written instructions from the Controller, provided that the Processor acts for and within the scope of the purposes stated at https://emfas.ai/sub-processors. The Processor may always undertake the actions necessary to fulfil its obligations under the Agreement or Applicable Legislation.

In the event that the Processor reasonably considers that any instructions violate Applicable Legislation, the Processor shall promptly notify the Controller thereof.

The Processor shall maintain adequate technical and organizational security measures to ensure that the Data is protected against destruction, modification and proliferation. The Processor shall further ensure that Data is protected against unauthorized access.

The Processor shall ensure (i) that only authorized employees or consultants have access to the Data, (ii) that the authorized employees or consultants process the Data only in accordance with this DPA and the Controller’s instructions and (iii) that each authorized employee or consultant is bound by a confidentiality undertaking towards the Processor in relation to the Data.

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach. Such notification shall include information reasonably necessary for the Controller to enable it to comply with its obligations under Applicable Legislation.

The Processor shall make commercially reasonable efforts, to identify the cause of such personal data breach and take such steps as the Processor deems necessary and reasonable in order to remedy the cause of such personal data breach. The obligation to remedy the cause of a personal data breach shall not apply to personal data breaches that are caused by the Controller.

The Processor shall assist the Controller with the fulfilment of the Controller’s obligation to ensure that the data subjects may exercise their rights under Applicable Legislation by ensuring appropriate technical and organizational measures. The Processor is obligated to notify the Controller without undue delay of any such requests from data subjects to exercise their rights.

The Processor shall further assist the Controller in relation to the Controller’s obligations under Articles 32-36 of the GDPR. The Processor is entitled to charge the Controller for any work carried out by it to comply with this Section 6 on a time and material basis in accordance with the hourly rates set out in the Agreement.

The Controller provides the Processor with a general authorization to engage third parties as necessary to process the Data or any part thereof on its behalf ("Sub-Processor").

The Processor shall enter into written agreements with each Sub-Processor, on terms which ensures the same level of data protection and security as under this DPA. The Processor shall be liable towards the Controller for each Sub-Processor’s acts and omissions as for its own.

The Processor maintains a list of Sub-Processors which are available on https://emfas.ai/sub-processors. The Processor will notify the Controller in writing of any changes to the list. If the Controller objects to any new Sub-Processor within thirty (30) days of such notice, the Processor and Controller will work together in good faith to find a mutually acceptable resolution to address such objection, including but not limited to reviewing additional documentation supporting the Sub-Processor's compliance with this DPA and Applicable Legislation, or delivering the Services without the involvement of such Sub-processor. In the event that the Processor and Controller cannot reach a mutually acceptable resolution within a reasonable timeframe, the Processor shall be entitled to terminate the Agreement upon 45 days’ notice.

Upon the Controller’s request, the Processor will provide to the Controller information necessary to demonstrate the Processor’s compliance with its obligations under Applicable Legislation and this DPA.

If the Controller finds the information in clause 9.1. insufficient or identifies any material non-compliance, the Controller shall be entitled to conduct an audit of the Processor's data processing and relevant information. This audit can be carried out once per year, with a 30-day written notice. The Processor shall reasonably assist the Controller during such audit. The Controller shall be solely responsible for any and all costs and expenses associated with an audit.

Upon completion of such audit, the Controller will provide the Processor with a copy of the audit report, which is subject to the confidentiality terms of this DPA. The Controller may use the audit reports only for the purposes of meeting regulatory audit requirements and/or confirming compliance with the requirements of this DPA.

If a data protection authority carries out an audit of the Processor which may involve the processing of the Data, the Processor shall promptly notify the Controller thereof.

Each Party’s liability for damages under this DPA is governed by and set out in the General Terms and Conditions to the Agreement.

Notwithstanding the foregoing, administrative fines under Article 83 of the GDPR, due to a party’s breach of its obligations under the GDPR, shall be imposed on the offending party and shall not be subject to any limitations under this DPA.

This DPA shall be governed by, and construed in accordance with, the substantive laws of Sweden.

Any dispute, controversy or claim arising out of or in connection with this DPA, or the breach, termination or invalidity thereof, shall be finally settled by arbitration in accordance with the Rules of the Arbitration Institute of the Stockholm Chamber of Commerce.

The arbitral tribunal shall be composed of three (3) arbitrators. The seat of arbitration shall be Stockholm, Sweden, and the language to be used in the arbitral proceedings shall be English.

If there is more than one dispute, controversy or claim arising out of or in connection with this DPA, and/or any other document made pursuant thereto, such disputes, controversies or claims, shall, unless deemed inappropriate by the arbitral tribunal in its sole discretion, be settled within the same arbitration proceedings, or, at least, by the same arbitrators.

The information concerning any dispute, controversy or claim arising out of or in connection with this DPA, including any arbitral award, shall remain confidential, save that a party may disclose such information if necessary to exercise its rights under this DPA, any arbitral award or due to regulatory requirements.