DATA PROCESSING AGREEMENT
This data processing agreement (the "Agreement") is entered into between:
ControllerNyttio Demo Ltd556688-43211 High Street, LondonContact person: Anna AndersonEmail: info@nyttio.sePhone: 08-123 45 67
ProcessorSupplier Ltd559999-111110 Supplier Road, ManchesterContact person: Peter PearsonEmail: contact@supplier.examplePhone: 040-12 34 56
1. Background
The controller engages the processor to process personal data on the controller's behalf under this agreement (the "Agreement").
2. Scope of processing
Description of processing: The supplier provides operation and support of our IT system, including storage of personal data in a cloud service.
Categories of personal data: Customer details, contact details, contracts and orders
Categories of data subjects: Customers, suppliers and contact persons
Purpose and nature: To perform the services described above on the controller's behalf.
Start date and duration: 2026-10-25; Until further notice.
3. Processor obligations
The processor shall:
- process personal data only on documented instructions from the controller, including transfers to third countries, unless required by law;
- ensure that persons authorised to access the data are bound by confidentiality;
- maintain required records and comply with applicable data protection law; and
- immediately inform the controller if an instruction, in the processor's opinion, infringes data protection law.
4. Security
The processor shall implement appropriate technical and organisational measures under Article 32 GDPR. Measures shall be risk-based and include access control, authentication, encryption where appropriate, backups, logging, continuity, and regular testing and evaluation.
5. Sub-processors
The processor may engage sub-processors only with the controller's specific or general written authorisation. Under general authorisation, the processor shall give notice of intended changes so the controller may object. The sub-processor shall be bound by equivalent data protection obligations. The processor remains responsible for its performance.
6. Assistance to the controller
Taking into account the nature of processing, the processor shall assist the controller in responding to data subject requests and meeting obligations concerning security, impact assessments, prior consultation and regulatory requirements.
7. Personal data breaches
The processor shall notify the controller without undue delay after becoming aware of a personal data breach. To the extent available, the notice shall describe the breach, affected categories and scale, likely consequences, measures taken or proposed, and a contact for further information.
8. Transfers outside the EU/EEA
Personal data shall not be transferred outside the EU/EEA without documented instructions and a valid GDPR transfer mechanism. On request, the processor shall disclose storage locations and applicable safeguards.
9. Information and audits
The processor shall provide information necessary to demonstrate compliance with this Agreement and Article 28 GDPR and allow and contribute to reasonable audits. Audits shall normally be announced with reasonable notice and conducted without unnecessary disruption.
10. Return and deletion
When the services end, the processor shall, at the controller's choice, return or delete the personal data and existing copies unless law requires continued storage. Deletion shall be capable of written confirmation.
11. Confidentiality, liability and amendments
The parties' confidentiality obligations survive termination. Each party is responsible for its obligations under applicable law. Amendments and additions must be in writing and approved by both parties.
12. Term and termination
The Agreement applies from 2026-10-25 and continues until further notice.
The controller may terminate the Agreement if the processor materially breaches its data protection obligations and fails to remedy the breach within a reasonable period.
13. Governing law and disputes
The Agreement shall be governed by swedish law. Disputes shall first be resolved by negotiation and thereafter by a court of competent jurisdiction with Stockholm as the first instance, unless mandatory law provides otherwise.
14. Additional terms
This agreement replaces previous data processing agreements between the parties.
15. Signatures
Stockholm, 2026-10-25
For the controller: Nyttio Demo Ltd
________________________________________
Name: Anna Anderson
For the processor: Supplier Ltd
________________________________________
Name: Peter Pearson
