Non-disclosure agreement
- Agreement type
- Mutual
- Agreement date
- 2026-07-16
- Effective date
- 2026-07-16
1. Parties
This non-disclosure agreement (the Agreement) is entered into between:
- Part A
- Nyttio Demo AB
- Registration number
- 556799-1234
- Address
- Storgatan 1
111 22 Stockholm - Notice email
- avtal@nyttio.se
- Contact person
- Anna Andersson, Managing Director
- Part B
- Kund AB
- Registration number
- 556688-4321
- Address
- Kundvägen 2
222 33 Malmö - Notice email
- avtal@kundab.se
- Contact person
- Peter Persson, Head of Procurement
This Agreement is mutual. Each Party may be a Disclosing Party or Receiving Party depending on who discloses or receives the information.
2. Background and Purpose
The Purpose of this Agreement is as follows: The Parties shall evaluate and, if they decide to proceed, carry out a potential business and consultancy collaboration. The Receiving Party may use Confidential Information only to the extent necessary for this Purpose and not for its own product development, competing activities, marketing, or sales.
The Agreement applies only to information disclosed from the Effective Date.
3. Definitions
Group companies are not Representatives and may not receive access without the Disclosing Party's written approval.
- Confidential Information
- Information marked or identified as confidential or that, by its nature, content, or circumstances, should reasonably be understood as confidential, regardless of format or means of disclosure. It also includes the existence of discussions, this Agreement, and notes, analyses, or compilations derived from the information.
- Particularly relevant information
- Business plans, pricing, customer and supplier information, contracts, technical solutions, software, security information, personal data, and materials belonging to customers or other third parties.
4. Exceptions
Confidential Information excludes information the Receiving Party can demonstrate through reliable records was public without breach, already lawfully known without a duty of confidence, lawfully received from an authorised third party, independently developed without use of the information, or released in writing. Public components do not make a non-public combination or application public.
5. Permitted Use
The Receiving Party may use the information only for the Purpose, make necessary copies, and provide need-to-know access to authorised Representatives. It may not use the information for another customer, commercialise or license it, disclose it to a competitor, make it public, use it for re-identification, or bypass access or security controls. General professional knowledge may be used, but not identifiable trade secrets or specific documents and solutions.
Confidential Information may not, without written approval, be entered into external generative AI services, coding assistants, translation services, or analytics services, particularly where the provider may use it for training or product development.
6. Representatives, Consultants, and Subcontractors
Access may be given only to a Representative who needs the information, has been informed of its confidential nature, and is bound by law, professional duty, or a written agreement providing at least equivalent protection. The Receiving Party is responsible for its Representatives as for its own conduct and shall flow down relevant security and confidentiality requirements. No separate personal confidentiality undertaking is required.
7. End-Customer and Other Third-Party Information
The Agreement covers information belonging to a Protected Third Party. The Receiving Party is not automatically bound by undisclosed upstream or flow-down terms. Additional requirements become binding only if provided in writing, clear and relevant, supplied before access, and accepted in writing. References to policies as amended from time to time do not permit unilateral, unlimited, or materially cost-increasing obligations.
8. Information Security
The Receiving Party shall use at least the same care as for its own information of similar sensitivity and always a reasonable professional standard. Risk-appropriate controls shall include least privilege, individual accounts, secure authentication, encryption, malware protection, logging, backups, secure deletion, and instructions. Private email accounts, cloud services, or storage media may not be used.
9. Security Incidents
The Receiving Party shall notify the Disclosing Party without undue delay of actual or suspected unauthorised access, loss, misdirected disclosure, or other suspected breach. To the extent available, the notice shall describe the event, affected information and systems, likely consequences, actions, and a contact person. The Receiving Party shall immediately contain, investigate, and mitigate the incident and shall not make public statements without consultation unless required by law.
10. Required Disclosure and Protected Reporting
Information may be disclosed when required by law, court, authority, or binding market rule. Where permitted, the Receiving Party shall give prior notice, allow protective measures to be sought, and disclose only what is necessary. The Agreement does not restrict whistleblowing, reporting crimes or serious misconduct, cooperation with a competent authority, or confidential legal advice. The exception does not permit broader disclosure than the law requires or protects.
11. Personal Data
Each Party is responsible for its processing of personal data. This Agreement is not a legal basis, processor instruction, or data processing agreement. If a Party processes personal data on behalf of the other, a separate agreement compliant with Article 28 GDPR must be entered into before processing begins. The specific data processing agreement prevails within its scope.
12. Intellectual Property and Ownership
Confidential Information and associated rights remain the property of the Disclosing Party or Protected Third Party. No assignment, licence, or right to develop, manufacture, or market arises under this Agreement. The Receiving Party shall not disassemble, decompile, analyse, measure, test, or otherwise reverse engineer software, prototypes, samples, or technical materials, except to the limited extent permitted by mandatory law.
13. Accuracy and Further Cooperation
Information is provided as is without warranty of completeness or accuracy unless expressly agreed otherwise. This does not limit warranties in a separate main agreement. Neither Party is obliged to disclose particular information, enter another agreement, order or supply services, or continue negotiations.
14. No Non-Competition or Non-Circumvention Restriction
This Agreement governs confidentiality and information use. It does not create a non-compete, non-solicitation, customer-protection, exclusivity, direct-contact, or non-circumvention restriction. Such restrictions must be expressly agreed and may not be applied contrary to competition law.
15. Return and Deletion
On request or when the Purpose or Agreement ends, the Receiving Party shall within 10 Business Days return or securely delete the information, local copies, exports, notes, analyses, and physical media and confirm this on request. Legally required archive copies and inseparable automatic backups may be retained subject to continuing confidentiality, restricted ordinary access, and normal secure deletion cycles.
16. Term and Duration of Confidentiality
The Agreement takes effect on 2026-07-16 and remains in force indefinitely, terminable on 30 days' written notice. Termination does not affect information already disclosed. For information that is not a trade secret, confidentiality then continues for 5 years. Trade secrets remain protected while they meet the statutory requirements. Credentials and vulnerabilities remain protected until revoked or remediated, and personal data for as long as it is lawfully processed or retained.
17. Breach and Mitigation
A Party discovering or suspecting a breach shall immediately stop unauthorised use, mitigate harm, preserve relevant evidence, and notify the other Party. The Disclosing Party may seek interim or injunctive relief and other protective measures. The breaching Party is liable under applicable principles; a limitation in another agreement applies only if it expressly covers this Agreement and is not prevented by mandatory law or an express exception.
The Parties have not agreed a predetermined contractual penalty. Damages and other remedies are determined under this Agreement and applicable law.
18. Public-Sector Activities
Neither Party has been identified as a public authority or other organisation subject to public-access rules.
19. Protective Security
The Parties currently do not expect security-classified information or security-sensitive activities to be involved. If this assessment changes, access shall stop until the statutory security-protection measures are in place.
20. References, Names, and Publicity
Neither Party may, without the other Party's written approval, publicise the relationship, use the other Party's or an end customer's name or logo, identify them as a reference, or publish a case study or press release.
21. Relationship with Other Agreements
This Agreement supplements consultancy agreements, orders, and other contracts. A later agreement replaces or amends it only if expressly stated. A specific protective-security or data processing agreement prevails within its express scope. General references to policies or end-customer terms do not replace this Agreement.
22. Assignment
Neither Party may assign its rights or obligations without the other Party's written approval. Assignment is permitted in a merger or transfer of the principal business if the transferee assumes all obligations in writing.
23. Amendments, Waiver, and Severability
Amendments must be written and approved by authorised representatives. Failure to act is not a waiver. If a provision is invalid, the remaining provisions continue and the Parties shall replace it with a valid provision that as closely as possible achieves the same purpose.
24. Notices
Notices of termination, breach, incident, and other material matters shall be sent in writing to avtal@nyttio.se and avtal@kundab.se. Changes to contact details shall be notified without delay. Notice is deemed received on confirmed email delivery, the next Business Day after an error-free email sent before 16:00, or three Business Days after registered post.
25. Governing Law and Disputes
The Agreement is governed by the substantive laws of Sweden, excluding its conflict-of-laws rules. Any dispute arising out of or in connection with this Agreement shall be determined by the Swedish courts, with Stockholms tingsrätt as the court of first instance. Regardless of the chosen forum, a Party may seek interim injunctive or other urgent protective relief from a competent court.
26. Electronic Signatures and Counterparts
The Agreement may be signed electronically and in counterparts that together constitute one agreement. Each signatory confirms authority to represent the stated Party.
27. Signatures
The authorised representatives confirm that they have read and accepted the Agreement.
