Data processing agreement

This agreement is entered into between [Customer company, reg. no.] (the "Customer", controller) and Axegren Invest AB, reg. no. 559241-6001, provider of Ecomduct (the "Provider", processor).

The Customer uses Ecomduct to analyse its store, advertising and content and to publish content it approves. This agreement governs the Provider's processing of personal data on the Customer's behalf under Article 28 GDPR.

The processing covers the data subjects, personal data and purposes set out in Annex 1, for as long as the Customer uses Ecomduct and thereafter under section 11.

The Provider processes personal data only on the Customer's documented instructions. This agreement, the terms of service and the Customer's choices in Ecomduct (for example which platforms are connected and which content is approved for publishing) constitute instructions.

The Provider shall promptly inform the Customer if it considers an instruction to infringe data protection law.

The Provider ensures that persons authorised to process the personal data are bound by confidentiality.

The Provider implements the technical and organisational measures required by Article 32 GDPR, described in Annex 2.

The Customer grants a general authorisation to engage sub-processors. The providers listed on the Sub-processors page (/subprocessors) are approved at signature.

The Provider informs the Customer at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable grounds and, if the parties cannot agree, terminate the service. The Provider imposes equivalent obligations on each sub-processor and remains liable for them.

The database and files are stored in the EU. Transfers outside the EU/EEA take place only with a lawful mechanism under Chapter V GDPR, such as an adequacy decision (including the EU–US Data Privacy Framework) or Standard Contractual Clauses.

Taking into account the nature of the processing, the Provider assists the Customer in responding to data subject requests and with impact assessments and prior consultations where required.

Requests the Provider receives directly from data subjects are forwarded to the Customer without undue delay.

The Provider notifies the Customer without undue delay, and no later than 48 hours after becoming aware of a personal data breach, with the information the Customer needs to notify the supervisory authority.

The Provider makes available the information necessary to demonstrate compliance and allows for audits by the Customer or an independent auditor it appoints, with reasonable notice and at most once a year unless a breach justifies otherwise.

When the Customer stops using Ecomduct, the Provider shall, at the Customer's choice, return the Customer's data (export) and then delete it. Active data is deleted within 90 days; backups are overwritten in the normal cycle and deleted within a further 90 days.

Data the Provider is legally required to keep, such as accounting records, is kept for as long as the law requires.

Each party is liable under Article 82 GDPR. This agreement prevails over the terms of service on matters of personal data. It applies for as long as the Provider processes personal data on the Customer's behalf.

Swedish law applies. Disputes are settled by the Swedish general courts.

Data subjects: the Customer's staff and users of Ecomduct; people shown or named in the Customer's content; people who interacted with the Customer's social accounts (in aggregated statistics).

Personal data: names and email addresses of users; images, video and copy; statistics from connected accounts. Ecomduct does not store personal data about the Customer's shoppers. Special categories of data (Article 9) shall not be uploaded.

Purposes: analysis of sales, advertising and content; AI-assisted suggestions; scheduling and publishing of content the Customer approves.

Database and files are stored in the EU (Ireland). All traffic is encrypted (TLS).

Access is controlled per workspace and role; row-level security in the database prevents access to other customers' data. Files are stored privately and served through time-limited links, except media the Customer publishes openly.

Tokens for connected platforms are stored encrypted and can only be read by the server.

Changes that are published or sent to connected platforms require the Customer's approval and are logged.