DATA PROCESSING AGREEMENT

Grunden AI AB, reg. no. 559341-9129 | Last updated: 20260915

This Data Processing Agreement is incorporated into and forms part of the agreement between Grunden and the Customer.

This Data Processing Agreement (the “DPA”) forms part of the agreement between Grunden AI AB, reg. no. 559341-9129, Mårdstigen 4, SE-170 75 Solna, Sweden (“Grunden”) and the customer identified in the applicable agreement or order (the “Customer”) (each a “Party”, together the “Parties”) regarding Grunden’s AI inference services (the “Services”). It constitutes the Parties’ data processing agreement under Article 28(3) of Regulation (EU) 2016/679 (the “GDPR”). Terms defined in the GDPR have the same meaning in this DPA. References to Sections are to sections of this DPA. “Customer Content” means the content submitted to the Services by or for the Customer (Input) and the content generated by the Services in response (Output).

1. Scope, roles and instructions

1.1This DPA governs all processing of personal data by Grunden on behalf of the Customer under the agreement. In matters concerning the processing of personal data, this DPA prevails over the other parts of the agreement.

1.2Grunden processes personal data in two capacities: (i) in relation to Customer Content, Grunden is the Customer’s processor; and (ii) in relation to account, usage and billing data concerning the Customer’s personnel, Grunden is the Customer’s processor for the purposes of administering the Services. The processing is described in Appendix A.

1.3Where the Customer acts as processor for its own customers, or procures the Services for the benefit of its affiliates, portfolio companies or other underlying customers, Grunden is engaged as sub-processor within the meaning of Article 28(4) GDPR, and this DPA applies to Grunden in that capacity. Instructions are in that case given by the Customer; Grunden does not accept instructions directly from the Customer’s underlying customers.

1.4Grunden shall process personal data only on the Customer’s documented instructions, including with regard to transfers, unless required to do so by EU or member state law; in such a case, Grunden shall inform the Customer of that legal requirement before processing, unless the law prohibits it. Grunden shall inform the Customer without undue delay if, in its opinion, an instruction infringes the GDPR or other applicable data protection law.

1.5Where the Customer has undertaken data protection obligations towards its own customers and has made them available to Grunden, this DPA shall be applied so as to enable the Customer to comply with those obligations; in case of conflict, the stricter obligation applies.

2. Confidentiality and records

2.1Grunden shall ensure that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access is limited to what each person needs for their role.

2.2Grunden shall maintain a record of processing activities under Article 30(2) GDPR and shall make available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR.

3. Security

3.1Grunden shall implement and maintain technical and organisational measures appropriate to the risk in accordance with Article 32 GDPR, at all times including at least the measures set out in Appendix C. The measures may be updated provided that the overall level of security is not reduced.

3.2Grunden shall carry out penetration testing by an independent third party at least annually and shall make summary results available to the Customer on request within thirty (30) days of completion.

4. No training and data rights

4.1Grunden shall not use Customer Content or any personal data processed under this DPA to train, fine-tune or improve any model, and shall impose the same restriction throughout its sub-processor chain.

4.2Customer Content belongs to the Customer or, where applicable, the Customer’s underlying customer. Grunden acquires no rights to Customer Content beyond what is necessary to provide the Services and may not use it for any own purpose.

5. Location of processing and transfers

5.1All processing of Customer Content takes place on infrastructure located within the EU/EEA. Features enabling third-country processing are disabled by default at organisation level and may be enabled only on the Customer’s written instruction for a specific account.

5.2Transfers of personal data to countries outside the EU/EEA are prohibited unless the Customer has approved the transfer in writing in advance, a valid transfer mechanism under Chapter V GDPR is in place, and the transfer is limited to the specific account, feature and purpose approved. For the avoidance of doubt, no Customer Content is transferred outside the EU/EEA under any circumstances.

6. Sub-processors

6.1The Customer provides a general authorisation for the sub-processors listed in Appendix B. Grunden shall keep its sub-processor chain, including the GPU infrastructure providers, published and current, and shall notify the Customer at least thirty (30) days before any addition or replacement. The Customer may object on reasonable, documented grounds within fourteen (14) days of notification; if the objection is not resolved, the Customer may terminate the affected part of the Services without cost.

6.2Grunden shall impose data protection obligations no less protective than this DPA on each sub-processor and remains fully liable for their performance. Sub-processors in the Customer Content data path are limited to providers processing within the EU/EEA.

7. Assistance

7.1Grunden shall, taking into account the nature of the processing, assist the Customer with appropriate technical and organisational measures in responding to requests from data subjects under Chapter III GDPR. Requests received directly by Grunden are forwarded to the Customer without undue delay and are not answered by Grunden except on instruction.

7.2Grunden shall assist the Customer in ensuring compliance with Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to Grunden.

8. Personal data breaches

8.1Grunden shall notify the Customer of a personal data breach affecting personal data processed under this DPA without undue delay and in any event no later than forty-eight (48) hours after becoming aware of it, with the information required under Article 33(3) GDPR to the extent available, supplemented as further information becomes available and with a final incident report within fifteen (15) business days. Grunden shall take reasonable measures to contain and remediate the breach and shall cooperate with the Customer and, where relevant, the Customer’s underlying customers.

9. Audits

9.1The Customer may audit Grunden’s compliance with this DPA once per twelve (12) month period, and additionally following a personal data breach or a documented compliance concern, on fourteen (14) days’ written notice or shorter where warranted by the circumstances. The Customer may exercise the audit right through an independent third party, and may extend the right to its underlying customers’ or their regulators’ auditors where required by controller or regulatory obligations. Each Party bears its own costs; audits are conducted so as to minimise disruption to Grunden’s operations.

10. Deletion and return

10.1Grunden shall export all data relating to the Customer’s accounts in open, machine-readable formats within thirty (30) days of the Customer’s request and at termination, with reasonable migration assistance.

10.2Upon termination of the agreement, Grunden shall delete all personal data processed under this DPA within thirty (30) days and certify deletion on request, except to the extent retention is required by EU or member state law. Operational and security logs are retained for 30 days and then deleted.

11. Term

11.1This DPA applies for as long as Grunden processes personal data under the agreement and, for personal data retained under statutory obligations, until deletion.

APPENDIX A: DESCRIPTION OF THE PROCESSING

Subject matter and nature

AI inference services: processing of prompts (Input) and generation of Output via API, with associated account administration, logging, security monitoring, support and billing.

Duration

The term of the agreement plus the deletion period under this DPA.

Capacity (i): Customer Content

The content of the Services: prompts submitted by the Customer’s users (Input) and the responses generated (Output), including any personal data they contain. The Customer (or its underlying customer) is controller and Grunden is the Customer’s processor or, where Section 1.3 applies, sub-processor. Data subjects and categories follow from what users submit. Special categories (Article 9 GDPR) shall not be submitted unless separately agreed.

Capacity (ii): account, usage and billing data

The administrative data around the Services: name, e-mail, account, usage and billing data for personnel with account access, never the content of prompts or responses.

Retention

Customer Content is processed transiently and not stored beyond what this DPA permits. Operational and security logs per Section 10.2. Billing data as required by applicable accounting law. Deletion on termination per Section 10.2.

APPENDIX B: APPROVED SUB-PROCESSORS

General authorisation is granted for the sub-processors listed below. Changes are notified and may be objected to in accordance with Section 6.1.

Model weights are obtained read-only from public repositories and deployed self-hosted on the infrastructure above; no model licensor has access to Customer Content or processes personal data, and model licensors are therefore not sub-processors within the meaning of Article 28 GDPR.