Data processing agreement

This agreement is part of the terms of service between Gridhall AB (the "processor") and the customer organization (the "controller"). It applies when the processor handles personal data on the controller's behalf through AICapacity.

It covers personal data the controller adds to listings, deal rooms, messages and documents, such as contact persons, signatories and employees named in contracts. It does not cover account data the processor handles as a controller, described in the privacy policy.

The processor processes personal data only to provide AICapacity as described in the terms and on the controller's documented instructions, which are given by the controller's use and configuration of the service. The processor informs the controller if it believes an instruction breaks data protection law.

• Purpose: hosting, matching, sharing with counterparties after mutual yes, notifications, support and backups.
• Data subjects: the controller's employees, contacts and counterparties named in content.
• Categories: names, job titles, business contact details and the content of messages and documents. Special categories are not expected and should not be uploaded.
• Duration: the term of the agreement, then deletion or return as set out below.

• Data is hosted in the EU and encrypted in transit and at rest.
• Organization data is isolated by row-level security in the database; counterparty identities are hidden until mutual yes.
• Staff access is limited to people who need it, bound by confidentiality, and logged, as are document downloads and identity reveals.
• Personal data is never sent to AI models.

The controller authorizes the sub-processors below. The processor imposes data protection terms on each that are no less protective than this agreement, and gives at least 30 days' notice of a new sub-processor by updating this page and e-mailing organization owners; the controller may object on reasonable grounds. Transfers outside the EU/EEA rely on standard contractual clauses or an adequacy decision.

The processor helps the controller answer data subject requests, including through the export and deletion tools in the product, and with impact assessments where reasonably required.

The processor notifies the controller without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the controller's data, with the information needed to meet the controller's own obligations.

The processor makes available the information needed to show compliance with this agreement and allows reasonable audits, with at least 30 days' notice, no more than once a year unless a breach has occurred, at the controller's cost.

When the agreement ends, the processor deletes the controller's personal data within 30 days, after giving the controller the opportunity to export it, except where law requires it to be kept (for example signed contracts and invoices). Questions: hello@aicapacity.ai.