Data Processing Agreement for kobbi

The terms Processing, Personal data, Controller, Processor, Personal data breach, Data subject and Third country have in this agreement the meaning given in Article 4 of the General Data Protection Regulation.

Data protection legislation — the General Data Protection Regulation and the Swedish legislation that supplements it, including the Swedish Data Protection Act (lagen 2018:218 med kompletterande bestämmelser till EU:s dataskyddsförordning).

Instruction — the documented instruction given by the Controller on the Processing, in this agreement Annex 1 together with later additions under section 7.3.

Log and Logging — the record kept of access to and operations on the Personal data, and the act of recording itself.

Sub-processor — a processor engaged by the Processor to carry out part of the Processing on behalf of the Controller.

The Service — the service kobbi provided by the Processor, an AI assistant that answers messages in the Controller channels (WhatsApp, Instagram DM and web chat) and that can look up catalogue, stock, order and return data.

End customer — a natural person who writes to the kobbi assistant of the Controller.

3.1 By this agreement together with the Instructions and the list of Sub-processors, the Controller governs the Processing of Personal data carried out by the Processor on behalf of the Controller. The purpose is to safeguard the rights and freedoms of the Data subject in the Processing, in accordance with Article 28(3) of the General Data Protection Regulation.

3.2 The main agreement under this agreement is the Customer Agreement for kobbi between the parties.

• Customer Agreement for kobbi

3.3 Where anything set out in section 1, section 3.2, sections 15 or 16, section 17.6, sections 18–20 or section 22 of this agreement is governed differently in the main agreement, the main agreement prevails.

4.1 The Controller hereby appoints the Processor to carry out the Processing on behalf of the Controller as set out in this agreement.

4.2 The Controller shall give written Instructions to the Processor on how the Processing is to be carried out. The Instruction is set out in Annex 1.

4.3 The Processor may carry out the Processing only in accordance with this agreement and the Instructions in force from time to time.

5.1 The Controller is responsible for there being a legal basis for the Processing at all times and for drawing up correct Instructions.

5.2 The Controller shall without undue delay inform the Processor of changes in the Processing that affect the obligations of the Processor under the data protection legislation.

5.3 The Controller is responsible for informing Data subjects about the Processing and for upholding the rights of Data subjects.

5.4 The Controller is responsible for not entering Personal data into the Service beyond what is set out in Annex 1, section 2. In particular, the Service is not intended for the processing of special categories of personal data within the meaning of Article 9 of the General Data Protection Regulation.

6.1 The Processor undertakes to carry out the Processing only in accordance with this agreement and for the specific purposes set out in the Instructions, and to comply with the data protection legislation.

6.2 The Processor shall take measures to protect the Personal data against all forms of Processing that are incompatible with this agreement, the Instructions and the data protection legislation.

6.3 The Processor undertakes to ensure that all natural persons working under its direction comply with this agreement and the Instructions.

6.4 At the request of the Controller, the Processor shall assist the Controller in ensuring compliance with the obligations under Articles 32–36 of the General Data Protection Regulation and in responding to requests for the exercise of the rights of the Data subject under Chapter III of the General Data Protection Regulation, taking into account the nature of the Processing and the information available to the Processor.

6.5 If the Processor finds that the Instructions are unclear, in breach of the data protection legislation or missing, the Processor shall without delay inform the Controller, temporarily cease the Processing and await new Instructions, unless the parties agree otherwise.

6.6 If the Controller provides the Processor with new or amended Instructions, the Processor shall, without undue delay from receipt, inform the Controller whether implementing the new Instructions changes the costs of the Processor.

6.7 The Service is an AI system. The Processor ensures that end users are informed that they are interacting with an AI system, in accordance with Article 50 of Regulation (EU) 2024/1689 (the AI Act). This information cannot be switched off by the Controller.

7.1 The Processor shall take all appropriate technical and organisational security measures required by the data protection legislation to prevent personal data breaches.

7.2 The Processor shall continuously ensure that the technical and organisational security of the Processing provides an appropriate level of confidentiality, integrity, availability and resilience.

7.3 Any additional or amended requirements on protective measures from the Controller after the parties have entered into this agreement are to be regarded as new Instructions under this agreement.

7.4 Through an access control system, the Processor shall grant access to the Personal data only to natural persons working under the direction of the Processor who need the access in order to perform their duties. Access is logged.

7.5 The Processor undertakes to continuously Log access to the Personal data. Logs are erased as set out in Annex 1, section 6. The parties agree that access logs and content logs have different retention periods: content logs are erased quickly in order to comply with Article 5(1)(e) of the General Data Protection Regulation, whereas access logs may be kept longer because they do not contain message content.

7.6 Sensitive identifiers, including personal identity numbers, are masked before they reach the logs or error monitoring of the Processor.

8.1 The Processor and all natural persons working under its direction shall observe both confidentiality and professional secrecy in the Processing. The Personal data may not be used or disclosed for other purposes, directly or indirectly, unless otherwise agreed.

8.2 The Processor shall ensure that all natural persons working under its direction who take part in the Processing are bound by a confidentiality undertaking in respect of the Processing. The Processor also undertakes to ensure that a confidentiality agreement is in place with the Sub-processor.

8.3 The Processor shall promptly notify the Controller of any contact with a supervisory authority concerning the Processing.

8.4 If a Data subject, a supervisory authority or a third party requests information from the Processor concerning the Processing, the Processor shall inform the Controller of the matter.

8.5 The Personal data is not used to train AI models. Personal data processed on behalf of the Controller is not used, either by the Processor or by a Sub-processor, to train, fine-tune or otherwise improve general AI models.

9.1 As part of its guarantees under Article 28(1) of the General Data Protection Regulation, the Processor shall without undue delay, at the request of the Controller, be able to account for the technical and organisational security measures used, in accordance with Article 28(3)(h) of the General Data Protection Regulation.

9.2 The Processor shall review the security of the Processing at least once (1) a year through a self-assessment. The result shall be shared with the Controller on request.

9.3 The Controller is entitled, itself or through another third party appointed by it (which may not be a competitor of the Processor), to verify that the Processor meets the requirements of this agreement, the Instructions and the data protection legislation.

9.4 As an alternative to sections 9.2–9.3, the Processor is entitled to offer other means of review, for example a review carried out by an independent third party.

9.5 The Processor shall enable a supervisory authority to carry out supervision as requested by that authority.

9.6 The Processor shall secure for the Controller rights towards the Sub-processor that correspond to all rights the Controller has towards the Processor under section 9.

10.1 Where the Controller has requested rectification or erasure because of incorrect Processing by the Processor, the Processor shall take appropriate action without undue delay and no later than within thirty (30) days of receiving the necessary information.

10.1.1 If the Controller states in its request that the action is needed in order for the Controller to answer a request from a Data subject within the time limit under Article 12(3) of the General Data Protection Regulation, the Processor shall take the action within ten (10) working days.

10.2 If the Processor takes technical and organisational measures in the Processing that may affect the Processing, the Processor shall inform the Controller in writing in good time before the measures are taken.

11.1 The Processor shall be able to restore the availability of and access to the Personal data in a timely manner in the event of a physical or technical incident, in accordance with Article 32(1)(c) of the General Data Protection Regulation.

11.2 The Processor undertakes to assist the Controller in meeting its obligations in the event of a personal data breach.

11.3 In the event of a personal data breach of which the Processor becomes aware, the Processor shall without undue delay and no later than within forty-eight (48) hours of becoming aware of the breach notify the Controller of the event in writing. The notification is sent to the contact person stated in section 1.

The description shall set out:

• a) the nature of the personal data breach and, where possible, the categories and approximate number of Data subjects concerned and the categories and approximate number of personal data records concerned,
• b) the likely consequences of the personal data breach, and
• c) the measures taken or proposed, including measures to mitigate the possible adverse effects of the personal data breach.

11.4 Where it is not possible to provide the full description at the same time, the description may be provided in phases without undue further delay.

12.1 The Processor is entitled to engage the Sub-processor or Sub-processors listed in the attached list of Sub-processors, Annex 2.

12.2 The Processor undertakes to enter into a written agreement with the Sub-processor that imposes on the Sub-processor the same data protection obligations as are imposed on the Processor in this agreement.

12.3 In the agreement with the Sub-processor, the Processor shall ensure that the Controller has the right to terminate the Sub-processor and to instruct the Sub-processor to erase or return the Personal data if the Processor has ceased to exist or become insolvent.

12.4 The Processor is fully responsible towards the Controller for the Processing carried out by the Sub-processor.

12.5 Where the Processor intends to engage a new Sub-processor or replace an existing one, the Processor shall notify the Controller in writing of

• a) the name, company registration number and registered office (address and country) of the Sub-processor,
• b) the type of data and the categories of Data subjects processed, and
• c) where the Personal data is to be processed.

12.6 The Controller is entitled, within thirty (30) days of the date of the notification under section 12.5, to object to the engagement of a new Sub-processor by the Processor and, on the basis of such an objection, to terminate this agreement in accordance with section 16.4.

12.7 The Processor shall at all times keep a correct and up-to-date list of Sub-processors and make it available to the Controller. The list shall in particular state in which country the Sub-processor processes the Personal data and what types of Processing the Sub-processor carries out.

12.8 When the Processor stops using a Sub-processor, the Processor shall notify the Controller in writing.

13.1 The Processor processes and stores the Personal data within the EU/EEA, with the exception of the transfers expressly set out in Annex 1, section 7 and in Annex 2. By accepting this agreement the Controller gives its Instruction regarding those transfers.

13.2 In other respects the Processor is entitled to transfer Personal data to a Third country for Processing only if the Controller has approved such a transfer in writing in advance and has issued Instructions for that purpose.

13.3 A transfer to a Third country may take place only if it is compatible with the data protection legislation and meets the requirements of this agreement and the Instructions.

14.1 Where compensation for damage in connection with the Processing is payable to the Data subject because of a breach of a provision of this agreement, the Instructions and/or an applicable provision of the data protection legislation, Article 82 of the General Data Protection Regulation applies.

14.2 Administrative fines under Article 83 of the General Data Protection Regulation, or under Chapter 6 section 2 of the Swedish Data Protection Act (lagen 2018:218), are borne by whichever party to this agreement the fine is imposed on.

14.3 If either party becomes aware of a circumstance that may lead to damage for the other party, that party shall without undue delay inform the other party and work actively together with it to prevent and minimise such damage.

14.4 Notwithstanding what is stated in the main agreement, sections 14.1 and 14.2 take precedence over other rules on the allocation of claims between the parties as regards the Processing.

14.5 Relationship to the limitation of liability in the main agreement. In addition to what follows from sections 14.1 and 14.2, section 10.1 (liability cap) and section 10.2 (indirect damage) of the main agreement also apply to claims between the parties based on this agreement. The limitations do not, however, apply to

• a) compensation payable directly to a Data subject under Article 82 of the General Data Protection Regulation, or
• b) administrative fines under Article 83 of the General Data Protection Regulation or under Chapter 6 section 2 of the Swedish Data Protection Act (lagen 2018:218), which are borne in accordance with section 14.2.

15.1 This agreement applies from the point in time when it has been accepted by both parties and until further notice. The parties have a mutual right to terminate this agreement on thirty (30) days notice.

15.2 This agreement never ceases to apply before the main agreement. For as long as the Processor processes Personal data on behalf of the Controller under the main agreement, this agreement applies. If this agreement is terminated under section 15.1 or section 16.4, the main agreement also ends at the same time, and fees relating to the time after that are refunded to the Controller.

16.1 Either party is entitled to call for renegotiation of this agreement if the ownership of the other party changes materially or if the applicable legislation, or its interpretation, changes in a way that is decisive for the Processing.

16.2 Additions to, and amendments of, this agreement shall be made in writing and accepted by both parties.

16.3 When either party becomes aware that the other party is acting in breach of this agreement and/or the Instructions, that party shall without delay notify the other party of the conduct.

16.4 If the Controller objects to the engagement of a new sub-processor by the Processor under section 12.6, the Controller is entitled to terminate this agreement with immediate effect.

17.1 After termination of this agreement the Processor shall without undue delay, depending on what the Controller chooses, either erase and certify to the Controller that this has been done, or return

• a) all Personal data processed on behalf of the Controller, and
• b) all related information such as Logs, Instructions, system solutions, descriptions and other documents.

17.1.1 Erasure is the default option. If the Controller does not request otherwise, the data is erased under section 17.1, and erasure takes place as soon as the account is closed. If the Controller instead wishes to have the data returned, such a request must be made in writing no later than at the same time as the termination; after that the data may already have been erased and cannot then be recreated.

17.1.2 On request the Processor provides a written certificate that erasure under section 17.1 has been carried out.

17.2 In connection with a return, the Processor shall also erase existing copies of Personal data and related information.

17.3 The obligation to erase does not apply where storage is required under Union or national law. The following data is therefore retained even after this agreement has expired:

17.4 If Personal data or related information is returned, it shall be done in a commonly used and standardised format.

17.5 Until the data is erased or returned, the Processor shall ensure compliance with this agreement.

17.6 Return or erasure under section 17.1 shall be completed no later than thirty (30) calendar days from the time of termination of this agreement, unless otherwise stated in the Instruction. Processing of Personal data carried out by the Processor after that is to be regarded as unlawful Processing.

17.7 The provisions on confidentiality and professional secrecy in section 8 continue to apply even if this agreement otherwise expires.

18.1 Notices concerning this agreement and its administration, including termination, shall be sent by e-mail to the contact person of each party for this agreement.

18.2 Notices concerning the cooperation of the parties on data protection shall be sent by e-mail to the contact person of each party for that cooperation.

18.3 A notice is deemed to have reached the recipient no later than one (1) working day after the notice was sent.

19.1 Each party shall appoint a contact person for this agreement.

19.2 Each party shall appoint a contact person for the cooperation of the parties on data protection.

20.1 Each party is responsible for the details stated in section 1 being correct and up to date at all times.

20.2 A change to the details in section 1 shall be notified to the other party in accordance with section 18.1.

21.1 This agreement is interpreted and applied under Swedish law, excluding its conflict of law rules. Disputes arising out of this agreement shall be settled by a competent Swedish court.

22.1 This agreement is accepted in the Service. On acceptance it is recorded which version was accepted, by which user and at what time. The agreement is in addition provided on request in digital format for electronic signature or in paper format for handwritten signature.

1 a. The subject matter of the Processing carried out by the Processor is to provide the kobbi service — an AI assistant that answers messages in the Controller channels (WhatsApp, Instagram DM and web chat) and that can look up catalogue, stock, order and return data — and to provide support for the service.

1 b. The purpose of the Processing is to enable the Controller to answer messages from its end customers automatically, to give them information about products, stock status, orders and returns, and to enable the Controller to follow up and quality assure the replies of the assistant.

1 c. The nature of the Processing — the following processing operations are carried out: collection, recording, structuring, storage, reading, use, automated analysis (embedding and model calls), disclosure by transmission to a Sub-processor, restriction and erasure.

2. The Processing covers the following types of Personal data:

• The content of messages between the end customer and the assistant of the Controller — text, image, audio and attached files.
• Channel identifiers — WhatsApp phone number, Instagram ID and profile name.
• Commerce and order data that the Controller has made available to the assistant, for example order number, delivery address and return status.

The Service never asks for a personal identity number. If a personal identity number is nevertheless sent in a message, it is masked before the data reaches the logs or error monitoring of the Processor. The Service is not intended for special categories of personal data under Article 9 of the General Data Protection Regulation.

3. The Processing covers the following categories of Data subjects:

• End customers of the Controller — natural persons who write to the kobbi assistant of the Controller via WhatsApp, Instagram DM or web chat.
• Employees and users of the Controller who have an account in the panel of the service.

4. Specific handling requirements.

• 4.1 The Processor shall apply the retention periods set out in section 6 below.
• 4.2 The Processor shall observe data minimisation when retrieving data from the channels, in particular as regards Instagram DM where EU data storage cannot be selected.
• 4.3 The Personal data is not used to train or fine-tune AI models (see section 8.5 of this agreement).

5. Specific technical and organisational security measures. The Processor takes the following measures:

6. Logging and retention periods.

A different retention period for conversations and messages may be agreed in writing between the parties.

7.1 Processing locations within the EU/EEA: operation and storage (database, files) take place in Stockholm, Sweden (Adminor AB). For the WhatsApp Business Platform, EU data storage has been selected (Germany).

7.2 Known limitations of EU data storage for WhatsApp: while a message is actually being processed, the content may reside in international data centres for up to 60 minutes, and the setting does not cover address book data.

7.3 Transfers to Third countries that the Controller instructs by accepting this agreement:

If the Controller has not given directions on the transfer of Personal data to a Third country in this Instruction, the Processor is not entitled to make such a transfer.

7.4 Transfer impact assessment. For each transfer based on Article 46(2)(c), the Processor shall draw up and keep up to date a transfer impact assessment in accordance with recommendations 01/2020 of the European Data Protection Board and the judgment of the Court of Justice of the European Union in case C-311/18 (Schrems II). The assessment is provided to the Controller on request.

8. Duration of the Processing. The Processing continues for as long as this agreement applies. The term of this agreement is set out in section 15. After the expiry of this agreement, section 17 applies.

9.1 Other instructions. At the request of the Controller, the Processor shall provide the information needed for the Controller to fulfil its record-keeping obligation under Article 30(2) of the General Data Protection Regulation.

The Controller approves that the Processor engages the Sub-processors listed below for the Processing of Personal data.