Data Processing Agreement

Data controller: [Company] (the "Customer") Data processor: Sev Nordic AB ("Onesync"), as identified in the Agreement

Within the service, Onesync processes certain personal data on the Customer’s behalf. This annex governs that processing. Where the processing falls within the scope of the EU General Data Protection Regulation (GDPR), this annex is the written contract required by Article 28 GDPR. Where it falls within the scope of UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, this annex governs the processing accordingly. Where both apply, the stricter requirement prevails.

The processing covers the personal data necessary to provide the service under the Agreement and continues for as long as the Agreement is in force. On termination, the clause on deletion and return below applies.

The processing covers:

- Names, email addresses and telephone numbers of the Customer’s own clients and newsletter subscribers - Bookings and enquiries, including the time requested and any free text the visitor writes - Messages in chat, email and cases between the Customer’s own clients and the Customer - Customer records the Customer keeps in the service - Visit statistics (for example clicks and page views) relating to the Customer’s pages and widgets - Data connected to the Customer’s Google Business Profile account administered by Onesync

The data subjects are the Customer’s own clients and, where applicable, the Customer’s staff connected to the account.

## Special categories The service is not built for the special categories of personal data referred to in Article 9 GDPR. Onesync never asks for them, and the free-text fields shown to the Customer’s own clients expressly ask them not to write identity numbers or health information. The Customer shall likewise not use free-text fields to enter such data.

Free text may nonetheless contain it, because it is the data subject who writes. Where such data is provided, the Customer as controller is responsible for having a condition under Article 9(2) and for handling the data accordingly. Onesync processes it only on the Customer’s instructions and on the same terms as the other data in this annex.

The personal data is processed solely to provide the services under the Agreement: receiving and handling bookings, enquiries and messages, keeping the Customer’s own customer records, sending mailings, producing analytics and administering the Google Business Profile. Onesync may not use the data for its own or any other purpose, save for the aggregated statistics described below.

Onesync applies the following retention periods. The Customer may at any time instruct a shorter period in writing; a longer period requires the Customer to state its legal basis for it.

- Chat conversations with guests and customers, including messages: 90 days. - The assistant chat used by the Customer’s own staff: 180 days. - Proof of cookie consent: 24 months. The consent itself expires after 12 months and is then obtained again. - Login attempts: 24 hours. - All other personal data processed on the Customer’s behalf — bookings, enquiries, subscribers and the customer register — is kept for the term of the Agreement and is then deleted or returned under the clause on deletion and return.

Deletion is carried out by an automated job that runs every night, not on request after the fact. Onesync maintains a register of every retention period and supplies it on request.

Deletion from the running system does not immediately reach backups. The sub-processor operating the database holds backups for a limited period, after which the data ceases to exist there too. Onesync does not restore a backup to recover data deleted under this clause.

Onesync produces aggregated statistics about how the platform is used — visit counts, booking counts, message counts and similar tallies. Those statistics contain no identifier: they are built from records in which no name, email address, plaintext IP address or browser string is stored, and they cannot be linked to an individual visitor.

The statistics are therefore not personal data, and Onesync is responsible for them in its own name. The personal data processed on the Customer’s behalf is not used for Onesync’s own purposes. This is deliberate: a processor that begins to determine the purposes of a processing operation becomes a controller for it under Article 28(10) GDPR, whatever the contract calls the parties, and the aggregation is what keeps the allocation of roles in the Agreement real.

- Process personal data only on the Customer’s documented instructions, including as set out in this annex. - Ensure that personnel with access to the data are bound by confidentiality. - Implement appropriate technical and organisational security measures (for example access control and encryption in transit) to protect the data. - Assist the Customer in responding to requests from data subjects exercising their rights. - Notify the Customer without undue delay, and no later than 72 hours after becoming aware, of a personal data breach affecting the data processed. - Engage sub-processors only in accordance with the clause below, and impose on them obligations equivalent to those in this annex. - On request, provide the information reasonably required to demonstrate compliance with this annex.

Onesync may engage sub-processors (for example providers of hosting, email delivery and AI services) to provide the service. Onesync is responsible for imposing on sub-processors the same data protection obligations as apply under this annex.

The current list of sub-processors is published at https://onesync.se/integritet/underbitraden and is also available on request. The Customer is notified in advance of any change of sub-processor processing personal data under this annex, with the opportunity to object.

Onesync is Sev Nordic AB, a Swedish company established in the European Union, so the processing under this annex takes place within the EU. Personal data is stored inside the EU/EEA and is not stored in any third country.

Where the data is stored does not by itself decide whether a transfer takes place: what decides it is who is given access. Certain sub-processors are companies established outside the EU/EEA, in some cases even where the processing itself runs on EU infrastructure. They are named rather than hidden, and the transfer is made on the basis of the European Commission’s Standard Contractual Clauses (Decision 2021/914), Module Two or Module Three as applicable, which the Parties agree to enter into and which are incorporated into this annex by reference.

Onesync has carried out a transfer impact assessment covering those transfers and supplies it to the Customer on request, together with any further assistance the Customer reasonably requires. Onesync is responsible for monitoring that the transfer basis remains valid and for informing the Customer of changes affecting it. Which sub-processors are concerned appears at https://onesync.se/integritet/underbitraden.

On termination of the Agreement, Onesync shall, at the Customer’s choice, delete or return all personal data processed on the Customer’s behalf, and delete existing copies, unless storage is required by applicable law. This shall be done within 30 days of termination.

Each Party is liable for damage caused by its failure to meet its obligations under applicable data protection law or this annex, in accordance with the limitation of liability in the Agreement.

This annex takes effect at the same time as the Agreement and applies for as long as the Agreement is in force, and thereafter to the extent required to fulfil the obligations in the clause on deletion and return.