Legal
Epicz Lab AB | Version 1.0 | Effective date: This document applies from the Effective Date specified in the applicable Order Form, unless otherwise expressly agreed in writing.
This Data Processing Addendum ("DPA") supplements and forms part of the Master Subscription Agreement and applicable Order Form (the "Agreement") entered into by and between:
1. Epicz Lab AB ("Processor"), and
2. The entity identified as the customer in the Order Form ("Controller" or "Customer").
• "Applicable Data Protection Law" means all applicable worldwide legislation relating to data protection and privacy, including the EU General Data Protection Regulation (EU 2016/679) ("GDPR"), the UK GDPR, and the California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA"), as amended.
• "Personal Data", "Data Subject", "Processing", "Controller", and "Processor" have the meanings given to them under Applicable Data Protection Law.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data processed by Processor.
• "Sub-processor" means any third party appointed by Processor to process Customer Personal Data in connection with the Agreement.
2.1 Roles of the Parties: The parties acknowledge that Customer acts as the Controller (or Processor acting on behalf of a third-party controller) and Epicz Lab acts as the Processor with respect to Customer Personal Data.
2.2 Compliance with Laws: Each party shall comply with its respective obligations under Applicable Data Protection Law.
2.3 Customer Instructions: Processor shall process Personal Data solely on documented instructions from Customer, including regarding transfers of Personal Data outside the EEA/UK, unless required to do so by applicable law.
3.1 Confidentiality: Processor ensures that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3.2 Security Measures: Processor shall implement and maintain appropriate technical and organizational measures designed to ensure a level of security appropriate to the risk, including the measures detailed in Annex II.
3.3 Data Subject Rights: Taking into account the nature of the processing, Processor shall assist Customer by appropriate technical and organizational measures, insofar as possible, in responding to requests from Data Subjects exercising their rights under Applicable Data Protection Law.
3.4 Assistance with Compliance: Processor shall reasonably assist Customer in ensuring compliance with Customer's obligations regarding security, breach notifications, impact assessments (DPIAs), and prior consultations with supervisory authorities.
4.1 Authorized Sub-processors: Customer grants Processor general written authorization to engage Sub-processors. Processor's current list of Sub-processors is available upon request or published at trust.epiczlab.com/subprocessors.
4.2 Notice of Changes: Processor shall provide Customer with reasonable advance notice (e.g., via email or status page update) of any intended appointment of new Sub-processors or replacements.
4.3 Right to Object: Customer may object to a new Sub-processor on reasonable data protection grounds within 30 days of notice. If the parties cannot resolve the objection, Customer may terminate the relevant services.
4.4 Sub-processor Obligations: Processor shall impose data protection terms on any Sub-processor that are substantially similar to those set out in this DPA.
5.1 Processor shall notify Customer without undue delay (up to 48h) after becoming aware of a Security Incident affecting Customer Personal Data. Processor shall provide the information then available and supplement it without undue further delay as additional information becomes available.
5.2 Such notification shall include, to the extent available: a description of the incident, the categories and approximate number of Data Subjects and records concerned, likely consequences, and remediation measures taken or planned.
5.3 Processor's notification of or response to a Security Incident shall not be construed as an admission of fault or liability.
6.1 Hosting Location. Processor uses datacenters in Europe as the primary hosting location for Customer Personal Data. Any additional processing locations, including those used by Sub-processors, shall be identified in the applicable processing annex or Sub-processor list and remain subject to this DPA.
6.2 Onward Transfers. Processor shall ensure that any onward international transfer, including remote access where it constitutes a transfer under Applicable Data Protection Law, complies with Customer's documented instructions and Applicable Data Protection Law. Where an applicable adequacy decision does not cover the transfer, Processor shall ensure that appropriate safeguards are in place before the transfer begins, including, where applicable, the relevant module of the EU Standard Contractual Clauses with completed annexes, the UK International Data Transfer Addendum, or required Swiss adaptations.
6.3 Sub-processors and Precedence. Processor shall ensure that transfers to its Sub-processors meet these requirements. The notification and objection provisions in Section 4 continue to apply. Any applicable mandatory transfer clauses shall prevail over conflicting provisions of this DPA or the Agreement.
7.1 Upon termination or expiration of the Services involving the processing of Customer Personal Data, Processor shall, at Customer's choice, return or delete that Customer Personal Data and delete remaining copies, unless Union or Member State law applicable to Processor requires continued storage.
7.2 Customer shall communicate its choice of return or deletion within 15 days following termination or expiration. Processor shall complete the return or deletion within 30 days following termination or expiration. If Customer provides no instructions within the 15-day period, Processor shall delete the Customer Personal Data within that 30-day period, subject to Sections 7.3, 7.4 and 7.6.
7.3 Customer Personal Data retained in backups shall be isolated from ordinary use and deleted through the established backup lifecycle within 90 days following termination or expiration. Until deletion, such data shall remain protected under this DPA and shall not be processed except as necessary for secure storage, disaster recovery or compliance with applicable law. If a backup is restored, Processor shall reapply the applicable deletion instructions.
7.4 Where continued storage is legally required, Processor shall retain only the data required, for only the required period, and restrict processing to that legal purpose. Processor shall inform Customer of the requirement unless legally prohibited.
7.5 Processor shall ensure that its Sub-processors comply with the applicable return and deletion requirements. On Customer's request, Processor shall provide written confirmation of completion, identifying any data temporarily retained under Sections 7.3, 7.4 or 7.6 and its applicable retention period. This DPA shall continue to apply for as long as Processor or its Sub-processors retain Customer Personal Data.
7.6 Support and Diagnostic Data. Customer Personal Data contained in support tickets, support correspondence, and diagnostic logs or debugging records created in connection with support requests or incident investigations ("Support Data") may be retained after termination or expiration for up to twenty-four (24) months, in accordance with Processor's data management policy. Processor may retain Support Data solely to document support and incident history, to establish, exercise or defend legal claims, and to maintain security and audit records. Processor shall limit Support Data to what is necessary for those purposes, restrict access to it, keep it protected under this DPA, and not process it for any other purpose. At the end of the retention period, Processor shall delete or anonymise Support Data, unless Section 7.4 requires longer retention. Support Data does not include copies of Customer's production datasets or of the Customer Knowledge Model.
8.1 Processor shall make available to Customer all information necessary to demonstrate compliance with its obligations under this DPA and Article 28 of the GDPR, and shall allow for and contribute to audits, including inspections, conducted by Customer or an independent auditor mandated by Customer.
8.2 Customer shall first consider relevant, current independent audit reports, certifications and other compliance information made available by Processor. Where that information is insufficient to demonstrate compliance, Customer may conduct a further audit or inspection. The availability of reports or certifications shall not remove Customer's audit rights.
8.3 Routine audits shall be conducted on reasonable advance notice, during normal business hours, and ordinarily no more than once in any twelve-month period. These limitations shall not prevent additional or expedited audits where required by applicable law or a competent supervisory authority, following a Security Incident affecting Customer Personal Data, or where Customer has reasonable grounds to suspect material noncompliance with this DPA.
8.4 The parties shall cooperate to agree an appropriate scope and arrangements for each audit. Audits shall be subject to reasonable confidentiality and security safeguards, protect other customers' information, and minimize unnecessary disruption. These safeguards shall not prevent an effective audit or restrict a competent supervisory authority's powers.
8.5 Processor shall promptly address any noncompliance identified by an audit and provide Customer with information on the corrective actions taken or planned. Processor shall immediately inform Customer if, in its opinion, an instruction infringes the GDPR or other applicable Union or Member State data protection law.
8.6 Audit Costs. Customer shall bear its own costs of conducting audits, including the fees of any auditor it appoints. For any audit beyond the first audit in a twelve-month period, Customer shall also reimburse Processor for reasonable, documented costs directly attributable to supporting that additional audit. Processor shall provide an advance estimate, and the parties shall agree the applicable rates and scope of chargeable assistance in writing. Such charges shall not prevent or unreasonably delay an audit required under Section 8.3.
• Customer: Customer as specified in the Agreement.
• Epicz Lab AB: Epicz Lab (Vasagatan 12, 111 20 Stockholm, Sweden), Contact: support@epiczlab.com.
• Categories of Data Subjects: Customer's employees, authorized users, contractors, and end users.
• Categories of Personal Data: Names, email addresses, contact details, account credentials, technical identifiers (IP addresses, device logs), and any data submitted by Customer through the services.
• Special Categories of Data (Sensitive Data): None, unless explicitly agreed in writing by the parties.
• Frequency and Duration: Continuous for the duration of the Agreement.
• Nature and Purpose of Processing: Provision, maintenance, support, and security of the services pursuant to the Agreement.
Processor maintains security measures designed to protect Personal Data, including:
1. Access Control: Access to Personal Data is restricted to what is authorized and necessary for assigned duties, access to code repositories is role-based, company remote access requires multi-factor authentication, and passwords are managed under Processor's Access Control Policy.
2. Data Encryption: Strong cryptographic ciphers and configurations are used for Customer Personal Data stored or transmitted over public networks, in line with vendor recommendations and industry best practice. AES-256 is recommended for confidential data at rest where appropriate and feasible, and key management is documented and access-controlled.
3. Personnel Security: Personnel are bound by confidentiality obligations and must comply with Processor's information security policies, including secure device use and the return of company devices and information on departure.
4. Vulnerability & Incident Management: Production systems follow documented configuration and hardening standards, generate protected security logs with alerting for significant risks, and are subject to security testing and change management. An Incident Response Plan covers suspected or confirmed security incidents.
5. Business Continuity & Resilience: Regular backups are encrypted and stored separately from production, a Business Continuity and Disaster Recovery Plan is maintained, and disaster recovery testing, including backup restoration, is performed at least annually.
Further detail is set out in Processor's Security Measures at www.epiczlab.com/security.
Log in