Data Processing Addendum (DPA)

The parties agree that Customer is the Data Controller and Original Creation is the Data Processor in respect of any Personal Data submitted, stored, or processed through the Service on behalf of Customer.

In the event of any conflict between this DPA and the Terms of Service, the provisions of this DPA shall prevail with regard to the processing of Personal Data.

Subject Matter & Purpose: Original Creation processes Personal Data solely to provide, operate, maintain, and support the Service, including user authentication, digital product passport management, supplier data collection, and security monitoring, in accordance with Customer's documented instructions.

Duration: The processing shall continue for the term of Customer's subscription to the Service, plus any applicable post-termination data retention or export period set forth herein.

The primary purpose of the Service is the structuring and management of product, material, and supply chain data. Personal Data processed within the platform is limited and typically encompasses:

• Categories of Data Subjects: Customer employees, authorized users, contractors, and supplier contact persons invited to provide product documentation.
• Types of Personal Data: Business contact details (name, business email, telephone number, job title, company affiliation), login and authentication credentials (hashed passwords, authentication tokens), and system usage metadata (IP addresses, timestamps, access logs).

Special categories of data (Article 9 GDPR) are neither requested nor intended to be processed within the Service.

Original Creation agrees to:

• Process Personal Data strictly on documented instructions from Customer, including regarding transfers outside the EU/EEA, unless required to do so by applicable Union or Member State law.
• Ensure that all personnel authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
• Implement and maintain appropriate technical and organizational measures (TOMs) to ensure a level of security appropriate to the risk, as required under Article 32 GDPR (including encryption in transit and at rest, strict access controls, multi-factor authentication, and redundant backups).
• Assist Customer, insofar as reasonably possible, by appropriate technical and organizational measures, in fulfilling Customer's obligation to respond to requests from data subjects exercising their statutory rights.

Customer grants Original Creation general written authorization to engage subprocessors for hosting, cloud infrastructure, and platform delivery. The current subprocessors are:

Original Creation shall inform Customer at least 30 days before adding or replacing a subprocessor. Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, Customer may terminate the affected part of the Service.

Original Creation shall impose data protection obligations on any subprocessor no less protective than those set out in this DPA, and remains fully liable to Customer for the performance of the subprocessor's obligations.

Original Creation hosts the platform's application, database, files and AI processing within the European Union / European Economic Area (EU/EEA), in Sweden. Some subprocessors listed in section 5 are established outside the EU/EEA or may process limited data there. Any such transfer is covered by appropriate safeguards pursuant to Chapter V of the GDPR, namely the European Commission's Standard Contractual Clauses or an adequacy decision such as the EU–US Data Privacy Framework.

In the event of a confirmed Personal Data Breach affecting Customer Personal Data, Original Creation shall notify Customer without undue delay (and no later than 48 hours after becoming aware of the incident). The notification shall describe the nature of the breach, the affected data, likely consequences, and remediation measures taken.

Upon termination or expiration of the Service, Original Creation shall, at Customer's choice, delete or return all Customer Personal Data from the live systems within 30 days, unless applicable Swedish or European Union law mandates longer retention.

Copies in encrypted database backups are deleted when those backups expire, at the latest 12 months after creation. Until then, backups are kept isolated, used only to recover from a disaster, and never used for any other processing. If a backup is ever restored, Original Creation deletes the Customer Personal Data again before the restored system is put back into use.

Original Creation shall make available to Customer all information reasonably necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits, including inspections, conducted by Customer or an independent auditor mandated by Customer, upon reasonable prior written notice.