Data Processing Terms

1. Introduction

Licensee (hereinafter referred to as the "Controller") controls certain Personal Data, which it wishes to provide to Forecasterly (Forecasterly AB, org. no. 559481-9921, hereinafter referred to as the "Processor") in accordance with the Agreement and, in particular, with the terms set out herein.

The Parties hereby agree to the terms upon which the Controller will provide the Processor with the Personal Data and the Processor shall Process the Personal Data.

These Data Processing Terms shall apply from the date of execution of the Agreement by both Parties and until such time that Processor ceases to Process Personal Data on behalf of Controller.

2. Purposes of Processing

Processor shall, in accordance with the Agreement, provide Controller with (i) Forecasterly's system, i.e. a cloud-based software as a service solution used by Controller for the main purposes of gathering and storing Budgets and Forecasts provided by Controller (ii) associated support/maintenance services, including problem report handling services (all of the above is hereinafter referred to as the "Services").

3. Definitions

All capitalized terms not otherwise defined herein shall have the respective meaning given to such terms in the GDPR.

4. Instructions

4.1. The Processor shall only be entitled to Process the Personal Data for the purposes set out in Article 2 above, and in accordance with the Controller's reasonable written instructions, and in any event in compliance with applicable laws and legal obligations.

4.2. The Processor may not Process the Personal Data for a longer period than what is necessary for the fulfilment of its undertakings under the Agreement. It shall be noted, for the avoidance of doubt, that the storage of Processed Data is part of the Services as an ongoing undertaking, until such times that the Controller, in its own discretion deletes Processed Data from Forecasterly's system. The Controller is responsible to delete the Data when deemed no longer necessary for the fulfilment of Forecasterly's undertakings under the Agreement.

5. Restricted Access

5.1. Processor shall restrict access to the Personal Data to only such persons who requires it in order for Processor to provide the Services, or as otherwise may be required to comply with Processor's obligations according to the Data Protection Act. Furthermore, Processor shall take reasonable steps to ensure the reliability of any of its employees, agents and sub-contractors who may have access to Personal Data.

6. Security

6.1. The Processor shall take Appropriate Technical and Organisational Measures to protect the Personal Data while considering the technical options that are available, the costs to implement the measures, the specific risks that are present with the current Processing of Personal Data, and the sensitivity of the Personal Data that is Processed. Such measures shall at least:

• Protect the Personal Data against accidental or unlawful destruction, accidental loss or alteration, unauthorised or unlawful storage, processing, access or disclosure (including by use of pseudonymisation and encryption for data in transit and at rest, where possible);
• Treat and safeguard the Personal Data as strictly private and confidential;
• Restore the availability and access to Personal Data in a timely manner in accordance with Processor's back-up policy, in the event of a physical or technical incident;
• At all times having in place and adhering to a suitable, written data protection policy with respect to the Processing of Personal Data.

6.2. Furthermore, Processor shall not without Controller's prior consent cause or permit the Personal Data to be Processed outside the European Economic Area or such other countries that the EU Commission has determined to provide an adequate level of data protection in accordance with the General Data Protection Regulation (EU 2016/679), with the exception that the Processor cannot prohibit the Controller to travel to such area and log in to Forecasterly's system.

7. Auditing, Assistance and Reporting

7.1. Processor shall co-operate with and assist the Controller when necessary to comply with the Data Protection Act, and to enable Data Subjects to exercise their rights under the Data Protection Act. Processor shall allow for and assist in audits, including inspections, following Controller's legitimate written request and at such times as agreed between the Parties. The Processor shall in such event make available facilities, personnel, policies, documents and information strictly as necessary and limited for the purpose of the audit, and only as relevant with regards to the Processing of Personal Data on behalf of the Controller and subject to such restrictions for on-site audits as may apply for Processor's hosting environments. With regards to any such assistance, Processor shall have the right to require compensation for its actual costs, and for its assistance in accordance with Processor's hourly rates based on a fair and verifiable assessment of the time spent.

7.2. An audit shall not grant the Controller access to Processor's, or any third-party's, trade secrets or proprietary information unless required to comply with the Data Protection Act. The Controller shall ensure that its personnel conducting such audits are subject to adequate secrecy obligations. The Controller respects and acknowledges that such audit must be performed without causing interruptions to the Processor's regular operations. Furthermore, Processor shall be entitled to receive a copy of any audit reports.

7.3. In the event that a Data Subject, Supervisory Authority, law enforcement authority or any other third-party requests information from the Processor regarding Processing of Personal Data, the Processor shall refer the requesting party to the Controller and may not disclose any Personal Data to the requesting party, nor act on the Controller's behalf, unless otherwise required by applicable law.

7.4. The Processor shall promptly, and at the latest within applicable time-limits set forth in the Data Protection Act, notify the Controller about:

• any legally binding request for disclosure of the Personal Data by the Supervisory Authority, or a law enforcement authority, unless otherwise prohibited; and
• any request received directly from the Data Subjects, without responding to that request, unless it has been authorised by the Controller to do so.

7.5. Furthermore, the Processor shall, if possible, immediately notify the Controller in case of accidental or unauthorized access to the Controller's Personal Data or other security incident involving the Controller's Personal Data, or at least within 72 hours after the Processor became aware of such incident. Such notification shall at least:

• describe the nature of the Personal Data incident, including, if possible, the categories and number of data subjects concerned and categories of Personal Data concerned;
• provide name and contact details to the Data Protection Officer or other contact point where further information can be obtained;
• describe the likely consequences of the Personal Data incident; and
• describe what actions have been taken, or which the Processor proposes to take, to correct the Personal Data incident, including, where appropriate, measures to reduce any adverse effects.

Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay.

8. Sub-Processing

8.1. The Controller hereby agrees to that parts of the Services may be provided through sub-processors via third party services subject to Processor having entered into separate data processing agreements with such sub-processors that comply with the Data Protection Act. The Processor will maintain a current list of sub-processors and will provide a copy of that list to the Controller upon request. The sub-processors at the time of this Agreement are: Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, MailerSend Inc., Datadog, Inc., and Microsoft Ireland Operations Limited (Microsoft Azure).

8.2. The Controller hereby agrees that the Processor may, when relevant for the purposes of maintaining, developing and/or enhancing the Services, exchange sub-processors as well as add other sub-processors. Upon such change, Processor must notify Controller at least 30 days in advance. In the event Controller doesn't consent to the change due to reasonable legal grounds, Controller may terminate the agreement and receive refund of any prepaid fees for the remaining part of the agreement term.

8.3. Location for Processing: Forecasterly ensures that data remains within secure data centers located in Europe, in compliance with applicable EU data protection laws.

9. Ownership of Data

The Processor hereby acknowledges and agrees that the Processor shall never at any time receive ownership of the Personal Data. Upon the termination of the Agreement, Processor will delete all such Personal Data with the exception of what is stated in section 4.2 ii). Controller may also in writing request Processor to instead return all such data before deleting any remaining copies. Such a request must however be done within ten (10) days after the termination of the Agreement.

10. Liability

Each party is liable in accordance with the Data Protection Act, subject to the general limitation of liability as set out in the Agreement. Each Party accepts and acknowledges that any penalties or administrative fines imposed on either Party (or both) by the supervisory authority pursuant to the Data Protection Act shall be regarded as conclusive and thus agrees to refrain from making any claims for compensation through recourse proceedings (or otherwise) against the other Party on the basis of thereof.

11. Confidentiality

11.1. The Processor shall not, without the prior written consent of the Controller, divulge the whole or any part the Personal Data to any person except its employees or consultants subject to the same policies and requirements as employees, and then only to those who need to know the same, and only to the extent necessary for the proper performance of the Agreement.

11.2. To the extent that any Personal Data is disclosed to employees or consultants of the Processor in accordance with Article 11.1, the Processor shall ensure that such individuals are bound by non-disclosure undertakings no less onerous than those set forth herein and in the Agreement.