This Data Processing Agreement ("DPA") forms part of the Agreement between Trailed AB, reg. no. 559573-4194, with registered office at Nordenskiöldsgatan 11A, 211 19 Malmö, Sweden ("Processor"), and the customer identified in the applicable Order Form ("Controller").
This DPA applies where Processor processes Personal Data on behalf of Controller in connection with the Deem service (the "Service") under the Agreement, as required by Article 28(3) GDPR.
Processor processes Personal Data solely on behalf of and in the interest of Controller, in accordance with Controller's Instructions and this DPA.
Where Processor gains access to personal data of Controller's affiliates in fulfilling the Agreement, such data is treated as Personal Data under this DPA. Controller is responsible for ensuring that it is authorized to issue Instructions and exercise rights under this DPA on behalf of such affiliates.
This DPA is incorporated into and forms part of the Agreement. In case of conflict regarding the processing of Personal Data, this DPA prevails over the Agreement, except that the Order Form prevails where it expressly states that it overrides this DPA with respect to a specific processing matter and such override is permitted by Applicable Data Protection Law.
1 Definitions
1.1 "Applicable Data Protection Law" means Regulation (EU) 2016/679 ("GDPR"), applicable national laws supplementing the GDPR, and all other privacy and data protection legislation applicable to the processing under this DPA.
1.2 "Instructions" means Controller's documented instructions to Processor. The Instructions comprise: (a) this DPA and the Agreement; (b) Controller's configuration and use of the Service, including integrations and Connected Accounts, data capabilities, support requests, admin settings, API settings, prompts, signals, automated workflows, autonomy levels, approval gates, and guardrails configured by Controller; and (c) any further written instructions given by Controller through the Service, support channels, an Order Form, or other agreed written means. Controller may amend Instructions in writing at any time, provided that any amendment must be lawful, within the scope of the Service and the Agreement, and not require material changes to the Service unless the Parties agree the scope, timeline, and any applicable costs in writing.
1.3 "Sub-processor" means a third party engaged by the Processor to process Personal Data on the Controller's behalf.
1.4 The terms Personal Data, Data Subject, Personal Data Breach, processing, controller, and processor have the meanings given in the GDPR.
2 Scope, Nature and Purpose of Processing
2.1 Processor shall process Personal Data solely on behalf of Controller, in accordance with the Instructions and Applicable Data Protection Law, and not for its own purposes. If Processor believes an Instruction violates Applicable Data Protection Law, it shall inform Controller without undue delay. Processor may process Personal Data as necessary to provide, operate, maintain, secure, monitor, support, troubleshoot, improve the reliability of, and document the Service, in each case as processor on behalf of Controller and in accordance with the Instructions.
2.2 The subject matter, duration, nature, and purpose of the processing, the types of Personal Data, and the categories of Data Subjects are set out in Annex A.
2.3 AI processing. The processing includes analysis of Personal Data by artificial-intelligence systems, including large language models, to generate assessments, classifications, signals, summaries, recommendations, and, where configured by Controller, communications and workflow actions ("AI Processing"). AI Processing is performed to provide the Service on Controller's behalf. Processor shall not use Personal Data to train or fine-tune general-purpose AI models. Where Personal Data is submitted to third-party AI model providers, Processor shall configure and contract for no training on Personal Data and for retention only as necessary to provide, secure, monitor abuse of, or comply with law in relation to the Service, as further described in Annex B and the sub-processor register. Outputs derived from Personal Data that relate to identifiable individuals are Personal Data of Controller and subject to this DPA.
2.4 Location. Personal Data is stored in the European Union, except as otherwise described in this DPA, Annex B, the sub-processor register, or the applicable Order Form. Section 9 governs transfers outside the EEA.
2.5 Special categories. The Service is not designed or intended for special categories of data (Art. 9 GDPR) or data relating to criminal convictions (Art. 10 GDPR). Controller shall not knowingly or intentionally submit such data and shall configure its integrations accordingly, except where expressly agreed in the applicable Order Form or where incidental processing cannot reasonably be avoided and is handled in accordance with this DPA. See Annex A.
2.6 Deem’s own processing. Deem processes Authorized Users’ account data and data about their use of the Service, including product usage analytics, as an independent controller for operating, securing and improving the Service, as described in Deem’s Privacy Policy and Section 8.5 of the Terms. That processing is not covered by this DPA. It does not include Customer Data.
3 Obligations of the Processor
3.1 The Processor shall process Personal Data only in accordance with the Instructions, and shall ensure strict separation between the Controller's Personal Data, the Processor's own data, and data of third parties (tenant-level isolation).
3.2 The Processor shall implement and maintain appropriate technical and organizational measures pursuant to Article 32 GDPR to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, appropriate to the risk. The measures in place at the date of this DPA are described in Annex C. The Processor may update them, provided the level of protection is not materially reduced.
3.3 The Processor shall ensure that persons authorized to process Personal Data are committed to confidentiality or under an appropriate statutory obligation of confidentiality.
3.4 The Processor shall inform the Controller without undue delay of: (i) substantial disruptions of the Service affecting the processing; (ii) suspected infringements of Applicable Data Protection Law or this DPA by the Processor or its Sub-processors in relation to the Controller's Personal Data; and (iii) any legally binding request for disclosure of Personal Data by a public authority, unless prohibited from doing so by law.
3.5 The Processor's contact point for data protection matters is privacy [at] deem.inc. (The Processor is not required to appoint a Data Protection Officer under Article 37 GDPR.)
4 Personal Data Breach Notification
4.1 In the event of a Personal Data Breach affecting Controller's Personal Data, Processor shall notify Controller in writing as soon as possible and in any case no later than seventy-two (72) hours after becoming aware of it. The notification shall, to the extent information is available: (i) describe the nature of the breach, including categories and approximate numbers of Data Subjects and records concerned; (ii) communicate the contact point for further information; (iii) describe likely consequences; and (iv) describe measures taken or proposed to address the breach and mitigate its effects.
4.2 The Processor shall supplement the notification as further information becomes available, and shall document breaches, their effects, and remedial action taken, sufficient to enable the Controller and supervisory authorities to verify compliance.
4.3 The Processor shall not notify Data Subjects or authorities on the Controller's behalf unless required by law or instructed by the Controller.
5 Assistance to the Controller
5.1 Taking into account the nature of the processing, the Processor shall assist the Controller with appropriate technical and organizational measures in fulfilling the Controller's obligations to respond to Data Subject requests (Chapter III GDPR), and in ensuring compliance with Articles 32–36 GDPR (security, breach notification, data protection impact assessments, and prior consultation), taking into account the information available to the Processor.
5.2 If a Data Subject request is made directly to the Processor, the Processor shall forward it to the Controller without undue delay and shall not respond substantively except on the Controller's instruction or where legally required.
5.3 Assistance relating to Processor's own obligations under this DPA and Applicable Data Protection Law is provided free of charge. For other assistance, Controller shall reimburse Processor's reasonable, documented costs, unless otherwise agreed in the applicable Order Form.
6 Audit Rights
6.1 The Processor shall make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR, and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller (subject to statutory or professional confidentiality obligations).
6.2 Audits shall be announced at least four (4) weeks in advance, conducted during normal business hours without disturbing Processor's operations, and no more than once per twelve (12) months, except where required by a supervisory authority or following a Personal Data Breach or demonstrated material non-compliance. Processor is not obliged to disclose trade secrets, information compromising security, or data of other controllers.
6.3 The Controller agrees that audit obligations may first be satisfied by the Processor providing current third-party attestations or reports (e.g., a SOC 2 report, once available) and responses to reasonable written security questionnaires; an on-site inspection may follow where such materials are insufficient for a documented reason.
6.4 Each Party bears its own audit costs, except that where an audit reveals more than a minor breach by Processor of this DPA or Applicable Data Protection Law, Processor shall bear the Controller's reasonable and documented costs of that audit.
6.5 In the event of an audit or information request from a supervisory authority concerning the Controller, the Processor shall reasonably assist, and shall always allow such authority to conduct audits of the Processor's operations as required by law.
7 Sub-processors
7.1 The Controller grants a general authorization for the engagement of Sub-processors. The Sub-processors engaged at the date of this DPA are listed in Annex B.
7.2 Processor shall inform Controller in advance of any intended addition or replacement of a Sub-processor, including: identity and corporate domicile; the processing performed; the location(s) of processing; and, where relevant, the transfer mechanism. Controller may object on reasonable, documented data-protection grounds within thirty (30) days of notification. The Parties shall then cooperate in good faith to find a solution (including a replacement Sub-processor or additional safeguards); failing a solution within a reasonable period, Controller may terminate the affected part of the Service.
7.3 The Processor shall impose on each Sub-processor, by written contract, data protection obligations essentially equivalent to those in this DPA — in particular as regards confidentiality, security, and Sub-processor engagement — and shall remain fully liable to the Controller for the Sub-processor's performance.
7.4 An accurate, current Sub-processor list, including processing locations, is maintained by Processor and provided on request or made available at a URL notified by Processor to Controller.
8 Confidentiality
8.1 Each Party shall keep confidential all Personal Data and other non-public information received under this DPA, use it only for the purposes of this DPA and the Agreement, and disclose it only to personnel, Sub-processors, and advisors who need it for those purposes and are bound by confidentiality.
8.2 Standard exclusions apply (information public without breach; lawfully known prior; independently developed; lawfully received from a third party; disclosure required by law or a supervisory authority, with prior notice to the other Party where lawful) — except that Personal Data is always protected regardless of such exclusions.
8.3 These obligations survive termination of this DPA and the Agreement.
9 Transfers Outside the EEA
9.1 The Processor shall not transfer Personal Data outside the EEA except on documented Instructions or where required by Union or Member State law (in which case the Processor shall inform the Controller before processing, unless prohibited).
9.2 Certain Sub-processors are entities of corporate groups headquartered outside the EEA or may involve access from outside the EEA as described in Annex B or the sub-processor register. Where any transfer within the meaning of Chapter V GDPR occurs, Processor shall ensure a valid transfer mechanism — including, where applicable, the EU–U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses — together with supplementary measures where appropriate. On request, Processor shall provide copies of the relevant transfer safeguards, redacted for confidential commercial terms.
10 Deletion and Return
10.1 Upon termination or expiry of the Agreement, Processor shall make Controller's Personal Data available for export in a structured, commonly used, machine-readable format during the export window agreed in the Agreement. Where mandatory switching obligations under the EU Data Act apply, Processor shall provide reasonable assistance to export the exportable data within the required transition period, subject to Controller's timely cooperation, technical feasibility, security requirements, and this DPA. Processor shall thereafter delete all Personal Data within thirty (30) days after expiry of the export window, with removal from backups within the backup retention cycle, unless Union or Member State law requires storage.
10.2 Upon Controller's request, Processor shall confirm deletion in writing within fourteen (14) days of the request or of completing the deletion, whichever is later.
11 Liability
11.1 Liability. Subject to mandatory law, including Article 82 GDPR, each Party shall be responsible for administrative fines, damages, costs, losses, and expenses arising from or relating to the processing of Personal Data under this DPA to the extent caused by that Party's breach of this DPA or Applicable Data Protection Law. Subject to the foregoing, the limitations and exclusions of liability in the Agreement apply to this DPA, including any enhanced cap applicable to DPA breaches.
11.2 Data Subject rights. For the avoidance of doubt, nothing in this DPA or the Agreement limits or excludes any right of a Data Subject to claim compensation directly from either Party under Article 82 GDPR or other applicable data protection law, nor any liability towards a Data Subject to the extent such liability cannot be limited under applicable law.
12 Term and Termination
12.1 This DPA applies for the term of the Agreement; termination of the Agreement terminates this DPA. Either Party's right to terminate for cause remains unaffected.
12.2 If the Processor materially breaches this DPA and fails to remedy within thirty (30) days of the Controller's written notice, Controller may terminate the Agreement to the extent affected, with immediate effect.
12.3 Sections 8, 10, and 11 survive termination.
13 General
13.1 Amendments materially affecting the data processing under this DPA must be in writing or made in accordance with the amendment mechanism in the Agreement. If any provision is invalid, the remainder stands and the Parties shall replace the invalid clause with a valid one reflecting its intent. The conflict rule in the introductory provisions applies to any inconsistency concerning the processing of Personal Data.
13.2 This DPA is governed by Swedish law. Disputes are resolved in the same forum as the Agreement.
Annex A — Details of Processing
Subject matter and nature: Provision, operation, maintenance, security, support, and improvement of the reliability of the Service, including hosting, ingestion, storage, structuring, analysis, AI Processing, workflow automation, technical support, troubleshooting, logging, backup, restoration, export, deletion, and communications or actions through Connected Accounts as configured by Controller.
Duration: The term of the Agreement, plus the export, switching, deletion, backup-retention, and legal-retention periods described in the Agreement and this DPA.
Categories of Data Subjects: Controller Representatives and Business Contacts, as further described below.
| Controller Representatives | Employees, contractors, advisors, and other authorized users of Controller using the Service. |
| Business Contacts | Employees, representatives, users, contacts, and other individuals associated with Controller's customers, prospects, partners, suppliers, or other third parties whose data appears in Connected Accounts or communications processed through the Service. |
Categories of Personal Data: The Service may process the following categories of Personal Data, depending on Controller's configuration, Connected Accounts, Instructions, and use of the Service
| Category | Examples |
|---|---|
| Account and user data | Name, work email, role, user ID, account ID, team/workspace information, authentication data, access rights, and approval history. |
| Business contact and relationship data | Name, business contact details, job title, employer, relationship/account information, CRM records and custom fields, customer/prospect/partner/supplier references, and product usage events relating to identifiable individuals. |
| Communication and content data | Content and metadata of business communications and records connected by Controller, including email, support, chat, meeting notes, support tickets, system notifications, and delivery metadata. |
| Configuration and instruction data | Service configuration data, integration metadata, prompts, instructions, signals, workflow settings, autonomy levels, approval gates, and guardrails configured by Controller. |
| Technical, usage, support and security data | IP address, device/browser identifiers, activity logs, audit logs, diagnostic logs, security logs, support communications, and related technical metadata. |
| Derived and output data | Sentiment/intent classifications, engagement patterns, health assessments, scores, signals, summaries, recommendations, generated communications, and workflow outputs relating to identifiable individuals. |
Purpose-specific processing: The following table links the principal purposes of processing to the categories of Personal Data normally processed for each purpose. The exact categories depend on Controller's configuration, Instructions, Connected Accounts, and use of the Service.
| Purpose | Relevant categories of Personal Data | Processing operations |
|---|---|---|
| Account administration and access management | Account and user data; technical, usage, support and security data. | Collection, storage, authentication, authorization, access control, account administration, logging, and audit. |
| Integration and Connected Account operation | Account and user data; business contact and relationship data; communication and content data; configuration and instruction data; technical, usage, support and security data. | Connection, ingestion, retrieval, storage, structuring, synchronization, metadata processing, and application of Controller-configured scopes and permissions. |
| Service functionality, analysis and AI Processing | Business contact and relationship data; communication and content data; configuration and instruction data; technical, usage, support and security data; derived and output data. | Structuring, retrieval, analysis, AI inference, classification, summarization, signal detection, generation of scores, recommendations, summaries, and other customer-facing outputs. |
| Workflow execution and actions through Connected Accounts | Account and user data; business contact and relationship data; communication and content data; configuration and instruction data; derived and output data; technical, usage, support and security data. | Workflow execution and, as configured by Controller, composition, sending, creation, updating, or triggering of communications, records, tasks, or workflows via Controller's Connected Accounts. |
| Technical support, troubleshooting and customer-success assistance | Account and user data; configuration and instruction data; technical, usage, support and security data; and any business contact and relationship data, communication and content data, or derived and output data included in or necessary to resolve the relevant support matter. | Access, review, investigation, troubleshooting, issue replication, support response, configuration assistance, and documented resolution. |
| Security monitoring, abuse prevention and incident response | Account and user data; configuration and instruction data; technical, usage, support and security data; and, where relevant to an incident or suspected misuse, affected business contact and relationship data, communication and content data, and derived and output data. | Logging, monitoring, alerting, detection, investigation, containment, remediation, documentation, and notification support. |
| Backup, restoration, export, deletion and legal retention | All categories of Personal Data processed through the Service, to the extent necessary for the relevant backup, restoration, export, deletion, retention, or legal-compliance process. | Backup, restoration, retention, retrieval, export, deletion, erasure confirmation, and legally required preservation. |
Special categories (Art. 9/10): No — not intended. Controller shall not knowingly or intentionally submit special-category or criminal-offence data; the Service is not designed for such data, except where expressly agreed or where incidental processing cannot reasonably be avoided and is handled in accordance with this DPA (Section 2.5).
Annex B — Authorized Sub-processors (as of 5 November 2026)
| Sub-processor | Corporate domicile | Processing performed | Location of processing | Transfer mechanism (if applicable) |
|---|---|---|---|---|
| Amazon Web Services EMEA SARL / Amazon Web Services, Inc. | Luxembourg / USA | Cloud infrastructure, storage, AI inference (Bedrock) | EU — eu-central-1 (Frankfurt); backup copies in eu-west-1 (Ireland); AI inference in AWS EU regions | DPF / SCCs (group level) |
| MongoDB Ltd / MongoDB, Inc. | Ireland / USA | Managed database | EU — eu-central-1 (Frankfurt); backup copies in eu-west-1 (Ireland) | DPF / SCCs (group level) |
| Temporal Technologies, Inc. | USA | Workflow orchestration: workflow inputs, results and execution state, which may contain extracts of Customer Data, kept for up to 30 days | EU — eu-central-1 (Frankfurt) | DPF / SCCs |
| Anthropic (via AWS Bedrock) | USA (Irish EU entity) | AI model provision — inference only; no retention; no training | EU — AWS EU regions via Amazon Bedrock EU cross-region inference | Covered via AWS; DPF / SCCs |
| Brevo SAS | France | Transactional email: sign-in codes, invitations and notifications to Authorized Users, which may quote excerpts of Customer Data | EU (France) | — (EU entity) |
Annex C — Technical and Organizational Measures (Art. 32 GDPR)
Summary; the full description is maintained in Processor's Security & Data Protection Overview, available on request or at a URL notified by Processor to Controller.
- Encryption: TLS in transit; AES-256 at rest for databases, object storage, and backups; encryption keys created and managed within the EU region
- Pseudonymization / minimization: data minimization toward Sub-processors — each receives only what its function requires; workflow orchestration receives only the data each workflow step needs, kept for up to 30 days
- Confidentiality, integrity, availability, resilience: tenant-level isolation at application and database layers; private-subnet architecture with no public data-store endpoints; separate AWS accounts for staging and production; multi-AZ deployment
- Access control: SSO with enforced MFA; role-based least-privilege access; time-limited production admin access restricted to named individuals; no standing CI/CD credentials (OIDC federation); prompt revocation on personnel changes
- Restoration and testing: continuous backup with point-in-time recovery; recovery point objective and recovery time objective as specified in the Security & Data Protection Overview; periodic restore testing; documented disaster-recovery procedures
- Ongoing evaluation: peer-reviewed changes via CI/CD; centralized logging, monitoring, and alerting; vulnerability management; periodic review of measures; personnel bound by confidentiality and documented security policies, including Incident Response, Vendor Management and Acceptable Use
- Incident response: documented procedures with severity classification and the breach-notification commitment in Section 4