Data Processing Agreement (DPA)

1. Parties and scope

This agreement is made between the Customer (controller) and Styrra AB, reg. no. [organisationsnummer] (processor) and forms part of the Terms of Service. It applies to all processing of personal data that Styrra performs on the Customer's behalf in the service ("Customer Data"). If the Customer is a Partner acting itself as processor for its client, Styrra is sub-processor and this agreement applies mutatis mutandis.

Terms have the meaning given in Regulation (EU) 2016/679 ("GDPR") and Swedish supplementary legislation.

2. Instructions

Styrra processes Customer Data only on the Customer's documented instructions, which are the Terms of Service, this agreement and the Customer's use and configuration of the service, unless Union or Member State law requires otherwise. Styrra shall inform the Customer of such a requirement unless the law forbids it.

If Styrra considers an instruction to infringe data protection rules it shall notify the Customer and may suspend until the Customer confirms or changes the instruction. The Customer is responsible for having a legal basis for the processing and for informing data subjects.

The subject matter, duration, nature, purpose, types of personal data and categories of data subjects are set out in Annex 1.

3. Confidentiality and personnel

Styrra ensures that persons with access to Customer Data are bound by confidentiality and have access only as needed for the engagement.

4. Security measures

Styrra implements appropriate technical and organizational measures under Article 32 GDPR, at least those in Annex 2. The measures may be updated but not materially degraded.

5. Sub-processors

The Customer gives Styrra general authorization to engage sub-processors as listed in Annex 3. Styrra enters a written agreement with each sub-processor with the same data protection obligations as this agreement and is liable to the Customer for the sub-processor's performance, subject to the limits in section 12.

Styrra notifies the Customer (by email or in the service) of intended additions or replacements at least 30 days in advance. The Customer may object on reasonable grounds within that time. If the parties cannot agree, the Customer may terminate the affected service without charge for the rest of the period.

6. Third-country transfers

Styrra and sub-processors may transfer Customer Data to third countries only if Chapter V GDPR is satisfied, for example an adequacy decision or standard contractual clauses with supplementary measures. The Customer authorizes Styrra to enter standard contractual clauses with sub-processors on the Customer's behalf where needed.

7. Data subject rights and assistance

Styrra assists the Customer, taking into account the nature of the processing, by appropriate technical and organizational measures so the Customer can respond to data subject requests. Requests made directly to Styrra are forwarded to the Customer without undue delay.

Styrra assists the Customer in meeting obligations under Articles 32–36 GDPR (security, breach notification, impact assessment and prior consultation) taking into account the information available to Styrra. Reasonable costs of assistance beyond the service's normal functionality may be charged.

8. Personal data breaches

Styrra notifies the Customer without undue delay and where possible within 48 hours after becoming aware of a personal data breach affecting Customer Data, with the information required by Article 33(3) GDPR as far as available. Styrra takes reasonable steps to contain the breach. The Customer is responsible for notifying the supervisory authority and data subjects. Notification is not an admission of fault or liability.

9. Deletion and return

On termination Styrra allows the Customer to export Customer Data for 30 days. Styrra then deletes Customer Data within a further 60 days, including from backups on their normal rotation, unless storage is required by Union or Swedish law. The audit log (user ID, time, action) is kept as described in the Privacy Policy for Styrra's own legitimate interest and so the Customer can prove its approvals.

10. Information and audit

Styrra provides the information necessary to demonstrate compliance with Article 28 and allows for and contributes to audits. The Customer shall first accept Styrra's current documentation, certifications or independent audit reports. On-site audits may be made at most once per year (except after an incident), on at least 30 days' notice, during business hours, under confidentiality, without disrupting operations and at the Customer's cost.

11. Customer's responsibility

The Customer is responsible for (a) Customer Data having been collected and being shareable with Styrra lawfully, (b) having a legal basis and having informed data subjects, (c) not sending more personal data than necessary, in particular no special categories or national identity numbers without need, and (d) assigning its users the right permissions.

12. Liability

The limitation of liability in the Terms of Service (section 11) also applies to this agreement, so that Styrra's total liability under the agreements together does not exceed the cap there. It does not affect data subjects' rights under Article 82 GDPR or liability that cannot be limited under mandatory law. Each party bears its share of an administrative fine under Article 83 only to the extent the law allows it to be apportioned.

13. Term and disputes

This agreement applies as long as Styrra processes Customer Data on the Customer's behalf. Sections 8–9, 12 and 13 survive. Swedish law and the dispute resolution in the Terms of Service apply. In case of conflict on personal data processing this agreement prevails over the Terms of Service.

Annex 1. Description of the processing

• Purpose and nature: storage, reading, analysis, summarization, classification and proposals for bookkeeping of financial data; answering questions; transferring approved entries to the Customer's accounting system or a SIE4 file; audit log.
• Categories of data subjects: the Customer's employees and users, suppliers and customers (sole traders and contact persons), other persons named in documents.
• Types of personal data: names, contact details, organization and national identity numbers (when included in documents), address, bank account, amounts and transaction history, salary data at voucher level if the Customer enters such data, free text in documents.
• Special categories: not to be processed unless necessary for the bookkeeping. The Customer is responsible for limiting this.
• Duration: the term plus the period in section 9.

Annex 2. Technical and organizational measures

• Encryption of data in transit (TLS) and at rest.
• Per-organization access control with row-level security in the database; least privilege; role-based permissions in the service; two-step approval above amount limits.
• Secrets (keys, tokens) held in environment variables and secret managers, never in code; accounting-system access tokens stored encrypted.
• Immutable, hash-chained audit log.
• Content in documents and email treated as untrusted: it cannot change permissions, rules or payees.
• Logging and monitoring, vulnerability and update management, backups and restore testing.
• Personnel bound by confidentiality, access granted on need, and production data not used in development environments.
• Requirements on sub-processors: contracts, security review, agreement not to train models on Customer Data.

Annex 3. Sub-processors

• Supabase Inc.: Database, authentication, file storage (EU (verify project region))
• Vercel Inc.: Hosting, edge network, AI Gateway (EU/US)
• Anthropic PBC (via Vercel AI Gateway): Language model inference for answers and proposals (US/EU)
• Stripe Payments Europe Ltd.: Payments and invoicing (EU/US)
• Fortnox AB, Bokio AB and other ERP providers chosen by the Customer: Customer-initiated connection to the Customer's own accounting system (EU)