Data Processing Agreement

General Data Processing Agreement for all Odyssey services

Version 1 · Effective 28 April 2026

Agreement in accordance with Article 28(3) of the General Data Protection Regulation (EU) 2016/679

1. INTRODUCTION#

In this DPA the Customer is referred to as the "Controller" and Odyssey is referred to as the "Processor".

2. DEFINITIONS#

In addition to the terms defined in the Agreement and running text of this DPA, the following terms, whether in singular or plural, with definite or indefinite article, shall have the meaning defined below whenever they are capitalised.

Processing	Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Data protection legislation	Refers to all privacy and personal data legislation, along with any other legislation (including regulations and directives) applicable to the Processing carried out in accordance with this Agreement, including national legislation and EU legislation.
Instruction	The written instructions that more specifically define the object, duration, type and purpose of Personal Data, as well as the categories of Data Subjects and special requirements that apply to the Processing.
Log	A Log is the result of Logging
Logging	Logging is a continuous collection of information about the Processing of Personal Data that is performed according to this Agreement and which can be associated with an individual natural person.
Personal Data	Any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Personal Data Breach	A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed.
Data Subject	Natural person whose Personal Data are Processed.
Third Country	A state that is not a member of the European Union (EU) or the European Economic Area (EEA).
Subprocessor	A natural or legal person, public authority, agency or other body which, in the capacity of subcontractor to the Processor, Processes Personal Data on behalf of the Controller.

3. BACKGROUND AND AIM#

3.1 The aim of the DPA is to safeguard the freedoms and rights of the Data Subject during Processing, in accordance with what is stipulated in Article 28(3) of the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

3.2 In case of conflict between the Agreement and the DPA, this DPA shall take precedence in matters relating to the processing of personal data.

3.3 Any reference in this DPA to national or union legislation refers to the provisions applicable at any given time.

4. PROCESSING OF PERSONAL DATA AND SPECIFICATION#

4.1 The Controller hereby appoints the Processor to carry out Processing on behalf of the Controller, pursuant to the provisions of this DPA.

4.2 The Controller shall give written Instructions to the Processor as to how the Processor shall carry out the Processing.

4.3. The Processor may only perform the Processing in accordance with this DPA and the Instructions applicable at any given time.

5. OBLIGATIONS OF THE CONTROLLER#

5.1 The Controller undertakes to ensure that there is a legal basis for the Processing at all times, and to issue correct instructions so that the Processor and any Subprocessors can carry out their duties in accordance with this DPA and the Agreement, where applicable.

5.2 The Controller undertakes to inform the Processor without undue delay of any changes in the Processing that may affect the Processor’s obligations pursuant to the Data Protection Legislation.

5.3 The Controller is responsible for informing Data Subjects of the Processing and to safeguard the rights of Data Subjects in accordance with the Data Protection Legislation, as well as to take every other measure required of the Controller pursuant to the Data Protection Legislation.

6. OBLIGATIONS OF THE PROCESSOR#

6.1 The Processor undertakes to only perform the Processing in accordance with this DPA and the Instructions and to comply with the Data Protection Legislation. The Processor also undertakes to stay informed of currently applicable laws and regulations in this area.

6.2 The Processor shall take measures to protect the Personal Data against all kinds of Processing that is not in compliance with this DPA, the Instructions and the Data Protection Legislation.

6.3 The Processor undertakes to ensure that all natural persons who work under its supervision comply with this DPA and the Instructions, and that these natural persons are informed about relevant legislation.

6.4 At the request of the Controller, the Processor shall assist the former in ensuring compliance with the obligations pursuant to Articles 32–36 of GDPR, and shall respond to requests regarding the exercise of Data Subjects’ rights pursuant to Chapter III of GDPR, taking into consideration the type of Processing and the information available to the Processor.

6.5 In the event that the Processor finds the Instructions to be unclear, in violation of the Data Protection Legislation or non-existent, and the Processor is of the opinion that new or supplementary Instructions are necessary in order to fulfil its undertakings, the Processor shall inform the Controller of this without delay, temporarily suspend the Processing and await new Instructions.

6.6 In the event the Controller provided the Processor with new or amended Instructions, the Processor shall inform the Controller, without undue delay after receiving them, whether the implementation of the new Instructions will entail any changed costs for the Processor.

7. SECURITY MEASURES#

7.1 The Processor is obligated to take all technical and organisational security measures required by the Data Protection Legislation in order to prevent Personal Data Breaches, by ensuring that the Processing complies with the requirements of GDPR and that the rights of the Data Subjects are protected.

7.2 The Processor shall continuously ensure that the technical and organisational security relating to the Processing maintains an appropriate level of confidentiality, integrity, availability and resilience.

7.3 Any future or modified requirements for protective measures coming from the Controller once the Parties have entered this DPA shall be considered new Instructions in accordance with this DPA.

7.4 The Processor shall use an authorisation control system to allow access to the Personal Data only for such natural persons who work under the supervision of the Processor and who need such access in order to perform their duties.

7.5 The Processor undertakes to continuously Log access to the Personal Data pursuant to this DPA, to the extent required according to the Instruction. Logs may not be purged until at least five (5) years after the time of Logging, unless otherwise specified in the Instruction. Logs shall be subject to the necessary protective measures pursuant to the Data Protection Legislation.

7.6 The Processor shall systematically test, examine and evaluate the effectiveness of the technical and organisational measures that are intended to ensure the security of the Processing.

8. SECRECY/DUTY OF CONFIDENTIALITY#

8.1 The Processor and all natural persons who work under its supervision shall observe both secrecy and the duty of confidentiality during Processing. Personal Data may not be used or disseminated for other purposes, neither directly or indirectly, unless otherwise agreed.

8.2. The Processor is required to ensure that all natural persons working under its supervision who participate in the Processing are bound by a confidentiality agreement regarding the Processing. However, this is not required if those persons are already subject to a statutory duty of confidentiality with criminal liability. The Processor also undertakes to ensure that there is a confidentiality agreement with its Subprocessor, as well as between the Subprocessor and all natural persons working under its supervision who participate in the Processing

8.3 The Processor shall immediately inform the Controller of any contacts with the supervisory authority regarding the Processing. The Processor shall not be entitled to represent the Controller or act on behalf of the Controller vis-à-vis supervisory authorities in matters relating to the Processing.

8.4 If the Data Subject, supervisory authority or a third party requests information from the Processor regarding the Processing, the Processor shall inform the Controller thereof. Information regarding the Processing may not be divulged to the Data Subject, supervisory authority or third party without the written consent of the Controller, unless the obligation to disclose the information is prescribed by law. The Processor shall assist in the communication of such information as is the subject of consent or legal requirement.

9. INSPECTION, SUPERVISION AND AUDITING#

9.1 At the request of the Controller, the Processor shall without undue delay provide information, as part of its undertakings in accordance with Article 28(1) of GDPR, regarding the technical and organisational security measures used to ensure that the Processing complies with the requirements of this DPA and Article 28(3)(h) of GDPR.

9.2 The Processor must at least once (1) per year review the security of the Processing through a self-monitoring in order to ensure that the Processing complies with the DPA. The result of this self-monitoring shall be made available to the Controller upon request

9.3 The Controller has the right to inspect, or to appoint a third party (who must not be a competitor of the Processor) to inspect the Processor’s compliance with the requirements of this DPA, the Instruction and the Data Protection Legislation. In connection with such inspection, the Processor shall assist the Controller or the person carrying out the inspection on behalf of the Controller, with documentation, access to premises, IT systems and other assets required to verify the Processor’s compliance with this DPA, the Instructions and the Data Protection Legislation. The Controller shall ensure that the personnel carrying out the inspection are subject to secrecy or duty of confidentiality pursuant to law or contract.

9.4 The Processor, as an alternative to the provisions of items 9.2–9.3, may offer other approaches to inspection of the Processing, such as inspection by an independent third party. In that case, the Controller shall be entitled, but not obligated, to apply this alternative approach to the inspection. In the event of this kind of inspection, the Processor shall give the Controller or the third party the assistance needed to perform the inspection.

The Processor shall enable the supervisory authority, or other government agency with legal authority, to conduct supervision at the authority’s request and pursuant to the applicable legislation at any given time, even if such an supervision would otherwise violate the provisions of the DPA.

9.5 The Processor shall ensure that the supervisory authority, or other government agency with legal authority, is able to conduct supervision at the authority's request and pursuant to applicable legislation, even if such supervision would otherwise be subject to confidentiality obligations under this DPA.

10. HANDLING OF CORRECTIONS, DELETIONS, ETC.#

10.1 In the event that the Controller has requested a correction or deletion as a result of incorrect Processing by the Processor, the Processor shall take appropriate measures, without undue delay, no later than thirty (30) days from the date on which the Processor received the required information from the Controller. When the Controller has requested deletion, the Processor may only perform Processing of the Personal Data in question as a part of the correction or deletion process.

10.2 If technical and organisational measures (e.g. upgrades or troubleshooting) are taken by the Processor with regard to the Processing, and these can be expected to affect the Processing, the Processor shall inform the Controller in writing in accordance with the provisions on notifications set out in the General Terms and Conditions. This information shall be communicated well in advance of the measures being taken.

11. PERSONAL DATA BREACHES#

11.1 The Processor shall have the ability to restore availability and access to Personal Data in a timely manner in the event of a physical or technical incident as defined in Article 32(1)(c) of GDPR.

11.2 In considering the nature of the Processing and the information available to the Processor, the Processor undertakes to assist the Controller in fulfilling its obligations in the event of a Personal Data Breach involving the Processing. At the request of the Controller, the Processor shall also assist in investigating suspicions of possible unauthorised Processing of and/or access to Personal Data.

11.3 In the case of a Personal Data Breach that the Processor has been made aware of, the Processor shall notify the Controller in writing of the incident without undue delay and, where feasible, no later than thirty-six (36) hours after becoming aware of the breach, to enable the Controller to meet its own obligation to notify the competent supervisory authority within seventy-two (72) hours pursuant to Article 33 of GDPR.

The description shall include:

The nature of the Personal Data Breach, and, if possible, the categories and the number of Data Subjects affected, as well as the categories and number of personal data items affected,
the probable consequences of the Personal Data Breach, and
measures that have been taken or proposed, as well as measures to mitigate the potential negative effects of the Personal Data Breach.

11.4 If it is not possible for the Processor to provide the entire description as set out in item

11.3 of the Agreement at the same time, the description may be provided in stages without undue additional delay.

12. SUBPROCESSOR#

12.1 The Processor is entitled to hire the Subprocessor(s) listed in the Subprocessor appendix.

12.2 The Processor undertakes to enter a written agreement with the Subprocessor to regulate the Processing that the Subprocessor carries out on behalf of the Controller and to only hire Subprocessors who provide adequate guarantees to carry out appropriate technical and organisational measures to ensure that the Processing fulfils the requirements of GDPR. When it comes to data protection, such an agreement shall entail the same obligations for the Subprocessor as are set out for the Processor in this DPA.

12.3 The Processor is fully responsible in relation to the Controller for any Processing carried out by a Subprocessor.

12.4 The Processor is entitled to hire new subprocessors and to replace existing subprocessors.

12.5 When the Processor intends to hire a new subprocessor or replace an existing one, the Processor shall verify the Subprocessor’s capacity and ability to meet their obligations in accordance with the Data Protection Legislation. The Processor shall notify the Controller in writing of

the Subprocessor’s name, corporate identity number and head office (address and country),
which type of data and categories of Data Subjects are being processed, and
where the Personal Data will be processed.

12.6 The Controller is entitled within thirty (30) days of the notice pursuant to item 12.5 to object on reasonable grounds to the Processor's use of a new Subprocessor, by providing a written notice to the Processor setting out those grounds. 12.6a Upon receipt of a valid objection, the Processor and Controller shall use reasonable endeavours to resolve the objection within thirty (30) days. If no resolution is reached, the Controller shall be entitled to terminate the Agreement with thirty (30) days' written notice, without liability for early termination fees, provided the termination notice is given within sixty (60) days of the original Subprocessor notice.

12.7 When the Processor stops using the Subprocessor, the Processor shall notify the Controller in writing that they will no longer be using the Subprocessor.

12.8 At the Controller’s request, the Processor shall send a copy of the agreement regulating the Subprocessor’s Processing of Personal Data in accordance with item 12.2.

13. LOCALISATION AND TRANSFER OF PERSONAL DATA TO A THIRD COUNTRY#

13.1 The Processor shall ensure that the Personal Data will be handled and stored within the EU/EEA by a natural or legal person who is established in the EU/EEA, unless the parties to this DPA agree otherwise.

13.2 The Processor is only entitled to transfer Personal Data to a Third Country for Processing if the Controller has given advance written approval of such transfer and has issued Instructions to this end. Any such transfer must be based on one of the following lawful transfer mechanisms under Chapter V of GDPR: (i) an adequacy decision by the European Commission pursuant to Article 45 of GDPR; (ii) appropriate safeguards pursuant to Article 46 of GDPR, including Standard Contractual Clauses (SCCs) as adopted by the European Commission; (iii) certification under an approved framework such as the EU–US Data Privacy Framework (DPF); or (iv) another applicable derogation under Article 49 of GDPR. The Processor shall, upon request, provide the Controller with documentation of the applicable transfer mechanism for each Subprocessor processing data outside the EU/EEA.

13.3 Transfer to a Third Country for Processing pursuant to item 13.2 of the DPA may be carried out only if it complies with the Data Protection Legislation and fulfils the requirements for the Processing set out in this DPA and the Instructions

14. LIABILITY FOR DAMAGES IN CONNECTION WITH THE PROCESSING#

14.1 In the event that compensation for damages in relation to Processing is payable to the Data Subject, through a legally binding judgement or settlement, due to a violation of the DPA, Instructions and/or applicable provision of the Data Protection Legislation, Article 82 of GDPR is applicable.

14.2 Fines in accordance with Article 83 of GDPR or Chapter 6, Section 2 of the Data Protection Act (2018:218) shall be paid by the party to this DPA that has been levied such a fee.

14.3 If either party becomes aware of circumstances that could be detrimental to the other party, the first party shall immediately inform the other party of this and work actively with the other party to prevent and minimise the damage or loss.

14.4 Notwithstanding any of the provisions of the Agreement, items 14.1 and 14.2 of this DPA take precedence over other rules regarding the allocation between the parties of claims regarding the Processing.

15. CHOICE OF LAW AND DISPUTE RESOLUTION#

This DPA shall be governed by and construed in accordance with Swedish law. Any disputes arising out of or in connection with this DPA shall be resolved in accordance with the dispute resolution provisions set out in the General Terms and Conditions, which are incorporated herein by reference.

16. MEASURES IN THE EVENT OF TERMINATION OF THE DPA#

16.1 Upon termination of the Agreement, the Controller shall, without undue delay, request that the Processor transfers all Personal Data to the Controller or deletes them, according to the preference of the Controller. If the Personal Data are transferred, this must take place in an open and standardised format. “All Personal Data” means all Personal Data that have been the subject of Processing, as well as other related information such as Logs, Instructions, system solutions, descriptions and other documents that the Processor received through an exchange of information pursuant to the DPA.

Notwithstanding the foregoing, the Processor shall be entitled to retain Logs as defined in this DPA for the minimum retention period specified in item 7.5, even after the termination of this Agreement. Such retained Logs shall remain subject to the confidentiality and security obligations of items 7 and 8 of this DPA, and shall be deleted no later than five (5) years from the date of the relevant Logging event. The Processor shall not use retained Logs for any purpose other than compliance with applicable law or to defend against legal claims.

16.2 Transfers and deletions pursuant to item 16.1 of the DPA shall be carried out no later than thirty (30) days from the time notice of termination was given in accordance with item 16.1 of this DPA.

16.3 Processing performed by the Processor after the time specified in item 16.2 shall be considered unauthorised Processing.

16.4 The provisions regarding secrecy and confidentiality in item 8 of this DPA shall remain in effect even if the DPA otherwise ceases to apply.