Data processing agreement

Data processing agreement

between

The Customer, as stated in the Customer's account with Syntakk
(the controller)

and

Syntakk ApS
CVR no. 45223515
Helgavej 26, 5230 Odense M, Denmark
(processor)

Version 1.0, effective from 04-09-2026

This data processing agreement is an integral part of the licence agreement for Syntakk, cf. clause 1.1.2 of the licence agreement, and is accepted together with it when an account is created. For the processing of personal data, this agreement takes precedence over the licence agreement.

1. Preamble

1. These clauses set out the rights and obligations of the controller and the processor when the processor processes personal data on behalf of the controller.
2. The clauses have been designed to ensure the parties' compliance with Article 28(3) of the General Data Protection Regulation (Regulation (EU) 2016/679).
3. The clauses apply to the processor's processing of personal data as part of the delivery of the Syntakk platform.
4. The following appendices form an integral part of this agreement:

• Appendix A — Information about the processing
• Appendix B — Sub-processors
• Appendix C — Instructions on the processing and security of processing
• Appendix D — Regulation of other matters

1. In the event of inconsistency between the clauses and the appendices, the clauses take precedence, unless the appendix expressly provides otherwise.
2. The clauses do not release the processor from obligations to which it is directly subject under the General Data Protection Regulation.

2. Rights and obligations of the controller

1. The controller is responsible for ensuring that the processing of personal data takes place in accordance with the General Data Protection Regulation, the Danish Data Protection Act and this agreement.
2. The controller is responsible for ensuring that there is a legal basis for the personal data that the controller instructs the processor to process.
3. The controller warrants that no personal data other than that set out in Appendix A is entered into Syntakk, including that no special categories of personal data covered by Article 9 of the General Data Protection Regulation or data relating to criminal offences covered by Article 10 are entered.
4. The controller is responsible for the content of the product passports published via Syntakk, cf. clauses 4.2 and 6.2 of the licence agreement.

3. The processor acts on instructions

1. The processor only processes personal data on documented instructions from the controller. The instructions are set out in this agreement with appendices, in the licence agreement and in the controller's use of the platform's functions.
2. The processor immediately informs the controller if, in the processor's opinion, an instruction infringes the General Data Protection Regulation or other data protection legislation.
3. The instructions can be changed or clarified in writing by the controller at any time. If changed instructions require adaptation of the platform or significant additional work, the processor may refuse the instructions or require payment under clause 3.2.5 of the licence agreement.

4. Confidentiality

1. The processor only grants access to personal data to the persons necessary to fulfil the obligations towards the controller.
2. The processor ensures that these persons have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3. At least once a year, the processor reviews who has access to personal data and withdraws access that is no longer necessary.
4. At the controller's request, the processor makes documentation of the confidentiality obligation available.

5. Security of processing

1. The processor implements the technical and organisational measures set out in Appendix C, which at least meet the requirements of Article 32 of the General Data Protection Regulation.
2. The processor carries out its own risk assessment and then implements measures that ensure a level of security appropriate to the risk.
3. If the controller wants additional measures beyond those set out in Appendix C, these are agreed separately and implemented at the controller's expense.
4. The processor may change the technical and organisational measures, provided that the level of security is not reduced. Significant changes are notified to the controller.

6. Use of sub-processors

1. The processor has the controller's general authorisation to use sub-processors. The sub-processors approved when the agreement is entered into are set out in Appendix B.
2. The processor publishes the current list of sub-processors at syntakk.dk/en/legal/sub-processors.
3. The processor notifies the controller at least 30 days before adding or replacing a sub-processor. Notification is given by notice under clause 9.4 of the licence agreement.
4. Within 14 days of the notification, the controller may object in writing to the change. The objection must be based on specific and objective grounds relating to data protection.
5. If the parties cannot find a solution within 30 days of the objection, the controller may terminate the licence agreement with effect from the time the new sub-processor is taken into use, and receive a proportionate refund for the unused part of the paid period. This is the controller's sole remedy in respect of the change.
6. The processor enters into a written agreement with each sub-processor imposing on it the same data protection obligations as follow from this agreement.
7. The processor is fully liable to the controller for the sub-processor's compliance with the obligations.
8. For reasons of operation, security or legislation, the processor may take a new sub-processor into use without the notice that follows from clause 6.3, if this is necessary to avert an acute risk. In that case, the controller is notified without undue delay, and clauses 6.4 and 6.5 apply correspondingly.

7. Transfers to third countries

1. The processor only processes personal data within the EU/EEA, unless otherwise stated in Appendix B.
2. Any transfer to a third country may only take place on the basis of documented instructions from the controller and in accordance with Chapter V of the General Data Protection Regulation. The controller's acceptance of this agreement with Appendix B constitutes such instructions for the transfers set out in Appendix B.
3. The transfer basis for each individual transfer is set out in Appendix B, including whether the transfer takes place on the basis of an adequacy decision or on the basis of the European Commission's standard contractual clauses with associated supplementary measures.
4. The processor informs the controller if the processor is required under EU law or the national law of the Member States to transfer personal data to a third country, unless such notification is prohibited.

8. Assistance to the controller

1. Taking into account the nature of the processing, the processor assists the controller as far as possible in fulfilling the controller's obligations towards the data subjects, including requests for access, rectification, erasure, restriction, data portability and objection.
2. The controller itself responds to requests from data subjects using the platform's functions, to the extent possible.
3. If the request cannot be met using the platform's functions, the processor assists against payment under clause 3.2.5 of the licence agreement.
4. The processor also assists the controller with:
   1. notification of personal data breaches to the supervisory authority,
   2. communication of personal data breaches to the data subjects,
   3. data protection impact assessments, and
   4. prior consultation of the supervisory authority.
5. Assistance under clause 8.4 is provided free of charge where the matter has arisen at the processor or a sub-processor. Where the matter has arisen at the controller or its own suppliers, the assistance is provided against payment under clause 3.2.5 of the licence agreement.

9. Notification of personal data breaches

1. The processor notifies the controller without undue delay after the processor has become aware of a personal data breach, and where possible no later than 24 hours afterwards.
2. The notification is sent to the contact person stated by the controller under Appendix D.1 and to the email address registered on the account.
3. The notification contains, to the extent the information is available:
   1. the nature of the breach, including the categories and approximate number of data subjects and records concerned,
   2. the likely consequences of the breach,
   3. the measures taken or proposed to be taken, and
   4. contact details where further information can be obtained.
4. If the information is not available at the same time, it may be provided in phases as it becomes available.
5. The controller is responsible for notifying the breach to the supervisory authority within the 72-hour deadline.

10. Erasure and return of data

1. On termination of the licence agreement, the processor erases the personal data, unless the controller requests its return within the deadline in clause 10.2.
2. Within 30 days of the termination of the licence agreement, the controller may request that the personal data be returned in a commonly used machine-readable format. The return of personal data cannot be made conditional on payment, cf. clause 8.3.4 of the licence agreement.
3. The processor erases the personal data no later than 60 days after the termination of the licence agreement, cf. clause 8.3.5 of the licence agreement. Personal data in backups is erased at the next rotation of backups, and no later than 30 days after the erasure.
4. The processor may keep personal data beyond the deadlines in clause 10.3 to the extent required by law, including the Danish Bookkeeping Act. The retention is limited to what is necessary, and the data is not processed for other purposes.
5. At the controller's request, the processor confirms the erasure in writing.

11. Audits, including inspections

1. The processor makes available the information necessary to demonstrate compliance with Article 28 of the General Data Protection Regulation and this agreement.
2. Every year, the processor prepares a written statement on compliance with this agreement and with the technical and organisational measures in Appendix C. The statement is provided to the controller on request.
3. On request, the processor also answers the controller's security questionnaire, but no more than once a year.
4. If the controller wants an auditor's report, for example under ISAE 3000, this can be agreed separately. The costs are borne by the controller, unless the report reveals significant non-compliance by the processor.
5. The controller or its authorised auditor may carry out a physical inspection at the processor. An inspection may be carried out no more than once a year and must be notified at least 20 Business Days in advance, unless there is a specific suspicion of a personal data breach. The controller bears its own and the processor's costs of the inspection.
6. The processor supervises its sub-processors by obtaining their audit and security reports and documents this supervision. The controller may, on request, gain insight into this documentation.
7. Supervisory authorities have access to the processor's physical premises on presentation of appropriate identification.

12. The parties' agreement on other matters

1. Any regulation by the parties of other matters is set out in Appendix D.
2. Liability between the parties, including limitation of liability, follows clause 5.2 of the licence agreement. The limitation of liability does not, however, apply to liability for damages towards data subjects under Article 82 of the General Data Protection Regulation or to fines imposed on a party under Article 83 of the Regulation.
3. If a party is liable for more than corresponds to its responsibility for the damage, that party may claim the excess from the other party under Article 82(5) of the General Data Protection Regulation.

13. Entry into force and termination

1. The agreement enters into force when the controller accepts the licence agreement when creating an account, by written acceptance of a quote or by taking the platform into use.
2. The agreement applies for as long as the processor processes personal data on behalf of the controller. The agreement cannot be terminated separately while the licence agreement is in force.
3. The processor may amend this agreement with 30 days' notice by notice under clause 9.4 of the licence agreement, where the amendment is necessary as a result of changed legislation, practice of supervisory authorities or changes to the platform. If the amendment is significantly to the controller's detriment, the controller may terminate the licence agreement with effect from the entry into force of the amendment and receive a proportionate refund.
4. Amendments that reduce the protection of the data subjects cannot be made under clause 13.3.
5. After termination, the agreement continues to apply to the obligations which by their nature must be fulfilled after termination, including clauses 4, 10 and 11.
6. The current version of the agreement is available at syntakk.dk/en/legal/data-processing-agreement. Previous versions are provided on request.

Appendix A — Information about the processing

A.1 Purpose of the processing

The processor processes personal data on behalf of the controller for the purpose of delivering, operating, supporting and further developing the Syntakk platform, including giving the controller's users access, creating and managing digital product passports under the Battery Regulation and distributing these via QR code and link.

A.2 Nature of the processing

Collection, recording, organisation, storage, alteration, retrieval, use, publication of product passports, disclosure to sub-processors, restriction and erasure.

A.3 Categories of data subjects

• The controller's contact persons
• The controller's users and administrators of the platform
• Contact persons at the controller's suppliers and partners, to the extent the controller enters such information
• Natural persons who contact the controller through a published product passport, to the extent such a function is used

A.4 Categories of personal data

Only ordinary personal data, cf. Article 6 of the General Data Protection Regulation:

• Name, position and workplace
• Work email address and phone number
• Username, access rights and role in the platform
• Login history, IP address and activity log
• Information that the user enters in free-text fields

The processing does not include special categories of personal data under Article 9 or data relating to criminal offences under Article 10. The controller must not enter such data into the platform.

Most of the data entered into the platform is product, material and supplier information, which is not personal data.

A.5 Duration of the processing

The processing runs for as long as the licence agreement is in force, and ends with erasure under clause 10.

Appendix B — Sub-processors

B.1 Approved sub-processors

When entering into this agreement, the controller has approved the following sub-processors:

B.2 Processing outside the EU/EEA

The processor processes personal data within the EU/EEA. If processing takes place outside the EU/EEA at a sub-processor, this is stated in the table in B.1 together with the transfer basis.

B.3 AI-assisted data import

1. If the controller uses the AI-assisted data import function, the data uploaded by the controller is processed by the AI provider stated in B.1, solely for the purpose of structuring and entering data into the platform.
2. The data is not processed to train the provider's models, cf. clause 6.1.3 of the licence agreement.
3. The controller should not upload files with personal data to this function beyond what is necessary.

B.4 Changes

Changes to the list are made under clause 6 with 30 days' notice and a right to object. The current list is available at syntakk.dk/en/legal/sub-processors.

Appendix C — Instructions on the processing and security of processing

C.1 Subject matter of the processing

The processor processes personal data as necessary to deliver, operate, support and further develop the Syntakk platform in accordance with the licence agreement.

C.2 Technical measures

• Data is stored in a dedicated database per customer, so the controller's data is logically separated from other customers' data
• All communication with the platform takes place over an encrypted connection (TLS)
• Personal data is stored encrypted at storage level
• Passwords are only stored as salted hash values
• Access to the production environment requires an individual account and two-factor authentication
• Separate environments for operation, testing and development; production data is not used in test and development environments without anonymisation
• Daily backups with 30 days' retention and periodic testing of restoration
• Logging of access to and changes in personal data
• Monitoring of operations and security events
• Ongoing updating of operating systems, frameworks and dependencies, including security updates without undue delay

C.3 Organisational measures

• Everyone with access to personal data is subject to a duty of confidentiality
• Access is granted on a need-to-know basis and reviewed at least annually
• Employees are instructed in the processing of personal data on employment and on an ongoing basis thereafter
• Access is withdrawn on departure
• Written procedure for handling personal data breaches
• Annual review of the level of security and of these instructions

C.4 Physical measures

The processor does not operate its own servers. Physical security of the data centres used is handled by the hosting provider, cf. Appendix B. The processor's own equipment is protected by disk encryption, password and automatic locking.

C.5 Retention period and erasure

• Personal data is kept for as long as the licence agreement is in force
• On termination, personal data is erased no later than 60 days afterwards, cf. clause 10.3
• Backups are erased no later than 30 days after the erasure
• Log data is kept for 12 months, after which it is erased or anonymised
• Bookkeeping and invoicing material is kept in accordance with the rules of the Danish Bookkeeping Act

C.6 Assistance with data subjects' rights

1. The controller can itself search for, correct, export and erase information about its own users in the platform.
2. The processor assists to the extent a request cannot be met using the platform's functions, cf. clause 8.3.

C.7 Supervision of the processor

1. Every year, the processor prepares a written statement on compliance with this agreement, cf. clause 11.2.
2. The statement includes a review of the measures set out in C.2–C.4 and of any deviations in the past year.
3. The controller may request supplementary documentation, cf. clauses 11.3–11.5.

C.8 Supervision of sub-processors

1. Every year, the processor obtains the sub-processors' audit or security reports, where available, and reviews them.
2. If no report is available, the processor carries out a written assessment of the sub-processor's level of security.
3. The documentation of the supervision is kept and made available to the controller on request.

Appendix D — Regulation of other matters

D.1 Contact persons

1. In the Customer Portal, the controller states the name, title, email address and phone number of the person to be contacted in the event of a personal data breach, and of any data protection officer (DPO).
2. The controller is responsible for keeping the information up to date. If no contact person has been stated, notifications are sent to the account's registered email address.
3. The processor's point of contact for questions about this agreement is hello@syntakk.dk.

D.2 Governing law

1. This agreement is governed by Danish law, including the Danish Data Protection Act.
2. If the controller is subject to data protection legislation in another country, the controller must inform the processor of this. If this entails requirements beyond this agreement, the costs are borne by the controller.
3. Venue follows clause 9.9 of the licence agreement.

D.3 Breach

The licence agreement's provisions on breach apply correspondingly to this agreement.

D.4 Costs

Where this agreement refers to payment at an hourly rate, the current hourly rate under clause 3.2.5 of the licence agreement applies. The processor provides an estimate before the work starts.