Data Processing Agreement

1. Parties and background

This Data Processing Agreement (the "Agreement") applies between the customer using MyAgents in its business (the "Customer", controller) and AI Company Nordic AB, reg. no. 5591637359, Källvägen 11, 191 46 Sollentuna, Sweden ("MyAgents", processor).

The Agreement forms part of the MyAgents Terms of Service and applies from when the Customer starts using the service in its business. A Customer who wants a signed copy can sign below and send it to us, or ask us for a copy to sign digitally.

The Agreement meets the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"). Terms such as personal data, processing, data subject and personal data breach have the meaning given in the GDPR.

2. What MyAgents processes and why

MyAgents processes personal data on the Customer's behalf solely to provide the service: an AI agent that reads and writes email and messages, keeps customer records and notes, analyses accounting data, finds tenders and customers, books and reminds, and carries out what the Customer asks for or approves.

The nature and purpose of the processing and the categories of data subjects and personal data are described in Appendix 1. Processing lasts while the Customer uses the service and ends as set out in section 10.

3. The Customer's instructions

MyAgents processes the personal data only on the Customer's documented instructions. This Agreement, the Terms of Service and the choices the Customer makes in the service (for example which accounts are connected and what is approved in Approve) are the Customer's instructions.

If MyAgents considers that an instruction infringes the GDPR or other data protection law, we inform the Customer without delay. MyAgents does not use the personal data for its own purposes, does not sell it and does not let any AI provider train models on it.

4. Confidentiality

Only people at MyAgents who need access to run, troubleshoot or support the service may access the personal data. They are bound by confidentiality. Support access happens only when needed for a case.

5. Security

MyAgents implements the technical and organisational measures required by Article 32 GDPR, appropriate to the risk. The current measures are described in Appendix 2. MyAgents may improve the measures but not lower the overall level of protection.

6. Sub-processors

The Customer gives MyAgents general prior authorisation to engage the sub-processors listed in Appendix 3. MyAgents enters into written agreements with each sub-processor giving at least the same protection as this Agreement and remains liable to the Customer for the sub-processor's processing.

Before engaging a new sub-processor, MyAgents publishes the change on this page and notifies the Customer by email or in the service at least 30 days in advance. The Customer may object on reasonable grounds. If the parties cannot agree, the Customer may terminate the service at no cost from the date the change takes effect.

Services the Customer connects to its own account (for example Gmail, Outlook, Fortnox and Visma Spiris) process data on the Customer's behalf under the Customer's own agreements with them and are not sub-processors of MyAgents.

7. Transfers outside the EU/EEA

Personal data is stored in the EU. Some sub-processors process data in the USA (see Appendix 3). Such transfers rely on the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR) or the EU–US Data Privacy Framework where the recipient is certified, supplemented by encryption and data minimisation. Where a provider offers EU processing, MyAgents uses it.

8. Assistance to the Customer

MyAgents helps the Customer respond to requests from data subjects (for example access, rectification, erasure and portability). The Customer can export and delete data in the service. MyAgents forwards requests that come directly to us.

MyAgents also assists, to a reasonable extent, with impact assessments, prior consultations and the Customer's obligations under Articles 32–36 GDPR.

9. Personal data breaches

MyAgents notifies the Customer without undue delay, and no later than 48 hours after becoming aware of a personal data breach affecting the Customer's data. The notice describes, as far as possible, what happened, the data and number of data subjects concerned, the likely consequences and the measures taken.

10. When the Agreement ends

When the Customer ends the service or deletes its account, MyAgents deletes the personal data within 30 days. Backups are rotated within 30 days. The Customer can export its data before then. Data MyAgents must keep by law, such as invoices under the Swedish Bookkeeping Act, is kept as long as the law requires and used for nothing else. Retention during the term is set out in Appendix 1.

11. Audits

MyAgents gives the Customer the information needed to show compliance with this Agreement. The Customer, or an independent auditor bound by confidentiality, may carry out an audit at most once a year with 30 days' notice, or more often if a supervisory authority requires it or after a serious breach. The Customer bears its own costs.

12. Liability, term and disputes

Liability is governed by the Terms of Service and Article 82 GDPR. The Agreement applies as long as MyAgents processes personal data on the Customer's behalf. If the Agreement and the Terms of Service differ on personal data matters, the Agreement prevails.

MyAgents may update the Agreement when law, supervisory authorities or the service require it. Material changes are notified at least 30 days in advance. Swedish law applies. Disputes are settled by the general courts with the Stockholm District Court as first instance.

Appendix 1. The processing

Purpose

To provide MyAgents: an AI agent for email, messages, customer records, accounting analysis, tenders, bookings, watches and calls.

Operations

Storage, reading, searching, compiling, analysis with AI models, drafting texts, sending what the Customer has approved, deletion.

Data subjects

The Customer's owners and staff, the Customer's customers, suppliers and contacts, senders and recipients of email and messages, people who call the Customer's number.

Personal data

Names, email addresses, phone numbers, titles and companies; content of email, messages, documents and notes; invoices and receivables from the accounting system; call transcripts and summaries; calendar events.

Special categories

Not processed intentionally. The Customer should not ask the agent to process special categories of data (Article 9 GDPR) or national ID numbers unnecessarily.

Retention

Account data (email, name, preferences): Until you delete your account. Content you create (tasks, notes, decisions, memories): Until you delete it, or account deletion. Conversations with the agents: 24 months, then deleted. Call transcripts and summaries: 12 months, then deleted. Connected-account tokens: Until you disconnect the integration. Email send logs: 12 months. Security and audit logs: 12 months. Billing records (invoices): 7 years (Swedish Bookkeeping Act). Backups: Rotated within 30 days.

Appendix 2. Security measures

• Database and files are stored in the EU (Ireland), encrypted at rest and in transit (TLS).
• Each customer's data is separated with row-level security in the database; users can only reach their own account.
• Gmail, Outlook, Fortnox and Visma Spiris are connected with OAuth. MyAgents receives a key the Customer can revoke, never the password.
• Passwords for other mailboxes are encrypted with a dedicated key and used only by the system to read and send email. The AI models never see them.
• No email, SMS, post, booking or purchase is sent without the Customer approving it in Approve.
• Card details are handled by Stripe (PCI DSS level 1) and never reach MyAgents' servers.
• AI calls go first to models in the EU. The AI providers do not train models on the Customer's content.
• Access for operations and support is limited to those who need it. Security and audit logs are kept for 12 months.
• Backups are rotated within 30 days. The Customer can export and delete its data in the service.

Appendix 3. Sub-processors

Services you connect yourself (not sub-processors of MyAgents): Google (Gmail, Google Kalender), Microsoft (Outlook, Microsoft 365), Fortnox, Visma Spiris, TikTok, E-postleverantörer via IMAP/SMTP (one.com, Loopia m.fl.).