Data processing agreement

15 October 2026

  1. GENERAL
    1. The Company shall be the data controller for all processing of personal data carried out using the Service unless otherwise specified in this data processing agreement. Mitigater shall, within the scope of the Service, process personal data on behalf of the Company as a data processor, to the extent set out in clause 1.2. The purpose, duration, nature, and objectives of the processing, as well as the types of personal data and categories of data subjects affected by the processing, are further detailed in Appendix - Description of the processing of personal data in the Service. The Company is responsible for ensuring that all such processing of personal data complies with applicable data protection legislation, including the General Data Protection Regulation (EU 2016/679) ("Applicable Legislation").
    2. This data processing agreement applies only to companies that have entered into an agreement with Mitigater for the use of the Service, and to personal data relating to the Company's own organisation, such as the Company's users and other persons acting on its behalf as well as personal data relating to security and support and to communication with users. Other personal data relating to external companies that are not customers of Mitigater, including suppliers and other companies registered in or invited to the Service, and to the contact persons and users of such companies is not covered by this data processing agreement. Personal data that external companies in the Service share with each other through connections, for example suppliers sharing information with their customers further up the supply chain, is disclosed between those companies as independent data controllers (controller to controller); each company is the data controller for the data it shares and for the data it receives. Notwithstanding this clause 1.2, Mitigater is the data controller for the processing of personal data relating to user accounts as described in Mitigater's Privacy Policy.
  2. GENERAL OBLIGATIONS OF MITIGATER
    1. As data processor, Mitigater shall only process personal data in accordance with the Company's written instructions under this data processing agreement, as well as any additional documented instructions provided by the Company from time to time. Additional instructions may be communicated to Mitigater via email or on a specific form. These instructions should contain equivalent information as specified in the appendix to this data processing agreement.
    2. In the event that Mitigater lacks instructions necessary to fulfill its duties, Mitigater shall promptly inform the Company and await further instructions. Should Mitigater find that an instruction conflicts with Applicable Legislation, Mitigater shall inform the Company without undue delay. If, in such a case, the Company fails to provide additional instructions, Mitigater shall disregard the conflicting instruction and notify the Company accordingly. Should the Company persist in the unlawful instruction, Mitigater is entitled to terminate the Agreement prematurely as per the terms outlined in the general terms and conditions.
    3. The Company's sending or acceptance of an invitation or connection to or from another company in the Service constitutes a documented instruction from the Company to Mitigater to make the data covered by such connection available to that company, to the extent described in the Service. The Company may end a connection in the Service at any time, whereupon Mitigater shall cease to make new data available through that connection. Making data available to another company constitutes a disclosure by the Company, as data controller, to that company, which becomes the data controller for the data received (see clause 1.2).
    4. Despite clause 2.1, Mitigater has the right to process personal data to the extent required to fulfill its obligations under Applicable Legislation, such as complying with orders from authorities. However, Mitigater must inform the Company of this legal obligation before proceeding with such processing, unless mandatory legislation prohibits Mitigater from providing such information.
    5. If any requests for information regarding the Company's processing of personal data are received by Mitigater, Mitigater shall direct them to the Company by notifying the Company's contract manager via email. Mitigater may not disclose personal data or any other information regarding the processing of personal data without written instructions from the Company. Mitigater is not authorized to represent the Company or act on behalf of the Company with any third party, including supervisory authorities.
  3. TECHNICAL AND ORGANIZATIONAL MEASURES
    1. Mitigater shall implement the technical and organizational measures required by Applicable Legislation to protect the personal data processed within the Service, including those specified in the security appendix to this data processing agreement. Company's prior approval is necessary for any changes to the technical and organizational measures that may decrease the level of security. The parties agree that these measures shall be regularly reviewed to ensure their adequacy considering the risks associated with the processing of personal data.
    2. Upon request, Mitigater shall assist the Company with necessary information available to Mitigater for the Company to fulfill its obligations regarding impact assessments and prior consultations with relevant supervisory authorities regarding the processing conducted by Mitigater on behalf of the Company within the Service.
    3. To the extent possible, Mitigater shall assist the Company by taking appropriate technical and organizational measures to enable the Company to fulfill its obligation to respond to requests to exercise data subjects' rights as provided by Applicable Legislation. The Service includes certain functionality to facilitate the Company's compliance with requests from data subjects to exercise their rights under Applicable Legislation.
    4. Mitigater shall ensure that access to personal data is restricted to Mitigater's personnel who require access to fulfill their obligations to the Company. Furthermore, Mitigater shall ensure that such authorized personnel observe confidentiality equivalent to that provided under clause 8 below through individual confidentiality agreements.
  4. PERSONAL DATA INCIDENTS
    1. In the event of a personal data incident (as defined in Applicable Legislation), Mitigater shall notify the Company in writing through the Company's contract manager without undue delay after becoming aware of the incident and no later than within 24 hours in accordance with Mitigater's applicable procedure. The notification shall include information about the nature of the incident, categories and number of data subjects and personal data records affected, the likely consequences of the incident, and a description of the measures Mitigater (if any) has taken to limit the potential negative effects of the incident to enable the Company to fulfill its obligation, if any, to report the personal data incident to the relevant supervisory authority. If it is not possible to provide all the information at once, Mitigater shall provide the information to the Company as soon as it becomes available to Mitigater.
    2. If it is likely that a personal data incident poses a risk to the data subjects' personal integrity, Mitigater shall, to the extent possible, immediately after becoming aware of the personal data incident, take appropriate remedial measures to prevent or limit the potential negative effects of the personal data incident.
  5. ACCESS TO INFORMATION, ETC.
    1. Mitigater shall continuously document the measures taken to fulfill its obligations under this data processing agreement. Upon request, the Company shall have the right to access the latest version of such documentation. For information on the processing of personal data carried out within the Service, see the appendix to this data processing agreement.
    2. Furthermore, Mitigater shall enable and assist the Company, or a third party designated by the Company, in conducting an audit, including inspection, of the technical and organizational measures Mitigater takes to fulfill its obligations under this data processing agreement. Mitigater shall be notified in writing of such an audit at least 30 days in advance. All costs of the audit shall be borne by the Company, including any costs incurred by Mitigater for participating in the audit. The Company shall ensure that any third party conducting the audit on behalf of the Company shall observe confidentiality no less restrictive than that provided under clause 8 below. Corresponding provisions apply to the Company's request for an audit of a Sub-processor engaged by Mitigater in connection with the Service, see clause 6 below.
  6. ENGAGEMENT OF SUB-PROCESSORS
    1. The Company hereby approves Mitigater engaging subcontractors listed in the Appendix, as updated from time to time in accordance with clause 6.3 (the current list is also published at mitigater.com/legal/subprocessors), to process personal data on behalf of the Company in connection with the Services ("Sub-processors"). The subcontractors engaged by Mitigater at the time of entering into this Agreement are also listed in the appendix to this data processing agreement. The Company further grants general advance approval to Mitigater for engaging new Sub-processors provided that Mitigater ensures that the Sub-processor provides sufficient guarantees to implement appropriate technical and organizational measures to ensure that the processing complies with the requirements of Applicable Legislation.
    2. Mitigater shall enter into a data processing agreement with the Sub-processor. Such a data processing agreement shall include provisions equivalent to those set forth in this data processing agreement and Applicable Legislation.
    3. In the event that Mitigater intends to engage a new Sub-processor, Mitigater shall inform the Company thereof at least thirty (30) days before the new Sub-processor starts processing personal data, by email to the Company's contract manager. Mitigater shall provide information about the Sub-processor's identity (including full company name, registration number, and address), the location (geographical) where the Sub-processor will process personal data, the type of service the Sub-processor will perform, and the protective measures that the Sub-processor will take to protect the personal data processed. The Company has the right to object to Mitigater engaging the Sub-processor to process personal data on behalf of the Company within two (2) weeks from the notification, whereby Mitigater and the Company shall jointly seek a mutually acceptable solution, and otherwise the Agreement may be terminated prematurely as provided in the General Terms and Conditions.
  7. TRANSFER TO AND PROCESSING OF PERSONAL DATA OUTSIDE THE EU/EEA AREA
    1. The Company hereby approves Mitigater, as necessary, transferring the Company's personal data outside the EU/EEA area. Such transfer may only take place if (i) the country has an adequate level of protection for personal data according to a decision by the EU Commission covering the processing of personal data, (ii) if Mitigater ensures that appropriate safeguards are in place, such as standard data protection clauses adopted by the EU Commission, in light of the legislation of the recipient country, or (iii) if any other exception in Applicable Legislation allows for the transfer.
    2. In the event that Mitigater transfers personal data outside the EU/EEA based on standard data protection clauses, the Company hereby authorizes Mitigater to enter into such standard contractual clauses on behalf of the data controller.
  8. CONFIDENTIALITY
    1. Without prejudice to confidentiality commitments in the Agreement, the following shall also apply.
    2. Mitigater shall keep personal data processed on behalf of the Company strictly confidential. Thus, Mitigater shall not, directly or indirectly, disclose any personal data to third parties unless authorized in writing by the Company, unless Mitigater is required by law to disclose personal data or it is necessary for the performance of the Agreement. Mitigater agrees that this confidentiality commitment shall continue to apply even after the termination of the Agreement.
    3. The Company undertakes to keep all information received regarding Mitigater's security measures, procedures, IT systems, or otherwise of a confidential nature strictly confidential and further undertakes not to disclose to any outsider confidential information originating from Mitigater or its Sub-processors. However, the Company has the right to disclose such information that the Company is obliged to disclose by law or under the Agreement. The Company agrees that this confidentiality commitment shall continue to apply even after the termination of the Agreement.
  9. LIABILITY
    1. In the event that Mitigater incurs damages or receives claims as a result of Mitigater's processing of personal data in accordance with the Company's instructions, the Company shall indemnify Mitigater for the damage caused thereby. However, Mitigater shall be responsible for the performance of Sub-processors' obligations towards the Company if the Sub-processor fails to fulfill its obligations. Any limitation of liability under this data processing agreement shall not apply in relation to the Company's liability under this data processing agreement.
    2. If the Company's additional documented instructions regarding the processing of personal data are not supported by the Service or do not follow from Mitigater's commitments under the Agreement and which Mitigater could not reasonably have foreseen, and these requirements result in Mitigater incurring additional costs, Mitigater shall have the right to choose between terminating the agreement with immediate effect or receiving compensation from the Company for these costs.
  10. RETURN AND DELETION OF PERSONAL DATA
    1. Upon termination of the Agreement, Mitigater shall, at the Company's choice, return or delete all personal data processed on behalf of the Company and delete existing copies, unless storage of the personal data is required by Union or Member State law. If the Company has not requested return within thirty (30) days after termination, Mitigater shall delete the personal data. During this period, the Company may also request an export of its data, which Mitigater shall provide free of charge in a structured, commonly used and machine-readable format. Personal data in backups is deleted in accordance with the retention period for backups set out in the Appendix.

APPENDIX - DESCRIPTION OF THE PROCESSING OF PERSONAL DATA IN THE SERVICE

This appendix shall be deemed an integral part of the data processing agreement. It describes only the processing that Mitigater carries out as data processor on behalf of the Company. Processing relating to companies that are not customers of Mitigater is not covered by this data processing agreement (see clause 1.2).

1. PURPOSE OF THE PROCESSING

THE PERSONAL DATA IS PROCESSED FOR THE FOLLOWING PURPOSES:

  • To provide the service and support of the service; and
  • To make data available to other companies in the Service in accordance with the Company's instructions (see clause 2.3); and
  • To fulfil any additional documented instructions provided by the Company from time to time.

2. LOCATIONS WHERE PERSONAL DATA WILL BE PROCESSED

The personal data is processed by Mitigater within the EU/EEA, except as set out in the list of Sub-processors below. For information about the Sub-processors engaged by Mitigater and where they process the Company's personal data, see the list below and Mitigater's website as periodically indicated.

3. RETENTION OF PERSONAL DATA

See below in point 4 for further information on how long personal data is retained.

4. DETAILED DESCRIPTION OF THE PROCESSING OF PERSONAL DATA IN THE SERVICE

See below for a detailed description of the processing of personal data occurring in the service.

MANAGE THE SERVICE

CATEGORIES OF DATA SUBJECTS

The following categories of data subjects may be subject to processing:

  • The Company's employees and contact persons and employees of the Company's companies or suppliers.
  • Contact persons of companies that have been invited to connect in Mitigater by a company using our services.

CATEGORIES OF PERSONAL DATA

The following categories of personal data may be processed depending on the data registered by the Company:

  • Identity information (e.g., name)
  • Contact information (e.g., email address and company telephone number)
  • User account information
  • Organisational information (e.g., job title)
  • Personal data that may be included in documents relating to the Company's own organisation uploaded by the Company (e.g., names in certificates)

PROCESSING OF PERSONAL DATA

For this purpose, the following processing of personal data is included, for example:

  • Collection through registration of data
  • Access for viewing and editing personal data through the service
  • Transfer of personal data to collect and ensure updated and accurate data
  • Making personal data available to other companies in the Service in accordance with the Company's instructions
  • Access for the data subject to information concerning the data subject in connection with their use of the service
  • Preparation of reports for monitoring and basis

RETENTION OF PERSONAL DATA

Personal data is retained for the duration the Company uses the Service and is thereafter returned or deleted in accordance with clause 10, unless otherwise required by applicable legislation.

TECHNICAL FUNCTIONALITY AND SECURITY

CATEGORIES OF DATA SUBJECTS

The following categories of data subjects may be subject to processing:

  • All categories of data subjects as specified above.

CATEGORIES OF PERSONAL DATA

The following categories of personal data may be processed depending on the data registered by the Company's users:

  • All categories of personal data as specified above
  • Technical data (e.g., IP address and data included in error logs)

PROCESSING OF PERSONAL DATA

For this purpose, the following processing of personal data is included, for example:

  • Backup
  • Troubleshooting
  • Incident management

RETENTION OF PERSONAL DATA

Personal data is retained for the same period as specified in relation to the respective purposes of the processing of personal data above. Data in logs is retained for troubleshooting and incident management for a period of 12 months from the time of the log event. Data in backups is retained for a period of 4 months from the date of the backup.

SUB-PROCESSORS

The following Sub-processors are engaged by Mitigater to provide the Services at the time of entering into the Data Processing Agreement.

Identity Processing location Service
Elastx AB, reg. no. 556906-5617 Sweden Hosting
Mailgun EU E-mail delivery
Bugsink EU Error logging
OpenAI USA Search function (certificates)

ANNEX - TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

The following technical and organizational measures are implemented by Mitigater and its Sub-processors to protect the Personal Data covered by this Data Processing Agreement:

  • Access control measures, such as password management and authentication procedures (including two-factor authentication), logging, user authorization controls, and access to data center facilities.
  • Measures to ensure confidentiality, such as encryption during transmission.
  • Measures to ensure availability, such as backups, firewalls, antivirus systems, logging, and uninterrupted power supply (UPS).

Furthermore, Mitigater has procedures in place to manage security incidents, staff are subject to confidentiality requirements, and security measures are conducted on a regular basis.