Data Processing Addendum

1. Scope and roles

This DPA forms part of the YouSaid Terms or applicable order. The customer is controller or processor, and Sansa Group AB, acting through its Sansa Vision subdivision, is processor or subprocessor, for personal data submitted to YouSaid as customer content. Each party remains responsible for its independent controller processing.

2. Processing instructions

We process customer personal data only to provide, secure, support, and maintain YouSaid, according to the agreement, documented product settings, and lawful written instructions. We will notify the customer if an instruction appears to violate applicable data protection law unless prohibited.

3. Processing details

• Subject matter: customer feedback, support, research, decision, and release follow-up services.
• Duration: the agreement plus the deletion and backup period.
• Data subjects: customer end users, account contacts, employees, contractors, and other people represented in customer content.
• Data types: identity, contact, account, conversation, survey, product context, diagnostics, attachment, preference, and usage data.
• Purpose: receipt, acknowledgment, response, evidence analysis, product decision support, approved communication, and outcome measurement.

4. Confidentiality and security

Personnel with access are bound by confidentiality. We maintain measures appropriate to risk, including tenant and product scope, access control, encryption in transit, provider encryption at rest, audit trails, key rotation, secret redaction, rate limits, backups, incident response, and isolation testing.

5. Subprocessors

The customer authorizes subprocessors needed to provide the service. We remain responsible for their data protection obligations to the extent required by law. We will provide notice of material new subprocessors and a reasonable opportunity to object on documented data protection grounds.

6. Assistance

Taking into account the nature of processing, we assist with data subject requests, security, breach response, impact assessments, regulator consultations, and compliance information. Extra work outside standard product capabilities may be charged at agreed rates.

7. Incidents

We will notify the customer without undue delay after confirming a personal data breach affecting customer personal data and provide available information needed for the customer's obligations. Notification does not admit fault.

8. Return and deletion

During the term, the customer may export data through available tools. After termination or instruction, we delete or return customer personal data unless law requires retention. Deletion propagates through active read models, Durable Objects, vector records, artifacts, and integrations. Backups expire on their protected schedule.

9. Transfers

For restricted transfers, the parties incorporate the applicable 2021 EU Standard Contractual Clauses, Module Two or Three as appropriate, with the customer as exporter and Sansa Group AB as importer. The UK Addendum and Swiss adaptations apply where relevant. The agreement and this DPA supply the annex details.

10. Audit

We provide reasonable information needed to demonstrate compliance. Audits first use current certifications, reports, and questionnaires. An on-site audit may occur no more than once yearly unless required by a regulator or material incident, with reasonable notice, confidentiality, and minimal disruption.

11. Contact and execution

This DPA is accepted with the Terms. The processor is Sansa Group AB, organization number 559111-9507, Soldathemsgatan 20, 415 28 Göteborg, Sweden. A countersigned copy and current annex package may be requested at privacy@yousaid.dev.