Data Processing Agreement

(1) The customer that has entered into the Service Agreement with DataFigured (“Customer”), as controller; and

(2) DataFigured Oy, Business ID 3519376-2, Mechelininkatu 4 B 51, 00100 Helsinki, Finland (“DataFigured”), as processor.

1.1 This Data Processing Agreement (“DPA”) forms part of the agreement under which DataFigured provides the ERP Agent service to Customer, including the order form and DataFigured’s terms of service (together the “Service Agreement”). It applies whenever DataFigured processes Customer Personal Data on Customer’s behalf, including during pilots and tests.

1.2 On the processing and protection of Customer Data, this DPA prevails over the Service Agreement. On all other matters, including fees, the Service Agreement prevails. Liability is governed by Section 12.

1.3 Terms such as controller, processor, personal data, data subject, processing and personal data breach have the meanings given in Regulation (EU) 2016/679 (“GDPR”). In addition: “Customer Data” means all data that Customer or its users submit to the Service or make available to it through integrations; “Customer Personal Data” means personal data contained in Customer Data; “Derived Data” means data generated from Customer Data specifically for Customer, such as Customer’s product-matching index and the matches learned from its users’ corrections; “Sub-processor” means a third party engaged by DataFigured that processes Customer Personal Data; and “Security Incident” means a personal data breach affecting Customer Personal Data.

1.4 “Enterprise package” means the Enterprise version of the Service, as stated in the order form. Terms that this DPA sets out for the Enterprise package apply only when Customer has ordered it.

1.5 In the Enterprise package, the parties may agree in writing that Customer’s own data processing agreement replaces this DPA.

2.1 Customer is the controller and DataFigured is the processor of Customer Personal Data. The details of the processing are set out in Annex 1.

2.2 DataFigured processes Customer Personal Data only on Customer’s documented instructions. The Service Agreement, this DPA and Customer’s use and configuration of the Service are Customer’s complete instructions at the time of signing. Further instructions must be given in writing; if they require work beyond the standard Service, the parties agree on the fee before the work starts.

2.3 DataFigured informs Customer without delay if, in its opinion, an instruction infringes data protection law, and may suspend the processing concerned until Customer confirms or changes the instruction.

2.4 If EU or Member State law requires DataFigured to process Customer Personal Data otherwise than on Customer’s instructions, DataFigured informs Customer before the processing, unless that law prohibits it.

2.5 Customer is responsible for having a lawful basis for the processing, for informing data subjects, and for the lawfulness of its instructions. Customer does not submit special categories of personal data (GDPR Article 9) or data on criminal convictions (Article 10) to the Service unless the parties have agreed so in writing.

3.1 DataFigured uses Customer Data and Derived Data to provide the Service to Customer and to improve it for Customer, for example when Customer’s own product-matching index learns from its users’ corrections.

3.2 Neither DataFigured nor any Sub-processor uses Customer Data or Derived Data to train or fine-tune general-purpose AI models. DataFigured uses AI providers only on terms that prohibit the provider from training on Customer Data and, where the provider offers it, with zero data retention.

3.3 Customer Data and Derived Data are kept logically separated per customer organisation, and no other customer ever gets access to them. DataFigured never discloses Customer’s prices, customer identities, volumes or quotation contents to another customer.

3.4 DataFigured may (a) improve the Service generally, such as its code, prompts and matching methods, provided that no Customer Data can be identified in or derived from the result; and (b) compile anonymised, aggregated statistics that identify neither Customer, nor any individual, nor Customer’s customers or products.

3.5 Outside the Enterprise package, DataFigured may also use Customer Data and Derived Data that are not personal data, in de-identified form, to develop and improve the Service, including for other customers, during and after the term of the Service Agreement. Such data includes product-matching examples (the terms used in requests and the products they were matched to), learned rules, matching indices and generic product knowledge such as unit conventions and product-code structures. It never includes Customer’s prices, customer identities or volumes. The matching indices, rules and models that DataFigured builds are DataFigured’s trade secrets.

3.6 In the Enterprise package, Customer Data and Derived Data are used only to provide the Service to Customer, and Section 3.5 does not apply.

4.1 DataFigured gives access to Customer Personal Data only to persons who need it to provide the Service. Each of them is bound by a written confidentiality obligation or a statutory duty of confidentiality, and has been instructed in data protection.

5.1 DataFigured implements and maintains the technical and organisational measures described in Annex 2, which are designed to ensure a level of security appropriate to the risk, as required by GDPR Article 32.

5.2 DataFigured may update the measures as technology and threats develop, provided that the overall level of protection is not reduced.

5.3 Customer Data is stored in the EU/EEA. Section 7 governs processing outside the EU/EEA.

6.1 Customer gives DataFigured a general authorisation to engage Sub-processors. DataFigured publishes the current list of its Sub-processors, with the location of processing and the purpose of each, at erp-agent.com/subprocessors (the “Sub-processor List”). The Sub-processors in use on the date of this DPA are listed in Annex 3, Part A. The AI providers listed in Annex 3, Part B are also authorised, but only for language-model processing in EU/EEA regions on the terms of Section 3.2; DataFigured may route processing to them without separate notice.

6.2 DataFigured engages only Sub-processors that meet the requirements of this DPA: each Sub-processor is bound by a written contract to data protection obligations that give at least the same level of protection as this DPA, AI providers are bound by the terms in Section 3.2, and any processing outside the EU/EEA complies with Section 7. DataFigured remains fully liable to Customer for the performance of each Sub-processor’s obligations, subject to Section 12.

6.3 Outside the Enterprise package, DataFigured may add or replace Sub-processors that meet the requirements of Section 6.2 without separate notice to Customer. DataFigured updates the Sub-processor List before a new Sub-processor starts processing Customer Personal Data, and this update is DataFigured’s information to Customer of the change under GDPR Article 28(2).

6.4 In the Enterprise package, DataFigured notifies Customer by email at least thirty (30) days before a new Sub-processor starts processing Customer Personal Data. The notice names the Sub-processor, its location and the purpose.

6.5 Customer may object to a new Sub-processor on reasonable data protection grounds by written notice within thirty (30) days after the Sub-processor List was updated or, in the Enterprise package, within fifteen (15) days of the notice under Section 6.4. The parties then seek a solution in good faith, for example a configuration in which the new Sub-processor does not process Customer’s data. If no solution is found within thirty (30) days of the objection, Customer may terminate the affected part of the Service by written notice without penalty, and DataFigured refunds any fees prepaid for the period after termination. This is Customer’s sole remedy for an objection.

6.6 In the Enterprise package, if a Sub-processor must be replaced urgently for security or continuity reasons, DataFigured may make the change immediately and notifies Customer without delay. Customer’s right to object under Section 6.5 then applies from the notice.

7.1 Customer Personal Data is processed outside the EU/EEA only by Sub-processors engaged under Section 6, and only under a valid transfer mechanism of GDPR Chapter V: an adequacy decision of the European Commission (including the EU–U.S. Data Privacy Framework for certified recipients) or the Commission’s Standard Contractual Clauses (Decision (EU) 2021/914) with any supplementary measures required.

7.2 DataFigured provides Customer with a summary of its transfer impact assessment on request.

7.3 EU-only processing is available in the Enterprise package: DataFigured then configures the Service so that all processing of Customer Data takes place in the EU/EEA, which may limit the language models and features available to Customer. Otherwise, processing outside the EU/EEA takes place as set out in Section 7.1.

8.1 DataFigured notifies Customer of a Security Incident without undue delay, and at the latest within forty-eight (48) hours, or twenty-four (24) hours in the Enterprise package, after becoming aware of it.

8.2 The notice describes, as far as then known, the nature of the incident, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact person. Information not yet available is provided in phases without undue delay.

8.3 DataFigured takes the reasonable measures needed to contain and investigate the incident and to mitigate its effects. It gives Customer a written incident report within ten (10) business days of the first notice.

8.4 If the incident was caused by a breach of this DPA by DataFigured or its Sub-processor, DataFigured bears its own costs of handling the incident and reimburses Customer’s reasonable, documented costs of notifying the supervisory authority and the data subjects, subject to Section 12.

8.5 Notifying or reporting an incident is not an acknowledgement of fault or liability.

9.1 DataFigured forwards to Customer without undue delay any request from a data subject that it receives, and does not respond to it except on Customer’s instructions. The Service lets Customer access, export, correct and delete Customer Personal Data; DataFigured gives reasonable further help where the Service does not cover a request.

9.2 DataFigured gives Customer the information reasonably available to it that Customer needs for data protection impact assessments and prior consultations with a supervisory authority, and for meeting its obligations under GDPR Articles 32–36.

9.3 Assistance under this Section is included in the fees up to four (4) hours per calendar year, or sixteen (16) hours in the Enterprise package. Further assistance is charged at EUR 150 per hour (excluding VAT), except where it is needed because of DataFigured’s breach of this DPA.

9.4 This Section concerns data protection assistance only. It does not limit the customer support or the continuous tuning of matching quality included in the Service Agreement.

10.1 DataFigured makes available to Customer all information necessary to demonstrate compliance with GDPR Article 28 and this DPA.

10.2 On request and free of charge, DataFigured provides its current security overview and Sub-processor list, and the third-party certifications or audit reports available to it, including those of its hosting providers. In the Enterprise package, DataFigured also answers one reasonable security questionnaire per calendar year and provides a summary of its annual vulnerability scan.

10.3 Customer, or an independent auditor bound by confidentiality who is not a competitor of DataFigured, may carry out an audit if (a) the information under Section 10.2 is not sufficient to demonstrate compliance, (b) a Security Incident has occurred, or (c) a supervisory authority requires it. Customer gives thirty (30) days’ written notice, or a shorter reasonable notice after a Security Incident. Audits are carried out at most once in any twelve (12) months, except after a Security Incident or at a supervisory authority’s request, during business hours, and remotely unless an on-site audit is necessary. The facilities of hosting providers are audited through their own certifications and reports. In the Enterprise package, Customer may also carry out one audit per calendar year without any of the conditions (a)–(c), on site where Customer so requests.

10.4 Each party bears its own audit costs. DataFigured’s time is charged at the rate in Section 9.3; in the Enterprise package, the first business day per audit is free of charge. If the audit reveals a material breach of this DPA by DataFigured, DataFigured bears its own costs, reimburses Customer’s reasonable audit costs subject to Section 12, and remedies the breach at its own cost within a reasonable time agreed with Customer, at the latest within thirty (30) days unless otherwise agreed.

10.5 In the Enterprise package, DataFigured keeps an audit trail of operations on Customer Data for twelve (12) months and provides it to Customer on request.

11.1 When the Service Agreement ends, DataFigured deletes Customer Personal Data from its production systems and from those of its Sub-processors within thirty (30) days, unless Customer asks within that period for it to be returned first in a common machine-readable format such as CSV or JSON.

11.2 For the same thirty (30) days, Customer may export the data that it or its users submitted to the Service and the documents the Service produced for it, in line with the EU Data Act (Regulation (EU) 2023/2854). Outside the Enterprise package, DataFigured then deletes that data, except the de-identified data that is not personal data and that it may keep under Section 3.5. The matching indices, rules and models that DataFigured builds are not exported.

11.3 In the Enterprise package, DataFigured also deletes all Derived Data, including Customer’s matching indices, within thirty (30) days after the export period, and Section 3.5 does not apply.

11.4 Copies in backups are deleted within ninety (90) days. DataFigured confirms the deletion in writing on request.

11.5 Sections 11.1–11.4 do not apply to data that EU or Member State law requires DataFigured to keep; such data remains protected under this DPA until deleted. Security and audit logs are kept for at most twelve (12) months.

12.1 Liability under this DPA is subject to the limitations and exclusions of liability in the Service Agreement, including the exclusion of indirect and consequential damages, except as set out in this Section 12.

12.2 Outside the Enterprise package, DataFigured’s total liability under or in connection with this DPA, including for breaches of this DPA or of data protection law by DataFigured or its Sub-processors and for costs under Sections 8.4, 10.4 and 12.5, is limited to the fees paid by Customer under the Service Agreement in the six (6) months before the event giving rise to the claim. This limit is part of, and not in addition to, the total limit of liability in the Service Agreement, and if the Service Agreement sets a lower limit, the lower limit applies.

12.3 In the Enterprise package, DataFigured’s total liability for claims arising from a breach of this DPA or of data protection law by DataFigured or its Sub-processors is limited to two (2) times the fees paid or payable by Customer under the Service Agreement in the twelve (12) months before the event giving rise to the claim, but not less than EUR 50,000.

12.4 The limitations of liability do not apply to damage caused intentionally or through gross negligence, or where mandatory law does not allow them.

12.5 Subject to Sections 12.1–12.3, compensation paid by a party to a data subject under GDPR Article 82 is shared between the parties in proportion to their responsibility for the damage. Each party bears any administrative fine imposed on it.

12.6 In the Enterprise package, DataFigured maintains cyber and professional liability insurance appropriate to the Service and provides evidence of the insurance on request.

13.1 This DPA enters into force when the Service Agreement that refers to it enters into force, and remains in force for as long as DataFigured processes Customer Personal Data.

13.2 This DPA is governed by the laws of Finland. Disputes are resolved as provided in the Service Agreement or, if it contains no provision on disputes, in the District Court of Helsinki.

13.3 This DPA is made in English. If DataFigured provides a translation, the English version prevails in case of conflict.

13.4 Notices under this DPA are sent by email: to DataFigured at privacy@erp-agent.com, and to Customer at the contact email address given in the order form or, if there is none, the email address of Customer’s administrator user in the Service.

Part A – Sub-processors in use. This is the current Sub-processor List (Section 6.1).

Part B – Authorised alternative AI providers (EU/EEA regions only, Section 6.1).

Questions about this agreement or our data processing: privacy@erp-agent.com.