Data Processing Agreement

Appendix 3 to the Vesence agreement

Version 1.4.0 · Effective 26 October 2026

This Data Processing Agreement forms part of the Vesence agreement together with the applicable Order Form, the General Terms and Conditions, the Service Description, and Vesence's Security Requirements. The current list of sub-processors engaged under this DPA is published at vesence.com/subprocessors.

1. Background and objective

1.1

This data processing agreement ("DPA") is applicable between the Customer and Vesence in relation to Vesence's processing of personal data within the scope of the provision of the Services, as ordered by the Customer under an Order Form.

1.2

By executing an Order Form that references this DPA, the Customer agrees to the terms and conditions set out herein and that this DPA shall form an integrated part of the Agreement.

1.3

If any provision of this DPA is found by any court of competent jurisdiction to be invalid or unenforceable, the invalidity of such provision shall not affect the other provisions hereof, and all provisions not affected by such invalidity shall remain in full force and effect.

1.4

The Customer acknowledges that Vesence, in its capacity as an EU-based processor of personal data, is required to enter into data processing agreements with data controllers on whose behalf Vesence processes personal data within the provision of the Services. Thus, the provision in this DPA applies between the Parties even if the GDPR is not applicable to the Customer.

1.5

It is acknowledged and agreed that with regard to the processing of personal data under this DPA, the Customer is the controller and Vesence is the processor for such processing, even if Customer, in practice, is processing personal data on behalf of its Affiliates (i.e. is acting as a data processor to its Affiliates and Vesence thereby is a so-called sub-processor).

1.6

The duration, nature and purpose of the processing, the types of personal data and categories of data subjects processed under this DPA are specified in Annex 1 hereto, as may be updated by the Parties as applicable from time to time.

2. Definitions

Capitalized terms used in this DPA shall have the meaning assigned to them in the Vesence General Terms and Conditions, unless the context requires otherwise. In addition to the definitions under the Vesence General Terms and Conditions, the below terms shall have the following meanings:

"Data Protection Legislation" means all EU and relevant member state legislation and regulations, including regulations and decisions issued by relevant supervisory authorities, protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data that from time to time apply to Vesence and the Customer, including without limitation the GDPR, including any future interpretations thereof in court precedence from the EU Court of Justice or any other authorized court or supervisory authority.

"DPA" means this data processing agreement and the appendices attached hereto (as amended from time to time in accordance herewith).

"GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

"Sub-processor" means any processor engaged by Vesence, by an Affiliate of Vesence or by another Sub-processor, including Affiliates of Vesence acting as processors (as the case may be).

"Standard Contractual Clauses" or sometimes also referred to as the "EU Model Clauses" means the Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, based on the Commission Decision (EU) 2021/914 of 4th June 2021.

The terms "controller", "processor", "data subject", "processing", "personal data", and "personal data breach", shall have the same meanings as set out in article 4 of the GDPR.

3. Customer obligations

3.1

Except as may be otherwise required under the Data Protection Legislation, the Customer shall, on behalf of any Affiliate, serve as a single point of contact for Vesence in all matters under this DPA and shall be responsible for the internal coordination, review and submission of instructions or requests to Vesence as well as the onward distribution of any information, notifications and reports provided by Vesence hereunder.

3.2

In its capacity as controller the Customer confirms (for its own part and/or on behalf of its Affiliates, as the case may be) that it is entitled to provide access to personal data to Vesence for the purposes hereof and, consequently, that it has a lawful basis and any necessary approvals from any relevant data subjects for Vesence's performance of the Services.

3.3

The Customer shall have sole responsibility for the accuracy, quality, and legality of personal data and the means by which the Customer acquired personal data.

4. Vesence undertaking and instruction

4.1

Vesence undertakes to process the personal data that it has access to under the Agreement only on behalf of Customer, for the purpose of fulfilling the Agreement and during the term of the Agreement. Vesence further undertakes:

(a)

To process the personal data in accordance with the Data Protection Legislation, the Agreement and any additional documented instructions from Customer. Vesence may, however, without instructions, process information required by the laws of the European Union or national legislation in a member state to which Vesence is subject, but shall inform Customer of such requirement prior to processing, provided that Vesence is not prohibited from giving such information with reference to important grounds of public interest;

(b)

To keep the personal data confidential and not to disclose the personal data to any third party or in any other way use the personal data in contradiction with the Agreement and the DPA. Vesence shall also ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to personal data shall be withdrawn when it is no longer necessary, and the personal data shall thereafter no longer be accessible to those persons. Personal data processed on Customer's behalf shall not be used by Vesence or its Sub-processors for their own purposes, including training AI models. These confidentiality obligations continue for as long as Vesence or a Sub-processor retains the personal data;

(c)

To implement all appropriate technical and organisational measures necessary in order to ensure a level of security, as required pursuant to the Data Protection Legislation (Article 32 of the GDPR), including complying with the security requirements set out in Annex 1 to this DPA and in Appendix 4 to the Agreement;

(d)

To inform Customer of the technical and organisational measures it will implement in order to protect the personal data, processed on behalf of Customer. If Vesence makes changes that could affect the protection of personal data, Customer shall be informed of this well in advance before such changes are implemented;

(e)

To assist Customer, taking into account the nature of the processing, by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of Customer's obligation to respond to requests from data subjects exercising their rights laid down in Chapter III of the GDPR;

(f)

To assist Customer in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (implement security measures, manage personal data breaches, conduct data privacy impact assessments and participate in prior consultations with the supervisory authority) taking into account the nature of the processing and the information available to Vesence, including complying with the requirements in relation to personal data breaches set out in section 5 below; and

(g)

To immediately inform Customer if, in its opinion, an instruction infringes the Data Protection Legislation.

4.2

Vesence shall disclose personal data to a public authority only where permitted by the Data Protection Legislation and shall limit any disclosure to the personal data lawfully required. Where legally permitted, Vesence shall notify Customer of the request before disclosure. A request from an authority outside the EU/EEA does not in itself authorise disclosure or transfer under this DPA. This section does not limit the requirements in section 4.1(a) or any applicable Standard Contractual Clauses.

5. Personal data breach

5.1

Vesence will inform the Customer without undue delay after it becomes aware of any personal data breach in connection with the processing of personal data under this DPA, observing the following process:

(a)

Vesence will investigate the personal data breach and take reasonable measures to identify its root cause(s) and, where such breach is caused by Vesence or a Vesence Sub-processor, mitigate its adverse effects;

(b)

as information is collected or otherwise becomes available, to the extent legally permitted, Vesence will provide the Customer with a description of the personal data breach, the type of data to which the breach relates, and other information the Customer may reasonably request concerning the affected data subject(s) where such information is available to Vesence; and

(c)

the Parties agree to coordinate in good faith on developing the content of any related public statements or any required notices for the affected data subject(s) and/or the competent supervisory authorities.

5.2

The obligations in section 5.1 apply irrespective of the cause of the personal data breach. Vesence may charge the Customer for any assistance that the Customer may request when a personal data breach is attributable to or caused by the Customer. Such charges shall not delay or condition Vesence's notification or assistance required under the Data Protection Legislation.

6. Audits

Vesence shall upon the Customer's request, make all necessary information available to demonstrate compliance hereof and allow for audits, including inspections, to be performed by the Customer (or an independent third-party auditor mandated by the Customer that is reasonably acceptable to Vesence and subject to signature of a confidentiality agreement with Vesence) of Vesence relevant to the personal data processed under this DPA.

7. Sub-processors

7.1

Vesence may delegate the processing of personal data to a Sub-processor. Vesence shall ensure that it has concluded a data processing agreement with such Sub-processor on terms equivalent to and not less restrictive than the provisions in this DPA and in compliance with the Data Protection Legislation. Where a Sub-processor fails to fulfil its data protection obligations, Vesence shall remain liable for the performance of such Sub-processor's obligations.

7.2

Subject to section 7.3 below, the Customer hereby gives its general written consent and authorization to Vesence to use Sub-processors for the processing of personal data solely for the purposes set forth in this DPA. The current list of Vesence Sub-processors is available at https://www.vesence.com/subprocessors ("Sub-processor List"). Vesence will give Customer written notice, including by email to Customer's designated contact, of any intended appointment or replacement of a Sub-processor at least thirty (30) days before authorizing the new Sub-processor to process Customer's personal data in connection with the provision of the Services, and will update the Sub-processor List at the same time. The Sub-processor List shall identify the Sub-processor, its processing activities and relevant processing countries and, where applicable, the transfer mechanism under section 11. Certain Sub-processors are optional for the Customer as indicated in the Sub-processor List where personnel with administrative privileges can chooses between AI model providers.

7.3

The Customer may object to Vesence's use of a new Sub-processor by notifying Vesence in writing within thirty (30) days after receipt of the notice under section 7.2. The new Sub-processor shall not process Customer's personal data before that period has expired or, if Customer objects within that period, while the objection remains unresolved. In the event that the Customer objects to a new Sub-processor, Vesence will use commercially reasonable efforts to provide the Services without engaging the Sub-processor subject to the objection. If such a work-around is not possible, the Customer shall be entitled to terminate the subscription of the relevant Vesence Service. In the event of such termination, the Customer shall not be entitled to any refund of any fees paid to Vesence within the scope of the Agreement.

8. Limitation of liability

8.1

The Parties' liability with respect to data subjects' claims for compensation shall be handled in accordance with article 82 of the GDPR.

8.2

Each Party shall be liable for any administrative fine imposed on it by a supervisory authority under article 83 of the GDPR to the extent such fine results from that Party's own breach of the Data Protection Legislation or this DPA.

8.3

Without prejudice to the foregoing, the Parties' liability under this DPA shall be limited in accordance with the provisions of the Vesence General Terms and Conditions.

9. Term

9.1

The DPA is effective from the effective date of the Agreement or, where this DPA is entered into on a standalone basis, from the date on which the Parties sign or otherwise agree to this DPA, and in each case for as long as Vesence processes personal data on Customer's behalf.

9.2

In the event that Vesence is in breach of its obligations under the DPA, Vesence must remedy the deficiency within thirty (30) days of Vesence being notified of the breach, or within the time period agreed between the Parties. If Vesence fails to remedy a material deficiency within the agreed time period, Customer has the right to terminate the subscription of the Services (and thereby the Agreement) with immediate effect or the longer period of notice notified by Customer.

9.3

When the Agreement expires or terminates, Vesence shall, based on Customer's instructions, delete or return to Customer, in a manner acceptable to Customer, all personal data, and delete existing copies unless storage of personal data is required pursuant to European Union law or the Member State's national law. Vesence undertakes to actively seek instructions from Customer without delay.

10. Governing law and Dispute resolution

10.1

The DPA shall be governed by the substantive laws of Sweden.

10.2

Disputes regarding the interpretation and application of the DPA shall be settled in accordance with the provisions in the Vesence General Terms and Conditions regarding dispute resolution.

11. International transfers

11.1

Vesence may transfer personal data to a recipient outside the EU/EEA, including by making personal data available by remote access, only on Customer's documented instructions and in compliance with Chapter V of the GDPR. Such instructions may be set out in the Agreement and Customer's documented selection of available Services or AI model providers. This section does not override any more restrictive processing-location commitment separately agreed with Customer.

11.2

Before a transfer takes place, Vesence shall ensure that it is covered by an applicable adequacy decision under Article 45 of the GDPR or by appropriate safeguards under Article 46, including, where applicable, Standard Contractual Clauses entered into by the relevant parties. Where required under the Data Protection Legislation, Vesence shall assess the effectiveness of the transfer mechanism and implement supplementary measures. Vesence shall keep these arrangements under review and make information reasonably necessary for Customer to assess the transfer available in accordance with section 6. Customer's selection of a Service or AI model provider does not dispense with these requirements.

11.3

If the requirements in this section can no longer be met, Vesence shall suspend the affected transfer and inform Customer without undue delay. The transfer may resume only when those requirements are met.

Annex 1

Instructions for the processing of personal data

1. Purposes of processing

Personal data is processed by Vesence to provide the Services to Customer in the manner described in the Agreement.

If Usage-Based Pricing is enabled for the Customer, personal data is also processed to display Customer's consumption of Vesence Credits under the Agreement. For the avoidance of doubt, consumption data relating to the Customer will also be processed by Vesence as a data controller for the purpose of calculating and charging subscription fees.

2. Categories of processing

The processing of personal data includes processing with regard to the following categories of processing:

Data Collection: The text provided by the user (documents, agreements, questions, answers, conversations) may contain personal data. This data is collected to generate responses.
Analysis: The collected data is used to analyze the user's needs and intentions. Machine learning algorithms process this information to generate appropriate responses and insights.
Vesence Credit: Where Usage-Based Pricing is enabled, Vesence Credit consumption data on a user, matter and day level is collected in order to display the consumption of Vesence Credits for Customer through the Services.
Cloud Storage: persistent storage and retrieval of files, chat history and workspace and project context, including personal data contained therein, to enable continuity between sessions, access from authorised devices and collaboration between authorised Customer users. This processing takes place solely for the purpose of providing Cloud Storage to Customer, subject to the activation requirements in Section 6 of this Annex.
Diagnostic: logging of email addresses, tool-usage events and timestamps solely to troubleshoot issues and ensure the reliability of the Services provided to Customer.

3. Categories of data subjects

The categories of data subjects that will be processed are all those appearing in the agreements, documents, etc. uploaded to the Services provided under the Agreement, which may include, for example:

Customer's employees and hired consultants.
Contact persons and other representatives who sign/appear in agreements, documents, correspondence, etc.
Others who appear in the data that Customer inputs into the Services.

4. Categories of personal data

The categories of personal data that will be processed include all those appearing in the agreements, documents, information etc. uploaded to the Services provided under the Agreement, which may include names, personal identification numbers, signatures, professions, shareholdings, etc.

If Usage-Based Pricing is enabled, the categories of personal data that will be processed may also include user identifiers, matter identifiers, and the relevant user's usage of Vesence Credits.

5. Location of processing

Personal data processing is performed within the EU/EEA, except for transfers authorised under section 11 of this DPA. The relevant processing countries for Sub-processors are identified in the Sub-processor List. Any more restrictive processing-location commitment separately agreed with Customer remains applicable.

6. Retention

Personal data is retained only for the purposes and periods described in this Annex and in accordance with Customer's instructions. Personal data included in prompts in so-called "agents" created by the Customer (only applicable to the Vesence Web Application) will be retained until deleted by the Customer.

Customer may choose to activate Cloud Storage. Cloud Storage is optional and is not activated by default. Customer's activation of Cloud Storage constitutes Customer's documented instruction for the Cloud Storage processing described in Section 2 of this Annex.

Once activated, files, chat history and workspace and project context are retained in Vesence's Microsoft Azure environment for use between sessions until the earliest of deletion by Customer, Customer's deactivation of Cloud Storage, Customer ceasing to use the Services, or Customer requesting removal. Customer may at any time deactivate Cloud Storage and request removal of the retained data. Upon expiry or termination of the Agreement, return and deletion of personal data and existing copies shall be governed by section 9.3 of this DPA.

All other applicable safeguards, including non-use of Customer Data for AI training, tenant isolation and the security and transfer restrictions in the Agreement and this DPA, continue to apply to Cloud Storage.

Notwithstanding the foregoing, where Usage-Based Pricing is enabled for the Customer, personal data necessary to display Vesence Credit consumption will be retained for the duration of the Agreement or until Customer requests it to be deleted.

Diagnostic data is retained only as necessary for the diagnostic purposes set out in Section 2 of this Annex, subject to periodic review and deletion when no longer needed. Section 9.3 of this DPA remains applicable.

7. Technical and organizational security measures

Vesence shall process personal data in accordance with the provisions of the Agreement, including the Security Requirements in Appendix 4.