Data Processing Agreement for Todai Contracts

In case of discrepancies, the Danish version prevails.

Effective from [date]

Parties

The Data Processor: Todai A/S
CVR no. 41776641
Olivia Hansens Gade 3, 2nd floor, 1799 Copenhagen V
(hereinafter "Todai" or "the data processor")

The Data Controller: The company that has entered into an agreement with Todai for the use of Todai Contracts (hereinafter "the Customer" or "the data controller").

The parties are each referred to as a "party" and together as "the parties".

1. Preamble

1.1 These Terms set out the data processor's rights and obligations when processing personal data on behalf of the data controller.

1.2 The Terms have been drawn up with a view to the parties' compliance with Article 28(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation).

1.3 The Terms form an integral part of the Terms of Use for Todai Contracts and are accepted at the same time as those terms when a subscription is created. No separate signature is required, but the Customer may at any time request a signed copy, cf. clause 15.

1.4 In connection with the provision of Todai Contracts, the data processor processes personal data on behalf of the data controller in accordance with these Terms.

1.5 These Terms take precedence over any corresponding provisions in other agreements between the parties.

1.6 Four appendices are attached to these Terms and form an integral part thereof:

• Appendix A contains further information on the purpose and nature of the processing, the type of personal data, the categories of data subjects, and the duration of the processing.
• Appendix B contains the conditions for the data processor's use of sub-processors and a list of approved sub-processors.
• Appendix C contains the instructions for the processing, a description of the security measures observed as a minimum, and how supervision is carried out.
• Appendix D contains the parties' regulation of other matters.

1.7 The Terms and their appendices are retained in writing, including electronically, by both parties. The version in force at any given time is available on Todai's website, stating the version number and effective date.

1.8 These Terms do not release the data processor from obligations imposed on it under the GDPR or other legislation.

2. The data controller's obligations and rights

2.1 The data controller is, as a general rule, responsible to the outside world, including to the data subject, for ensuring that the processing of personal data takes place within the framework of the GDPR and the Danish Data Protection Act.

2.2 The data controller therefore has both the rights and the obligations to decide the purposes for and the means by which processing may take place.

2.3 The data controller is, among other things, responsible for ensuring that there is a legal basis for the processing that the data processor is instructed to carry out — including the processing of information about the persons to whom the data controller sends documents for signature.

2.4 The data controller is responsible for informing data subjects about the processing, including that an external platform is used for preparing and signing documents.

3. The data processor acts on instructions

3.1 The data processor may only process personal data on documented instructions from the data controller, unless required to do so under EU or national law to which the data processor is subject. The instructions are set out in Appendices A and C. Subsequent instructions must be documented and retained in writing together with these Terms.

3.2 The data processor shall immediately inform the data controller if, in the data processor's opinion, an instruction infringes the GDPR or other EU or national data protection provisions.

3.3 The data controller's use of Todai Contracts constitutes a documented instruction to the data processor to carry out the processing entailed by the function used. This includes, among other things, creating documents, adding signatories, sending for signature, using AI features, activating integrations and exporting data.

4. Confidentiality

4.1 The data processor shall only grant access to personal data processed on behalf of the data controller to persons who are subject to the data processor's power of instruction, who have undertaken an obligation of confidentiality or are subject to an appropriate statutory duty of confidentiality, and only to the extent necessary. The list of persons with access is reviewed on an ongoing basis, and access is closed when it is no longer necessary.

4.2 The data processor shall, upon request from the data controller, be able to demonstrate that the relevant persons are subject to a duty of confidentiality.

5. Security of processing

5.1 Article 32 of the GDPR provides that the data controller and the data processor shall, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, implement appropriate technical and organisational measures to ensure a level of security appropriate to those risks.

5.2 The data processor shall — independently of the data controller — assess the risks to the rights of natural persons posed by the processing and implement measures to mitigate those risks. For the purposes of this assessment, the data controller shall make the necessary information available to the data processor.

5.3 The data processor shall assist the data controller in complying with the obligation under Article 32 by making available to the data controller the information necessary regarding the technical and organisational security measures implemented.

5.4 The measures implemented as a minimum are set out in Appendix C.

6. Use of sub-processors

6.1 The data processor shall comply with the conditions referred to in Article 28(2) and (4) of the GDPR in order to engage another processor (a sub-processor).

6.2 The data processor has the data controller's general authorisation to use sub-processors. The data processor shall inform the data controller of any planned changes concerning the addition or replacement of sub-processors with at least 30 days' notice, thereby giving the data controller the opportunity to object before the change takes effect. The list of approved sub-processors is set out in Appendix B.

6.3 Notification is given by email to the contact person registered by the data controller in Todai Contracts, as well as by publication of an updated version of Appendix B on Todai's website.

6.4 Where the data processor engages a sub-processor, the data processor shall, through a contract or other legal act, impose on the sub-processor the same data protection obligations as those set out in these Terms.

6.5 The sub-processor agreement and any subsequent amendments thereto shall, at the data controller's request, be sent in copy to the data controller. Provisions on commercial terms that do not affect the data protection content are exempted.

6.6 The data processor remains fully liable to the data controller for the performance of the sub-processor's obligations.

7. Transfer to third countries or international organisations

7.1 Any transfer of personal data to third countries or international organisations may only be carried out by the data processor on the basis of documented instructions to that effect from the data controller and shall always take place in accordance with Chapter V of the GDPR.

7.2 If a transfer is required under EU or national law to which the data processor is subject, the data processor shall inform the data controller of that legal requirement prior to processing, unless that law prohibits such information on important grounds of public interest.

7.3 Personal data is stored and processed on servers located within the EU/EEA. The data processor draws attention to the fact that several of the sub-processors used are affiliated with or controlled by companies outside the EU/EEA, cf. Appendix B. To the extent that such group affiliation entails the possibility of access to personal data from a third country, any such transfer takes place on the basis of the European Commission's standard contractual clauses, supplemented by the technical measures set out in Appendix C.

8. Assistance to the data controller

8.1 Taking into account the nature of the processing, the data processor shall, insofar as this is possible, assist the data controller by appropriate technical and organisational measures in fulfilling the data controller's obligation to respond to requests for the exercise of data subjects' rights laid down in Chapter III of the GDPR, including:

• the duty of disclosure when collecting personal data from the data subject
• the duty of disclosure if personal data have not been collected from the data subject
• the right of access
• the right to rectification
• the right to erasure
• the right to restriction of processing
• the notification obligation regarding rectification or erasure of personal data or restriction of processing
• the right to data portability
• the right to object
• the right not to be subject to a decision based solely on automated processing

8.2 The data processor provides such assistance in practice by making available features in Todai Contracts by which the data controller can itself look up, export, correct and delete information. If a request cannot be met using these features, the data processor will provide assistance on request.

8.3 The data processor shall assist the data controller in ensuring compliance with the obligations pursuant to Articles 32-36 of the Regulation, taking into account the nature of the processing and the information available to the data processor.

9. Notification of personal data breach

9.1 The data processor shall notify the data controller without undue delay after becoming aware that a personal data breach has occurred.

9.2 The notification shall, where possible, take place no later than 24 hours after the data processor became aware of the breach, so that the data controller is able to comply with its obligation to report the breach to the supervisory authority within 72 hours.

9.3 The data processor shall assist the data controller in providing the following information, cf. Article 33(3) of the Regulation:

• the nature of the breach, including the categories and approximate number of data subjects and records concerned
• the likely consequences of the breach
• the measures taken or proposed to address the breach

10. Erasure and return of data

10.1 On termination of the services relating to processing, the data processor shall be obliged to delete all personal data processed on behalf of the data controller, unless EU or national law requires storage of the personal data.

10.2 The data controller has access to export all personal data from Todai Contracts itself, including signed documents with the associated audit trail, for 30 days after termination.

10.3 The data processor shall thereafter delete the personal data no later than 90 days after termination, including at sub-processors.

10.4 The data processor shall, upon the data controller's request, be able to demonstrate that erasure has taken place.

11. Audit, including inspection

11.1 The data processor shall make available to the data controller all information necessary to demonstrate compliance with Article 28 of the GDPR and these Terms, and shall allow for and contribute to audits, including inspections, conducted by the data controller or another auditor mandated by the data controller.

11.2 The procedure for audits and inspections is further specified in Appendix C.

11.3 The data processor is obliged to grant supervisory authorities access to the data processor's physical facilities upon presentation of appropriate identification.

12. The parties' agreement on other matters

12.1 The parties may agree on other provisions concerning the service relating to the processing of personal data, provided that such provisions do not directly or indirectly conflict with these Terms or reduce the data subject's fundamental rights and freedoms. Such provisions are set out in Appendix D.

13. Entry into force and termination

13.1 These Terms take effect upon the data controller's acceptance of the Terms of Use for Todai Contracts.

13.2 Either party may request that these Terms be renegotiated if legislative changes or shortcomings in the Terms give rise to this.

13.3 These Terms remain in force for as long as the service relating to the processing of personal data continues. During this period, the Terms may not be terminated unless other provisions governing the provision of the service are agreed between the parties.

13.4 The data processor may amend these Terms with 30 days' notice where the amendment is necessary as a result of legislation, regulatory practice or changes to the service. Material amendments to the disadvantage of the data controller entitle the data controller to terminate the subscription with effect from the date the amendment takes effect. Amendments are announced as described in clause 6.3.

13.5 If the provision of the services ceases, and the personal data have been deleted or returned in accordance with clause 10, these Terms may be terminated in writing by either party.

14. Contact

Inquiries regarding this agreement, including requests for assistance, security documentation or a signed copy, should be directed to:

Todai A/S
[privacy@todai.ai]

The data controller's contact person is the person registered as the contact person on the subscription in Todai Contracts. The data controller is responsible for keeping this information up to date.

15. Signed copy

If the data controller wishes to obtain an individually signed copy of this agreement, it may be requested at [privacy@todai.ai]. Todai will in that case send the agreement for electronic signature.

Appendix A — Information on the processing

A.1 The purpose of the processing

The data processor makes the contract platform Todai Contracts available to the data controller. The purpose of the processing is to enable the data controller to create, prepare, send, sign, store and retrieve contract documents, and to document who signed what and when.

A.2 The nature of the processing

The processing primarily comprises:

a. User administration. Creation and administration of the data controller's own users, including access management and logging of activity.

b. Preparation and storage of documents. Storage and processing of the content the data controller inputs into the system, including documents that may contain personal data about employees, contact persons and others.

c. AI-assisted preparation and review. When the data controller uses the system's AI features, the content of the relevant document or proposal is processed for the purpose of preparing a draft, suggesting wording or identifying gaps. This processing takes place at the data controller's initiative and on the data controller's instructions. The content is not used to train models.

d. Sending for signature. Sending emails to the persons designated by the data controller as signatories, including processing of name, email address and, where applicable, telephone number.

e. Identification and signature. Verification of the signatory by sending a one-time code via SMS and, where applicable, by use of electronic identification, as well as registration of the signature. The signature function is provided by the data processor itself; only the sending of SMS is carried out by a sub-processor.

f. Audit trail. Logging of events linked to a document, including the time of opening, viewing and signing, as well as IP address and browser information, for the purpose of being able to document how the signature came about. This information forms part of the signed document.

g. Disclosure to the data controller's own systems. If the data controller activates an integration, information is transferred to the data controller's own accounts with the relevant provider on the data controller's instructions. The relevant provider is, in that context, the data controller's own data processor and not a sub-processor of the data processor.

h. Receipt of incoming email. If this feature is used, emails sent by the data controller or its counterparties to a contract-specific address are received and stored, for the purpose of linking confirmations and addenda to the relevant document.

i. Support. Processing of information in connection with inquiries from the data controller's users.

A.3 Types of personal data

Ordinary personal data:

• Name, email address, telephone number, job title and company affiliation
• User role and access rights
• IP address and information about browser and device
• Timestamps for login, viewing, opening of documents and signature
• Where electronic identification is used: name and identifier from the identity service used
• The content of the documents the data controller inputs into the system, including any personal data such documents may contain
• The content of email correspondence linked by the data controller to a document

Sensitive personal data: The system is not designed for the processing of information covered by Article 9 of the Regulation or information on criminal offences covered by Article 10. The data controller must not input such information into the system without a prior written agreement with the data processor.

Danish civil registration numbers (CPR numbers): The system has no fields for CPR numbers, and the data processor does not obtain CPR numbers from electronic identity services. The data controller should not include CPR numbers in documents uploaded to the system.

A.4 Categories of data subjects

• The data controller's employees and other users of the system
• Persons to whom the data controller sends documents for signature
• Contact persons at the data controller's customers, suppliers and business partners
• Other persons who may be named in the documents the data controller inputs into the system

A.5 Duration

The processing commences upon these Terms taking effect and is not limited in time. The processing continues until the agreement for the provision of Todai Contracts is terminated or cancelled. Erasure then takes place as described in clause 10.

Appendix B — Sub-processors

B.1 Approved sub-processors

Upon these Terms taking effect, the data controller has approved the use of the following sub-processors.

1. Lovable Labs Incorporated
1 Lincoln St, Boston, MA 02111, USA
EU entity: Lovable Labs AB, Regeringsgatan 25, 111 53 Stockholm, Sweden
Data protection officer: dpo@lovable.dev · EU representative: Assenteo Ltd
Processing: Hosting and operation of Todai Contracts, including application execution, database, file storage, authentication and server functions.
Location of processing: EU. The region is selected by the data processor in Lovable Cloud.
Note: The company is incorporated in the USA. See clause B.3 on jurisdiction.

2. Supabase Inc.
[Address — to be completed from Lovable's sub-processor list]
Processing: The underlying database platform for Lovable Cloud, including PostgreSQL database, authentication, file storage and server functions.
Location of processing: EU (Frankfurt, Ireland, London or Paris depending on the region selected).
Note: The company is incorporated in the USA. See clause B.3.

3. Amazon Web Services
Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg
Processing: The underlying physical infrastructure on which databases, file storage and server functions are run.
Location of processing: EU (the selected AWS region).
Note: Affiliated with a US parent company. See clause B.3.

4. Sinch Email (Mailgun)
[Legal name and address — to be completed from the supplier's data processing agreement]
Processing: Sending of email from Todai Contracts, including invitations to sign, receipts and notifications. Processes sender and recipient address, subject, content and delivery status.
Location of processing: EU (EU region).

5. Twilio
[Legal name and address — to be completed from the supplier's data processing agreement]
Processing: Sending of SMS with one-time codes to signatories. Processes telephone number and message content.
Location of processing: [TO BE COMPLETED — clarify whether EU data storage is used, and state the transfer basis if not]

6. EmailConnect
[Legal name and address]
Processing: Receipt of incoming email to contract-specific addresses.
Location of processing: EU (France and Germany).
Note: Used only if the data controller activates the feature.

7. [AI provider]
[Legal name and address]
Processing: Processing of document and proposal text for the purpose of preparing drafts, suggesting wording and reviewing documents.
Location of processing: [TO BE COMPLETED]
Note: The provider does not use the content to train models.

8. [Payment provider]
[Legal name and address]
Processing: Processing of billing information and payments.
Location of processing: [TO BE COMPLETED]

B.2 Providers that are not sub-processors

The following are not sub-processors of the data processor: HubSpot, monday.com, Float, Slack, Google Workspace and similar services to which the data controller itself is a customer. When the data controller activates an integration, the transfer takes place to the data controller's own account on the data controller's instructions, and the relevant provider is the data controller's own data processor.

B.3 Jurisdiction

All personal data is stored and processed on servers within the EU/EEA.

However, several of the sub-processors used are incorporated in, or affiliated with companies in, the USA. The data processor draws attention to this circumstance for the purposes of the data controller's own risk assessment. The data processor has entered into agreements with the relevant suppliers that include the European Commission's standard contractual clauses, and has implemented the supplementary technical measures set out in Appendix C, including encryption of data in transit and at rest.

B.4 Notice of changes

In the event of changes to the list, the data controller will be notified with at least 30 days' notice, cf. clauses 6.2 and 6.3. The data controller may, within the notice period, raise a reasoned objection. If the objection is maintained, the data controller may terminate the subscription with effect from the time the change takes effect.

Appendix C — Instructions regarding the processing of personal data

C.1 Subject matter of the processing and instructions

The data processor's processing of personal data on behalf of the data controller takes place by the data processor making Todai Contracts available and carrying out the processing described in Appendix A on the data controller's instructions.

The data controller's use of the system's features constitutes a documented instruction. Further instructions shall be given in writing to the contact address set out in clause 14.

C.2 Security of processing

The data processor implements at least the following technical and organisational measures:

Access control

• Access requires an individual user account. Shared accounts are not used.
• Access to data is enforced at database level, so that a user can only access the data to which the user's role and affiliation grant access.
• Role-based access control with separation between administrator, sender and reader.
• Access for the data processor's own employees is granted on a need-to-know basis, limited to what is necessary, reviewed regularly and closed upon termination of employment.

Encryption

• All communication is encrypted via TLS.
• Data is encrypted at rest.

Document integrity

• Signed documents are sealed so that subsequent alterations can be detected.
• An audit trail is generated per document, which cannot be altered or deleted, and which accompanies the signed document.

Security of the signature process

• Access to sign takes place via a unique, time-limited link per signatory.
• The signatory is verified by a one-time code sent via SMS with a limited validity period and a limited number of attempts.
• Links are invalidated once the signature has been completed and if the document is withdrawn.

Logging

• Logging of login, lookups, changes, sending and signing, with timestamp, user and IP address.
• Log files are retained for [12] months.

Operation and resilience

• Data is hosted in the EU.
• Regular backups are taken, and restoration is tested.
• Separate environments are used for development and production, and production data is not used in development or test environments.

Organisational measures

• Employees with access are subject to a duty of confidentiality.
• Employees with access receive introductory data protection training.
• A procedure is in place for handling and reporting security breaches.

C.3 Retention period and deletion routine

Personal data is retained by the data processor until the data controller requests that the data be deleted or returned, or until the agreement is terminated, cf. clause 10.

The data controller may at any time delete individual documents and individual users in the system.

C.4 Location of processing

Processing of the personal data covered by these Terms may not, without the data controller's prior approval, take place at locations other than those set out in Appendix B.

C.5 Instructions regarding transfer to third countries

Personal data is stored and processed within the EU/EEA. Any transfers to third countries take place on the basis of the European Commission's standard contractual clauses or a valid adequacy decision, cf. clause 7 and Appendix B.3.

C.6 Procedures for the data controller's audits

Upon request, the data processor makes the following available to the data controller once a year:

• A description of the technical and organisational measures implemented
• Responses to a written questionnaire on security of processing
• [Any audit statement or report from security testing, if available]

If the data controller wishes to carry out a physical inspection, the time shall be agreed with at least 30 days' notice. The inspection must not unduly inconvenience the data processor's operations. The data controller bears its own costs, and the data processor may invoice time spent in excess of [4] hours at its applicable hourly rate.

C.7 Procedures for supervision of sub-processors

The data processor supervises sub-processors by annually obtaining and reviewing the documentation on security of processing made available by the sub-processor, including any audit statements and certifications. The documentation is made available to the data controller upon request.

Appendix D — The parties' regulation of other matters

D.1 Liability. The parties' liability in connection with the processing of personal data is governed by the Terms of Use for Todai Contracts, to the extent this does not conflict with the GDPR or reduce the rights of the data subject.

D.2 Assistance beyond what has been agreed. Assistance under clauses 8 and 11 that goes beyond what can be provided through the system's standard features may be invoiced based on time spent at the data processor's applicable hourly rate. This does not apply to assistance in connection with matters attributable to the data processor.

D.3 Versioning. The version of this agreement in force at any given time is published on Todai's website with a version number and effective date. Previous versions are archived and may be requested.