Data Processing Agreement

Pre-release draft, version 2026-10-28. This agreement and its processing schedule require approval before production personal-data processing.

1. Parties, scope and instructions

The business customer is the controller, or a processor authorized by its controller. Firesub AB (registration number 556847-0578, VAT SE556847057801) is the processor for application content handled on the customer’s behalf. Processing consists of hosting, storing, retrieving, transmitting, securing and deleting content needed for the selected Backify capabilities, for the service term and agreed deletion period. The customer determines the purposes, data subjects and data categories. Account administration and statutory billing records are governed separately by the Privacy Policy.

2. Processing schedule required for activation

The order must identify the controller, authorized contacts, enabled capabilities, data categories and subjects, approved processing locations, any special-category data, retention periods, backup expiry, deletion or return instructions and authorized subprocessors. Production activation must wait until this schedule and applicable transfer safeguards are confirmed. Sensitive or regulated data requires explicit prior agreement.

3. Processor obligations

Firesub AB processes personal data only on documented instructions, including instructions about transfers, unless legally required otherwise. We will inform the customer of such a legal requirement where permitted and notify it if an instruction appears to infringe data-protection law. Personnel with access must be bound by confidentiality. We will maintain appropriate technical and organizational measures and limit access to authorized personnel.

4. Security measures

Measures include server-side access checks, organization scoping, encrypted provider credentials, isolated application sessions, scoped deployment and runtime identities, persistent key management, protected transport, security logging and controlled releases. Evidence, backup and restoration arrangements, incident procedures and any customer-specific controls must be reviewed in the processing schedule. Product controls are not a certification.

5. Subprocessors and transfers

Only the providers approved in the processing schedule may process customer data on our behalf. They must be bound to equivalent data-protection obligations. Proposed changes require advance notice and an opportunity for the customer to raise reasonable data-protection objections before activation. Transfers outside the EEA require a valid legal mechanism and assessment of supplementary measures where necessary. No blanket promise that all platform or provider data remains in the selected application region is made.

6. Rights, incidents and assistance

We will assist the customer, taking account of the nature of processing and available information, with data-subject requests, security obligations, breach notifications, impact assessments and consultations. We will notify the customer without undue delay after becoming aware of a personal-data breach, provide available information about its scope and mitigation, and cooperate in the response. We will refer direct requests relating to customer-controlled application data to the customer unless law requires otherwise.

7. Return, deletion and evidence

At the end of processing, the customer chooses return or deletion of personal data and existing copies according to the agreed schedule, unless applicable law requires retention. Backup expiry and restoration restrictions must be specified in that schedule. We will make information needed to demonstrate compliance available and support reasonable audits, protecting other customers’ confidential information.

8. Contacts and precedence

Use the contacts designated in the order and the support page. This agreement takes precedence over conflicting service terms for processing on the customer’s behalf. The final order must identify the contracting entities and dispute arrangements.