Data Processing Agreement

This Data Processing Agreement is entered into between the following parties:

Data Controller: The Customer, as defined in the applicable service agreement ("the Data Controller").

Data Processor: 360 Sprint ApS, CVR 27700489, Akademigrunden 30C, 4180 Sorø, Denmark ("the Data Processor").

This DPA enters into force when the Data Controller accepts the Terms of Service via the platform (click-wrap).

1. Background and Purpose

This Data Processing Agreement ("DPA") is entered into pursuant to the General Data Protection Regulation (EU) 2016/679 ("GDPR") Article 28(3) and governs the Data Processor's processing of personal data on behalf of the Data Controller in connection with the provision of 360 Sprint — a strategic intelligence analysis platform ("the Service"). The DPA constitutes an annex to the applicable service agreement ("the Terms of Service") between the Parties.

2. Definitions

In this DPA: "Personal Data" means any information relating to an identified or identifiable natural person, cf. GDPR Article 4(1). "Processing" means any operation or set of operations performed on personal data, cf. GDPR Article 4(2). "Data Subjects" means the natural persons whose personal data is processed under this DPA. "Sub-Processor" means a third party engaged by the Data Processor to process personal data on behalf of the Data Controller. "Security Incident" means a personal data breach as defined in GDPR Article 4(12).

3. Subject Matter, Purpose and Instructions

3.1 Subject Matter

The Data Processor processes personal data solely for the purpose of providing the Service to the Data Controller, including: storage and processing of strategic analysis data uploaded by the Data Controller; AI-driven analysis of data fields classified as PUBLIC or INTERNAL; user account management and access control; transactional emails related to account administration; error tracking and performance monitoring (with PII filtering).

3.2 Instructions

The Data Processor shall process personal data only on documented instructions from the Data Controller, unless required to do so by EU or Member State law. The Data Controller's instruction upon entering into this DPA is that the Data Processor may process personal data for the purpose of providing the Service as described in the Terms of Service.

3.3 Categories of Data Subjects

The processing covers personal data relating to the following categories of data subjects: employees and consultants of the Data Controller (platform users); natural persons whose data the Data Controller uploads to the platform (e.g., contacts of customers, partners, or competitors); publicly available information about natural persons in connection with strategic analysis.

3.4 Types of Personal Data

The processing covers the following categories of personal data: User identity data (name, email address, session information); Business data (data uploaded by the Data Controller — content determined by the Data Controller); Technical metadata (IP addresses, browser data, access logs). Special categories of personal data (Article 9) are not permitted under this DPA. The Data Controller is responsible for ensuring that special categories are not uploaded to the platform.

3.5 Duration of Processing

This DPA is effective for as long as the Data Processor processes personal data on behalf of the Data Controller under the Terms of Service.

4. Data Processor Obligations

4.1 Documented Instructions

The Data Processor shall process personal data only in accordance with the Data Controller's documented instructions, including with regard to transfers of personal data to a third country or international organization, unless required by EU or Member State law.

4.2 Confidentiality

The Data Processor ensures that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4.3 Security

The Data Processor implements all measures required under GDPR Article 32, and at minimum the technical and organizational measures described in Annex 2 to this DPA. The Data Processor continuously evaluates and updates these measures to ensure an appropriate level of security.

4.4 Sub-Processors

The Data Processor obtains approval from the Data Controller before engaging new sub-processors. Approval is granted in accordance with the procedure described in Section 5. A list of current sub-processors is set out in Annex 1.

4.5 Assistance to the Data Controller

The Data Processor assists the Data Controller, taking into account the nature of the processing, with appropriate technical and organizational measures to fulfill the Data Controller's obligation to respond to requests from data subjects exercising their rights under Chapter III of GDPR. Assistance is provided without undue delay and within 10 business days. The Data Processor also assists the Data Controller with compliance under GDPR Articles 32–36, including DPIAs and prior consultation.

4.6 Deletion, Return and Data Portability

Upon termination of the Service, the Data Controller has 30 days to export all personal data in a structured, machine-readable format. Thereafter, the Data Processor deletes all personal data and copies within 30 days after the export period expires (60 days total), unless EU or Member State law requires retention. The Data Processor confirms deletion in writing. Deletion is also carried out by sub-processors within the same timeframe.

4.7 Audit and Documentation

The Data Processor makes available all information necessary to demonstrate compliance with GDPR Article 28, and allows for and contributes to audits, including inspections, conducted by the Data Controller or an auditor mandated by the Data Controller. Audits require 30 days' written notice and are conducted at the Data Controller's expense during normal business hours.

4.8 Notification of Unlawful Instructions

The Data Processor immediately informs the Data Controller if, in the Data Processor's opinion, an instruction infringes GDPR or other EU or Member State data protection provisions.

5. Sub-Processors

5.1 General Authorization

The Data Controller hereby grants specific authorization to the sub-processors listed in Annex 1.

5.2 Changes to Sub-Processors

The Data Processor notifies the Data Controller in writing via email of intended changes regarding the addition or replacement of sub-processors with at least 30 days' notice. The Data Controller may object in writing within this period. If the Parties cannot reach agreement, the Data Controller may terminate the Terms of Service with notice equal to the notification period. An updated list of sub-processors is available at trust.360sprint.dk.

5.3 Sub-Processor Requirements

The Data Processor imposes the same data protection obligations on sub-processors as those set out in this DPA, in particular providing sufficient guarantees for appropriate technical and organizational measures.

5.4 Liability for Sub-Processors

The Data Processor is fully liable to the Data Controller for the sub-processor's performance of its obligations.

6. International Data Transfers

The Data Processor processes all personal data within the EU/EEA by default. Where processing occurs outside the EU/EEA, this is limited to the sub-processors listed in Annex 1, and the transfer is based on a valid transfer mechanism under GDPR Chapter V, including: EU-US Data Privacy Framework (DPF) for transfers to DPF-certified companies in the USA; EU Standard Contractual Clauses (SCCs) pursuant to Commission Implementing Decision (EU) 2021/914. An updated overview of applicable transfer mechanisms is available in Annex 1 and at trust.360sprint.dk.

7. Security Incidents

7.1 Notification

The Data Processor notifies the Data Controller without undue delay and no later than 72 hours after becoming aware of a security incident affecting personal data processed under this DPA. The notification includes: a description of the nature of the incident; the name and contact details of the Data Processor's data protection contact; a description of the likely consequences; a description of measures taken or proposed to address the incident.

7.2 Further Assistance

The Data Processor assists the Data Controller in fulfilling the obligation to report security incidents to supervisory authorities and data subjects under GDPR Articles 33 and 34.

7.3 Documentation

The Data Processor documents all security incidents, including the circumstances, effects, and remedial measures taken. Documentation is made available to the Data Controller upon request.

8. Data Subject Rights

If the Data Processor receives a request from a data subject exercising rights under GDPR Chapter III (access, rectification, erasure, restriction, portability, objection), the Data Processor promptly and within 5 business days forwards the request to the Data Controller and refrains from responding to it, unless authorized by the Data Controller. The Data Processor assists the Data Controller in fulfilling data subject requests by providing relevant technical capabilities (data export, account deletion, etc.).

9. Contact Information

Data Processor's data protection contact:

10. Liability and Indemnification

The Parties' liability and indemnification obligations are governed by the Terms of Service. The Data Processor's liability under GDPR Article 82 is not limited to the extent such limitations would be in conflict with GDPR.

11. Duration and Termination

This DPA is effective for as long as the Data Processor processes personal data on behalf of the Data Controller. The DPA terminates automatically upon termination of the Terms of Service, subject to obligations that survive termination (in particular Section 4.6 on deletion and Section 7 on security incidents).

12. Governing Law and Jurisdiction

This DPA is governed by Danish law. Any disputes shall be settled by the Copenhagen City Court (Københavns Byret).

13. Entry into Force

This DPA enters into force when the Data Controller accepts the Terms of Service, including this DPA, via the platform.