Data Processing Agreement (DPA)

1. Scope and precedence

This Data Processing Agreement (DPA) applies when Credon AB processes personal data on behalf of a customer within the Credon platform.

This DPA forms part of the customer agreement. In case of conflict, this DPA governs matters related to personal data processing.

2. Roles of the parties

The customer is the data controller for customer data entered into the service.

Credon is the data processor for processing carried out on behalf of the customer under documented instructions.

3. Documented instructions

Credon processes personal data only on documented instructions from the customer, including instructions expressed through the customer's use of configured features.

Credon will notify the customer if an instruction appears to infringe applicable data protection law.

4. Purpose and nature of processing

Processing supports AML-related workflows including KYC, KYB, risk assessment, screening, documentation, and reporting.

Processing may be carried out manually, automatically, and with AI-assisted features used as decision support.

5. Categories of data subjects and data

Data subjects may include end customers, representatives, beneficial owners, signatories, counterparties, and users of the service.

Personal data may include identification details, contact details, ownership and representation data, risk indicators, sanctions and PEP-related information, and audit logs.

6. Confidentiality and personnel

Credon ensures that authorized personnel are bound by confidentiality obligations and access personal data on a need-to-know basis.

7. Security measures

Credon implements appropriate technical and organizational safeguards, including access controls, authentication, encryption in transit where applicable, logging, and incident response routines.

Security controls are reviewed and updated as part of continuous risk management.

8. Subprocessors

The customer grants general authorization for Credon to engage subprocessors necessary to provide and secure the service.

Credon remains responsible for subprocessors and ensures they are bound by data protection terms equivalent to this DPA.

9. International transfers

Credon aims to process personal data within the EU and EEA.

If transfers outside the EU or EEA are necessary, Credon applies a valid transfer mechanism under GDPR.

10. Data subject rights and assistance

Credon assists the customer, to a reasonable extent, in handling requests from data subjects and in fulfilling GDPR obligations such as DPIAs and supervisory authority inquiries.

If Credon receives a direct request from a data subject related to customer-controlled data, Credon will direct the request to the customer unless prohibited by law.

11. Personal data breaches

Credon notifies the customer without undue delay after becoming aware of a personal data breach affecting customer-controlled data.

The customer remains responsible for external notifications to authorities and data subjects where required by law.

12. Deletion, return, and retention

Upon termination, Credon deletes or returns personal data in accordance with contract terms and the customer's instructions, unless retention is required by applicable law.

Limited retention may apply for legal claims, accounting obligations, and security logging requirements.

13. Audit and compliance information

Credon makes available information reasonably necessary to demonstrate compliance with this DPA.

Where relevant, audit rights are exercised in a proportionate manner that protects other customers and service security.

14. Term and updates

This DPA remains in effect for as long as Credon processes personal data on behalf of the customer.

Credon may update this DPA to reflect legal, technical, or service changes. Material adverse changes are communicated in advance.