1. Subject Matter and Nature of Processing

1. INTYGIO processes Personal Data solely to provide the Service as described in the Terms of Service. Processing is limited to Account Data — names and business email addresses of the Customer's authorised platform users — necessary for authentication, access management, billing administration and support.
2. Product passport payloads are product data and must not contain Personal Data. Customers are technically and contractually restricted from submitting Personal Data in passport payloads.
3. INTYGIO does not use Customer Personal Data for any secondary purpose, including profiling, marketing or AI model training.

2. Processor Obligations

1. Instructions. INTYGIO processes Personal Data only on the Customer's documented instructions, as set out in these terms and the Terms of Service, unless required otherwise by applicable law.
2. Confidentiality. All persons authorised to access Personal Data are subject to written confidentiality obligations.
3. Security. INTYGIO implements and maintains technical and organisational measures appropriate to the risk, as described at intygio.com/legal/security.
4. Sub-processors. INTYGIO may engage the sub-processors listed at intygio.com/legal/subprocessors. INTYGIO will provide at least thirty (30) days' notice before adding or replacing a sub-processor by updating that page and notifying the Customer by email. Sub-processors are contractually bound to data protection obligations no less protective than this DPA.
5. Data subject rights. INTYGIO will provide reasonable assistance to enable the Customer to respond to data subject requests under Chapter III GDPR.
6. Breach notification. INTYGIO will notify the Customer without undue delay upon becoming aware of a personal data breach affecting Personal Data processed under this DPA, including sufficient information for the Customer to fulfil its notification obligations.
7. Deletion. Upon termination or expiry of the Customer's account, INTYGIO will securely delete Account Data within thirty (30) days, unless applicable law requires further retention.
8. Audit. INTYGIO will make available information reasonably necessary to demonstrate compliance with this DPA and contribute to audits conducted by the Customer or a mandated auditor on at least sixty (60) days' prior written notice.
9. Supervisory authority. INTYGIO will cooperate with the Swedish Authority for Privacy Protection (IMY) and notify the Customer without undue delay of any supervisory inquiry relating to Personal Data processed under this DPA.

3. International Transfers

1. All Personal Data is processed and stored within the EEA. INTYGIO does not transfer Personal Data outside the EEA. All sub-processors are EEA-based.

4. General

1. Governing law. This DPA is governed by the laws of Sweden. Disputes are subject to the exclusive jurisdiction of the courts of Stockholm.
2. Notices. Notices to INTYGIO under this DPA shall be sent to legal@intygio.com and are deemed received twenty-four (24) hours after sending unless a delivery failure notification is received.
3. Updates. INTYGIO may update this DPA to reflect changes in law or processing activities. Material changes will be notified by email at least thirty (30) days in advance. Continued use of the Service after the effective date constitutes acceptance.
4. Enterprise agreements. Customers requiring individually negotiated terms, custom sub-processor restrictions or signed counterparts should contact legal@intygio.com to request the INTYGIO Enterprise Data Processing Agreement.