Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between the business or other organisation using Dynamotics ("Merchant") and Dynamotics, the operator of the Dynamotics software platform ("Dynamotics"). It supplements and forms part of the Dynamotics Terms of Service ("Terms").

This DPA applies only where Dynamotics processes Personal Data on behalf of the Merchant in connection with the Services. It does not apply where Dynamotics processes Personal Data as an independent Data Controller, as explained in Article 15 and in the Dynamotics Privacy Policy.

Capitalised terms including Controller, Processor, Data Subject, Personal Data, Processing, Personal Data Breach and Supervisory Authority have the meanings given to them in the GDPR. Other capitalised terms have the meanings given in the Terms.

Dynamotics will process Merchant Data only on documented instructions from the Merchant, including instructions given through the Merchant's configuration and lawful use of the Services, unless processing is required by applicable law.

If applicable law requires additional processing, Dynamotics will inform the Merchant before carrying it out unless the law prohibits that notification for important public-interest reasons.

Dynamotics will promptly inform the Merchant if, in its reasonable opinion, an instruction infringes the GDPR or other applicable data protection law. Dynamotics may suspend the affected processing until the instruction is amended or its lawfulness is confirmed.

Taking into account the state of the art, implementation costs, the nature and scope of processing and the risks to individuals, Dynamotics will maintain appropriate technical and organisational measures designed to protect Merchant Data in accordance with GDPR Article 32.

The current categories of measures are described in Annex II. Dynamotics may update those measures as technology and risks change, provided that the overall level of protection is not materially reduced.

The Merchant gives Dynamotics general written authorisation to engage the Sub-Processors listed in Annex III and to appoint new Sub-Processors where reasonably necessary to provide the Services.

Dynamotics will impose data protection obligations on each Sub-Processor that are no less protective, in all material respects, than the relevant obligations in this DPA. Dynamotics remains responsible for the performance of its Sub-Processors' obligations to the extent required by applicable law.

Dynamotics will provide reasonable advance notice through email, the dashboard or an updated Sub-Processor list before a new Sub-Processor begins materially processing Merchant Data. A Merchant may raise a reasonable, documented data-protection objection by contacting support@dynamotics.com. The parties will work in good faith to resolve the objection.

The Merchant is responsible for responding to requests from its Data Subjects. Taking into account the nature of the processing, Dynamotics will provide reasonable assistance through available platform functionality and support so the Merchant can respond to requests involving access, rectification, erasure, restriction, portability or objection.

If Dynamotics receives a request directly concerning Merchant Data, it will redirect the requester to the relevant Merchant or notify the Merchant where reasonably possible. Dynamotics will not independently fulfil the request unless instructed by the Merchant or required by law.

Dynamotics will notify the Merchant without undue delay after becoming aware of a confirmed Personal Data Breach affecting Merchant Data.

As information becomes available, the notification will include the nature of the breach, affected data and Data Subjects, likely consequences, mitigation taken or proposed, and a point of contact. Information may be provided in stages where it cannot reasonably be supplied at the same time.

Dynamotics will take reasonable steps to contain, investigate and mitigate the breach. A notification does not constitute an admission of fault or liability. The Merchant remains responsible for determining whether notifications to a Supervisory Authority or affected individuals are required.

During the subscription, the Merchant may use available platform tools to access, correct or delete Merchant Data. Where available, the Merchant should export information it wishes to retain before closing its account.

On termination of the Services, and at the Merchant's choice, Dynamotics will delete or return Merchant Data within a reasonable period, unless applicable law requires continued storage. Data in protected backups may remain until overwritten through normal backup cycles. While retained, backup data will remain protected and will not be used for other purposes except recovery, security and legal compliance.

Dynamotics will make available information reasonably necessary to demonstrate compliance with GDPR Article 28 and this DPA. Where that information is insufficient, the Merchant may request a reasonable audit relating specifically to the processing of its Merchant Data.

Audits must be conducted on reasonable advance notice, during normal business hours, no more than once in any 12-month period, and in a manner that avoids unreasonable disruption or access to another customer's data. These limits do not apply following a relevant Personal Data Breach or where a Supervisory Authority requires an audit. The requesting Merchant bears its audit costs, and all audit information is confidential.

Dynamotics and its Sub-Processors may process Merchant Data in countries outside the country in which it was collected. Where the GDPR restricts a transfer outside the EEA, Dynamotics will use a lawful transfer mechanism, such as an adequacy decision, the European Commission's Standard Contractual Clauses, or another mechanism permitted by applicable law.

Where reasonably required, the parties agree that the applicable European Commission Standard Contractual Clauses are incorporated into this DPA by reference and completed using the information in this DPA and its Annexes.

This DPA does not govern Personal Data that Dynamotics processes as an independent Controller, including Merchant account contact details, service communications, support correspondence, security records and subscription administration. That processing is described in the Dynamotics Privacy Policy.

The liability limitations and exclusions in the Terms apply to this DPA to the fullest extent permitted by law.

If this DPA conflicts with the Terms on the processing of Merchant Data, this DPA controls. If the applicable Standard Contractual Clauses conflict with this DPA, those clauses control for the restricted transfer concerned.

This DPA begins when the Merchant accepts the Terms or otherwise enters into this DPA and remains effective for as long as Dynamotics processes Merchant Data on the Merchant's behalf. Provisions that are intended to protect retained data survive termination for as long as that data remains in Dynamotics' possession.

Dynamotics may update this DPA where reasonably necessary to reflect changes in law, the Services, security practices or Sub-Processors. Material changes will be communicated through the platform, by email or by updating this page and its effective date. Changes will not materially reduce the protection of Merchant Data contrary to applicable law.

This DPA is governed by the law specified in the Terms and, where that law is not specified or cannot apply, the laws of Sweden. Nothing in this DPA removes rights or obligations that cannot be excluded under applicable data protection law.