Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of and supplements the Terms of Service between Rukkor AB (“Rukkor”) and the Customer, governing processing of personal data by Rukkor as a processor on the Customer's behalf. In the event of conflict with the Terms of Service, this DPA prevails for the processing of personal data.

1. Roles

Rukkor processes personal data solely as a processor on the Customer's documented instructions; the Customer is the controller and is solely responsible for the lawful basis for personal data it processes through the Services. The provision of the Services is the Customer's primary instruction.

2. Confidentiality

Rukkor ensures personnel authorised to process personal data are bound by confidentiality and trained; access is restricted to those who need it.

3. Security

Rukkor maintains appropriate technical and organisational measures, including encryption in transit and at rest, role-based access and MFA for administrative access, regular testing, and resilience/restoration procedures. Current measures are described in the Trust Center (www.rukkor.com/legal/trust-center).

4. Security incidents

Rukkor notifies the Customer without undue delay and within 72 hours of becoming aware of a personal-data breach, with the information available, and assists with Articles 33–34 GDPR obligations.

5. Data subject rights

The Customer is responsible for responding to data subject requests; Rukkor provides commercially reasonable assistance and forwards any request it receives directly without responding, unless required by law.

6. Sub-processors

The Customer grants a general authorisation to engage the sub-processors in Annex 2. Rukkor gives reasonable advance notice of additions/replacements; the Customer may object on reasonable data-protection grounds within 14 days, and unresolved objections allow termination of the affected Services. Rukkor remains liable for its sub-processors' performance to the extent it is responsible.

7. International transfers

Personal data in the Rukkor product is hosted exclusively within the EU (Germany) and is not transferred to any US-owned cloud provider. Where any sub-processor is located outside the EEA (see Annex 2), transfers rely on EU Standard Contractual Clauses or another Chapter V mechanism; such transfers are limited to billing or transport metadata and never include Rukkor product content.

8. Retention and deletion

Rukkor retains personal data for the term plus up to three (3) years (during which the Customer may reactivate and export), then permanently deletes it. On the Customer's written request before that, Rukkor deletes within 30 days, except where law requires retention.

9. Liability

Subject to the liability limitations in the Terms of Service; each party may seek contribution from the other to the extent of that party's responsibility.

10. Term, law and contact

This DPA runs for the term of the Agreement and is governed by Swedish law (Ystads tingsrätt). Contact: Rukkor AB, Besökaregränd 2D, 271 42 Ystad, Sweden, support@rukkor.com.

Annex 1 — Description of Processing

Annex 2 — Approved Sub-processors

Rukkor’s current sub-processors are published at www.rukkor.com/legal/sub-processors, which forms part of this DPA. The list is grouped by service and identifies each sub-processor’s purpose, location, and transfer mechanism. For the Rukkor product, content stays within the EU (Hetzner; Berget AI when AI is enabled) and remaining providers process billing or transport metadata only. Rukkor notifies the Customer of any addition or replacement, and the Customer may object as set out in Section 6.