Data Processing Agreement

1. Parties and scope

This Data Processing Agreement (the "DPA"), version 1.0, is between the customer that buys a paid Sellopia plan (the "customer", the controller) and Utopia Group ApS (CVR 45886808), Wilkensvej 32, 2000 Frederiksberg, Denmark ("Sellopia", "we", "us", the processor).

It applies to every paid plan. The customer accepts it at checkout, when it accepts the Sellopia Terms of Service (the "Terms"). The DPA forms part of the Terms. Where the DPA and the Terms differ on the processing of personal data, the DPA applies. Enterprise customers can negotiate their own agreement, which then replaces this DPA.

Words such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in the General Data Protection Regulation (EU) 2016/679 (the "GDPR").

2. Subject matter, duration, nature and purpose

Subject matter. We process personal data on the customer's behalf to provide the service described in the Terms: the connector for AI apps, the training platform and billing.

Duration. For as long as the customer uses a paid plan, and after that until we have deleted the personal data as section 4 sets out.

Nature. Collection, storage, organisation, retrieval, analysis by AI models, transmission to the customer's users and deletion.

Purpose. To answer the customer's tool calls, prepare written negotiation briefs, build and run training from the customer's documents, give coach notes, manage accounts and enforce quotas. If the customer turns on Sellopia's use of saved tool results in its billing settings, we also use those results to improve our products and train our models, as a controller under our Privacy Policy, until the customer turns it off. We use the data for no other purpose.

3. Categories of data subjects and types of personal data

Data subjects.

• The customer's users: the people the customer lets use Sellopia.
• People named in documents the customer uploads, and in the negotiation details the customer gives us.

Types of personal data.

• Account data: name, e-mail address, organisation, role and sign-in method.
• Billing data.
• Connector requests and written briefs.
• The tool-call log: who called which tool, and when.
• Training content: documents, scenarios, voice and text sessions, and coach notes.

The customer must not give us special categories of personal data (GDPR Article 9) unless the service needs them and the customer has a lawful basis.

4. Our obligations as processor

We:

• Instructions. Process the personal data only on the customer's documented instructions. The Terms, this DPA and the customer's use of the service are those instructions. If an instruction breaks the GDPR in our opinion, we tell the customer. If law requires us to process data in another way, we tell the customer first, unless that law forbids it.
• Confidentiality. Make sure that every person who can access the personal data is bound by confidentiality.
• Security. Apply the technical and organisational measures in Annex 2 (GDPR Article 32).
• Sub-processors. Follow section 5 when we use other processors.
• Data-subject requests. Help the customer, as far as we can, to answer requests from data subjects who use their rights under the GDPR. If a data subject asks us directly, we refer the request to the customer.
• Assistance. Help the customer with its security obligations, breach notifications, data protection impact assessments and prior consultations (GDPR Articles 32 to 36), taking into account the information we have.
• Deletion or return. At the end of the service, delete or return the personal data, as the customer chooses. When an account closes we delete all its data within 30 days, except invoices, which Danish bookkeeping law requires us to keep for 5 years, and saved tool results the customer let us use, which we keep only in anonymised form.
• Information and audits. Give the customer the information it needs to show that we meet GDPR Article 28. We first answer in writing, for example by filling in the customer's security questionnaire. If that is not sufficient, the customer, or an auditor it appoints under confidentiality, can audit us at most once a year, with 30 days' written notice, at the customer's cost.

5. Sub-processors

The customer gives us general written authorisation to use sub-processors. Annex 3 lists their categories. The names are available on request at info@sellopia.ai.

We tell the customer at least 30 days before we add or replace a sub-processor. The customer can object on reasonable grounds within that period. If we cannot resolve the objection, the customer can end the affected service before the change takes effect.

Each sub-processor is bound by a written contract with data protection obligations equivalent to those in this DPA. We remain responsible to the customer for the work of our sub-processors.

6. International transfers

Documents, sessions and our database are stored in the EU (Frankfurt). Application servers and AI processing are in the United States, and our network provider may route requests outside the European Economic Area. We protect each transfer outside the EEA with the European Commission's Standard Contractual Clauses or, where the recipient is certified, the EU-US Data Privacy Framework.

7. Personal data breaches

If we become aware of a personal data breach that affects the customer's data, we tell the customer without undue delay and within 72 hours of becoming aware of it. The notice gives, as far as we know at that time:

• the nature of the breach, including the categories and approximate number of data subjects and records concerned;
• a contact point for more information;
• the likely consequences of the breach;
• the measures we have taken or propose to take to address it and to reduce its effects.

Where we cannot give all of this at once, we give it in phases without further undue delay.

8. Liability

Liability under this DPA is subject to the limitation of liability in the Terms.

9. Governing law

This DPA is governed by Danish law, and disputes go to the courts set out in the Terms.

Annex 1. Processing details

Annex 2. Technical and organisational measures

• Encryption in transit. All connections use TLS.
• Encryption at rest. Our database and storage providers encrypt stored data.
• Organisation isolation. Every row of data is tied to an organisation. Row-level security denies all access by default; only our server can reach the data, and it scopes every query to the customer's organisation.
• Staff access. Only the two founders can access customer data, for support, under confidentiality.
• Certified infrastructure. We hold no security certification of our own. Our infrastructure providers are SOC 2 Type II or ISO 27001 certified.

Annex 3. Sub-processor categories

Names on request at info@sellopia.ai.