Data Processing Agreement

The Controller: the customer identified in the Main Agreement (“Controller”)

The Processor: Atmoz AB, corporate registration number 559345-4001, Birger Jarlsgatan 57C, 113 56 Stockholm, Sweden (“Processor” or “Atmoz”)

The Main Agreement: The agreement between the Controller and Atmoz for the services, whether a pilot or a subscription, dated as of the date of its last signature, including its schedules (“Main Agreement”).

This Data Processing Agreement (“DPA”) forms part of the Main Agreement and gives effect to Article 28(3) of Regulation (EU) 2016/679 (“GDPR”). The Main Agreement may be a subscription to the Atmoz carbon accounting platform or a pilot, and this DPA applies to both in the same way. In this DPA, the “services” are the services Atmoz provides under the Main Agreement, including any Assisted Services under clause 2.6.

If this DPA and the Main Agreement conflict, this DPA prevails on the processing of personal data and, for clause 6, on all Controller Content (defined in clause 6.1), with two exceptions: (a) each party’s liability in connection with this DPA is subject to the limitations and exclusions of liability in the Main Agreement; and (b) a term of the Main Agreement that expressly varies this DPA prevails, provided the result remains consistent with Article 28 of the GDPR. Compensation to data subjects is allocated between the parties under Article 82 of the GDPR, and an administrative fine is borne by the party on which it is imposed.

1. Roles

1.1 The Controller is the controller and Atmoz is the processor in respect of the personal data described in Appendix A.

1.2 Atmoz processes personal data solely to provide the services under the Main Agreement.

1.3 This DPA governs personal data that Atmoz processes on the Controller’s behalf in the platform or otherwise in delivering the services, including Assisted Services under clause 2.6. It does not govern personal data for which Atmoz is itself the controller – Atmoz’s own business contacts, marketing, support correspondence, recruitment and website visitors – which is described in the Atmoz privacy policy. Where the Controller sends Atmoz a document from its own account to illustrate a support issue, that document remains the Controller’s data under this DPA.

1.4 “Contracting Authority” means a contracting authority within the meaning of the Swedish Public Procurement Act (lag (2016:1145) om offentlig upphandling) or the corresponding law of another EU/EEA state.

2. Processing only on documented instructions

2.1 Atmoz shall process personal data only on the Controller’s documented instructions, including as to transfers to a third country, unless required to do so by Union or Member State law to which Atmoz is subject. In that case Atmoz shall inform the Controller of the legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

2.2 The Controller’s documented instructions comprise: this DPA, the Main Agreement, the Controller’s use of the configuration and functionality of the service, and, for Assisted Services, the instructions described in clause 2.6(c).

2.3 Atmoz shall inform the Controller without delay if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.

2.4 The subject matter, duration, nature and purpose of the processing, the categories of personal data and the categories of data subjects are set out in Appendix A.

2.5 What reaches the platform is the Controller’s decision. The platform does not detect, redact or filter personal data out of document text. Text is processed as printed on the document. The Controller therefore determines what personal data is processed by determining what it submits: the documents carbon accounting requires, and no more personal data than the calculation requires. The same applies where the Controller shares material with Atmoz for Assisted Services under clause 2.6: the Controller decides what it shares, and Atmoz imports it as shared.

2.6 Assisted Services, including pilots. The Controller may ask Atmoz to carry out, on the Controller’s behalf, work in the service that the Controller’s own users could otherwise do – for example receiving the Controller’s source data, importing it into the platform, configuring the account, running calculations and reviewing results (“Assisted Services”). Assisted Services are typical of onboarding and pilots, and are provided on the following terms:

1. Access and staffing. Atmoz personnel perform Assisted Services only within the Controller’s account, each through an individual named account in a role the Controller assigns. The Controller decides whether Atmoz personnel have access and in which role, and may remove any or all of them at any time. Atmoz decides which of its personnel do the work and may add or replace them, for example to cover absence, and tells the Controller’s contact recorded in the Main Agreement of each person added no later than when access is granted. Where the Controller requires prior approval of individuals, that is agreed in the Main Agreement. Where Atmoz sets up the account for the Controller, it does so on the Controller’s instruction and, at the Controller’s request, makes a person nominated by the Controller the account owner. The Controller may at any time ask Atmoz for a list of the Atmoz personnel with access to its account;
2. Atmoz personnel act on the Controller’s instructions. Atmoz personnel performing Assisted Services act within the role the Controller assigns and on the Controller’s instructions and are bound by clause 3. Clause 5.8 sets out where they are based;
3. Instructions. For Assisted Services, the Controller’s documented instructions under clause 2.2 also include the scope of work described in the Main Agreement and written instructions from the Controller’s authorised contacts, including by email. Atmoz does not decide which of the Controller’s data is processed or for what purpose;
4. Source data shared outside the platform. Where the Controller shares source data with Atmoz outside the platform, it does so through a file-sharing location the Controller controls, such as its own SharePoint site or Google Drive, or through another channel agreed in writing. The Controller grants and withdraws Atmoz’s access to that location, and the provider of the location acts for the Controller, not as Atmoz’s sub-processor. Atmoz retrieves shared files only to import them into the platform; any working copy made in the course of import is held only on Atmoz-managed devices or within the platform, and is deleted once the import has been completed and checked;
5. Material is imported as shared. Atmoz does not review, screen or redact shared material for personal data, and clause 2.5 applies. Atmoz may decline to import material that is plainly outside the agreed scope, and will tell the Controller if it does; and
6. End of Assisted Services. When Assisted Services end, Atmoz removes its personnel from the Controller’s account, stops accessing any file-sharing location and asks the Controller to withdraw that access, unless the Controller instructs otherwise. This does not affect the support and operational access described in clause 3.4.

3. Confidentiality

3.1 Atmoz shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3.2 Confidentiality undertakings survive the end of the individual’s engagement with Atmoz and the end of this DPA.

3.3 Atmoz shall ensure that access to personal data is limited to those personnel who need it to perform the services.

3.4 Who can reach the Controller’s data. There are three routes, and no others:

1. the Controller’s own authorised users, within the Controller’s account and according to the permissions the Controller assigns, including Atmoz personnel performing Assisted Services under clause 2.6, who use no other route;
2. specifically authorised Atmoz personnel, under the access controls in Appendix B and where there is a legitimate reason, for support, maintenance, security and incident response, and for investigating and correcting suspected errors in the Controller’s figures; and
3. the sub-processors and company registries listed in Appendix C, each only to the extent its service requires.

Access by Atmoz personnel to personal data in the Controller’s account is recorded in the data-access audit records described in Appendix B.4, which identify the acting account and the object acted on. Those records are made available to the Controller on request. Where the Controller requires prior notification or approval before such access, that is agreed in the Main Agreement.

3.5 Statutory secrecy. Where the Controller is subject to obligations of secrecy under the Swedish Public Access to Information and Secrecy Act (offentlighets- och sekretesslagen 2009:400) or equivalent legislation, and notifies Atmoz that data in its account is or may be covered by such secrecy, Atmoz shall treat that data in accordance with the Controller’s documented instructions for it. Atmoz shall not disclose such data to any third party except as permitted by this DPA, and shall inform the Controller without undue delay if it receives a request for it. Atmoz makes no assessment of whether secrecy applies – that assessment is the Controller’s, and Atmoz acts on the Controller’s instruction.

3.6 Requests from public authorities. If Atmoz receives a legally binding request from a public authority, including a law-enforcement authority, for disclosure of personal data processed on the Controller’s behalf, Atmoz shall:

1. notify the Controller before disclosing, so that the Controller may seek to challenge or limit the request, unless the applicable law prohibits that notification;
2. where notification is prohibited, use reasonable efforts to obtain a waiver of the prohibition, and document those efforts so that they can be shown to the Controller afterwards;
3. disclose only the minimum data the request requires, having assessed on a reasonable reading whether the request is valid and binding; and
4. challenge the request where it appears unlawful under Union or Member State law, including where the request conflicts with Chapter V of the GDPR.

4. Security of processing (Article 32)

4.1 Atmoz shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. The measures in force are described in Appendix B.

4.2 Appendix B describes the measures in place at the date of this DPA. Atmoz may change a measure provided the level of security is not reduced.

5. Sub-processors

5.1 The Controller gives Atmoz general written authorisation to engage sub-processors, subject to this clause 5.

5.2 The sub-processors engaged at the date of this DPA are those listed in Appendix C, which reproduces the Atmoz sub-processor list maintained at atmoz.io/subprocessors. By entering into this DPA, the Controller approves the sub-processors listed in Appendix C. The published list shows the current position and is where changes appear first. As between the two, Appendix C governs in respect of the Controller until the Controller has received notice of the change under clause 5.4 – publication alone does not add or replace a sub-processor as against the Controller and does not shorten the notice period in 5.4.

5.3 The list is maintained to cover every third-party provider that processes the Controller’s personal data on Atmoz’s behalf in delivering the services, however that provider is purchased, integrated or used, and Atmoz updates it as providers change. A provider that receives no such personal data is not a sub-processor. A provider that decides its own purposes for the data is an independent controller, not Atmoz’s processor; the list records the role each provider holds.

5.4 Atmoz shall give the Controller at least 30 days’ advance notice before adding or replacing a sub-processor. Notice is given to the contact address recorded in the Main Agreement and is reflected in the sub-processor list. Atmoz shall give the same notice before an existing sub-processor begins processing personal data outside the EU/EEA, and clause 5.5 applies to that change as it does to a proposed sub-processor.

5.5 The Controller may object to a proposed sub-processor on reasonable data-protection grounds within the notice period. If the parties cannot resolve the objection, the Controller may terminate the affected part of the services without penalty.

5.6 Atmoz shall impose on each sub-processor, by contract, in substance the same data protection obligations as those in this DPA, and remains fully liable to the Controller for the performance of each sub-processor’s obligations. Before engaging a sub-processor, at least annually, and when its terms or data locations change materially, Atmoz reviews its contractual terms, information security (including any ISO/IEC 27001 certification or SOC 2 Type II report), data locations and transfer mechanism, and records the review in its sub-processor evidence register. A summary of the review is available to the Controller on request under clause 9.

5.7 Transfers through the whole chain. Personal data is processed within the EU/EEA as the main rule. Atmoz shall ensure that, throughout the sub-processing chain, personal data is processed within the EU/EEA, or in a country covered by a European Commission adequacy decision, or under the EU-U.S. Data Privacy Framework where the recipient is covered by a valid certification, or under Standard Contractual Clauses with supplementary measures where the transfer assessment shows they are needed. The transfer mechanism relied on for each sub-processor is stated in the sub-processor list.

Atmoz assesses each transfer by reference to the actual receiving entity, the destination country and the processing that takes place there, not by where a corporate group has its headquarters.

Information about the applicable safeguards, including the transfer assessment for each transfer that relies on Standard Contractual Clauses, and copies of the relevant instruments where appropriate, is available to the Controller on request, subject to redaction of commercial terms and of third parties’ personal data.

5.8 Access from outside the EU/EEA. Storage location and access location are different questions, and Appendix C’s location column answers only the first. Where a sub-processor has confirmed in writing that its personnel are located only within the EU/EEA, that is recorded against its entry in Appendix C. Sub-processors with global operations may access data from outside the EU/EEA for support, engineering, on-call or incident response; the safeguards recorded against that sub-processor apply where that arises. Atmoz personnel with access to Controller Content, in production or in any other environment, are based in the EU/EEA.

5.9 Where a sub-processor engages a further sub-processor, the requirements of clauses 5.6 and 5.7 apply to that further sub-processor. Information about further parties engaged by Atmoz’s sub-processors is available on request, as described in Appendix C.4.

5.10 Change in transfer law. If a transfer mechanism relied on under this clause 5 ceases to be available or no longer ensures adequate protection, for example because an adequacy decision is withdrawn, Atmoz shall inform the Controller without undue delay and the parties shall discuss alternatives, such as another mechanism, another sub-processor or additional technical measures. If no lawful solution is found within a reasonable time, the Controller may terminate the affected services without penalty, and Atmoz shall stop the affected transfers and delete or return the data concerned under clause 10.

6. Use of Controller data

6.1 Atmoz uses Controller Content, in any form, including aggregated, de-identified or Anonymised, only:

1. to provide the services, support the Controller and comply with Atmoz’s legal obligations, including creating Anonymised aggregates to operate and improve the service (for a Contracting Authority, only to operate, secure and monitor it), as described in clause 6.4;
2. for the default uses in clause 6.8, which the Controller may opt out of and which apply to a Contracting Authority only if it opts in; and
3. for any other use the Controller approves in advance under clause 6.3.

Providing the services does not include developing new products or features, analytics, benchmarking, profiling, marketing or other commercial exploitation, except as clauses 6.4 and 6.8 describe. Atmoz trains AI models on Controller Content only with the Controller’s approval under clause 6.3, and never sells the Controller’s personal data or uses it for advertising (clause 6.2).

“Controller Content” means personal data or other data provided by, or generated on behalf of, the Controller – including source documents, extracted and integration data, supplier and activity data, computed figures and review records – and anything derived from it, other than Usage Data under clause 6.7. “Anonymised” means data that cannot reasonably be used to identify, single out or infer information about any natural person or about the Controller.

6.2 Atmoz shall not disclose, sell, licence or otherwise make available the Controller’s personal data to any third party, other than:

1. to the sub-processors listed under clause 5, acting on Atmoz’s documented instructions;
2. to the company registries identified in Appendix C.3, which receive company identifiers only – name, VAT number, organisation number and country code – for the sole purpose of obtaining an industry classification so that an emission factor can be applied, and which act as independent controllers of their own registers rather than as Atmoz’s processors; or
3. where required by Union or Member State law.

Disclosure under (b) takes place on the Controller’s documented instructions under clause 2, as part of the processing described in Appendix A, and is limited to the identifiers and purpose stated in Appendix C.3. Atmoz does not sell personal data and does not share it for advertising purposes.

6.3 Atmoz may use Controller Content for any other purpose only where the Controller has approved that specific use in advance, either in writing (including by email) or, where available, by an authorised administrator in the platform settings. Signing the Main Agreement, accepting this DPA or continuing to use the service is not such approval. Each approval identifies the use, the parties’ roles and any conditions, and is logged. The Controller may withdraw an approval at any time by notice to privacy@atmoz.io or, where available, in the platform settings. Within 30 days of withdrawal, Atmoz stops the use and deletes the Controller Content held for it; anything built under the approval, such as a dataset, benchmark or model, is rebuilt without that content or no longer used, unless the approval provides otherwise.

6.4 Atmoz may process Controller Content as needed to provide the services on the Controller’s instructions, including supporting the Controller, investigating and correcting errors, and protecting the service against security threats and abuse. In addition:

1. Atmoz may create Anonymised aggregates of Controller Content, such as accuracy measures and service-wide totals of documents, lines or suppliers processed, to operate and improve the service, and may disclose those totals. Benchmarking is permitted only under clause 6.8;
2. where the Controller is a Contracting Authority, those aggregates are used only to operate, secure and monitor the service, and the Controller’s data is not included in disclosed totals, unless the Controller opts in, in the Main Agreement or by notice to privacy@atmoz.io. Any other Controller may agree the same limit in the Main Agreement;
3. Atmoz may keep the Anonymised aggregates and benchmarks it creates under this clause and clause 6.8 after this DPA ends, subject to the restrictions in those clauses and, for a Contracting Authority, only as part of service-wide measures that combine data from at least five customers; and
4. software improvements, including fixes for defects found while processing the Controller’s data, may be made available to all customers. Software that embodies what Atmoz learns but contains none of the Controller’s data is not Controller Content, nor is a test document that recreates a defect by reproducing only the layout of a Controller document, with no text, figures, identifiers or images from it.

6.5 AI processing. Personal data incidentally present in the Controller’s source documents may be processed by large language models provided through the AI inference sub-processor listed in Appendix C.2, as part of document parsing, classification and supplier resolution. Any of the personal data described in Appendix A.6(b) can pass through this path. In respect of that processing:

1. inference on Controller data runs within the EU;
2. the provider is contractually prohibited from using Controller data to train or fine-tune its models, and Atmoz gives no permission or instruction that would allow it;
3. the provider does not retain prompts or outputs for longer than is needed to produce the output, except that repeated prompt content may be cached briefly for reuse only within Atmoz’s own environment;
4. prompts are not logged for the provider’s abuse monitoring or reviewed by its personnel: Atmoz holds an exemption from that logging for every environment in which it processes Controller data, and obtains it for any new environment before Controller data is processed there. If the exemption ceases to apply, Atmoz will inform the Controller without undue delay;
5. Atmoz does not enable provider features that log or store prompts and outputs, or that send Controller data to services outside the inference platform, such as web-search grounding; and
6. the commitments in (b) to (d) rest on the provider’s contractual terms and written confirmations, not on a setting in the platform.

6.6 Declining language-model processing. The Controller may instruct Atmoz not to process its personal data using the language models described in 6.5. Such an instruction is given under clause 2 and is given effect through the ingestion paths agreed between the parties. Structured ERP or CSV ingestion does not invoke a language model at the extraction stage, but other parts of the service may, and the scope of any wider instruction is agreed between the parties before it takes effect. Atmoz does not offer this as a self-service or configurable setting in the platform, and the Controller should expect materially reduced functionality where it is exercised.

6.7 Usage Data.

This clause applies when product analytics is enabled.

1. “Usage Data” means information about how users interact with the platform – features and screens used, actions taken, and timing and performance measurements. It contains no document content, figures or text entered by users;
2. as part of the services and on the Controller’s instructions, Atmoz processes Usage Data as processor to operate, support and improve the platform through which the services are provided to the Controller, including to find and fix usability problems. Atmoz does not use Usage Data to profile or assess individual users, for marketing, sales or advertising, or in combination with Controller Content;
3. Usage Data is collected on Atmoz’s servers from a closed set of predefined events without free-text fields, and identifies users only by a pseudonymous identifier. Events are either derived from requests the platform handles in serving the user or, with the user’s consent under (d), sent by the user’s browser to Atmoz’s servers. No analytics identifier is placed on users’ devices, and no IP address is sent to the product-analytics sub-processor;
4. product analytics is on by default for events derived from requests; events sent by the browser are collected only with the user’s prior consent, which the user may withdraw at any time. Where the Controller is a Contracting Authority, product analytics applies only if the Controller opts in. The Controller may switch product analytics off for its account, and each user may switch it off for themselves, at any time; no further Usage Data about them is then collected for analytics. On the Controller’s instruction, Atmoz deletes Usage Data already held within 30 days;
5. Usage Data is kept for no longer than 24 months and is deleted at the end of the term under clause 10;
6. Atmoz shows users an in-platform notice describing product analytics and how to switch it off; and
7. in all other respects, Usage Data is personal data processed on the Controller’s behalf under this DPA.

6.8 Default uses.

1. Unless the Controller opts out, and subject to (b), Atmoz may use Controller Content only for:

(i) supplier classification – using classifications the Controller confirms or corrects for suppliers that are legal persons, not sole traders, to suggest classifications for the same suppliers to other customers, without revealing the Controller’s identity, documents, spend or figures, or that any customer buys from the supplier; (ii) service improvement – running new versions of the extraction and classification models, prompts and rules against the Controller’s documents in the production environment to measure and improve their accuracy, without copying the documents out of production, keeping only aggregate results that contain no personal data, and without training AI models on them; and (iii) benchmarks – comparing emissions and related indicators across customers, for example by industry, size or region, shown in the platform or published as industry insights, using Anonymised data only, from reporting periods that ended at least six months earlier, where each figure combines data from at least five customers, no single customer accounts for more than half of it, and it does not reveal the Controller’s identity, documents or figures;

1. where the Controller is a Contracting Authority, each use applies only if the Controller opts in to it, in the Main Agreement or by notice to privacy@atmoz.io. Data the Controller has notified under clause 3.5 is excluded from these uses even where the Controller opts in; and

2. the Controller may opt out of any of these uses in the Main Agreement or at any time by notice to privacy@atmoz.io or, where available, through the platform settings. Within 30 days, Atmoz stops the use and removes classifications derived from the Controller’s confirmations from suggestions shown to other customers, and excludes the Controller’s data from benchmarks produced after that date.

Atmoz carries out the uses in (a) as processor, as part of the services and on the Controller’s documented instructions under clause 2. What Atmoz retains from them contains no personal data: classifications of legal persons, aggregate accuracy results and Anonymised benchmarks.

6.9 Sharing with suppliers and other recipients.

The Controller decides, as controller, what it discloses of its figures and to whom, for example a supplier’s figures to that supplier, or its own figures to its customers and auditors. Nothing in this DPA restricts such disclosure, and the platform’s export and reporting functions are provided for that purpose as part of the services.

Where the Controller uses a platform function to send information or a request to a supplier, or to give a supplier access to figures that concern it, Atmoz processes the supplier’s contact details and any response on the Controller’s instruction as part of the services and as described in Appendix A; the supplier is shown which Controller the request comes from; and Atmoz does not use the supplier’s response for any other customer unless the supplier itself chooses, when responding, to make the same information available to other Atmoz customers it supplies. A figure attributed to a supplier who is a natural person, such as a sole trader, is personal data about that person; sharing it with that supplier is within this clause, and onward disclosure of it to other recipients is the Controller’s responsibility as controller.

7. Assistance to the Controller

7.1 Data subject rights. Taking into account the nature of the processing, Atmoz shall assist the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the Controller’s obligation to respond to requests to exercise data subject rights under Chapter III of the GDPR.

7.2 That assistance can include searching for, retrieving, correcting or deleting data within the Controller’s account where the Controller instructs it and the request is properly scoped to the Controller’s data. Atmoz does not decide the Controller’s response, and does not search any other customer’s account.

7.3 Atmoz shall notify the Controller without undue delay if it receives a request directly from a data subject relating to the Controller’s personal data, and shall not respond to that request itself except on the Controller’s instruction. Where a data subject approaches Atmoz without knowing which organisation holds the data, Atmoz will, where it can identify the Controller, pass the request on and ask that the Controller respond directly; Atmoz will not confirm to a third party whether a particular organisation is an Atmoz customer.

7.4 Assistance under Articles 32–36. Atmoz shall assist the Controller in ensuring compliance with the obligations in Articles 32 to 36 of the GDPR, taking into account the nature of the processing and the information available to Atmoz, including assistance with data protection impact assessments and with prior consultation of the supervisory authority. Appendix A, and in particular the limits recorded in A.7, is provided to support the Controller’s own assessment.

7.5 Whether the Controller’s own use of the platform involves automated decision-making within the meaning of Article 22 is a question for the Controller as controller, not for Atmoz.

7.6 Assistance under this clause is provided at no additional charge for a reasonable volume of requests.

8. Personal data breaches

8.1 Atmoz shall notify the Controller without undue delay after becoming aware of a personal data breach, or of reasonable grounds to suspect one, affecting the Controller’s personal data. Notification shall in any event be given within 48 hours of becoming aware, and Atmoz’s operational target is 24 hours. Notice is given to the incident contact recorded in the Main Agreement.

8.2 The notification shall describe, to the extent known at the time:

1. the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned;
2. the likely consequences of the breach;
3. the measures taken or proposed to address the breach and to mitigate its effects; and
4. a contact point for further information.

8.3 Atmoz does not delay the first notification until its investigation concludes; it notifies with the information available and supplements it without further undue delay as more becomes known.

8.4 Atmoz shall document each personal data breach, including the facts, its effects and the remedial action taken, and shall make that documentation available to the Controller on request.

8.5 Atmoz shall assist the Controller in investigating the breach and, where the Controller must inform data subjects under Article 34, in doing so. Atmoz shall not notify a supervisory authority or any data subject about a breach affecting the Controller’s personal data on the Controller’s behalf, except on the Controller’s instruction. The decision to notify a regulator or affected individuals, and the notification itself, remain the Controller’s.

9. Audit and information

9.1 Atmoz shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR.

9.2 Atmoz shall allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.

9.3 The Controller shall give reasonable written notice of an audit, normally 30 days; audits shall take place during normal business hours and no more than once in any 12-month period unless a personal data breach, a supervisory authority or reasonable grounds to suspect non-compliance require otherwise; and the Controller shall bear its own costs. The auditor shall be bound by confidentiality and shall not be a competitor of Atmoz.

9.4 Atmoz may satisfy an audit request in whole or in part by providing existing documentation, including sub-processor certifications and reports, where that documentation reasonably answers the Controller’s request.

9.5 Requests under this clause 9 may be met through the information in this DPA, the policies described in Appendix B.1 and sub-processor documentation under clause 9.4, and, where these do not reasonably answer the request, through an audit under clause 9.3. Where Atmoz holds a certification or third-party report relevant to the services, it may also provide it for that purpose.

10. Deletion or return at the end of the term

10.1 On termination or expiry of the Main Agreement, Atmoz shall, at the Controller’s choice, delete or return all personal data processed on the Controller’s behalf, and delete existing copies, unless Union or Member State law requires storage of the personal data.

10.2 The Controller shall make that choice in writing within 30 days of termination or, where a longer data-retrieval period applies under the Main Agreement or applicable law, before that period ends. Absent a choice, Atmoz shall delete.

10.3 Deletion during the term. Within the term the Controller decides what is uploaded, whether by its own users or by Atmoz as part of Assisted Services under clause 2.6, and when it is deleted. Deletion of the Controller’s data is instructed in writing to privacy@atmoz.io or, where available, through the platform. A user who deletes their own login removes only their own identity and membership, not the Controller’s data. Where the Controller instructs deletion, Atmoz carries it out across every system that holds the data; deactivating an account is not deletion.

10.4 Deletion is not instantaneous, and the following limits apply.

1. Backups and operational logs. Deleted personal data persists in backups and in operational logs until those retention windows expire. The windows are stated in Appendix B.3 and B.4 and are not configurable per customer.

2. Data warehouse recovery history. Deleted personal data remains recoverable in the data warehouse’s recovery history and in the provider’s fixed fail-safe period that follows it, for the periods stated in Appendix B.3. Atmoz cannot shorten or bypass the fail-safe period, including in response to an erasure request. After both periods have elapsed the data is unrecoverable, including by the provider’s own personnel.

3. Append-only records. Parts of the platform’s audit and calculation-evidence layer are append-only by design. Records in those stores are not updated or deleted in place in the ordinary course of the service. Append-only design affects how deletion is carried out, not whether it happens.

4. Object storage. Source documents are held in object storage with a short soft-delete window and with object versioning enabled, so a deleted object remains recoverable for that window and a superseded version remains until it is aged out. Both periods are stated in Appendix B.3.

5. Infrastructure provider’s deletion pipeline. When Atmoz deletes personal data held on the underlying cloud infrastructure – on the Controller’s instruction or when a retention window expires – the infrastructure provider’s own deletion process removes it from all of the provider’s systems within the period stated in the provider’s data processing terms, currently up to 180 days from the deletion action under the Google Cloud Data Processing Addendum. During that period the data is no longer accessible to Atmoz or through the service; it persists only inside the provider’s internal deletion pipeline, under the provider’s safeguards, until overwritten or expired.

10.5 Anonymisation is not a substitute for deletion, and pseudonymised or masked data that can still be linked to a person remains subject to the deletion obligation.

10.6 Deletion or return under 10.1 shall be completed within 30 days of the Controller’s instruction or, where no choice is made, of the end of the period in 10.2, save that personal data persists in the backup, recovery and versioned stores described in 10.4 until those windows expire. Those residual copies expire within 90 days of the same date, with two exceptions, both stated in Appendix B.4:

1. Authentication event logs. The identity provider’s authentication event logs, which contain end-user IP addresses, are retained for the period stated in Appendix B.4.
2. Data-access audit records. Records of which account performed an administrative action, and which account read or wrote an object in the document store, are retained for the period stated in Appendix B.4. These records identify the actor and the object acted on; they do not contain the contents of the Controller’s documents. They are retained so that access to the data before its deletion can still be verified.

Deleted personal data is restored from these stores only as provided in 10.7, and the stores are not used for any purpose other than recovery from failure and, for the logs in (a) and (b), security monitoring and audit.

The 30- and 90-day periods above cover the stores Atmoz operates; deletion from the underlying infrastructure then completes as described in 10.4(e).

10.7 Atmoz shall not restore deleted personal data from backup or any other recovery store except as part of a disaster recovery event, and shall re-apply the deletion after any such restore.

10.8 Atmoz shall confirm completion of deletion or return in writing on request.

10.9 What “return” comprises. A return under 10.1, and an export requested at any time during the term, comprises the Controller’s source documents together with the computed ledger lines derived from them – each with its tier, the identity and version of the emission factor applied, and the review and correction records described in Appendix A.3a – provided in a structured, commonly used and machine-readable format. The Controller may need to keep that evidence after this agreement ends, for example under sustainability or financial-reporting rules. Atmoz does not retain the Controller’s data after deletion under 10.1 in order to meet that need, and the Controller should export before deletion accordingly.

11. Term

11.1 This DPA takes effect on the date of the Main Agreement and continues for as long as Atmoz processes personal data on behalf of the Controller.

11.2 Clauses 3 (Confidentiality), 6 (Use of Controller data), 8.4 (breach documentation), 9 (Audit) and 10 (Deletion or return) survive termination to the extent necessary.

11.3 Pilot followed by a subscription. Where a Main Agreement for a pilot is followed by a further agreement between the parties for the services, this DPA continues to apply under that further agreement, which becomes the Main Agreement, unless the parties agree a replacement data processing agreement. That transition is not a termination or expiry for the purposes of clause 10.1, and the Controller’s data remains in its account unless the Controller instructs otherwise.

12. Governing law and jurisdiction

12.1 This DPA is governed by Swedish law.

12.2 Disputes arising out of or in connection with this DPA shall be settled by the Swedish general courts, with Stockholms tingsrätt as the court of first instance, unless the Main Agreement provides otherwise.

13. Changes to this DPA

13.1 This DPA may be changed only in writing agreed by both parties, except as clauses 4.2 and 5 provide for Appendices B and C and as set out in 13.2.

13.2 Atmoz may update this DPA by giving the Controller at least 30 days’ notice at the contact address recorded in the Main Agreement, or shorter notice where the law requires the change sooner, if the update: (a) is required by applicable law, a court order or guidance from a supervisory authority; (b) reflects a change in a party’s name or legal form; or (c) does not reduce the level of security, does not expand Atmoz’s use of Controller Content under clause 6 or remove a restriction on it, and does not otherwise materially and adversely affect the Controller’s rights under this DPA. Where the Controller is a Contracting Authority, an update under (c) requires the Controller’s written agreement.

13.3 If an update under 13.2(a) materially and adversely affects the Controller, the Controller may terminate the affected services without penalty by notice given within the notice period.

Appendix A – Description of the processing

This appendix gives the Article 28(3) and Article 30(2) description of the processing.

A.1 Subject matter

Provision of the Atmoz carbon accounting platform: ingesting the Controller’s financial and operational source data (supplier invoices, ERP records, CSV files, activity data), computing greenhouse gas emissions from it, and presenting the results to the Controller’s users; and, where agreed, Assisted Services under clause 2.6, including receiving source data the Controller shares with Atmoz and importing it into the platform.

A.2 Duration

For the duration of the Main Agreement, plus the deletion or return period in clause 10. Within the term, deletion follows clause 10.3. Any shorter retention period agreed between the parties is recorded in the Main Agreement or in a written instruction under clause 2.

A.3 Nature of the processing

Collection (including receipt of source data the Controller shares for Assisted Services), storage, structured extraction (including extraction by large language models, see clause 6.5), classification, computation, aggregation, display, review and correction, product analytics on Usage Data (clause 6.7), and deletion or return.

A.3a Human review of model output

Model output is subject to automated checks and, where those checks flag it, to human review.

Emissions figures are computed by deterministic code. No language model multiplies a quantity by an emission factor, and no model decides whether a computed figure passes the platform’s quality checks; a model proposes a classification or a candidate factor, and the computation is performed separately from it.

Where the platform’s checks mark a document or a computed line as suspect, it is placed in a review queue for a human operator, who may approve, reject or correct it, or substitute their own emission factor or figure. Each decision is recorded with the acting user, the scope of the decision, the verdict, the reason and the time. These are the review and correction records listed in A.6, and this section states what they contain.

Two limits. The queue surfaces output the platform’s checks have flagged; it is a targeted review mechanism and not a re-check of every line a model has touched. And whether the Controller’s own operators work the queue is a matter for the Controller, not something Atmoz’s systems enforce.

A.4 Purpose

Calculating and reporting the Controller’s greenhouse gas emissions, and operating, securing and supporting the service and, as clauses 6.4 and 6.8 allow, improving it and producing Anonymised benchmarks.

A.5 Categories of data subjects

A.6 Categories of personal data

Personal data reaches the platform in two ways.

(a) People the Controller gives accounts to, and their use of the platform

(b) Personal data inside accounting documents and ERP data, and in supplier exchanges

Special categories of personal data (Article 9) and criminal-conviction data (Article 10): none is required by the service, and the Controller shall not knowingly submit such data. Because source documents are free-form, Atmoz cannot technically exclude it and does not warrant that none is present.

A.7 Limits, and what is not processed

Each of the following describes what the platform is designed to do, and the limits of each statement are part of it.

• No personal-data detection or redaction in document text. Text is processed as printed (clause 2.5), which can include a person’s name and, in principle, special-category data.
• No field is designed to hold a traveller’s, passenger’s, guest’s or driver’s name. The extraction schema has no person-name field for them; passenger count is an integer. Such names can still arrive where a document mentions them: a line description naming a passenger is reproduced like any other free text. This is a commitment about what the platform asks for and structures, not a guarantee about the content of documents received.
• No field is designed to hold special-category data under Article 9 – nothing relating to health, religion, trade-union membership or the other Article 9 categories appears in any data model, schema or extraction prompt. The same limit applies as above: this is a commitment about what is requested and structured, not a guarantee about free text.
• Error events are designed to contain no personal data or other Controller data. Error events are minimised before they are sent to the provider in Appendix C.1: request content, user identifiers and IP addresses are excluded, events are sent through Atmoz’s servers rather than from users’ browsers, and text is masked by redaction rules, with the provider’s own data scrubbing enabled as a second layer. Redaction rules cannot guarantee that personal data written into a log message is always caught.
• No tracking identifiers in the browser. The platform uses only functional browser storage, such as the authentication session and interface preferences, and sets no identifying cookies. There are no analytics identifiers, tracking pixels or tag managers; the browser sends usage events only with the user’s consent under clause 6.7(d).
• End-user IP addresses in the logs listed in A.6 are used only for operating the service, troubleshooting and security monitoring, never for tracking, profiling, analytics or marketing. Their retention is stated in Appendix B.4.

Appendix B – Technical and organisational measures (Article 32)

B.1 Information security management system

Atmoz maintains an information security management system comprising documented policies owned by the CTO, covering the areas below. The policies are made available to the Controller on request.

B.2 Access control, identity and platform measures

The following are verified against deployed configuration:

• Multi-factor authentication. A second authentication factor is required for every interactive login, for Atmoz personnel and for Controller users alike. Enrolment cannot be deferred: a user without a second factor configured must enrol before completing a login. Machine identities used by the platform’s own services authenticate with client credentials and do not use the interactive login path.

• Identity. Authentication is provided by Zitadel Cloud on its EU instance. The platform operates no password store of its own; no password, hash or credential is stored in the Atmoz database.

• Role-based access control. Access within an account is role-based, with assignable roles and a single account owner per account, who must be an administrator.

• Access within an account. Access to documents is restricted to the users the Controller authorises, according to the permissions the Controller assigns them.

• Network posture. Backend services are not exposed directly to the public internet; traffic reaches them only through an API gateway.

• Log minimisation. Personal data such as email addresses is redacted before being written to application logs.

• Tenant isolation. Isolation between Controllers is enforced in the application layer. Every request is authenticated, and the account it acts on is taken from the verified session, not from data supplied in the request. Controllers share infrastructure – this is logical isolation, not a separate database or project per Controller.

• Vulnerability management. Dependencies are scanned automatically for known vulnerabilities, and findings are triaged by severity and exploitability and remediated accordingly.

Encryption. Personal data is encrypted in transit, using TLS 1.2 or higher with forward-secret cipher suites, and at rest, using the infrastructure provider’s managed encryption keys.

Environment separation. Production and non-production environments are separated. Controller Content is used outside production only when needed to investigate or fix a specific issue; it remains within the EU/EEA under the access controls in this appendix and is deleted once the work is complete, and in any case within 30 days.

B.3 Backups and recovery

Backups exist so that the Controller’s data survives failure, corruption or accidental loss. They are encrypted, held within the EU/EEA, and restricted to the personnel who operate the recovery process. The table also includes the recovery windows of the data warehouse and object storage, and copies used outside production under B.2, so that every period affecting how quickly deletion takes effect appears in one place.

The two data-warehouse rows run consecutively, giving a warehouse window of up to 37 days in total. The fail-safe period is the provider’s own, begins when the configurable recovery history ends, and cannot be shortened, bypassed or triggered early by Atmoz.

Beyond these windows there is no recovery: these stores are not an archive. The other limits on how quickly deletion takes effect are in clause 10.4.

Recovery procedures and objectives are documented and reviewed as the platform changes, and restores are tested as part of that programme. The Controller may ask about current recovery objectives and testing status at privacy@atmoz.io.

B.4 Operational and security logs

Logs are retained no longer than necessary for operating the service, troubleshooting and security monitoring.

Appendix C – Sub-processors

Reproduced from the Atmoz sub-processor list. Each entry is reviewed and evidenced under clause 5.6, and checked against deployed configuration. The published list at atmoz.io/subprocessors shows the current position and is where changes appear first; where the two differ, clause 5.2 decides which applies.

C.1 Infrastructure and platform

C.2 AI and LLM inference

Vertex AI serves the language models Atmoz uses, including Anthropic’s Claude models, within Google’s infrastructure under the Google Cloud DPA. Atmoz has no contract or data flow with any model developer, so model developers are not sub-processors of Atmoz. The no-training and retention position for this processing is in clause 6.5.

C.3 Company registries – recipients, and the role each holds

The enrichment service looks up a supplier’s industry classification so that an emission factor can be selected. It sends company identifiers only – name, VAT number, organisation number and country code – and no contact details. For a sole trader, a company name and registration number may identify an individual, which is why these lookups are treated as personal-data processing.

None of these recipients is an Article 28 sub-processor: each decides its own purposes for its register and is an independent controller.

The Dun & Bradstreet lookup is made only where the national registers do not resolve the supplier.

C.4 Further parties engaged by Atmoz’s sub-processors

Atmoz’s sub-processors engage further parties of their own. Atmoz maintains a record of those in Atmoz’s data path, recording for each the engaging sub-processor, the purpose, the location and whether the party receives Controller data.

That record is provided to the Controller on request.