Data Processing Agreement

Parties and acceptance

This Data Processing Agreement (“DPA”) is part of the Terms of Service (“Terms”) between Saifion ApS, CVR 46208145, Porcelænshaven 26, 2000 Frederiksberg, Denmark (“Saifion”, “Processor”), and the customer that holds the Saifion account (“Customer”, “Controller”).

The Customer accepts this DPA by accepting the Terms, which happens when it creates an account or uses the Platform. No separate signature is needed. Acceptance in electronic form meets the requirement in GDPR Article 28(9). A Customer that needs a separately signed data processing agreement can contact contact@saifion.com. Until one is signed by both parties, this DPA applies.

1. Scope

1.1 This DPA covers personal data that Saifion processes on the Customer's behalf when providing the Platform. It does not cover personal data Saifion processes as controller for its own purposes, which is described in the Privacy Policy.

1.2 If this DPA and the Terms conflict on the processing of personal data on the Customer's behalf, this DPA prevails. Otherwise the Terms prevail.

2. Definitions

Terms defined in the GDPR (Regulation (EU) 2016/679), such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach”, have the same meaning here. “Customer Personal Data” means personal data Saifion processes on the Customer's behalf under this DPA. “SCC” means the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914. “Data Protection Law” means the GDPR and the Danish Data Protection Act.

3. Roles

3.1 For Customer Personal Data, the Customer is controller and Saifion is processor.

3.2 Saifion is an independent controller, outside this DPA, for: user accounts and sign-in; its customer relationship and invoicing; security and prevention of misuse; its network of Forwarders; and the aggregated statistics described in Section 15.3 of the Terms, which do not identify any customer or person.

3.3 Forwarders that perform freight booked through the Platform, and Suppliers that receive purchase orders from the Customer, are independent controllers for the data they receive.

4. Description of the processing

4.1 Subject matter and duration: Processing needed to provide the Platform to the Customer, for as long as the Customer has an account and afterwards as set out in Section 11.

4.2 Nature: Collection, storage, organisation, structuring, reading, extraction, matching, use, disclosure by transmission and erasure, including automated reading of documents and emails with AI models.

4.3 Purposes:

• managing purchase orders, Suppliers, Forwarders, freight, shipments, documents and costs
• reading documents and emails from connected mailboxes and extracting order and shipment data
• sending purchase orders, messages and quote requests on the Customer's instruction
• synchronising data with systems the Customer connects
• retrieving tracking information for the Customer's shipments from carriers and tracking services, such as DHL and ShipsGo, using the shipment numbers the Customer makes available
• support at the Customer's request

4.4 Categories of personal data: Names, email addresses, phone numbers, job titles and company affiliation; the content of messages, emails and documents, such as invoices, packing lists and bills of lading, which can contain names and contact details; and login and activity data of Users.

4.5 Categories of data subjects: The Customer's Users and employees; contact persons at the Customer's Suppliers, Forwarders and other business contacts; and people named in documents and emails the Customer makes available.

4.6 Saifion does not intend to process special categories of personal data (GDPR Article 9) or data about criminal offences (Article 10). The Customer shall not upload such data.

5. The Customer's obligations

5.1 The Customer confirms that it has a lawful basis for the processing it instructs, that it has informed data subjects as required by GDPR Articles 13 and 14, and that its instructions comply with Data Protection Law.

5.2 The Terms, this DPA and the Customer's use and configuration of the Platform, including the Integrations it connects, are the Customer's documented instructions. Further instructions must be given in writing, for example by email to contact@saifion.com.

5.3 When the Customer has the Platform track a shipment with a carrier, such as DHL, the Customer confirms that the shipment's sender and recipient have been informed and, where required, have consented to the tracking information being retrieved through the Platform.

6. Saifion's obligations (GDPR Article 28(3))

6.1 Instructions

Saifion processes Customer Personal Data only on the Customer's documented instructions, including for transfers to third countries, unless EU or member state law requires otherwise. In that case Saifion informs the Customer first, unless the law prohibits it. Saifion informs the Customer if it believes an instruction breaks Data Protection Law.

6.2 Confidentiality

Saifion ensures that persons authorised to process Customer Personal Data are bound by confidentiality, and gives access only to those who need it.

6.3 Security

Saifion implements the measures in Annex I to ensure a level of security appropriate to the risk (GDPR Article 32).

6.4 Sub-processors

6.4.1 The Customer gives general authorisation for Saifion to use sub-processors. The current sub-processors are listed in Annex II.

6.4.2 Saifion notifies the Customer by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. If Saifion cannot meet the objection, the Customer may terminate the affected services.

6.4.3 Saifion binds each sub-processor by written contract to data protection obligations that provide sufficient guarantees under GDPR Article 28(4), and remains responsible to the Customer for the sub-processor's performance.

6.5 Data subject requests

Saifion assists the Customer, as far as possible, in responding to requests from data subjects. If a data subject contacts Saifion directly about Customer Personal Data, Saifion forwards the request to the Customer without undue delay and does not answer it without the Customer's authorisation, unless the law requires it.

6.6 Impact assessments

Saifion provides reasonable assistance with the Customer's data protection impact assessments and prior consultations (GDPR Articles 35 and 36), taking into account the information available to Saifion.

6.7 Personal data breaches

Saifion notifies the Customer without undue delay, and no later than 24 hours after becoming aware of a personal data breach affecting Customer Personal Data. The notification describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact person. Saifion assists the Customer with its obligations under GDPR Articles 33 and 34.

6.8 Audits

Saifion makes available the information needed to demonstrate compliance with GDPR Article 28 and allows for audits, including inspections, by the Customer or an auditor it appoints. Audits take place at most once a year unless there is reasonable suspicion of a breach, with 30 days' written notice, during business hours, and under confidentiality. Each party bears its own costs. Saifion may answer an audit request with documentation, including its sub-processors' certifications and audit reports, where that covers the scope of the request.

7. Transfers outside the EU/EEA

7.1 Some sub-processors are in the USA (Annex II). For these transfers Saifion relies on the EU-U.S. Data Privacy Framework where the sub-processor is certified under it, and otherwise on the SCC included in the sub-processor's data processing terms. The Customer can request a copy of the relevant safeguards.

7.2 When the Customer sends purchase orders to Suppliers or books freight with Forwarders outside the EU/EEA, the data is transferred on the Customer's instruction to recipients acting as independent controllers, and only the data needed for the order or shipment is shared.

8. Artificial intelligence

8.1 Saifion uses AI models from Anthropic (Annex II) to read documents and emails, extract data, draft text and make suggestions. Only the data needed for a task is sent.

8.2 Anthropic does not use data sent through its API to train its models. It keeps API inputs and outputs for a limited period, currently up to 30 days, for abuse monitoring and legal compliance, and longer only where content is flagged for violating its usage policy or where the law requires it.

8.3 Saifion does not use Customer Personal Data to train AI models.

8.4 AI output is presented to Users as suggestions and drafts. The Platform does not make decisions based solely on automated processing that have legal or similarly significant effects on data subjects (GDPR Article 22).

9. Liability

9.1 Liability under this DPA is subject to the limitations and exclusions in Section 10 of the Terms and is not in addition to them.

9.2 This does not limit liability that cannot be limited under mandatory law, including a data subject's right to compensation under GDPR Article 82.

10. Term and changes

10.1 This DPA applies for as long as Saifion processes Customer Personal Data on the Customer's behalf.

10.2 Saifion may update this DPA. Material changes that reduce the Customer's protection are notified by email at least 30 days before they take effect. If the Customer does not accept them, it may terminate the affected services before that date. Changes are recorded in the change log below.

11. Return and deletion

The Customer can ask for an export of its data at any time. When the services end, the Customer may request an export within 30 days. Saifion then deletes Customer Personal Data within 90 days of termination, unless EU or member state law requires it to be kept. Data kept for that reason is not processed for any other purpose. Tracking information retrieved from DHL is, however, deleted 30 days after the shipment is delivered, as DHL's terms require.

12. Governing law

This DPA is governed by Danish law. Disputes are settled as set out in Section 21 of the Terms. Where the SCC apply, their own rules on governing law and jurisdiction apply to them.

13. Contact

Saifion ApS, CVR 46208145, Porcelænshaven 26, 2000 Frederiksberg, Denmark, contact@saifion.com

Supervisory authority: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, dt@datatilsynet.dk, +45 33 19 32 00

Annex I: Technical and organisational measures

Encryption

• Encryption in transit (TLS) for all traffic to the Platform and between Saifion and its sub-processors
• Encryption at rest at the database provider
• Access tokens and keys for connected systems are encrypted with AES-256-GCM before they are stored, and deleted when the connection is removed

Access control

• Sign-in through a dedicated authentication provider (Clerk)
• Each customer's data is separated by organisation
• Roles within each customer organisation limit what each User can see and do
• Access to production systems is limited to Saifion personnel who need it, using personal accounts
• Links sent to Suppliers and Forwarders give access only to the order or request they concern

Data minimisation

• Only the data needed for a task is sent to AI models
• Integrations request only the permissions the features use

Availability

• The Platform runs on managed cloud providers (Annex II) that provide redundancy and recovery for their services

Organisation

• Everyone at Saifion with access to Customer Personal Data is bound by confidentiality
• Personal data breaches are assessed, recorded and notified as set out in Section 6.7
• Security fixes to dependencies are applied as part of regular development

Annex II: Sub-processors

Annex III: Summary of the processing

Change log