Personuppgiftsbiträdesavtal

Data Processing Agreement — GDPR artikel 28.3

Senast uppdaterad: 18 september 2026

Detta personuppgiftsbiträdesavtal gäller automatiskt för varje kund som har accepterat Isodoras villkor. En undertecknad version kan begäras via legal@isodora.se.

För ändamålen i artikel 28.3 i förordning 2016/679 (GDPR) mellan kundens organisation (den personuppgiftsansvarige) och

Kundens organisation som framgår av kontot och ev. Order Form (den personuppgiftsansvarige).

Isodora AB, org.nr 559565-0424, Svampvägen 167, 122 63 Enskede, Sverige (personuppgiftsbiträdet). Vardera en ”part”; tillsammans ”parterna”.

HAR ENATS om följande avtalsklausuler (Klausulerna) för att uppfylla GDPR och skydda den registrerades rättigheter.

1. Ingress

These Contractual Clauses (the Clauses) determine the rights and obligations of the data processor, when processing personal data on behalf of the data controller.

The Clauses have been designed to ensure the parties’ compliance with Article 28(3) of Regulation 2016/679 (GDPR).

In the context of the license provision by Isodora AB, the data processor will process personal data on behalf of the data controller in accordance with the Clauses.

The Clauses shall take priority over any similar provisions contained in other agreements between the parties.

Four appendices are attached to the Clauses and form an integral part of the Clauses.

Appendix A contains details about the processing of personal data, including the purpose and nature of the processing, type of personal data, categories of data subjects and duration of the processing.

Appendix B contains the data controller’s conditions for the data processor’s use of sub-processors and a list of sub-processors authorized by the data controller. The list is rendered from the same source as the public Sub-processors page and is always identical to it.

Appendix C contains the data controller’s instructions with regards to the data processor’s processing of personal data, the minimum security measures to be implemented by the data processor and how audits of the data processor and any sub-processors are to be performed.

Appendix D contains provisions for other activities which are not covered by the Clauses.

The Clauses along with appendices shall be retained in writing, including electronically, by both parties.

The Clauses shall not exempt the data processor from obligations to which the data processor is subject pursuant to the GDPR or any other legislation.

2. Den personuppgiftsansvariges rättigheter och skyldigheter

The data controller is responsible for ensuring that the processing of personal data takes place in compliance with the GDPR (see Article 24 GDPR), the applicable EU or Member State data protection provisions and the Clauses.

The data controller has the right and obligation to make decisions about the purpose(s) and means of the processing of personal data.

The data controller is responsible, among other, for ensuring that the processing of personal data, which the data processor is instructed to perform, has a legal basis.

3. Personuppgiftsbiträdet handlar enligt instruktioner

The data processor shall process personal data only on documented instructions from the data controller, unless required to do so by Union or Member State law to which the processor is subject. Such instructions shall be specified in appendices A and C. Subsequent instructions can also be given by the data controller throughout the duration of the processing of personal data, but such instructions shall always be documented and kept in writing, including electronically, along with the Clauses.

The data processor shall immediately inform the data controller if instructions given by the data controller, in the opinion of the data processor, contravene the GDPR or the applicable EU or Member State data protection provisions.

4. Sekretess

The data processor shall only grant access to the personal data being processed on behalf of the data controller to persons under the data processor’s authority who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality and only on a need to know basis. The list of persons to whom access has been granted shall be kept under periodic review. On the basis of this review, such access to personal data can be withdrawn, if access is no longer necessary, and personal data shall consequently not be accessible anymore to those persons.

The data processor shall at the request of the data controller demonstrate that the concerned persons under the data processor’s authority are subject to the above-mentioned confidentiality.

5. Säkerhet för behandlingen

5.1 Article 32 GDPR stipulates that, taking into account the current technical level, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the data controller and data processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. Depending on their relevance, the measures may include:

Pseudonymisation and encryption of personal data
the ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services
the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident
a procedure for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing

5.2 According to Article 32 GDPR, the data processor shall also, independently from the data controller, evaluate the risks to the rights and freedoms of natural persons inherent in the processing and implement measures to mitigate those risks. To this effect, the data controller shall provide the data processor with all information necessary to identify and evaluate such risks.

5.3 Furthermore, the data processor shall assist the data controller in ensuring compliance with the data controller’s obligations pursuant to Article 32 GDPR, by inter alia providing the data controller with information concerning the technical and organizational measures already implemented by the data processor pursuant to Article 32 GDPR along with all other information necessary for the data controller to comply with the data controller’s obligation under Article 32 GDPR.

5.4 If subsequently, in the assessment of the data controller, mitigation of the identified risks require further measures to be implemented by the data processor than those already implemented by the data processor, the data controller shall specify these additional measures to be implemented in Appendix C.

6. Anlitande av underbiträden

6.1 The data processor shall meet the requirements specified in Article 28(2) and (4) GDPR in order to engage another processor (a sub-processor).

6.2 The data processor shall therefore not engage another processor (sub-processor) for the fulfillment of the Clauses without the prior general written authorisation of the data controller.

6.3 The data processor has the data controller’s general authorisation for the engagement of sub-processors. The data processor shall inform the data controller in writing of any intended changes concerning the addition or replacement of sub-processors at least 30 days in advance, thereby giving the data controller the opportunity to object to such changes prior to the engagement of the concerned sub-processor(s). Longer time periods of prior notice for specific sub-processing services can be provided in Appendix B. The list of sub-processors already authorized by the data controller is Appendix B, which is identical to the public Sub-processors page.

6.4 Where the data processor engages a sub-processor for carrying out specific processing activities on behalf of the data controller, the same data protection obligations as set out in EU or Member State law shall be imposed on that sub-processor by way of a contract or other legal act, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the Clauses and the GDPR. The data processor shall therefore be responsible for requiring that the sub-processor at least complies with the obligations to which the data processor is subject pursuant to the Clauses and the GDPR.

6.5 A copy of such a sub-processor agreement and subsequent amendments shall, at the data controller’s request, be submitted to the data controller, thereby giving the data controller the opportunity to ensure that the same data protection obligations as set out in the Clauses are imposed on the sub-processor. Clauses on business related issues that do not affect the legal data protection content of the sub-processor agreement shall not require submission to the data controller.

6.6 The data processor shall agree a third-party beneficiary clause with the sub-processor where, in the event of bankruptcy of the data processor, the data controller shall be a third-party beneficiary to the sub-processor agreement and shall have the right to enforce the agreement against the sub-processor engaged by the data processor, for example, enabling the data controller to instruct the sub-processor to delete or return the personal data.

6.7 If the sub-processor does not fulfill its data protection obligations, the data processor shall remain fully liable to the data controller as regards the fulfillment of the obligations of the sub-processor. This does not affect the rights of the data subjects under the GDPR, in particular those foreseen in Articles 79 and 82 GDPR, against the data controller and the data processor, including the sub-processor.

7. Överföring till tredjeland eller internationella organisationer

Any transfer of personal data to third countries or international organizations by the data processor shall only occur on the basis of documented instructions from the data controller and shall always take place in compliance with Chapter V GDPR.

In case transfers to third countries or international organizations, which the data processor has not been instructed to perform by the data controller, is required under EU or Member State law to which the data processor is subject, the data processor shall inform the data controller of that legal requirement prior to processing unless that law prohibits such information on important grounds of public interest.

Without documented instructions from the data controller, the data processor therefore cannot within the framework of the Clauses:

transfer personal data to a data controller or a data processor in a third country or in an international organization
transfer the processing of personal data to a sub-processor in a third country
have the personal data processed by the data processor in a third country

The data controller’s instructions regarding the transfer of personal data to a third country including, if applicable, the transfer tool under Chapter V GDPR on which they are based, shall be set out in Appendix C.6.

The Clauses shall not be confused with standard data protection clauses within the meaning of Article 46(2)(c) and (d) GDPR, and the Clauses cannot constitute a basis for transfer of personal data as referred to in Chapter V GDPR.

8. Bistånd till den personuppgiftsansvarige

8.1 Taking into account the nature of the processing, the data processor shall assist the data controller by appropriate technical and organizational measures, insofar as this is possible, in the fulfillment of the data controller’s obligations to respond to requests for exercising the data subject’s rights laid down in Chapter III GDPR. This entails that the data processor shall, insofar as this is possible, assist the data controller in the data controller’s compliance with:

the right to be informed when collecting personal data from the data subject
the right to be informed when personal data have not been obtained from the data subject
the right of access by the data subject
the right to rectification
the right to erasure (the right to be forgotten)
the right to restriction of processing
notification obligation regarding rectification or erasure of personal data or restriction of processing
the right to data portability
the right to object
the right not to be subject to a decision based solely on automated processing, including profiling

8.2 In addition to the data processor’s obligation to assist the data controller pursuant to Clause 5.3, the data processor shall furthermore, taking into account the nature of the processing and the information available to the data processor, assist the data controller in ensuring compliance with:

The data controller’s obligation to without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the competent supervisory authority, Integritetsskyddsmyndigheten (IMY), unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons
the data controller’s obligation to without undue delay communicate the personal data breach to the data subject, when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons
the data controller’s obligation to carry out an assessment, prior to the processing, of the impact of the envisaged processing operations on the protection of personal data (a data protection impact assessment)
the data controller’s obligation to consult the competent supervisory authority, Integritetsskyddsmyndigheten (IMY), prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the data controller to mitigate the risk

The Data Processor’s obligations under the Agreement shall not give rise to a claim for separate payment to the Data Processor for time spent, unless the time spent exceeds five (5) hours.

The parties shall define in Appendix C the appropriate technical and organizational measures by which the data processor is required to assist the data controller as well as the scope and the extent of the assistance required. This applies to the obligations foreseen in Clause 8.1 and 8.2.

9. Anmälan av personuppgiftsincident

9.1 In case of any personal data breach, the data processor shall, without undue delay after having become aware of it, notify the data controller of the personal data breach.

9.2 The data processor’s notification to the data controller shall, if possible, take place within 24 hours after the data processor has become aware of the personal data breach to enable the data controller to comply with the data controller’s obligation to notify the personal data breach to the competent supervisory authority, cf. Article 33 GDPR.

9.3 In accordance with Clause 8.2, the data processor shall assist the data controller in notifying the personal data breach to the competent supervisory authority, meaning that the data processor is required to assist in obtaining the information listed below which, pursuant to Article 33(3) GDPR, shall be stated in the data controller’s notification to the competent supervisory authority:

The nature of the personal data including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned
the likely consequences of the personal data breach
the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects

9.4 The parties shall define in Appendix C all the elements to be provided by the data processor when assisting the data controller in the notification of a personal data breach to the competent supervisory authority.

10. Radering och återlämning av uppgifter

10.1 On termination of the provision of personal data processing services, the data processor shall delete or return personal data in accordance with Appendix C.4 and Appendix D.4, unless Union or Member State law requires storage of the personal data.

11. Granskning och inspektion

11.1 The data processor shall make available to the data controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 and the Clauses and allow for and contribute to audits, including inspections, conducted by the data controller or another auditor mandated by the data controller.

Procedures applicable to the data controller’s audits, including inspections, of the data processor and sub-processors are specified in appendices C.7 and C.8.

The data processor shall be required to provide the supervisory authorities, which pursuant to applicable legislation have access to the data controller’s and data processor’s facilities, or representatives acting on behalf of such supervisory authorities, with access to the data processor’s physical facilities on presentation of appropriate identification.

12. Parternas överenskommelse om andra villkor

The parties may agree to other clauses concerning the provision of the personal data processing service specifying, for example, liability, as long as they do not contradict directly or indirectly the Clauses or prejudice the fundamental rights or freedoms of the data subject and the protection afforded by the GDPR.

13. Ikraftträdande och upphörande

The Clauses become effective when the customer accepts the Terms (or on the date of a separately signed copy, if requested).

Both parties shall be entitled to require the Clauses renegotiated if changes to the law or inexpediency of the Clauses should give rise to such renegotiation.

The Clauses shall apply for the duration of the provision of personal data processing services. For the duration of the provision of personal data processing services, the Clauses cannot be terminated unless other Clauses governing the provision of personal data processing services have been agreed between the parties.

If the provision of personal data processing services is terminated, and the personal data is deleted or returned to the data controller pursuant to Clause 10.1 and Appendix C.4, the Clauses may be terminated by written notice by either party.

Kontaktpunkter för personuppgiftsansvarig och personuppgiftsbiträde

The data processor can be contacted via the contact point below or by contacting persons who are usually communicated with in the contractual relationship between the data controller and the data processor.

The parties shall be under obligation continuously to inform each other of changes to contacts/contact points. If it is not possible for the data processor to reach the data controller through the contact person provided, the data controller allows the data processor to contact another person who is normally communicated with in the contractual relationship.

Dataskyddsombud: dpo@isodora.se

Appendix A — Information about the processing

A.1. Purpose

The processing of the data controller’s personal data takes place for the purpose of fulfilling the agreement entered into between the data processor and the data controller regarding the data processor’s delivery of the data processor’s digital solution.

A.2. Nature of the processing

As the owner and provider of the solution, the data processor processes general operations, including hosting, displaying, organizing, receiving, forwarding, structuring, customizing, implementing, searching, processing, storing, restoring, deleting, restricting, maintaining, developing, logging, supporting, troubleshooting and other IT services associated with the data processor’s solution(s) and/or service(s) for the data controller in accordance with the agreement between the parties.

A.3. Types of personal data

The data processor generally processes general personal data (cf. Article 4(1) and Article 6 GDPR) such as name, phone number, email and IP address. When using the solution, the data controller may entrust the processing of all kinds of data and personal data to the data processor, which is why the data processor will potentially be able to process all categories of personal data.

A.4. Categories of data subjects

The customer’s end users. When using the solution, the data controller may entrust the processing of personal data about additional categories of data subjects.

A.5. Duration

The processing is not time limited and lasts until the subscription agreement between the parties for the delivery of the data processor’s tools to the data controller is terminated or canceled by one of the parties, subject to Appendix C.4 and D.4.

Appendix B — Sub-processors

On commencement of the Clauses, the data controller authorizes the engagement of the following sub-processors. This table is rendered from the same data source as the public Sub-processors page and is always identical to it.

Name	Description of processing	Location	Transfer mechanism
OpenAI, L.L.C.	AI-inferens, inbäddningar och tal-till-text för intervjuer för standardprofilen i USA. Används inte för chatt, analys, dokumentgenerering eller transkription när tenanten har ett EU-hostat paket.	USA	Standardavtalsklausuler (kommissionens beslut 2021/914)
Opper Technology AB	EU-gateway för AI (Stockholm). Dirigerar prompts och modellutdata för Opper-baserade profiler, inklusive EU-hostade Azure- och Mistral-paket.	Sverige (AWS eu-north-1, Stockholm)	Personuppgiftsbiträdesavtal (behandling inom EES; ingen tredjelandsöverföring)
Microsoft Ireland Operations Limited (Azure OpenAI)	Azure OpenAI-inferens i Sverige för organisationer med Azure GPT- eller blandat EU-paket (chatt, analys, dokumentgenerering och relaterad tal-till-text via EU-katalogen).	Sverige (Azure Sweden)	Personuppgiftsbiträdesavtal (behandling inom EES; ingen tredjelandsöverföring)
Mistral AI SAS	EU-hostade språkmodeller och Voxtral tal-till-text i Frankrike för organisationer med Mistral- eller blandat EU-paket.	Frankrike	Personuppgiftsbiträdesavtal (behandling inom EES; ingen tredjelandsöverföring)
Supabase, Inc.	Databas, fillagring och autentisering	EU (eu-north-1, Stockholm) eller USA (us-east-1) — beroende på var er organisation finns	Personuppgiftsbiträdesavtal (data lagras i er organisations region och korsar aldrig EU/USA-gränsen)
Vercel, Inc.	Serverlös drift och innehållsleverans (CDN)	USA (EU-baserade edge-regioner för leverans)	EU–USA:s ramverk för dataskydd (Data Privacy Framework)
Stripe, Inc.	Prenumerations- och betalningshantering	USA	EU–USA:s ramverk för dataskydd samt standardavtalsklausuler
Resend (Plus Five Five, Inc.)	Utskick av transaktionsmejl	USA	Standardavtalsklausuler
Functional Software, Inc. (Sentry)	Felspårning och övervakning av applikationen	Europeiska unionen där det är tillgängligt, annars USA	Personuppgiftsbiträdesavtal och standardavtalsklausuler
LangChain, Inc. (LangSmith)	Observerbarhet och spårning av AI-agenter	Europeiska unionen (LangSmith EU, eu.smith.langchain.com)	Personuppgiftsbiträdesavtal (data lagras i EU); standardavtalsklausuler för eventuell kvarstående överföring

The sub-processors listed above provide services on their own standard terms that cannot be negotiated by the data processor. By these Clauses, the data controller accepts that such processing activities are carried out on the sub-processor’s terms (cf. D.3).

Appendix C — Instruction pertaining to the use of personal data

C.1. The subject of / instruction for the processing

The data processor’s processing of personal data on behalf of the data controller shall be carried out by the data processor performing general operations, including hosting, displaying, organizing, receiving, forwarding, structuring, adapting, implementing, searching, processing, storing, recovering, deleting, restricting, maintaining, developing, logging, supporting, troubleshooting, and other IT services related to the data processor’s solution and/or service for the data controller in accordance with the agreement entered between the parties.

C.2. Security of processing

The Data Processor’s solutions and services generally include the processing of personal data as covered by Article 6 GDPR and other confidential information. The data processor has chosen to implement a generally high level of security and is entitled and obliged to decide the technical and organizational security measures required, and must as a minimum implement the measures below.

Information security covering confidentiality, integrity and accessibility; written instructions that personal data may only be processed when instructions are in place, reviewed at least annually.
Physical and environmental security of premises used for processing; access limited and aligned with the current threat level and the sensitivity and volume of the personal data.
Communication links and encryption: appropriate technical measures to protect systems and networks, including data in transit; transmission of sensitive and confidential information over the internet is protected by encryption based on a recognised algorithm; firewalls only allow encrypted data traffic.
Firewall or similar technical measures; antivirus installed and regularly updated on systems used for processing personal data.
Daily backups stored physically separate from primary data in a security-approved data centre, so that relevant data can be restored without undue delay.
Home/remote workstations: encrypted connection, internal instructions, and two-factor authentication where technically possible.
Employee instruction: information security policy reviewed within the last year; confidentiality agreements; screening; awareness training for employees who access or process personal data; terminated employees’ rights deactivated and assets retrieved.
Disposal of equipment: formal processes to ensure effective erasure of personal data prior to disposal of electronic equipment.
Logging in all environments where personal data is processed, including administrator activity, changes to log setups and system rights, stored with sufficient capacity and subject to ongoing random checks.

C.3. Assistance to the data controller

The data processor shall insofar as this is possible, within the scope specified below, assist the data controller in accordance with Clause 8.1 and 8.2 by implementing the following technical and organizational measures.

Data subjects’ rights, cf. Clause 8.1: assist by providing access to, deleting, restricting and correcting information, including at sub-processors, without undue delay, under a documented procedure for data-subject requests.
Breaches and incidents, cf. Clause 8.2 — information to be sent: facts about the detected breach (time, place, cause); when it started, was discovered and was stopped; nature of the breach including confidentiality, integrity and availability; categories and approximate number of data subjects and personal data if possible; name and contact details of the point of contact; likely consequences; measures taken or proposed.

C.4. Storage period / erasure procedures

It is agreed between the parties that the data controller shall instruct the data processor on the deletion and return of personal data in connection with the termination of the Clauses. The data controller shall, no later than 30 days after the processing of personal data has ceased, notify the data processor of whether all personal data shall be erased or returned to the data controller. If personal data is to be returned, the data processor shall delete any copies or backups. The data processor shall ensure that any sub-processors also comply with this notice.

If the data processor has not received notification from the data controller within 30 days after the processing of personal data has ceased, the data processor shall send a reminder to the data controller. If the data controller does not subsequently notify the data processor, the data processor is entitled to delete personal data without further notice.

The data processor is entitled to remuneration for its processing activities up to the point where the data controller notifies the data processor of whether all personal data shall be erased or returned.

Agent-internal state with global identifiers — for example LangGraph requirement-analysis checkpoints keyed by a global requirement id — cannot always be mapped back to a specific organisation at deletion time. Those rows are retained for up to 30 days after termination and then evicted by automated retention, as described in the Privacy Policy §8 and the public Data Retention page.

C.5. Processing location

Processing of personal data covered by these terms may not, without the data controller’s prior written approval, take place at locations other than those provided for in this data processing agreement and the addresses of the sub-processors used, as further described in the applicable Appendix B.

C.6. Instruction on the transfer of personal data to third countries

If the data controller does not in the Clauses or subsequently provide documented instructions pertaining to the transfer of personal data to a third country, the data processor shall not be entitled within the framework of the Clauses to perform such transfer, unless such transfer is to one of the authorized sub-processors mentioned in Appendix B. Transfer bases are used in accordance with Chapter V GDPR. The specific transfer bases are set out in the applicable Appendix B.

C.7. Procedures for the data controller’s audits of the data processor

The data processor may, at a later date and at its own expense, obtain an ISAE 3000 audit opinion from an independent third party concerning the data processor’s compliance with the GDPR, data protection provisions in other EU or Member State law, and these Clauses. There is no obligation to obtain such an opinion within a fixed period.

If an auditor’s statement is obtained, it will be available to the data controller on the data processor’s website.

The data controller may, against payment, challenge the framework and/or method of the declaration and may in such cases request a new declaration under a different framework and/or using a different method.

Based on the results of the statement, the data controller is entitled to request the implementation of additional measures in order to ensure compliance with the GDPR, other applicable data protection law, and these Clauses.

In addition, the data controller or a representative of the data controller shall have the right, against payment, to carry out inspections, including physical inspections, of the premises from which the data processor processes personal data, whenever the data controller deems them necessary. Any costs incurred by the data controller in connection with a physical inspection shall be covered by the data controller itself.

C.8. Procedures for audits of sub-processors

The data processor shall annually at the data processor’s expense obtain a report concerning the sub-processor’s compliance with the GDPR, the applicable EU or Member State data protection provisions and the Clauses.

Upon request, documentation of such inspections shall be provided to the data controller for information purposes.

Appendix D — The parties’ terms of agreement on other subjects

D.1. Liability and breaches

Any breach of the Clauses shall be governed and dealt with in accordance with the parties’ agreement regarding the provision of the services.

In cases where the data processor has paid out amounts to data subjects in accordance with Article 82 GDPR or the Swedish Tort Liability Act (Skadeståndslagen), the data processor shall have full recourse against the data controller for the amount paid out that exceeds the agreed limitation of liability in the parties’ agreement regarding the provision of the services.

The parties have thereby contractually derogated from Article 82(5) GDPR and the Swedish Tort Liability Act. Irrespective of Article 82(5), a party who has paid compensation to an injured party that does not correspond to full compensation may have recourse in accordance with the principle in Article 82(5).

The parties may not assert recourse or claims for damages against the other party for fines or other penalties imposed pursuant to applicable provisions of the Swedish Data Protection Act (Dataskyddslagen).

D.2. Consequences of any unlawful instructions from the data controller

The data controller is aware that the data processor is dependent on the data controller’s instructions on the extent to which the data processor is entitled to use and process the personal data on behalf of the data controller. The data processor shall therefore not be liable for claims arising from the data processor’s acts or omissions to the extent that these acts or omissions are a direct data processing activity carried out in accordance with the data controller’s instructions, unless it can be established that the data processor was aware of the unlawfulness of the processing.

D.3. Use of a sub-processor delivering on standard terms

Irrespective of Clause 6, if the data processor uses a sub-processor which provides services on its own terms that cannot be negotiated by the data processor, the sub-processor’s terms apply to the processing activities entrusted to such sub-processor. Where processing is carried out on the terms of a sub-processor, this is indicated for the relevant sub-processor in the list of sub-processors. By these Clauses, the data controller accepts and instructs that such specific processing activities are carried out on the sub-processor’s terms.

D.4. Deletion and return of information

The data controller shall, no later than 30 days after the processing of personal data has ceased, notify the data processor of whether all personal data shall be erased or returned to the data controller. In the event that personal data is to be returned to the data controller, the data processor shall delete any copies or backups. The data processor shall ensure that any sub-processors also comply with this notice from the data controller.

LangGraph checkpoints and other agent-internal state described in Privacy Policy §8 follow a 30-day automated retention window after termination, then erasure.