Data Processing Agreement (DPA)

Last updated: 2025-12-30

1. Parties

This Data Processing Agreement ("Agreement") is entered into between:

Data Controller: The Customer

Data Processor: Samlas AB, reg. no. 556763-6542 ("Structura")

2. Subject Matter and Instructions

Structura shall process personal data solely on behalf of the Data Controller and only in accordance with documented instructions provided by the Data Controller, for the purpose of delivering the Structura platform.

Structura shall not process personal data for its own purposes.

3. Categories of Personal Data and Data Subjects

The processing primarily includes:

basic user information (name, email address, organisational affiliation)
user identity, roles and access rights
technical system logs

Data subjects are users affiliated with the Data Controller.

Structura is not intended for the processing of special categories of personal data.

4. Security Measures

Structura implements appropriate technical and organisational measures to protect personal data, including but not limited to:

role-based access control
authentication and authorisation mechanisms
logging and traceability
data minimisation
protection against unauthorised access, loss or alteration

5. Confidentiality

Structura ensures that all persons authorised to process personal data are subject to confidentiality obligations or equivalent statutory duties of confidentiality.

6. Sub-processors

Structura may engage sub-processors to fulfil its obligations under this Agreement. Any such sub-processors shall be bound by written agreements that meet the requirements of Article 28 of the GDPR.

An up-to-date list of sub-processors shall be made available upon request.

7. Assistance to the Data Controller

Structura shall, to the extent reasonably possible, assist the Data Controller in:

responding to data subject requests
fulfilling obligations relating to security, personal data breaches, and data protection impact assessments

8. Personal Data Breaches

Structura shall notify the Data Controller without undue delay after becoming aware of a personal data breach and shall provide relevant information to support the Data Controller's response.

9. Audit and Inspection

The Data Controller shall have the right, upon reasonable notice, to conduct audits or inspections to verify Structura's compliance with this Agreement.

10. Termination

Upon termination of the service agreement, Structura shall, in accordance with the Data Controller's instructions, delete or return all personal data, unless retention is required by applicable law.