Terms and personal data processing

These terms apply to all services that UCS OneDo AB ("UCS OneDo") delivers to customers, including implementation, configuration, development, support, maintenance and upgrades of the Odoo ERP system. The terms form an integral part of quotations, agreements and orders between the parties.

Contents

• 1. List of sub-processors
• 2. Data processing agreement
• Appendix – Description of the processing
• 3. General terms and conditions

1. List of sub-processors

The sub-processors that UCS OneDo AB uses when processing personal data are listed below.

2. Data processing agreement

Definitions

Processing – any handling of personal data such as collection, recording, alteration, storage, adaptation, use and erasure, whether automated or manual.

Personal data – information relating to an identifiable person.

Controller – the party that determines the purposes and means of the processing of personal data.

Processor – the party that processes personal data on behalf of the controller.

Data subject – the private individual whose personal data is processed.

Third country – a state that is not a member of the European Union or a party to the European Economic Area (EEA).

Sub-processor – a processor engaged by the processor.

In this agreement, the Customer is the controller and UCS OneDo AB is the processor.

Purpose

The agreement is required in order to perform the agreed assignment within implementation, configuration, development, data import, support, maintenance and upgrades of the Odoo ERP system, as these undertakings mean that UCS OneDo AB may process personal data in the Customer's system.

This agreement shall be interpreted in accordance with Article 28 of the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council) and shall ensure that the applicable rules on the processing of personal data are complied with.

What personal data is processed

As assignments within implementation, support and maintenance of Odoo involve access to the Customer's database and the data it contains, the data that may occur is compiled in the appendix below, together with the nature, purpose and types of processing.

The controller's responsibilities

The controller is obliged to comply with the General Data Protection Regulation regarding the processing of personal data. It is the controller's responsibility to ensure that the data is handed over to the processor in a secure manner and to provide instructions on how the data is to be processed. The controller shall bear all costs and expenses arising from the controller changing its instructions or issuing new instructions.

The processor's responsibilities

The processor is obliged to document and comply with instructions from the controller and to observe permitted processing of personal data in accordance with the applicable rules. It is also the processor's responsibility to assist with information so that the obligations under GDPR Articles 32–36 are complied with, taking into account the nature of the processing and the information available to the processor.

Security and confidentiality

The processor is responsible for ensuring that security wherever personal data is processed on behalf of the controller is managed in such a way that an adequate level of security is achieved in accordance with GDPR Article 32. This applies both to digital storage in the form of servers and to the storage of physical original documents and procedures for processing. Access rights are also restricted internally at the processor so that only staff whose task is to process the data for the controller will have access to it.

The processor is also obliged to ensure that staff who are given access to the controller's personal data are bound by a confidentiality undertaking. This confidentiality undertaking shall also apply after the termination of the agreement.

Access for audit

In its role, the controller has the right to ensure that the processor complies with its obligations and has taken the measures required for these to be fulfilled. The processor therefore undertakes to provide the information required to carry out such an audit.

Engagement of sub-processors

The processor may engage subcontractors to process personal data. Current sub-processors are set out in the list above. This shall be regarded as a general prior written authorization. The processor may use AI-based tools for structuring, converting and validating business data in connection with the assignment, for example when migrating customer, supplier and CRM records from the controller's previous system. Such processing takes place under the processor's control, and the provider engaged is listed as a sub-processor in the list of sub-processors above.

Other processors of the controller

If the controller provides its own subcontractor, such as a server solution or cloud service, to which the processor has access, the controller must ensure that data processing agreements are in place with all such providers and that their security is adequate.

Rights of data subjects

The processor shall handle data in such a way that the controller can respond to an individual data subject's request to exercise their rights in the form of access (register extract), rectification, alteration and erasure.

Transfer to third countries

The processor may not transfer personal data belonging to the controller to a third country without the controller's prior authorization, other than as set out in the list of sub-processors. If such a transfer takes place, it shall be based on the European Commission's standard contractual clauses (SCC) or another valid transfer mechanism, and the parties shall first ensure that an adequate level of protection for personal data is maintained.

Incidents

In the event of a confirmed or suspected personal data breach, such as unauthorized access, incorrect alteration, incomplete erasure or other unauthorized processing, the processor shall investigate the incident, take measures to prevent recurrence and notify the controller with a written report without delay. The report shall contain a description of the incident, the personal data affected, the measures taken to prevent recurrence and contact details where further information can be obtained. If the incident has affected the rights and freedoms of the data subject, the controller shall comply with GDPR Article 34. It is also the controller's responsibility to report personal data breaches in accordance with GDPR Article 33.

Amendments and additions

Amendments and additions to this agreement shall be made in writing and signed by both parties.

Term and termination

This agreement applies from the date of the agreement and shall thereafter remain in force until the processor ceases to process personal data on behalf of the controller. Upon termination of the agreement, the processor is obliged to return and erase the data that this agreement entitles it to process.

Appendix – Description of the processing

Nature and purpose

To fulfill obligations under the service agreement between the parties regarding implementation, configuration, development, data import, support, maintenance and upgrades of the Odoo ERP system.

Types of personal data

Contact details such as name, email and telephone number of the customer's users and contact persons. Data contained in the customer's Odoo database, for example customer and supplier contacts, user accounts and access rights, billing information, and attachments and quotations in which personal names appear. Depending on which applications the customer uses, employee data may also occur, such as employment details, time reporting, attendance, payroll-related data and bank account numbers.

The personal data may include sensitive data to the extent that such data is provided or registered by the controller. The processing is carried out on the basis of Article 9(2)(a), (b) and (f) of the GDPR.

Categories of data subjects

Employees of the controller, users of the system, customers who are private individuals, employees and members of customers, suppliers, partners and other categories decided by the controller.

Processing operations

Collection, storage, organization, transfer, data matching, statistics, purging and erasure.

Retention of personal data

In accordance with the controller's policy and instructions.

3. General terms and conditions

Limitation of UCS OneDo AB's undertakings

1. UCS OneDo AB's undertakings under the agreement are conditional upon the Customer fulfilling its undertakings, the monthly fee being paid and other fees payable under the agreement being paid. If the Customer at any time fails to fulfill these obligations, UCS OneDo AB is entitled to cease, or refrain from commencing, its undertakings.

2. If UCS OneDo AB's undertakings are affected or cease in accordance with the preceding clause, this shall not affect the Customer's obligation to pay the fixed monthly fee or any other fee or payment due under the agreement.

Assignment

3. The Customer may not assign its rights or obligations under the agreement without the written consent of UCS OneDo AB.

UCS OneDo AB's liability for errors or defects

4. Errors or defects in work performed by UCS OneDo AB shall be remedied by UCS OneDo AB with the urgency required by the circumstances following a complaint from the Customer. The complaint shall contain detailed information about how the error or defect manifests itself. The costs of remedying shall be borne by UCS OneDo AB. If UCS OneDo AB has not fulfilled its obligations after a written reminder from the Customer, the Customer is entitled to a reduction of the monthly fee. Claims for a reduction must be made no later than one (1) month after the end of the period for which compensation is claimed. If UCS OneDo AB, despite a written reminder, does not fulfill its obligations, the Customer is entitled to terminate the agreement in writing with immediate effect. If the Customer terminates the agreement under this clause, the Customer is entitled to claim damages subject to the limitations set out in clauses 5–8.

Limitation of liability

5. UCS OneDo AB's total liability for damages towards the Customer, regardless of the grounds, is limited to compensation for direct loss in an amount corresponding to the fees paid by the Customer for the service to which the loss relates during the twelve (12) months immediately preceding the event that caused the loss.

6. UCS OneDo AB shall in no event be liable for indirect or consequential loss, such as loss of profit, loss of savings, loss of production, lost revenue, loss or corruption of data, loss of goodwill or third-party claims.

7. UCS OneDo AB is not liable for errors, interruptions or deficiencies in products and services provided by third parties, such as software and hosting from Odoo S.A., third-party apps, integrations or the Customer's own systems and suppliers. However, UCS OneDo AB will assist the Customer in reporting and following up such errors with the supplier concerned.

8. The limitations in clauses 5–7 do not apply in the event of intent or gross negligence, or in the event of a breach of the agreement's provisions on confidentiality.

Complaints and limitation period

9. The Customer is obliged to submit its complaints in writing within fifteen (15) days from the time a breach of contract on the part of UCS OneDo AB, including a breach due to delays or errors, was discovered or should reasonably have been discovered. If a complaint is not made in due time and in the manner prescribed in the agreement, the Customer loses the right to invoke remedies on account of the breach of contract. The Customer's right to make claims for compensation under the agreement expires in all circumstances six (6) months after the individual task has been completed by UCS OneDo AB.

Security and confidentiality

10. UCS OneDo AB shall take the necessary measures to comply with security regulations notified in writing by the Customer. If security regulations provided by the Customer after the conclusion of the agreement entail increased costs, UCS OneDo AB shall be compensated for this or be entitled to adjusted terms. Neither party may, without the other party's approval, disclose documents to third parties, or otherwise reproduce information, concerning the other party's internal affairs to any extent other than is required for the performance of the agreement. The duty of confidentiality does not apply to information that a party can show has become known to it otherwise than through the assignment, or that is publicly known. The duty of confidentiality also applies after the agreement has otherwise ceased to apply, regardless of the reason.

Intellectual property rights

11. All intellectual property rights to software, modules, apps, configurations, documentation and other material that UCS OneDo AB develops or produces within the framework of the agreement belong to UCS OneDo AB. The Customer receives a non-exclusive, non-transferable right to use the result in its own business, provided that the Customer has fulfilled its payment obligations under the agreement. The Customer may not, without UCS OneDo AB's written consent, copy, further develop, sell, license or otherwise make the result available to third parties. The Customer's own data and the content the Customer enters into the system belong to the Customer. Rights to Odoo's standard software and to third-party apps are governed by the license terms of the respective supplier.

Prohibition on hiring the consultant

12. The Customer may not, directly or indirectly, employ or otherwise engage staff from UCS OneDo AB during the term of the agreement and for six (6) months thereafter. This applies both to current staff and to staff who have left within the last six months. An exception applies if the Customer is required to offer the consultant employment under the Swedish Temporary Agency Work Act (2012:854) (lagen om uthyrning av arbetstagare).

If the Customer breaches this, the Customer shall pay a contractual penalty of SEK 200,000 to UCS OneDo AB. Alternatively, UCS OneDo AB may claim damages for the actual loss. This does not affect other rights UCS OneDo AB has in the event of a breach of contract.

Force majeure

13. A party is released from liability for failure to fulfill a particular obligation under the agreement if the failure is due to a circumstance beyond the party's control which the party could not reasonably have foreseen or avoided, and which prevents or substantially impedes performance. Such circumstances shall include, among other things, government action or new legislation, labor disputes, war or acts of terrorism, natural disasters, fire, widespread spread of disease, interruptions in public communications, electricity or internet supply, extensive cyberattacks, and errors or interruptions at a subcontractor caused by any of these circumstances. A party shall notify the other party without delay of the occurrence of such a circumstance and of when it has ceased.

14. If performance of the agreement has been substantially prevented for more than three (3) months due to a circumstance under clause 13, either party is entitled to terminate the agreement in writing without any obligation to pay compensation to the other party. Release under clause 13 does not affect the Customer's obligation to pay for services already delivered.

Amendments to the terms

15. Except as expressly stated in the agreement, amendments or additions to the agreement must, in order to be binding, be in writing and duly signed by both parties.

Disputes

16. Any dispute shall primarily be resolved by mutual agreement between the parties. If the parties cannot agree, the dispute shall be settled by a general court, with Linköping District Court (Linköpings tingsrätt) as the court of first instance.

Payment and prices

17. The monthly fee is paid monthly and invoiced in advance. Other costs are paid on a time-and-materials basis and invoiced on the last day of the month. A statutory reminder fee is charged for payment reminders. In the event of late payment, default interest is charged in accordance with the Swedish Interest Act (1975:635) (räntelagen) at the applicable reference rate plus 8 percentage points from the due date until payment is made in full. We apply a minimum charge of 15 minutes for our services. All prices are stated excluding VAT. Payment terms are 20 days from the invoice date.

Price adjustment

18. UCS OneDo AB is entitled to adjust its prices once per calendar year. Such an adjustment shall be notified to the Customer in writing at least one (1) month before it takes effect and shall be based on the change in Statistics Sweden's labor cost index for salaried employees, private sector (AKI), or an equivalent index if this ceases to be published.

19. Price adjustments beyond those set out in clause 18 shall be notified to the Customer in writing at least three (3) months before they take effect. If such an adjustment entails an increase of more than ten (10) percent, the Customer is entitled to terminate the service concerned in writing with effect from the date on which the increase takes effect. However, price changes resulting from changed prices from a third-party supplier, for example license and hosting fees from Odoo S.A., may be implemented by a corresponding amount from the date on which they take effect at the supplier.

Marketing and newsletters

20. By accepting these general terms and conditions, the Customer consents to receiving information and newsletters from UCS OneDo AB. The mailings may contain news, offers, system updates and other relevant information about UCS OneDo AB's services. The Customer may unsubscribe at any time via a link in the mailing or by contacting info@ucsonedo.se.

Customer references

21. We are happy to talk about the collaborations we are proud of. UCS OneDo AB may therefore name the Customer as a reference customer and use the Customer's company name and logo in marketing material, for example on its website, in presentations and in printed material. Such use always takes place with respect for the Customer's brand and without disclosing confidential information. For more extensive use, such as customer stories, interviews, filmed material or press releases, we obtain the Customer's approval in advance. The Customer may at any time give notice that its company name or logo may no longer be used, whereupon UCS OneDo AB will cease such use in newly produced material.

Use of AI tools

22. UCS OneDo AB uses AI-based tools as support when processing business data in connection with implementation and migration, for example when structuring, converting, cleansing and validating customer, supplier and product records and CRM data from the Customer's previous system. The tools are used as working aids under UCS OneDo AB's control and do not replace the consultant's review. The result is always checked by a consultant before it is entered into the Customer's production environment.

23. Such business data may contain contact details of natural persons, for example the name, job title, email address and telephone number of contact persons at the Customer's customers and suppliers. The processing is limited to what is necessary to carry out the assignment. UCS OneDo AB only uses business subscriptions where the provider is contractually prevented from using data entered for training or developing its models.

24. Without the Customer's prior written approval, the following are not processed in AI tools: employee data and payroll data, sensitive personal data under Article 9 GDPR such as data concerning health or trade union membership, personal identity numbers, data relating to criminal offenses, and account details and other payment details relating to natural persons.

Term and termination

25. If neither party has terminated the agreement, the agreement continues on an ongoing basis with a notice period of at least two (2) months. Subscriptions with a fixed term cannot be terminated later than two (2) months before the last date of the subscription.

UCS OneDo AB · Teknikringen 4 A, 583 30 Linköping · 070-739 65 94 · info@ucsonedo.se · www.ucsonedo.se