Data Processing Agreement

Version 6 November 2026. This Data Processing Agreement ("DPA") is part of the agreement between QLFR AI AB, org. no. 559389-2978, Drottninggatan 29, 103 59 Stockholm, Sweden ("Qualifier") and the customer ("Customer") for the Qualifier service (the "Service"). The DPA is part of Qualifier's general terms (qualifier.ai/terms). It applies to new customers from the day the Customer accepts the general terms or signs an offer that refers to them, and to existing customers from the version date. The Swedish version (qualifier.ai/sv/personuppgiftsbitradesavtal) has the same content. If the versions differ, the Swedish version prevails.

1. Definitions

Terms such as personal data, processing, controller, processor, data subject, personal data breach and supervisory authority have the meaning given in Regulation (EU) 2016/679 ("GDPR"). Standard contractual clauses means the clauses adopted by the European Commission in Implementing Decision (EU) 2021/914. The Customer's contact address means the email address the Customer has given Qualifier for notices or, if none, the email address of the Customer's account owner in the Service or, if none, the email addresses of the Customer's users.

2. Roles

2.1 The Customer is controller, Qualifier is processor. The Customer decides who is contacted, with what message and why. For personal data that Qualifier processes on the Customer's behalf to run the Customer's campaigns ("Customer Data"), the Customer is controller and Qualifier is processor. Customer Data is described in Annex 1.

2.2 The Customer is the sender. Emails are sent from the Customer's own mail account and in the Customer's name, or from mail accounts that Qualifier sets up for the Customer when the parties have agreed so. The Customer is the sender of every email. The Customer is responsible for having a legal basis for contacting each prospect, for the information it owes prospects under Articles 13 and 14 GDPR, and for following the marketing rules that apply to the recipients it chooses. The Customer is also responsible for having the right to connect each mail account and CRM to the Service, and for informing the people whose mail accounts are connected.

2.3 Qualifier is a separate controller for its own database. Qualifier finds prospects in professional networks, on the web, in open company data and from data vendors, and keeps its own database of business contact details. For that sourcing and database, and for its own customer administration, billing, security and product development, Qualifier is a controller in its own right, as described in Qualifier's privacy policy (qualifier.ai/privacy). This DPA does not apply to that processing. The parties are not joint controllers.

2.4 Where the line runs. A prospect's business contact details are in Qualifier's database before and after the Customer's campaign, and Qualifier is controller for them there. Customer Data is what arises from the Customer's use of the Service: the choice of a prospect for the Customer's campaign, the emails and replies, statuses, notes and tasks, what the Customer uploads or types in, and what is synchronised with the Customer's CRM. Contacts the Customer uploads or synchronises are not offered to other customers.

2.5 Signals Qualifier keeps. So that no customer writes to an address that does not work or to a person who has declined, the Customer instructs Qualifier to record the following from the Customer's campaigns in Qualifier's database, where Qualifier is controller for it: that an address bounced, that a person asked not to be contacted, that an automatic reply shows the person has left the employer, and whether a guessed address turned out to be right. Qualifier may also make statistics from Customer Data in which no person can be identified, keep them after the agreement ends, and use them to run, improve and describe the Service. Statistics and examples that Qualifier shows to others do not identify the Customer. Qualifier does not sell Customer Data.

3. Instructions

3.1 Qualifier processes Customer Data only on the Customer's documented instructions. The agreement, this DPA and the Customer's settings and actions in the Service are the Customer's complete instructions. The instructions include the transfers stated in Annex 3. Qualifier does not use Customer Data for its own purposes other than as stated in section 2.5.

3.2 Qualifier informs the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection law. Qualifier may suspend the processing concerned until the Customer has confirmed or changed the instruction.

3.3 Where Union or Member State law requires Qualifier to process Customer Data otherwise, Qualifier informs the Customer before processing, unless that law prohibits it.

4. Confidentiality

Qualifier ensures that everyone authorised to process Customer Data is bound by confidentiality, by contract or by law, and has access only to what their work needs.

5. Security

Qualifier takes the technical and organisational measures in Annex 2 and keeps a level of security appropriate to the risk, as required by Article 32 GDPR. Qualifier may change the measures as long as the level of protection is not reduced.

6. Subprocessors

6.1 The Customer gives Qualifier general authorisation to engage subprocessors. The subprocessors in use on the version date are listed in Annex 3.

6.2 Qualifier informs the Customer of a new or replaced subprocessor at least 30 days before it starts processing Customer Data, by email to the Customer's contact address or by a notice in the Service, and by updating Annex 3 at qualifier.ai/dpa. Qualifier may give shorter notice when a subprocessor must be replaced at once to keep the Service secure or running. The Customer may object in writing within the notice period on reasonable, documented data protection grounds. Qualifier may then choose not to use the subprocessor for the Customer's data or propose another solution. If Qualifier does neither within 30 days of the objection, the Customer may terminate the part of the Service that cannot be provided without the subprocessor and is refunded fees paid in advance for that part for the period after termination. This is the Customer's only remedy for an objection.

6.3 Qualifier binds each subprocessor by a written contract with data protection obligations equivalent to those in this DPA, and remains liable to the Customer for its subprocessors. For a subprocessor that Annex 3 marks as not yet having a signed data processing agreement, sections 6.3 and 7.2 apply from the day it is signed.

7. Transfers outside the EU/EEA

7.1 The Service's servers, database and backups are in the EU. Some subprocessors, among them the providers of AI language models, process data outside the EU/EEA.

7.2 Qualifier transfers Customer Data outside the EU/EEA only in compliance with Chapter V GDPR: to a country with an adequacy decision of the European Commission, to a recipient in the United States certified under the EU-US Data Privacy Framework, or under standard contractual clauses. Annex 3 states where each subprocessor processes data and the basis for the transfer.

8. Assistance

8.1 Data subjects. If a data subject contacts Qualifier about Customer Data, Qualifier forwards the request to the Customer without undue delay and does not answer it itself unless the Customer has asked it to. Taking into account the nature of the processing, Qualifier helps the Customer respond to requests under Chapter III GDPR with the Service's features and, where they are not enough, with reasonable assistance.

8.2 Unsubscribes. When a recipient asks not to be contacted, Qualifier stops further emails to that recipient through the Service. The Customer accepts that Qualifier, as a separate controller, keeps a suppression record so that the request is respected.

8.3 Impact assessments and supervisory authority. Qualifier gives the Customer the information reasonably needed for the Customer's obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultations, as far as they concern the Service.

8.4 Cost. Help that the Service's features and Qualifier's standard documentation do not cover, under sections 8.1, 8.3 and 10, is charged at Qualifier's current hourly rate after Qualifier has told the Customer the expected cost. Qualifier does not charge for help made necessary by its own breach of this DPA.

9. Personal data breach

Qualifier notifies the Customer at its contact address without undue delay, and no later than 72 hours, after becoming aware of a personal data breach affecting Customer Data. The notice describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences and the measures taken or proposed. Qualifier adds information as it becomes available. A notice is not an admission of fault or liability.

10. Audits

10.1 Qualifier makes available to the Customer the information needed to demonstrate compliance with Article 28 GDPR.

10.2 The Customer first uses the information under 10.1 and Qualifier's written answers. Where that is not enough to show compliance, the Customer may audit Qualifier's processing of Customer Data, itself or through an independent auditor who is bound by confidentiality and is not a competitor of Qualifier, at most once a year and with at least 30 days' written notice, unless a supervisory authority requires otherwise or a personal data breach has occurred. Audits take place during business hours, must not disrupt the Service or disclose other customers' data, and are at the Customer's cost. The Customer shares the audit report with Qualifier and keeps it confidential.

11. Term, return and deletion

11.1 This DPA applies for as long as Qualifier processes Customer Data. If the Customer has no running paid period, the agreement ends when the Customer asks Qualifier to close the account, or when no user of the Customer has signed in for 24 months.

11.2 When the agreement ends, the Customer chooses whether Customer Data is to be deleted or first handed over in a common file format, by writing to support@qualifier.ai. Qualifier carries out the choice within 30 days of the request. If the Customer has made no choice, Qualifier deletes Customer Data no later than 90 days after the agreement ended. Copies in backups are deleted automatically when the backup expires, no later than 22 days after the backup was taken. If a backup is restored, Qualifier deletes the data again before the Service is used. Access tokens and credentials for the accounts the Customer has connected are deleted when the agreement ends. Traces in technical logs are deleted by the automatic retention in Annex 2. Deletion does not apply where Union or Member State law requires the data to be kept.

11.3 Section 11.2 does not apply to data Qualifier holds as a separate controller under section 2.3: business contact details in Qualifier's own database, suppression records, the signals and statistics in section 2.5, the Customer's contact persons, and records Qualifier must keep under the Swedish Bookkeeping Act.

12. Liability

12.1 Each party bears the administrative fines imposed on it.

12.2 A party that has paid compensation to a data subject for damage the other party is responsible for may recover that share from the other party, as in Article 82(5) GDPR.

12.3 The Customer holds Qualifier harmless from claims by data subjects, recipients and authorities that arise from the Customer's instructions, its choice of recipients, the content of its emails, or a missing legal basis or missing information to data subjects.

12.4 The limitation of liability in the general terms applies to all of Qualifier's liability under this DPA, including under section 12.2 and under any indemnity in the general terms. It does not apply to intent or gross negligence.

12.5 Nothing in this DPA limits a data subject's rights or a party's liability towards a supervisory authority under the GDPR.

13. Changes, precedence, law and disputes

13.1 Qualifier may change this DPA in the same way as the general terms. A change may not reduce the protection of Customer Data.

13.2 If this DPA and the rest of the agreement conflict on the processing of personal data, this DPA prevails. Section 6.2 applies despite what the general terms say about refunds. Governing law and dispute resolution follow the general terms.

Annex 1. Description of the processing

Annex 2. Technical and organisational measures

Only measures in place on the version date are listed.

• Encrypted connections (TLS) to the Service and between application and database.
• The database accepts connections only from the application server. Reads for troubleshooting use a database role that can only read.
• Access tokens for connected mail accounts are encrypted with a key held in Google Cloud Key Management Service in region europe-west4 (Netherlands).
• The database is backed up every night. The copy is encrypted before it leaves the database server, and the key needed to read it is not kept on the servers. Restores are tested every quarter.
• Signing in to the Service as a customer's user requires a Qualifier admin account, and each start and end is logged. The production secrets can be decrypted only with a key held by one named person at Qualifier and with the build system's key.
• Each customer's data is logically separated in the Service. Users reach only their own company's data.
• Sign-in is by a one-time link to the user's email address or with the user's Google or Microsoft account. Session cookies are encrypted.
• Export files with Customer Data are stored privately and are given only to signed-in users with access.
• Retention the Service applies automatically: visitors' raw IP addresses 30 days, event logs about prospects 90 days, error reports 14 days, technical performance measurements 30 to 60 days, history of changes to records 12 months, users' sign-in IP history 12 months and backups 22 days. Application logs on the servers are overwritten continuously once they reach a fixed size.
• Sending pauses automatically when the bounce rate rises, and every address is verified before sending.
• An unsubscribe request stops further emails to the recipient.