Data Processing Agreement

1. Parties

This Data Processing Agreement ('DPA') forms part of the Saibon Group Terms of Service ('Main Agreement') between the Customer identified during account registration ('Data Controller' or 'Customer') and Saibon Group AB ('Data Processor' or 'Saibon'). This DPA takes precedence over the Main Agreement in all matters relating to personal data protection.

2. Definitions

The following terms have the meanings given below. Terms not defined here have the meaning given in GDPR Article 4.

3. Subject Matter and Duration

3.1 Subject Matter

Saibon will Process Personal Data on behalf of Customer solely to provide the Service and as otherwise described in this DPA. The details of the Processing are set out in Schedule 1.

3.2 Duration

This DPA is effective from the date Customer creates an account on the Service and remains in force until Saibon ceases to Process Personal Data on Customer's behalf, or until the Main Agreement terminates, whichever is later. Obligations that by their nature survive termination (deletion, confidentiality, liability) remain in effect after this DPA ends.

4. Nature, Purpose, and Data Processing Roles

The Processing covers the provision, operation, and hosting of the Saibon platform, including AI-driven consultant matching and marketplace visibility. Full details are set out in Schedule 1.

4.1 Role Mapping

Saibon acts in different capacities depending on the feature used:

Saibon will not use Personal Data Processed as Data Processor for its own purposes, except for anonymisation as described in Section 5.5.

5. AI-Driven Processing and Algorithmic Transparency

5.1 Customer Instruction to Use AI

By using the matching features of the Service, Customer instructs Saibon to use the Personal Data listed in Schedule 1 as input to the AI System to generate matching recommendations.

5.2 Objectivity and Non-Discrimination

Saibon warrants that the AI System's matching logic is designed to be objective and is based on professional competencies, experience, availability, and location. Saibon will regularly test the AI System for unintended bias in accordance with Article 10 of the EU AI Act.

5.3 Transparency and Human Oversight

Saibon will provide Customer, on written request, with high-level functional information about the AI System's matching logic. This does not extend to proprietary source code, trade secrets, or algorithmic weights. AI-generated matching suggestions and 'Saibon Ratings' are decision-support tools only. The final decision to engage a consultant rests solely with Customer.

5.4 Rate Data Minimisation

The Service is designed for compensation data to be entered as rate ranges or categorical bands — exact figures are not required or used by the platform. To maintain good data hygiene and proportionality, Customer should enter compensation expectations as Rate Data only (e.g. 'Level 1: 5000–5500 EUR/month'). Customer is responsible for ensuring its users follow this data minimisation practice.

5.5 Anonymisation for Platform Improvement

Saibon may anonymise aggregated data (Rate Data and skills information) to improve, train, and develop its AI models. Once fully anonymised — meaning that no individual can be re-identified even with reasonable effort — the data ceases to be Personal Data under Applicable Law and Saibon acts as an independent Data Controller for that data. Saibon will document its anonymisation methodology and make it available to Customer on request. Customer may opt out of anonymisation by written notice to Saibon at dpa@saibongroup.com. Where Customer opts out, Saibon will exclude Customer’s data from anonymisation pipelines within 30 days of receiving the notice.

6. Processing Instructions and Purpose Limitation

6.1 Processing on Instruction Only

Saibon will Process Personal Data only on documented instructions from Customer — including transfers to third countries — unless Processing is required by EU or national law to which Saibon is subject. In that case, Saibon will notify Customer of the legal requirement before Processing, unless prohibited from doing so on grounds of public interest.

6.2 Non-Compliant Instructions

If Saibon reasonably believes that a Processing instruction from Customer violates Applicable Law, Saibon will promptly notify Customer in writing, specifying the legal concern. Saibon may suspend compliance with the disputed instruction until Customer either (i) provides a written legal assessment confirming that the instruction is lawful, or (ii) modifies the instruction to address Saibon's concern. Saibon will not be liable for any delays or interruptions to the Service resulting from a suspension made in good faith under this clause. For the avoidance of doubt, this clause covers situations such as an instruction to process a category of data for which Customer has no legal basis, or an instruction to transfer data to a third country without an appropriate transfer mechanism.

6.3 Customer's Responsibility for Legal Basis

Customer warrants that it has a valid legal basis under GDPR Article 6 (and Article 9 where applicable) for all Processing it instructs Saibon to carry out. Customer further warrants that it has provided its consultants and employees with the information required under GDPR Articles 13–14, including information that Saibon's platform and AI System are used to manage and match consultant profiles.

7. Confidentiality and Access Control

7.1 Saibon Personnel

Saibon will ensure that its personnel who access Personal Data in the course of providing the Service (for example, for technical support or platform maintenance) are subject to binding confidentiality obligations and access Personal Data only to the extent strictly necessary for those purposes.

7.2 Customer Manages Its Own Access Permissions

Customer is solely responsible for configuring user roles, access permissions, and data visibility settings within its own account. Saibon provides role-based access control (RBAC) features as a platform capability — it is Customer, acting as Data Controller, who decides which Authorised Users may access which data. Saibon does not determine, supervise, or interfere with Customer's internal access decisions.

7.3 Logical Data Isolation

Saibon will implement and maintain logical data isolation to ensure that Customer’s Personal Data cannot be accessed by other Saibon customers.

7.4 Data Protection Officer

Saibon does not currently meet the threshold for mandatory DPO appointment under GDPR Article 37. Saibon’s data protection contact (Schedule 4) serves as the primary point of contact for data protection matters. Saibon will appoint a DPO if and when the statutory threshold is met and will update this DPA accordingly.

8. Technical and Organisational Security Measures (Art. 32 GDPR)

Saibon will implement and maintain the technical and organisational measures described in Schedule 3. These include at minimum:

• a) Encryption: Data at rest: AES-256. Data in transit: TLS 1.2 or higher.
• b) Access control: RBAC with least-privilege principles. All administrative access to the production environment is logged; logs are retained for at least 90 days.
• c) Network security: Logically isolated Virtual Private Cloud (VPC); firewalls and Security Groups; automated vulnerability scanning; Intrusion Detection System (IDS).
• d) Backups: Encrypted daily backups stored in a geographically separate EU region; 30-day retention; regular restoration testing.
• e) Penetration testing: At least one external penetration test per calendar year; critical findings remediated within 30 days.
• f) Data localisation: Customer Data at rest will be stored exclusively within the EU/EEA unless otherwise agreed in writing.

8.1 Security Incident Notification

Saibon will notify Customer of a Security Incident without undue delay and, where feasible, within 24 hours of becoming aware of it. The notification will include the information required by GDPR Article 33.3 to the extent available at the time. Supplementary information will be provided as it becomes available.

9. Marketplace Pseudonymisation

9.1 Platform Feature

When Customer publishes a consultant profile to the external marketplace, the Saibon platform automatically pseudonymises directly identifying information — such as name, photo, and contact details — so that they are not visible to third-party buyers. Identifying information is revealed only when Customer initiates a formal contact or engagement request through the platform. This pseudonymisation is a built-in platform feature; no additional configuration by Customer is required.

9.2 Customer's Publication Decision

The decision to publish a consultant's profile to the marketplace rests entirely with Customer. By publishing a profile, Customer confirms that it has obtained the necessary consent from the consultant or otherwise has a valid legal basis to make the profile visible (in pseudonymised form) to external buyers.

9.3 Security Incidents Involving Pseudonymised Data

If a Security Incident involves data that was pseudonymised in accordance with this Section, the Parties will jointly assess whether the incident creates a 'high risk' to Data Subjects (GDPR Art. 34) and whether individual notification is required. Effective pseudonymisation may reduce the assessed risk and proportionally limit Saibon's liability in relation to the incident.

10. Sub-Processors

10.1 General Authorisation

Customer grants Saibon general written authorisation to engage Sub-Processors. Current approved Sub-Processors are listed in Schedule 2. Saibon will notify Customer of any intended changes (additions or replacements) at least 30 days in advance. Customer may object to a new Sub-Processor within 20 days of receiving the notification.

10.2 Objection Process

If Customer raises a documented and reasonable objection to a new Sub-Processor, the Parties will attempt to resolve the issue in good faith. If no resolution is reached within 60 days, Customer may terminate the affected part of the Service. Termination of the Main Agreement is permitted only where the Sub-Processor change results in a material and documented reduction in the level of data protection and no equivalent alternative is available.

10.3 Sub-Processor Obligations and Flow-Down

Saibon will impose data protection obligations on each Sub-Processor equivalent to those in this DPA. If a Sub-Processor fails to fulfil those obligations, Saibon remains fully liable to Customer for the Sub-Processor's acts and omissions.

11. Assistance to Customer

11.1 Self-Service Data Management

The Service provides built-in tools that allow Customer to export, update, restrict, and delete Personal Data directly through the platform interface. Customer can use these tools to respond to most Data Subject requests (access, rectification, erasure, restriction, portability) without Saibon's involvement.

11.2 Technical Assistance

Where a Data Subject request cannot be fulfilled through the self-service interface, Saibon will provide reasonable technical assistance within 5 business days of a written request from Customer. Assistance beyond what is required by law will be charged at Saibon's current support rates.

11.3 DPIAs and Prior Consultation

Saibon will assist Customer with data protection impact assessments (DPIAs) under GDPR Article 35 and prior consultation with IMY under Article 36, taking into account the nature of the Processing and the information available to Saibon. Such assistance will be charged at Saibon's current rates.

12. Deletion and Return of Personal Data

12.1 On termination of the Main Agreement, Saibon will, at Customer's choice, either delete or return all Personal Data and delete existing copies, unless EU or national law requires continued storage.

12.2 Deletion or return will be completed within 30 days of termination. If Customer does not request return or deletion within 60 days, Saibon may delete the data. Saibon will confirm deletion in writing.

12.3 Saibon may retain limited Personal Data beyond this period where required by law (e.g. invoicing records under Swedish bookkeeping rules — 7 years).

12.4 Data Export Format

The Service provides Customer with a self-service data export function available at any time during the subscription. On request, Saibon will make Customer's Personal Data available in CSV or JSON format within 60 days of termination. Customer is encouraged to export its data before termination to ensure continuity.

12.5 Automatic Deletion at End of Retention Period

Saibon will implement technical controls to ensure that Personal Data is automatically deleted or irreversibly anonymised once the applicable retention period set out in Schedule 1 has expired, unless an active legal hold or statutory obligation requires continued storage. Saibon will notify Customer if a legal hold is applied that prevents scheduled deletion. Within 90 days of the Main Agreement's termination, Saibon will confirm in writing that all Personal Data (excluding legally retained records) has been deleted or anonymised.

13. Audit Rights

13.1 Saibon will make available to Customer all information reasonably necessary to demonstrate compliance with GDPR Article 28 and this DPA.

13.2 Security Certifications

Saibon will maintain, or actively work towards, a current SOC 2 Type II report or equivalent third-party security certification (e.g. ISO 27001). A current certification or audit report will be accepted by Customer as sufficient evidence of compliance with the security measures in Schedule 3, provided the report covers the relevant controls. Saibon will notify Customer within 30 days if a certification lapses without an equivalent replacement being in place, and will outline its remediation plan.

13.3 On-site audits are conditional on Saibon being unable to provide a satisfactory third-party audit report, or on there being reasonable documented grounds to suspect a material breach of this DPA. Audits may be conducted once per calendar year (more frequently following a Security Incident), with at least 30 days' written notice. Customer bears all audit costs, including Saibon's time at its current rates. Audit scope is limited to Saibon's own systems and documentation relevant to this DPA; it does not extend to Saibon’s proprietary source code, other customers’ data, or physical premises of Sub-Processors. Saibon will make a summary of penetration test findings (excluding proprietary remediation details) available to Customer upon written request.

14. Records of Processing Activities

14.1 Saibon's ROPA Obligation (GDPR Art. 30.2).

Saibon maintains a written record of all categories of Processing activities carried out on behalf of Customer, as required by GDPR Article 30.2. This record includes: the name and contact details of Saibon and, where applicable, its Data Protection Officer; the categories of Processing carried out on behalf of each controller; details of international transfers where applicable; and a general description of the technical and organisational security measures in place.

14.2 Access on Request.

Saibon will make its Article 30.2 records available to IMY or any other supervisory authority on request. Customer may also request confirmation that records relevant to Customer's Processing are maintained.

14.3 Customer's Own ROPA.

Customer, as Data Controller, is responsible for maintaining its own records of Processing activities under GDPR Article 30.1. Saibon will provide reasonable assistance to Customer in completing its ROPA entries for Processing carried out under this DPA, including by supplying the information set out in Schedule 1.

15. International Data Transfers

15.1 Saibon processes Personal Data primarily within the EU/EEA. Where Personal Data is transferred to or accessed from a country outside the EU/EEA, Saibon will ensure that the transfer is carried out in accordance with Applicable Law.

15.2 For Google Cloud EMEA Limited: Saibon relies on the EU–US Data Privacy Framework (DPF) and/or the European Commission's Standard Contractual Clauses (SCCs) where applicable, to ensure an equivalent level of protection to that provided within the EU/EEA.

15.3 Saibon will promptly inform Customer of any change to the transfer mechanism used that could affect the level of protection afforded to Customer's Personal Data.

16. Liability and Price Base Amount Caps

16.1 Reference: Prisbasbelopp (PBB)

Liability caps in this DPA are expressed in Swedish price base amounts (PBB) under the Social Insurance Code (2010:110). Caps are automatically indexed to annual PBB changes.

16.2 Differentiated Caps by Incident Type

Caps apply per calendar year and per incident, not cumulatively. Caps do not apply in cases of gross negligence, wilful misconduct, personal injury, or death.

16.3 GDPR Administrative Fines

Supervisory authority fines (IMY or other) cannot be contractually allocated between the Parties. Each Party bears full responsibility for fines arising from its own violation of the GDPR. Where a fine is imposed jointly, the Parties will apportion liability in proportion to their respective contribution to the infringement, determined by an independent lawyer appointed jointly by the Parties.

16.4 Indirect Damages

Neither Party will be liable for indirect or consequential damages, loss of profit, loss of goodwill, or business interruption, unless such damages arise from gross negligence or wilful misconduct.

17. Security Incident Disputes and Cost Allocation

17.1 Notification Chain and Deadlines

17.2 Cost Allocation

17.3 Dispute Resolution for Incident Liability

If the Parties disagree on the allocation of liability for a Security Incident: (1) the Parties will appoint a jointly agreed independent forensic investigator within 5 business days; (2) the investigator will deliver a written report within 30 days; (3) the Parties will base liability allocation on the investigator's findings; and (4) any remaining dispute will be referred to arbitration under Section 22.

18. Liability for Negligent or Incorrect Use

18.1 Definition of Negligent Use

'Negligent Use' means a Security Incident caused directly or materially by any of the following acts or omissions by Customer or its Authorised Users:

• a) Configuration errors: Customer configures the Service in a manner contrary to Saibon's documented guidelines, causing a data exposure (e.g. incorrectly configured sharing permissions or exposed API keys).
• b) Failure to revoke access: Customer fails to revoke access rights for departing employees or third parties despite notification or standard offboarding reminders from Saibon.
• c) Weak authentication: Customer disables or bypasses Saibon's MFA requirements or minimum password standards without an agreed exemption.
• d) Phishing or social engineering: Customer's personnel disclose credentials to unauthorised parties, where this is not attributable to a deficiency in Saibon's training materials or system design.
• e) Unauthorised integrations: Customer connects the Service to third-party applications not approved by Saibon, and those applications cause a data exposure.

18.2 Liability Shift

To the extent a Security Incident is directly caused by Negligent Use, Saibon's liability will be reduced proportionally to the contribution of the Negligent Use to the incident. Customer will bear the portion of liability attributable to Negligent Use. Regardless of any liability shift, Saibon will always fulfil its notification obligations (Section 16.1) and cooperate with the technical investigation.

18.3 Burden of Proof

Saibon bears the burden of demonstrating that Negligent Use occurred and will provide log data, alerts, and documentation in support of its position. Saibon may not unilaterally determine that Negligent Use has occurred without independent verification if Customer disputes it.

19. High-Risk AI System (EU AI Act, Regulation 2024/1689)

AI Risk Classification: Saibon's matching system is classified as a high-risk AI system under Annex III to the EU AI Act (Regulation 2024/1689), category 4: 'AI systems used in employment and workforce management'. Full high-risk requirements apply from 2 August 2026.

19.1 Saibon's Obligations as Provider of High-Risk AI

• a) Risk management (Art. 9): Implement and maintain a risk management system to identify and mitigate risks associated with the AI System.
• b) Data quality (Art. 10): Ensure training and validation data meets accuracy, representativeness, and bias-minimisation requirements.
• c) Technical documentation (Art. 11, Annex IV): Maintain up-to-date technical documentation on the AI System's architecture, training, and performance.
• d) Automatic logging (Art. 12): Maintain automatic logging of the AI System's operations and outputs.
• e) Transparency (Art. 13): Provide Customer and its users with clear information on the AI System's capabilities, limitations, and error margins.
• f) Human oversight (Art. 14): Enable Customer's users to review, question, and override AI-generated matching recommendations.
• g) Accuracy and robustness (Art. 15): Ensure the AI System is sufficiently robust against errors, failures, and cyber-attacks.
• h) Conformity assessment (Art. 43, 49): Complete a conformity assessment and, where required, register the AI System in the EU database for high-risk AI systems.

19.2 Customer's Obligations as Deployer of High-Risk AI

• a) Fundamental rights impact assessment (Art. 27): Carry out a fundamental rights impact assessment where applicable.
• b) Human oversight: Implement and maintain the human oversight measures specified in Saibon's product documentation.
• c) Incident reporting: Report serious incidents to Saibon without undue delay.
• d) Transparency to consultants: Inform consultants and affected individuals that an AI matching system is used and describe the parameters it considers.

20. Marketplace: Customer's Responsibilities on Publication

20.1 By publishing a consultant's profile to the Saibon marketplace, Customer confirms that: (i) the consultant has been informed that their profile will be shown in pseudonymised form to third-party buyers on the marketplace; (ii) the profile does not contain special-category data as defined in GDPR Article 9; and (iii) AI-assisted matching will be used to suggest the consultant for assignments.

20.2 Saibon will provide a technical mechanism allowing Customer to log publication confirmations with a timestamp. This log constitutes Customer's record of compliance with its information obligations under GDPR Articles 13–14.

20.3 Saibon is not liable for data protection violations arising from Customer publishing consultant profiles without having fulfilled the information obligations in Section 20.1.

21. Term and Termination

21.1 This DPA is co-extensive with the Main Agreement and terminates automatically when Saibon ceases to Process Personal Data on Customer's behalf.

21.2 Obligations relating to confidentiality, deletion, and liability survive termination of this DPA.

21.3 On termination, Saibon will make Customer's Personal Data available for self-service export for 60 days, after which Saibon may delete the data in accordance with Section 12.

21.4 Saibon may update this DPA from time to time. Material changes will be notified to Customer via email at least 30 days before taking effect. The current version is always available at www.saibongroup.com/legal/dpa. If Customer does not object in writing within 30 days of notification, the updated DPA will apply from the effective date stated in the notification.

22. Governing Law and Dispute Resolution

22.1 This DPA is governed by the laws of Sweden, without regard to its conflict of laws rules.

22.2 Before initiating arbitration, the Parties will attempt to resolve disputes through good-faith negotiation for a period of 30 days. If unresolved, the dispute will be finally resolved by arbitration administered by the Arbitration Institute of the Stockholm Chamber of Commerce (SCC), under SCC rules current at the time of the dispute. The seat of arbitration is Stockholm and the language of proceedings is English unless otherwise agreed.

22.3 The arbitral tribunal will consist of a sole arbitrator if the amount in dispute is below 10 PBB, otherwise three arbitrators.

Schedule 1 — Details of Processing

1. Subject Matter

The Processing covers the provision of Saibon's SaaS platform 'Consultant OS', including consultant portfolio management, AI-driven matching, and marketplace visibility, as described in the Main Agreement.

2. Processing Activities and Retention

3. Special-Category Data

Customer must not upload or Process special-category data as defined in GDPR Article 9 (including health data, trade union membership, ethnicity, political opinions, religious beliefs, or sexual orientation) via the Service, unless Saibon has expressly agreed to this in writing for a specific use case.

4. Rate Data Minimisation

The Service is designed to receive compensation data as rate ranges or categorical bands, not as exact figures. Customer is responsible for instructing its users to enter Rate Data only in this format, consistent with the data minimisation principle under GDPR Article 5.1(c).

Schedule 2 — Approved Sub-Processors

As at 1 March 2026, Saibon engages the following Sub-Processors:

An up-to-date list is available at www.saibongroup.com/legal/dpa or via a dedicated link in the customer portal. Saibon will notify Customer of any changes at least 30 days in advance.

Schedule 3 — Technical and Organisational Security Measures

Technical Measures

Organisational Measures

Schedule 4 — Contact Details

Supervisory Authority: Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm. Tel: +46 8-657 61 00. Email: imy@imy.se. Web: imy.se