Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Linkbase AB ("Linkbase", "we", "us") and the Customer ("you", "your") who uses the Linkbase application and services (the "Service").

This DPA governs the processing of Personal Data contained in the business records that Linkbase processes on behalf of the Customer in connection with the Service — for example the Customer's end customers' names, addresses, and order and transaction details. For that data the Customer is the Data Controller and Linkbase is the Data Processor. Personal data about the Customer's own users of the Service (account, billing, usage, and support data) is processed by Linkbase as an independent controller and is governed by the Linkbase Privacy Policy, not this DPA.

This DPA is entered into in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and other applicable data protection laws. This DPA is drafted in English; in the event of a conflict with any translation, the English text prevails.

In this DPA, the following definitions apply:

• "Personal Data": Any information relating to an identified or identifiable natural person as defined in the GDPR
• "Processing": Any operation performed on Personal Data, including collection, storage, use, transfer, and deletion
• "Data Controller": The Customer, who determines the purposes and means of the processing of Personal Data covered by this DPA
• "Data Processor": Linkbase, who processes Personal Data on behalf of the Data Controller
• "Connected Platform": A third-party platform that the Customer connects to the Service, such as e-commerce platforms, payment providers, advertising platforms, and accounting platforms
• "Sub-processor": A third party engaged by Linkbase to process Personal Data covered by this DPA
• "Data Subject": An individual whose Personal Data is processed
• "Personal Data Breach": A breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of Personal Data

3.1 Purpose

Linkbase processes Personal Data solely for the purpose of providing the Service as described in the Terms of Service. The Controller instructs Linkbase to:

1. Retrieve and store business records — such as orders, transactions, payouts, refunds, disputes, customer records, and product data — from the Connected Platforms the Controller has connected, including historical records when the Controller orders an import
2. Transform and synchronize such records between Connected Platforms according to the integrations and automations the Controller configures
3. Create accounting entries, vouchers, tax-related sales reports (such as OSS and EC sales reports), and supporting documents (such as receipts and specifications) in or for the Controller's accounting platform
4. Permit authorized Linkbase personnel to access Personal Data to operate, secure, maintain, support, and debug the Service, exclusively through Linkbase's internal, audited administrative gateway (including AI-assisted support and operations tooling built on that gateway), with role-based, least-privilege access recorded in an audit trail
5. Create de-identified, anonymized, or aggregated data as described in the Terms of Service, and anonymize or pseudonymize Personal Data before any use in non-production environments

These instructions, together with the Controller's configuration of the Service, constitute the Controller's complete documented instructions. Additional or changed instructions require written agreement between the parties.

3.2 Categories of Personal Data

• Names and contact information of the Controller's end customers and counterparties
• Billing and shipping addresses
• Email addresses and phone numbers
• Order and transaction data
• Payment information (amounts, dates, methods)
• Invoice and voucher data

No special categories of Personal Data (GDPR Article 9) are intended to be processed under this DPA, and the Controller shall not submit such data to the Service.

3.3 Categories of Data Subjects

End customers and counterparties of the Controller whose data appears in the business records of the Controller's Connected Platforms.

Linkbase agrees to:

1. Process Personal Data only on the documented instructions in Section 3, unless required by applicable law
2. Ensure that persons authorized to process Personal Data are bound by confidentiality obligations
3. Implement appropriate technical and organizational security measures
4. Engage Sub-processors only in accordance with Section 7 and under written agreements imposing data protection obligations no less protective than this DPA
5. Assist the Controller in responding to Data Subject requests
6. Assist the Controller in ensuring compliance with security, breach notification, and data protection impact assessment obligations
7. Delete or return all Personal Data upon termination of services in accordance with Section 12, unless retention is required by law
8. Make available to the Controller information necessary to demonstrate compliance with GDPR obligations, in accordance with Section 11

The Controller represents and warrants that:

1. It has a lawful basis for processing all Personal Data provided to Linkbase
2. It has provided all necessary notices and obtained any required consents from Data Subjects
3. It will comply with all applicable data protection laws in its use of the Service
4. Its instructions to Linkbase will comply with applicable data protection laws

Linkbase implements and maintains appropriate technical and organizational measures to protect Personal Data, including:

• Encryption of data in transit (TLS/SSL)
• Encryption of data at rest
• Role-based access controls and authentication mechanisms
• Audit logging of administrative access to Personal Data
• Server-side handling of Connected Platform credentials — access tokens never leave Linkbase's systems and internal tools do not have access to raw credentials
• Regular security assessments and monitoring
• Incident response procedures
• Employee training on data protection

The Controller provides general authorization for Linkbase to engage Sub-processors for hosting and infrastructure, payment processing, error tracking, AI inference, email delivery, and similar supporting functions. Linkbase maintains the current list of Sub-processors — including each Sub-processor's purpose, the categories of data it processes, its location, and the applicable transfer mechanism — at linkbase.se/legal/subprocessors.

Linkbase will update that list and notify the Controller at least 30 days before a new or replacement Sub-processor begins processing Personal Data covered by this DPA. Notification is provided through the Service or by email; the Controller may additionally request change notifications by email to privacy@linkbase.se.

If the Controller objects to a new Sub-processor on reasonable data protection grounds, the Controller may terminate the affected services within 30 days of notification. Linkbase remains responsible to the Controller for the performance of its Sub-processors' data protection obligations.

Personal Data is primarily processed within the EU/EEA. Some Sub-processors are established outside the EU/EEA or may process data there. Where Personal Data is transferred outside the EU/EEA, Linkbase ensures appropriate safeguards in accordance with Chapter V of the GDPR, such as Standard Contractual Clauses approved by the European Commission, certification under the EU–U.S. Data Privacy Framework, or transfers to countries with an adequacy decision.

Linkbase will promptly notify the Controller if it receives a request from a Data Subject to exercise their rights under GDPR. Linkbase will assist the Controller in fulfilling such requests, taking into account the nature of the processing. The Controller is responsible for responding to Data Subject requests.

Linkbase will notify the Controller without undue delay, and in any event no later than 72 hours, after becoming aware of a Personal Data Breach affecting Personal Data covered by this DPA. The notification will include, to the extent possible:

• Description of the nature of the breach
• Categories and approximate number of Data Subjects and records affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach

Where all details are not available within that time, Linkbase may provide the information in phases as it becomes available.

Linkbase will make available to the Controller, upon reasonable request and subject to confidentiality obligations, information necessary to demonstrate compliance with GDPR obligations. Linkbase may satisfy audit requests by providing relevant certifications and reports, such as ISO 27001 or SOC 2 reports, or summaries of independent security assessments and penetration tests, where these reasonably address the scope of the request.

Where such documentation is not sufficient, the Controller may conduct an audit or inspection, provided that:

• Reasonable advance notice is given (at least 30 days)
• Audits are conducted during normal business hours and no more than once in any 12-month period, unless required by a supervisory authority or following a Personal Data Breach
• The Controller bears the costs of any audit
• Audits do not unreasonably disrupt Linkbase's operations

This DPA remains in effect for the duration of the Terms of Service. Upon termination, Linkbase will, at the Controller's choice, delete or return all Personal Data covered by this DPA within 30 days of a verified request. If the Controller does not communicate a choice within 60 days of termination, Linkbase will delete the Personal Data. In each case, deletion does not extend to data whose retention is required by applicable law — including bookkeeping and tax legislation — in which case the retained data remains protected under this DPA for as long as it is retained. Retention behavior after disconnecting individual integrations is described in the Privacy Policy.

The limitations of liability set forth in the Terms of Service apply to this DPA. Each party's liability under this DPA is subject to the exclusions and limitations set forth in the Terms of Service.

This DPA is governed by Swedish law. Any disputes shall be resolved in accordance with the dispute resolution provisions in the Terms of Service.

For questions regarding this DPA or data protection matters: