Draft — under legal review
Data Processing Agreement
- Version
- 0.1-draft
- Updated
- Effective
- Not set (draft)
This Data Processing Agreement ("DPA") forms part of the Terms of Service between systown.ai AB (Systown AI) ("Processor") and the business customer ("Controller") whenever the Controller submits material containing personal data to MoatDefender. It meets Article 28(3) GDPR.
1. Scope
| Subject matter | Producing Moat Index readings, explanations and share cards from material the Controller submits |
| Duration | The term of the Controller's account, plus the deletion period in §9 |
| Nature and purpose | Extraction of facts from documents and text, scoring with AI models, storage, display, and sharing on the Controller's instruction |
| Personal data | Names, roles, professional background and contact details that appear in submitted material; any other personal data the Controller chooses to submit |
| Data subjects | Founders, employees, advisors, investors, customers and other people named in submitted material |
| Special categories | Not intended. The Controller must not submit special-category data (Art. 9) or criminal-offence data (Art. 10) |
2. Instructions
The Processor processes personal data only on the Controller's documented instructions. The Terms, this DPA and the Controller's use of the Service's features are those instructions. The Processor informs the Controller if it believes an instruction breaks the GDPR.
3. Confidentiality
Everyone authorised to process the personal data is bound by confidentiality.
4. Security
The Processor implements the measures in Annex II (Security), and reviews them as the Service changes.
5. Sub-processors
The Controller gives general authorisation for the sub-processors on Sub-processors. The Processor gives at least 30 days' notice by email of an addition or replacement. The Controller may object on reasonable data-protection grounds; if no solution is found, the Controller may terminate and receive a refund of prepaid, unused fees. The Processor imposes the same data-protection obligations on each sub-processor and remains liable for them.
6. Data-subject requests
The Service lets the Controller export and delete material itself. The Processor helps with other requests and forwards any request it receives directly.
7. Breaches
The Processor notifies the Controller without undue delay, and at the latest within 48 hours of becoming aware of a personal-data breach affecting the Controller's data, with the information Article 33(3) requires as it becomes available.
8. Assistance and audits
The Processor helps the Controller with security, breach notification, impact assessments and prior consultation (Art. 32–36), taking into account the information available to it. The Processor makes available the information needed to demonstrate compliance and allows audits by the Controller or an auditor it mandates, on reasonable notice, at most once a year unless a breach or authority requires otherwise.
9. End of processing
On termination, the Controller can export its data (see the EU Data Act notice). The Processor then deletes the personal data within 30 days, unless EU or member-state law requires storage.
10. Transfers
Transfers outside the EU/EEA take place only under Chapter V GDPR, as set out on Sub-processors.
11. Liability and precedence
Liability follows the Terms. If the Terms and this DPA conflict on personal data, this DPA prevails.
Annex I: Parties
Processor: systown.ai AB (Systown AI), 559163-5031, Kungsgatan 8, Stockholm, Sweden, privacy@moatdefender.com. Controller: the business customer named on the account.
Annex II: Technical and organisational measures
See Security. That page lists only measures the Service actually runs.
Annex III: Sub-processors
See Sub-processors.