Data processing agreement

1. Parties and roles

The parties are the customer company, acting as controller, and Reqventa, acting as processor.

For personal data Reqventa processes for its own purposes, for example account administration and security, Reqventa is instead the controller. That processing is described in the Privacy policy and is not covered by this agreement.

2. Scope, subject matter and duration

The subject matter of the processing is Reqventa's provision of the service to the customer.

Processing continues for as long as the customer uses the service under the agreement, and thereafter for the short period required for deletion or return under the deletion section.

3. Nature and purpose of processing

Processing includes collection, storage, structuring, analysis, use in AI-based interpretation and matching, display in the interface, generation of quotation drafts and documents, transfer to integrations chosen by the customer, and deletion.

The purpose is to enable the customer to handle incoming customer inquiries and quotation work in the service.

4. Documented instructions

Reqventa processes the customer's personal data only on the customer's documented instructions. The agreement, this data processing agreement and the customer's use of the service's features constitute the customer's instructions.

If Union or national law requires processing beyond the instructions, Reqventa informs the customer before processing, unless the law prohibits this.

If Reqventa considers an instruction to infringe applicable data protection law, Reqventa informs the customer to the extent permitted by law.

5. Confidentiality

Persons authorised to process the customer's personal data are bound by confidentiality undertakings or an appropriate statutory obligation of confidentiality. Access is limited to those who need it to deliver the service.

6. Security

Reqventa implements appropriate technical and organisational measures under Article 32 GDPR. The measures are described in Annex B and cover only measures that are actually implemented.

7. Subprocessors

The customer gives general written authorisation for Reqventa to engage subprocessors. Current subprocessors are published on the Subprocessors page.

Reqventa informs the customer of intended material changes to the subprocessor list before a new subprocessor begins processing the customer's personal data, giving the customer a reasonable opportunity to object on legitimate data protection grounds.

Reqventa imposes equivalent data protection obligations on each subprocessor by contract and remains responsible to the customer for the subprocessor's processing.

8. Transfers to third countries

Where processing takes place outside the EU/EEA, a valid transfer mechanism under applicable data protection law is applied, together with any necessary supplementary measures.

Processing region and transfer mechanism per subprocessor are shown on the Subprocessors page once verified.

9. Data subject requests

Reqventa assists the customer with appropriate technical and organisational measures so the customer can respond to data subject requests.

If Reqventa receives a request directly from a data subject concerning data for which the customer is controller, Reqventa refers or forwards the request to the customer and does not decide it independently, except where required by law.

10. Personal data breaches

Reqventa informs the customer without undue delay after becoming aware of a personal data breach affecting the customer's personal data.

Reqventa provides the information reasonably available to it that the customer needs to fulfil its obligations, and assists with reasonable measures to mitigate the effects of the breach.

11. Impact assessments and prior consultation

Reqventa provides reasonable assistance with data protection impact assessments and any prior consultation with a supervisory authority, taking into account the nature of the processing and the information available to Reqventa.

12. Deletion and return

On termination, Reqventa deletes or returns the customer's personal data at the customer's choice and in accordance with the agreed process, to the extent technically feasible.

Data may be retained to the extent required by law. Deletion and export processes are documented and can be configured in the service.

13. Information and audit

Reqventa makes available the information necessary to demonstrate compliance with Article 28 obligations, primarily through existing documentation, security descriptions and completed questionnaires.

On-site audits require reasonable prior notice, take place during normal business hours, must not unreasonably disrupt operations and are subject to confidentiality. The cost of extraordinary audits may be borne by the customer to the extent permitted by law and the agreement.

This does not limit the customer's mandatory rights under applicable data protection law.

14. Liability and order of precedence

The limitations of liability in the main agreement also apply to this data processing agreement, to the extent permitted by mandatory law.

In the event of conflict, this data processing agreement prevails over other contract documents in matters concerning the processing of personal data, unless a signed master agreement expressly states otherwise.

Annex A — Processing details

Categories of data subjects may, depending on the customer's actual use, include the customer's employees and users, contact persons at the customer's customers, contact persons at suppliers, prospective customers and other individuals appearing in communication or documents the customer adds to the service.

Categories of personal data may include name, work email, work phone, job title, employer or organisation, content of communication, email metadata, information in inquiries and quotation drafts, identifiers and account details.

The customer decides which data is added to the service. The service does not require sensitive personal data, and the customer should not add special categories of personal data unless expressly agreed and necessary.

Annex B — Technical and organisational measures

The following measures are implemented in the platform:

• Separate customer environments where all data is tied to an organisation
• Database-level data isolation using Row Level Security
• Server-side verification of organisation membership on every request
• Role-based access control within the organisation plus a separate platform role
• Invitation-only account registration enforced in the database
• Encrypted communication over TLS between browser, application and database
• Encryption of stored access tokens for connected email inboxes
• Secret management outside the application code
• Logging of quotation flow activity, price adjustments, matching corrections and administrative events

Reqventa makes no claims to certifications or measures that are not verified. Further measures are added to this annex once implemented and verified.