Version: ab-2026-10-25 · Date: 25 October 2026
between
the Customer – hereinafter the "Controller" –
the customer designated in the customer account or in the order
and
Sat-iTec AB – hereinafter the "Processor" –
Sat-iTec AB
Simeå 8097, 82167 Vallsta, Sweden
Org.nr 559375-4335 · VAT no. SE559375433501
Contact: guenther.loeb@sat-itec.se · Phone +46 76 111 79 63
Data protection contact (group data protection contact): Stefanie Löb · datenschutz@sat-itec.de
– together the "Parties" –
The Processor provides services to the Controller via the "ChatiTec" platform (GDPR-compliant AI/LLM platform). The platform is technically operated by the Processor's group company Sat-iTec Systemhaus GmbH, acting as sub-processor, in its own data centre in Germany (EU) (see Annex 2). In the course of these services, the Processor processes personal data on behalf of and on the instructions of the Controller. This Agreement specifies the data protection obligations of the Parties pursuant to Art. 28 GDPR. It applies in addition to the main agreement, i.e. the General Terms and Conditions of Sat-iTec AB and the individual order.
Information on the processing of personal data carried out by Sat-iTec AB as controller (e.g. customer and account data, invoicing) is available in the Privacy Policy.
(1) The subject matter of the processing is the provision and operation of the ChatiTec platform, including the AI/LLM processing of input content transmitted by the Controller or its users.
(2) The nature of the processing comprises in particular: collection, recording, storage, retrieval, use, anonymisation/pseudonymisation (PII tokenisation), transmission (to external AI providers in anonymised form only), erasure and destruction.
(3) The purpose of the processing is the provision of the contractually agreed platform and AI services.
(4) Categories of data subjects: in particular clients/patients of the Controller, their representatives and third parties, employees and users of the Controller, as well as other persons named in the input content.
(5) Categories of personal data: master data, contact data, content data of the inputs (prompts/documents) and, where applicable, special categories of personal data pursuant to Art. 9 GDPR (in particular data concerning health) and data subject to the Controller's statutory or professional duty of confidentiality (see § 3(3)).
(6) Duration: The processing takes place for the term of the main agreement. This DPA terminates automatically upon termination of the main agreement, without prejudice to continuing obligations (in particular § 3, § 9 and § 10).
(1) The Processor processes personal data only on documented instructions from the Controller, including with regard to transfers to third countries, unless required to do so by Union or Member State law to which the Processor is subject (Art. 28(3)(a) GDPR). In such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
(2) This Agreement, the main agreement and the Controller's use of the platform's functions and settings constitute the Controller's documented instructions. Individual instructions are given in writing (e-mail is sufficient); oral instructions must be confirmed in writing without undue delay.
(3) The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions (Art. 28(3), second subparagraph, GDPR). The Processor is entitled to suspend the execution of the instruction concerned until it is confirmed or amended by the Controller.
(1) The Processor ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR).
(2) The Processor obliges the personnel deployed – at the Processor and at its sub-processors, in particular Sat-iTec Systemhaus GmbH – by written confidentiality undertakings to maintain secrecy regarding personal data and all content entered on the platform by the Controller. Access to content takes place only to the extent necessary to provide the services (need-to-know principle).
(3) Where the Controller is subject to a statutory or professional duty of confidentiality (e.g. advocates/lawyers, healthcare professionals or auditors), the Controller is itself responsible for assessing whether, and under which conditions, the use of the platform and of the sub-processors listed in Annex 2 is compatible with those obligations, and for selecting appropriate settings where necessary (e.g. use of local models only). Upon request, the Processor provides the information required for this assessment. The confidentiality obligations under (1) and (2) also apply to such content.
(4) These obligations continue to apply after termination of the Agreement.
(1) The Processor implements the technical and organisational measures required under Art. 32 GDPR to ensure a level of security appropriate to the risk. The measures taken are described in Annex 1 (Technical and Organisational Measures), which forms part of this Agreement. The measures are implemented by the Processor together with its sub-processor Sat-iTec Systemhaus GmbH, which operates the platform in Germany.
(2) The technical and organisational measures are subject to technical progress. The Processor is entitled to develop them further, provided that the agreed level of protection is not reduced. Material changes shall be notified to the Controller.
(1) The Controller grants the Processor general prior written authorisation to engage other processors (sub-processors) (Art. 28(2) GDPR). The sub-processors engaged at the time of conclusion of the Agreement are listed exhaustively in Annex 2 (List of Sub-processors). The Controller specifically approves that the operation, hosting and support of the platform are carried out by the group company Sat-iTec Systemhaus GmbH, Germany.
(2) The Processor shall inform the Controller in good time in advance and in writing (e-mail is sufficient) of any intended changes concerning the addition or replacement of sub-processors. The Controller may object to the change within 14 days of the notification on reasonable data protection grounds (Art. 28(2) GDPR).
(3) The Processor shall contractually impose on each sub-processor the same data protection obligations as set out in this Agreement (Art. 28(4) GDPR), in particular providing sufficient guarantees to implement appropriate technical and organisational measures. Where the sub-processor fails to fulfil its data protection obligations, the Processor shall remain fully liable to the Controller for the performance of the sub-processor's obligations.
(4) Transfers to external AI providers (sub-processors) take place exclusively in anonymised form (PII tokenisation, enforced by default). When only local models are used, no external AI providers are engaged.
(5) Personal data are transferred to a third country (outside the EU/EEA) only if the conditions of Chapter V GDPR are met. The applicable transfer mechanism for each sub-processor is set out in Annex 2.
(1) Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures in fulfilling the Controller's obligation to respond to requests for exercising the data subjects' rights (Art. 12–23 GDPR; Art. 28(3)(e) GDPR).
(2) Taking into account the nature of processing and the information available to the Processor, the Processor assists the Controller in ensuring compliance with the obligations pursuant to Art. 32–36 GDPR (security of processing, notification of personal data breaches, data protection impact assessment, prior consultation; Art. 28(3)(f) GDPR).
(3) If a data subject contacts the Processor directly, the Processor shall forward the request to the Controller without undue delay.
(1) The Processor shall notify the Controller in writing of any personal data breach that has come to its knowledge without undue delay, and at the latest within 24 hours after becoming aware of it (Art. 33(2) GDPR).
(2) The notification shall, to the extent available, contain at least the information referred to in Art. 33(3) GDPR (nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, measures taken/proposed, contact point). Information not available at the time of the first notification shall be provided in phases without undue delay.
(3) Notification of the competent supervisory authority (Art. 33 GDPR) and, where applicable, communication to the data subjects (Art. 34 GDPR) are the responsibility of the Controller. The Processor assists the Controller to a reasonable extent.
(1) The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR (Art. 28(3)(h) GDPR).
(2) The Processor allows for and contributes to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller. Evidence may also be provided by means of appropriate certifications, current attestations or audit reports from recognised bodies. Inspections relating to the data centre and the operations in Germany are carried out in coordination with the sub-processor Sat-iTec Systemhaus GmbH.
(3) On-site inspections take place after timely notice (at least 14 days in advance), during normal business hours, without disrupting operations and with due regard to confidentiality and security interests and the rights of third parties (in particular the rights and confidentiality interests of other customers). The costs of an inspection initiated by the Controller are – unless otherwise agreed – borne by the Controller, unless it is established that the Processor has breached this Agreement or the GDPR.
(4) The competent supervisory authority for the Processor is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). The Processor cooperates with the supervisory authority on request (Art. 31 GDPR) and informs the Controller without undue delay of supervisory measures relating to the processing under this Agreement, to the extent permitted.
(1) After the end of the provision of the processing services, the Processor shall, at the choice of the Controller, erase all personal data or return them and delete existing copies, unless Union or Member State law requires storage of the personal data (Art. 28(3)(g) GDPR). This also applies at the sub-processors.
(2) Data are returned in a commonly used, machine-readable format (e.g. JSON, Markdown or PDF). Erasure is confirmed in writing upon request.
(3) Locally stored, Fernet-encrypted mapping data from the PII tokenisation are also destroyed as part of the erasure.
(1) The liability of the Parties towards data subjects is governed by Art. 82 GDPR. Otherwise, the liability provisions of the General Terms and Conditions of Sat-iTec AB apply, to the extent compatible with mandatory data protection law.
(2) The Controller is responsible for the lawfulness of the processing and for safeguarding the rights of data subjects. As between the Parties, each Party shall indemnify the other against claims based on a breach for which the first-mentioned Party is responsible.
(1) Order of precedence: In the event of conflicts between this DPA and the General Terms and Conditions of Sat-iTec AB, this DPA (including its annexes) prevails in matters concerning the processing of personal data; in all other matters the General Terms and Conditions prevail. As between this Agreement and its annexes, the main text of the Agreement prevails, except for the annexes' specific details on measures and sub-processors.
(2) Amendments and supplements to this Agreement must be made in writing (e-mail is sufficient). Annex 1 and Annex 2 may be updated in accordance with § 4(2) and § 5(2) respectively.
(3) Should any provision be invalid, the validity of the remaining provisions shall remain unaffected. The Parties shall replace the invalid provision with a valid provision that corresponds as closely as possible to its purpose.
(4) Governing law: This Agreement is governed by Swedish law, excluding its conflict-of-laws rules. The GDPR applies directly.
(5) Disputes: Disputes arising out of this Agreement shall be resolved by arbitration in accordance with the arbitration clause of the General Terms and Conditions (§ 12).
(6) Language: This Agreement is available in Swedish and English. The Swedish version is binding; the English version is a translation. In the event of discrepancies, the Swedish version prevails.
(7) Annexes:
Conclusion of the Agreement: This Agreement is concluded in electronic form (Art. 28(9) GDPR) by the Controller expressly accepting it upon registration or ordering; the time and version of acceptance are logged. A separate signature is not required. Upon request, Sat-iTec AB will provide a version signed by both Parties.
Version: ab-2026-10-25 · Date: 25 October 2026