Data Processing Agreement

Version 3.1, effective

22 August 2026

Parties. This Data Processing Agreement (the "DPA") is entered into between MuchSkills AB, registration number 559282-2521, Andra Långgatan 7A, 413 03 Gothenburg, Sweden ("MuchSkills", the "Processor") and the customer identified in the Agreement (the "Customer", the "Controller"). It forms part of, and is incorporated by reference into, the agreement between the parties for the provision of the MuchSkills platform and related services (the "Agreement"). No separate signature is required for this DPA to take effect; a signed copy is available on request. Purported amendments to this DPA by the Customer are of no effect unless agreed in writing by MuchSkills.

1. Definitions and interpretation

1.1 In this DPA: "GDPR" means Regulation (EU) 2016/679; "Data Protection Law" means the GDPR and any other data protection law applicable to the processing; "Customer Personal Data" means personal data processed by MuchSkills on behalf of the Customer under the Agreement; "Sub-processor" means a third party engaged by MuchSkills to process Customer Personal Data; and "Standard Contractual Clauses" means the clauses annexed to Commission Implementing Decision (EU) 2021/914.

1.2 The terms "controller", "processor", "data subject", "personal data", "processing" and "personal data breach" have the meanings given in the GDPR.

1.3 In the event of conflict, this DPA prevails over the Agreement on the processing of personal data; on all other matters the Agreement prevails; and an order form prevails over both for the specific terms it states.

2. Roles and scope

2.1 The Customer is the controller and MuchSkills is the processor in respect of Customer Personal Data. Where the Customer acts as a processor for a third-party controller, MuchSkills acts as a sub-processor and this DPA applies accordingly.

2.2 The subject matter, duration, nature and purpose of the processing, the categories of personal data and the categories of data subjects are set out in Annex 1. The Customer determines the purposes and means of the processing and is responsible for the lawfulness, fairness and transparency of the Customer Personal Data it provides, including for having a lawful basis under Article 6 and, where applicable, a condition under Article 9; for giving data subjects the information required by Articles 13 and 14; for the accuracy of the data; for configuring the platform, including access and visibility settings, in accordance with its own requirements; and for responding to data subjects exercising their rights. The Customer has the right to give MuchSkills documented instructions in accordance with clause 3, to receive the assistance and information set out in clauses 8 and 11, to object to a Sub-processor under clause 6.2, and to require deletion or return of Customer Personal Data under clause 10.

2.3 MuchSkills is a controller, not a processor, for data it processes for its own business purposes, being account administration, billing, support, security, communications to users and administrators about the platform and its use, and service improvement using data that has been anonymised, as described in the MuchSkills Privacy Policy. This DPA does not apply to that processing.

3. Processing on instructions

3.1 MuchSkills shall process Customer Personal Data only on the documented instructions of the Customer, including with regard to transfers, unless required to process by Union or Member State law to which MuchSkills is subject; in which case MuchSkills shall inform the Customer of that legal requirement before processing, unless the law prohibits it on important grounds of public interest.

3.2 The Agreement, this DPA, and the Customer's configuration and use of the platform constitute the Customer's documented instructions. Additional instructions must be agreed in writing, except that MuchSkills acts on a written instruction to delete or return Customer Personal Data in accordance with clause 10.

3.3 MuchSkills shall inform the Customer without undue delay if, in its opinion, an instruction infringes Data Protection Law.

4. Confidentiality

4.1 MuchSkills shall ensure that persons authorised to process Customer Personal Data, whether personnel of MuchSkills, of an affiliate, or of a contracted supplier, are bound by an appropriate obligation of confidentiality and process the data only on the Customer's instructions.

5. Security

5.1 MuchSkills shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking account of the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing. Those measures are described in Annex 2.

5.2 The standard is appropriateness under Article 32 of the GDPR and not a warranty of absolute security. No system connected to the internet can be guaranteed secure against every threat, including an act of war or a state-directed attack that appropriate measures could not have prevented. This does not affect MuchSkills' obligations under clause 9.

5.3 Standing access to Customer Personal Data in the production environment is restricted to a named, minimal set of authorised personnel, under least-privilege controls, with access logged and reviewed; where standing access is held by personnel located outside the European Economic Area, it is held only under the transfer safeguards described in clause 6.4.

5.4 MuchSkills may update its technical and organisational measures, provided the level of security is not materially reduced.

6. Sub-processors

6.1 The Customer grants MuchSkills general authorisation to engage Sub-processors. The Sub-processors engaged as at the date of this DPA are listed in Annex 3 and published, in their current form, at trust.muchskills.com.

6.2 MuchSkills shall give the Customer at least 30 days' notice of the addition or replacement of a Sub-processor, by publishing the change on its trust centre and notifying the subscribers of the change-notification service maintained there, and shall provide the information necessary for the Customer to exercise its right to object. MuchSkills will notify the Customer of any change to that mechanism, and will additionally notify the contact in the order where the Customer asks it to do so in writing. The Customer may object on reasonable data-protection grounds within that period, stating the grounds, and the parties shall discuss the objection in good faith. Where the function the Sub-processor performs can be disabled for the Customer without materially affecting the rest of the platform, MuchSkills shall disable it and the objection is resolved. Where it cannot, and the objection is not resolved within 30 days, the Customer may terminate the affected subscription on 30 days' written notice and MuchSkills shall refund the prepaid, unused Fees for the terminated period calculated pro rata; no refund is due where the replacement Sub-processor is subject to data-protection and security terms materially equivalent to those of the Sub-processor it replaces. Termination under this clause is the Customer's sole remedy in contract for an objection to a Sub-processor.

6.3 MuchSkills shall impose on each Sub-processor, by written contract, data-protection obligations that are in substance equivalent to those in this DPA, and remains fully liable to the Customer for the performance of each Sub-processor's obligations. A copy of a Sub-processor agreement, redacted to protect confidential information, is available to the Customer on request.

6.4 Customer Personal Data is hosted in the European Union. Where a Sub-processor processes Customer Personal Data outside the European Economic Area, MuchSkills has concluded with that Sub-processor, as data exporter in its own right and, where applicable, on the Customer's behalf, the Standard Contractual Clauses in the applicable module, together with the UK Addendum to those Clauses (version B1.0) where the data originates from the United Kingdom and the adaptations recognised by the Swiss authority where it originates from Switzerland, and with a documented transfer impact assessment and the supplementary measures in Annex 2. A copy of the relevant clauses, redacted to protect confidential information, is available to the Customer on request. Where the Customer is established outside the European Economic Area and a transfer to MuchSkills itself requires appropriate safeguards, the Standard Contractual Clauses apply between the parties as set out in Annex 6.

7. Artificial intelligence

7.1 Where an AI-assisted feature operates on skills data, content is minimised before it leaves the platform so that it does not, on its own, identify an individual. Where a feature necessarily operates on a document about an identifiable individual, the content processed is personal data and is processed under the Standard Contractual Clauses and the measures in Annex 2. The AI Addendum sets out the further terms applicable to AI-assisted features, including the allocation of roles under applicable AI law, and prevails on an AI matter.

7.2 MuchSkills does not use Customer Personal Data to train, fine-tune or improve any third-party AI model, and its AI Sub-processors are contractually prohibited from doing so.

7.3 AI outputs are produced and presented as suggestions and indicators for review by a person. They are not designed to be, and the Customer must not use them as, the sole or determinative basis for a decision producing legal or similarly significant effects within Article 22 of the GDPR. The Customer remains the decision-maker and, where it uses an output as a determinative input to such a decision, is responsible for the requirements of Article 22.

8. Assistance to the Customer

8.1 Taking into account the nature of the processing, MuchSkills shall assist the Customer by appropriate technical and organisational measures, insofar as possible, in responding to requests from data subjects, and provides in-product tools for access, correction, export and deletion.

8.2 MuchSkills shall notify the Customer without undue delay of any request received directly from a data subject relating to Customer Personal Data, and shall not respond to it except on the Customer's instructions.

8.3 Taking into account the nature of the processing and the information available to it, MuchSkills shall assist the Customer in ensuring compliance with its obligations under Articles 32 to 36 of the GDPR, including data-protection impact assessments and prior consultation, and shall make available the information the Customer reasonably needs for that purpose, including the security information in this DPA and its annexes.

9. Personal data breach

9.1 MuchSkills shall notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. MuchSkills becomes aware of a personal data breach when it has a reasonable degree of certainty that a security incident affecting Customer Personal Data has occurred.

9.2 The notification shall describe, to the extent known: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; and the measures taken or proposed to address it. Where the information cannot be provided at once, it may be provided in phases without undue further delay.

9.3 Notifying a supervisory authority and affected data subjects is the Customer's responsibility as controller. MuchSkills does not make those notifications on the Customer's behalf unless expressly instructed in writing.

10. Return and deletion

10.1 The Customer may export Customer Personal Data at any time during the subscription, self-service or through the API, in a structured, commonly used and machine-readable format.

10.2 On the end of the provision of the services, MuchSkills shall, at the Customer's choice, delete or return all Customer Personal Data and delete existing copies, unless Union or Member State law requires retention. Customer Personal Data is retained for a limited period after termination, normally around 90 days, to allow export or reinstatement, and is then deleted through periodic review; data removed from production is removed from backups within a further 90 days as the backup cycle expires. Where the Customer instructs MuchSkills in writing to delete or return Customer Personal Data, MuchSkills acts on that instruction where it is given by an authorised signatory of the Customer and verified out of band, within 30 days of verification, and confirms completion in writing. MuchSkills shall provide written confirmation of deletion on request.

11. Audit

11.1 MuchSkills shall make available to the Customer the information necessary to demonstrate compliance with Article 28 of the GDPR and this DPA, and shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer.

11.2 The Customer's audit right is satisfied in the first instance by MuchSkills' security documentation, certifications, any independent assurance report and its completed standard security questionnaire, made available under confidentiality; MuchSkills completes a Customer-specific questionnaire once in any 12-month period and otherwise at the Customer's cost. An on-site inspection may be conducted on at least 30 days' written notice, during business hours, at the Customer's cost, no more than once in any 12-month period except where required by a supervisory authority or following a personal data breach, and in a manner that does not compromise the security of other customers.

12. Liability and insurance

12.1 Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, including the uncapped exceptions stated there. Where the Customer requires a higher cap for data-protection claims, the parties may agree one in the order.

12.2 MuchSkills maintains insurance appropriate to its business, including cyber and data-protection liability cover, in accordance with clause 16.1 of the Enterprise Terms, and provides evidence of it as set out in that clause.

13. Force majeure

13.1 Neither party is liable for a failure or delay caused by an event beyond its reasonable control. This does not relieve MuchSkills of its obligation to notify a personal data breach under clause 9, which applies whatever the cause.

14. Term, survival and governing law

14.1 This DPA takes effect on the Effective Date of the Agreement and continues for as long as MuchSkills processes Customer Personal Data. Clauses that by their nature survive termination, including confidentiality, deletion and liability, continue in effect.

14.2 This DPA is governed by the law of Sweden. The courts of Sweden have exclusive jurisdiction over any dispute arising under it, including any dispute arising under the Standard Contractual Clauses incorporated by Annex 6, and where a dispute involves both this DPA and the Agreement the whole dispute is determined in that forum. This clause applies in place of any dispute-resolution provision in the Agreement, except that where the Customer is a public body prohibited by the law applicable to it from agreeing to this clause, the governing law and forum stated in the order apply and, failing any statement in the order, the law of the country in which the Customer is established and the courts of its principal place of business. This clause does not limit any right of a data subject or supervisory authority under applicable data protection law or under those Clauses.

Annex 1 Description of the processing

Processor contact	privacy@muchskills.com
Subject matter	Processing of Customer Personal Data to provide the MuchSkills platform and related services.
Duration	The term of the Agreement, and thereafter until deletion or return in accordance with clause 10.
Nature and purpose	Hosting and operating the platform; recording and mapping skills and certifications; skills-based planning and staffing; gap analysis; reporting; support; and security.
Categories of data subjects	The Customer’s workers, including employees, contractors and candidates, and the Customer’s administrators and users of the platform, whom the Customer chooses to include.
Categories of personal data	Identification and contact details; role and organisational data; skills, competencies and proficiency levels; certifications and their validity; education, work history, profile information; and usage and log data. For any AI-assisted feature that necessarily operates on a document about an identifiable individual, such as a curriculum vitae, résumé or equivalent profile document, the content of that document as provided or imported by the Customer.
Special categories	None intended. The platform is not intended for special categories of personal data, and the Customer must not provide such data except as expressly agreed in the order. Where a document the Customer provides or imports contains or reveals such data, the Customer remains responsible for a condition under Article 9(2), and MuchSkills applies to it the same measures as to other Customer Personal Data.
Frequency	Continuous, for the duration of the Agreement.

Annex 2 Technical and organisational measures

MuchSkills maintains the following measures. Further detail is available to the Customer, under confidentiality, through the MuchSkills trust centre.

Access control. Role-based access on the principle of least privilege; unique credentials with no shared logins; multi-factor authentication enforced on every administrative account; single sign-on through the customer's own identity provider using standard federated protocols, with optional automated user provisioning and de-provisioning. Administrative tooling for the production environment is accessible only to a named, minimal set of authorised administrators, requires multi-factor authentication, and all administrative activity is logged and monitored. Standing access to Customer Personal Data in production is restricted to a named, minimal set of authorised personnel under least-privilege controls, with all access logged and reviewed, and development staff work in development and test environments against synthetic or anonymised data.

Encryption. Customer Personal Data is encrypted at rest using a current, industry-standard strong symmetric algorithm of at least 256-bit strength, applied at the database and storage layer, and in transit using current, industry-standard transport encryption at a minimum protocol version no lower than that recommended by recognised standards bodies at the time, including for internal service traffic. Key access is restricted to named administrators and is logged. The specific algorithms and minimum protocol versions in force are published on the trust centre.

Data location. Customer Personal Data is stored at rest in data centres located within the European Union. Where a Sub-processor recorded on the sub-processor list processes Customer Personal Data outside the European Economic Area, it may hold it for the limited retention period recorded on that list, under the Standard Contractual Clauses. The hosting and database providers used, and the region of each, are identified on the sub-processor list, which is the authoritative record of where data is held.

Logging and monitoring. Logging and monitoring of access to, and activity affecting, Customer Personal Data, with alerting on anomalous events; security logs and AI-feature usage logs retained for up to 12 months.

Resilience and recovery. Automated encrypted backups, taken and retained at the frequencies and for the periods published on the trust centre; documented recovery point and recovery time objectives, which are design objectives that inform how the service is operated and not warranties; and periodic testing of restoration.

Application security. A secure development lifecycle with peer code review, dependency and vulnerability scanning, separation of production from development and test environments, and regular independent penetration testing.

Pseudonymisation and minimisation. Minimisation of personal data used in any external processing, and pseudonymisation where appropriate. For transfers, personal data is minimised before transmission, processed under contractual restrictions including a prohibition on model training and short provider-side retention, and supported by a documented transfer impact assessment.

Endpoint security. Centrally managed devices with enforced disk encryption and monitored configuration.

Personnel. Confidentiality obligations on all personnel with access, and regular security-awareness training.

Incident response. A documented incident-response process, including notification of personal data breaches in accordance with this DPA.

Governance. An information-security management system aligned to ISO/IEC 27001, with current certification status published on the trust centre, and periodic assessment of Sub-processors.

Annex 3 Sub-processors

The table below is a snapshot of the Sub-processors engaged as at the effective date of this DPA. The authoritative and current list is published on the MuchSkills trust centre, and that published list, as amended from time to time in accordance with clause 6.2, is the list for the purposes of this DPA and of Annex III to the Standard Contractual Clauses. The Customer may subscribe there to be notified of changes, and a dated copy of the list is available on request.

Sub-processor	Purpose	Location	Transfer safeguard
Amazon Web Services	Cloud hosting, storage and backup	Stockholm, Sweden (EU)	Not required (EU)
MongoDB Atlas	Managed database and backups	Stockholm, Sweden (EU)	Not required (EU)
OpenAI	In-product generative AI, including features operating on individual documents	United States	SCCs and transfer impact assessment; no model training; short retention
Google Vertex AI	In-product generative AI	European Union; the current list of regions used is published on the sub-processor list	EU processing where available; SCCs where a non-EU endpoint is used
Twilio SendGrid	Transactional and system email	EU data residency active	Not required for EU processing; SCCs for any support access
Intercom	In-app support chat and ticketing	United States	SCCs
Stripe	Billing and payment	Stripe Technology Europe Limited (Ireland); EU and US	SCCs for any US processing
Google Workspace	Business email and storage; intake of client-supplied files during services	Ireland (EU)	Not required (EU)
HubSpot	Customer relationship management	European Union (Germany)	Not required (EU)
Brevo	Marketing email to business contacts, onboarding and newsletters	France (EU)	Not required (EU)
Vanta	Security and compliance monitoring	United States	SCCs
Forest Admin	Administrative interface, self-hosted	Stockholm, Sweden (EU)	Not required (self-hosted, EU)
Upstrat Lab AB	Platform operations and support	Sweden (EU)	Not required (EU)
Dumka	Development and technical operations	Finland (EEA)	Not required (EEA)

Where this snapshot and the published list differ, the published list governs. Suppliers used solely for MuchSkills' own internal administration, which do not process Customer Personal Data, are not listed. Website and marketing providers that do not process Customer Personal Data are covered by the Website Privacy Policy and are not sub-processors under this DPA.

Annex 4 International privacy terms

This annex adds the terms that particular jurisdictions require. Only the paragraph for the Customer's jurisdiction applies, and for that jurisdiction this annex prevails over the rest of this DPA.

Norway and the wider EEA. Where the Customer or its data is in Norway, Iceland or Liechtenstein, the GDPR applies through the EEA Agreement in the same way as within the European Union, and references to a supervisory authority include the relevant national authority, such as Datatilsynet in Norway. No additional transfer mechanism is required for data that remains within the EEA.

United Kingdom. References to the GDPR are read as the UK GDPR with the Data Protection Act 2018; references to a supervisory authority include the Information Commissioner's Office; and a restricted transfer from the United Kingdom is made under the UK Addendum to the Standard Contractual Clauses, version B1.0, as concluded under clause 6.4 and completed by reference to Annexes 1, 2 and 3 to this DPA.

Switzerland. References to the GDPR include the Swiss Federal Act on Data Protection; references to a supervisory authority include the Swiss Federal Data Protection and Information Commissioner; protection extends to data about legal entities to the extent Swiss law requires; and the Standard Contractual Clauses apply with the adaptations the Swiss authority recognises.

Canada, including Quebec. MuchSkills processes personal information only to provide the service and on the Customer's instructions, and protects it with safeguards appropriate to its sensitivity. Under Quebec's Law 25, MuchSkills confirms that it processes only as needed to provide the service, that the processing and sub-processors are those in this DPA, that it will assist with a privacy-impact assessment for a transfer outside Quebec, and that it will notify the Customer without delay of any confidentiality incident.

Brazil. MuchSkills acts as operator under the Lei Geral de Proteção de Dados, processing on the Customer's instructions as controller, applying security measures consistent with this DPA, and supporting responses to data subjects and to the ANPD.

Australia. MuchSkills handles personal information in line with the Australian Privacy Principles, does not use or disclose it for unrelated purposes or its own direct marketing, and supports the Customer's obligations, including in relation to eligible data breaches.

Other jurisdictions. For a Customer elsewhere, this DPA applies in full and MuchSkills will consider in good faith any additional term the Customer's local law specifically requires of a processor. Requests: privacy@muchskills.com.

Annex 5 United States privacy terms

This annex applies where MuchSkills processes personal information about United States residents on the Customer's behalf, and prevails over the rest of this DPA on United States privacy matters. Terms such as "business", "service provider", "sell" and "share" have the meanings given in the California Consumer Privacy Act and its regulations (the "CCPA"); equivalent terms in other state laws are read accordingly.

A. California. MuchSkills is a service provider to the Customer, which is the business. MuchSkills: processes personal information only for the business purposes of providing the platform and services; does not sell or share personal information; does not retain, use or disclose personal information outside the direct business relationship, for any other purpose, or for any other commercial purpose; does not combine it with personal information from another source except as the CCPA permits; does not use it to train any third-party AI model; maintains reasonable security; provides the same level of privacy protection the CCPA requires; notifies the Customer if it can no longer meet its obligations; grants the Customer the right to take reasonable steps to stop and remediate unauthorised use; enables the Customer to respond to consumer requests, including requests to know, access, correct, delete, opt out of sale or sharing, limit the use of sensitive information, and requests relating to automated decision-making; and imposes these obligations on any sub-processor by written contract.

B. Other states. Where another state privacy law applies, MuchSkills acts as the Customer's processor: it processes personal data only on the Customer's documented instructions; keeps processing staff under a duty of confidentiality; deletes or returns personal data at the Customer's direction; makes available the information necessary to demonstrate compliance and, on request, allows a reasonable assessment; assists the Customer with data-subject requests, security, breach notification and assessments; and engages sub-processors only under equivalent written terms. Where a state privacy law imposes an additional specific requirement on a processor or service provider, MuchSkills complies with it in respect of personal data it processes for the Customer under this DPA. Without limitation, this includes not selling or sharing sensitive data, applying strict-necessity minimisation where the applicable law requires it, and supporting the Customer's response to a consumer who questions the result of profiling.

C. Status. This annex governs personal information about United States residents; the body of this DPA governs European Economic Area and United Kingdom data; read together they govern personal information about United States residents and European Economic Area and United Kingdom data respectively. MuchSkills does not sell or share personal information and does not act as a data broker.

Annex 6 Transfer mechanism

Where the Customer is established outside the European Economic Area and a transfer of Customer Personal Data to MuchSkills requires appropriate safeguards, the parties incorporate the Standard Contractual Clauses as follows. Onward transfers by MuchSkills to a Sub-processor outside the European Economic Area are made under the clauses MuchSkills has concluded with that Sub-processor in accordance with clause 6.4.

Module	Module Two (controller to processor) where the Customer is a controller; Module Three (processor to processor) where the Customer is itself a processor.
Clause 7 (docking)	Applies.
Clause 9 (sub-processors)	Option 2, general authorisation, with the 30-day notice period in clause 6 of this DPA.
Clause 11 (redress)	The optional independent-dispute-resolution language does not apply.
Clause 17 (governing law)	The law of Sweden.
Clause 18 (forum)	The courts of Sweden. This does not affect a data subject’s right under Clause 18(c) to bring proceedings before the courts of the Member State in which he or she is habitually resident.
Annexes	Annexes I, II and III to the Standard Contractual Clauses are populated by Annexes 1, 2 and 3 to this DPA respectively. For Annex I.C, the competent supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or, where the Customer is established in another EEA state and that state’s authority is competent, that authority.

Where a Sub-processor is certified under the EU-US Data Privacy Framework, that certification may be relied on in addition, but the Standard Contractual Clauses remain the primary transfer mechanism. Customer Personal Data is hosted in the European Union, and MuchSkills applies supplementary technical and organisational measures to transfers as described in Annex 2.

Contents