Contact us

Konvyra Data Processing Agreement

Last updated: 31 October 2026

This data processing agreement (DPA) is part of the Agreement between the Provider and the Customer and meets the requirements of article 28 of Regulation (EU) 2016/679 (the GDPR). Terms defined in the Konvyra Terms of Service (the Terms) have the same meaning here. The Swedish version is a translation for convenience; if the two differ, the English version prevails.

1. Roles

1.1 The Customer is the controller, and the Provider is the processor, of the personal data contained in the Customer Data (Personal Data).

1.2 If the Customer processes Personal Data as a processor on behalf of another controller, the Customer confirms that it is authorised to engage the Provider as sub-processor, that the instructions it gives are the controller's instructions, and that the Provider's obligations in this DPA are enough to meet its own obligations to that controller. The Provider then acts as sub-processor.

1.3 This DPA covers only processing of Personal Data on behalf of the Customer. The Provider acts as controller for its own purposes, such as invoicing the Customer, managing the customer relationship and its website; see the privacy policy on konvyra.com.

2. Subject matter and duration

2.1 The subject matter, nature and purpose of the processing, the types of Personal Data and the categories of data subjects are described in Annex 1.

2.2 The DPA applies for as long as the Provider processes Personal Data for the Customer under the Agreement, including during the Export Window and until deletion under section 10.

3. Instructions

3.1 The Provider shall process Personal Data only on the Customer's documented instructions, including as regards transfers to a third country, unless EU or Member State law to which the Provider is subject requires otherwise. The Provider then informs the Customer of that legal requirement before processing, unless the law prohibits it.

3.2 The Agreement, the Customer's and its Users' use of the Service's functions, and written instructions by email that are consistent with the Agreement are the Customer's documented instructions. An instruction that requires changes beyond the normal operation of the Service may be made subject to agreement on scope and a reasonable fee.

3.3 The Provider shall inform the Customer without undue delay if it considers that an instruction infringes the GDPR or other EU or Member State data protection law, and may suspend carrying out the instruction until the Customer has confirmed or changed it.

4. Confidentiality of personnel

4.1 The Provider shall ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access is limited to those who need it to provide the Service.

5. Security of processing

5.1 The Provider shall take the technical and organisational measures required by article 32 of the GDPR, appropriate to the risk. The measures at the date of this DPA are described in Annex 2.

5.2 The Provider may update the measures, provided the overall level of security is not materially reduced.

5.3 The Customer is responsible for its own use of the Service, including its Users' access rights and credentials, the security of its devices and networks, and the configuration choices it makes, and for assessing whether the measures in Annex 2 are suitable for the Personal Data it chooses to process.

6. Sub-processors

6.1 The Customer gives the Provider general authorisation to engage the sub-processors listed in Annex 3. The Provider shall impose on each sub-processor, by contract, data protection obligations that in substance are no less protective than those in this DPA, and remains fully responsible to the Customer for the sub-processor's performance, subject to section 12.

6.2 The Provider shall give the Customer notice of any intended addition or replacement of a sub-processor at least 30 days before the new sub-processor starts to process Personal Data. The notice is given by email to the Customer's contact in the Order, or by another written means the Provider has told the Customer about. In an emergency, such as a sub-processor becoming unavailable, the notice may be shorter.

6.3 The Customer may object to the change within 14 days of the notice, on reasonable grounds that relate to data protection. The parties shall then discuss the objection in good faith. If it is not resolved, the Provider may choose not to use the new sub-processor for the Customer's Instance. If the Provider cannot or does not offer that, the Customer may terminate the affected part of the Service by written notice with effect from the date the new sub-processor would start, and receive a pro rata refund of prepaid Fees for the period after that date.

6.4 A sub-processor for an AI Provider supplied by the Provider (see Annex 3) is used only when the Order includes such an AI Provider. An AI Provider that the Customer has chosen under its own agreement is not the Provider's sub-processor.

7. Transfers to third countries

7.1 Personal Data is hosted in the Region stated in the Order. The Provider shall not transfer Personal Data to a country outside the EU/EEA, or allow access from such a country, except as this section 7 allows or as the Customer instructs.

7.2 Before any transfer of Personal Data to a country outside the EU/EEA, or any access from such a country, by the Provider or its sub-processors, the Provider shall ensure that the Customer has given documented instructions for it and that an appropriate safeguard under Chapter V of the GDPR is in place for that transfer or access. This applies, for example, to hosting in the US if the Customer has chosen the US as the Region, to the handling of traffic on Cloudflare's global network, and to an AI Provider supplied by the Provider and its underlying model providers (Annex 3). The Region stated in the Order and the sub-processors in Annex 3 are such instructions only on the condition that the safeguard is in place before the transfer or access starts. The safeguard is, as applicable:

  • (a) an adequacy decision, including the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) where the recipient is certified under it and the decision is in force; or
  • (b) otherwise, the standard contractual clauses in Commission Implementing Decision (EU) 2021/914 (for a sub-processor, Module Three, processor to processor), together with the supplementary measures that are needed.

7.3 The Provider shall assist the Customer on reasonable request with the assessments of a transfer that the GDPR requires.

7.4 Unless the law prohibits it, the Provider shall notify the Customer promptly of any legally binding request from an authority to disclose Personal Data, and shall disclose only what the law requires.

7.5 Where the Customer is established outside the EU/EEA and the return of Personal Data to it is a transfer, the parties shall agree and put in place an appropriate safeguard before the return takes place. The Customer is responsible for transfers that it or its Users make by accessing the Service from outside the EU/EEA.

8. Assistance

8.1 Taking into account the nature of the processing, the Provider shall assist the Customer with appropriate technical and organisational measures in meeting its obligation to respond to requests from data subjects to exercise their rights under chapter III of the GDPR. The Customer can use the Service's functions to search, correct, delete and export Personal Data. If a data subject contacts the Provider directly, the Provider shall forward the request to the Customer without answering it, except to say that it has been forwarded.

8.2 The Provider shall assist the Customer in meeting its obligations under articles 32 to 36 of the GDPR (security, notification of personal data breaches, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to the Provider.

8.3 Assistance that goes beyond the Service's functions and normal support may be charged at a reasonable fee agreed in advance.

9. Personal data breach

9.1 The Provider shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Personal Data.

9.2 The notice shall, as far as the Provider then knows, describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed, and give a contact point. Information may be provided in stages as it becomes available.

9.3 The Provider shall take reasonable measures to limit and remedy the breach and shall cooperate with the Customer. The Customer decides whether to notify the supervisory authority and the data subjects. The Provider will not notify them on the Customer's behalf unless the law requires it. A notice is not an admission of fault or liability.

10. Deletion and return

10.1 When the Agreement ends, the Provider shall, at the Customer's choice, return the Personal Data (in CSV format, see section 5.5 of the Terms) or delete it. Return does not end the Provider's obligations: after returning the Personal Data, the Provider shall delete all remaining copies in accordance with section 10.2, except to the extent EU or Member State law requires storage. The Customer shall make its choice within the Export Window. If the Customer makes no choice, the Provider deletes the Personal Data after the Export Window.

10.2 The Provider shall complete the deletion of the Instance within 30 days after the end of the Export Window. Backups are deleted or overwritten in the ordinary backup cycle, within 30 days after the Instance is deleted. Until then, backup copies remain protected under this DPA and are not used for operational purposes.

10.3 The Provider may keep copies only to the extent EU or Member State law requires, and shall then continue to protect them under this DPA.

10.4 On request, the Provider shall confirm the deletion in writing.

11. Information and audits

11.1 The Provider shall make available to the Customer the information necessary to demonstrate compliance with article 28 of the GDPR and allow for, and contribute to, audits, including inspections, by the Customer or an auditor the Customer has mandated.

11.2 The Provider shall first answer reasonable written questions and provide documentation, such as reports or certificates it holds from itself or its sub-processors. If that is not enough, for example because an authority requires it, the documentation is insufficient or a personal data breach has occurred, the Customer may carry out an audit, on these conditions:

  • (a) the Customer gives at least 30 days' written notice and agrees the scope, timing and method with the Provider, except that shorter notice applies where an earlier audit is reasonably necessary for compliance with the GDPR, for example after a personal data breach or at the request of a supervisory authority;
  • (b) an audit is carried out at most once every 12 months, unless an additional audit is reasonably necessary for compliance with the GDPR, for example because an authority requires it or a personal data breach has occurred;
  • (c) the audit takes place during normal business hours and disturbs the Provider's operations as little as possible;
  • (d) the auditor is bound by confidentiality and is not a competitor of the Provider;
  • (e) the audit covers only the processing of Personal Data for the Customer, and gives no access to other customers' data or to information that would put the security of the Service at risk; and
  • (f) each party bears its own costs, and the Customer pays the Provider's reasonable documented costs for time spent that exceeds normal assistance.

11.3 Audits of sub-processors are carried out primarily through the reports and certifications the sub-processors make available. If these are not enough to demonstrate compliance, the Provider shall use reasonable efforts to obtain further information from the sub-processor or to enable an audit of it.

11.4 Nothing in this section limits the Customer's rights, or the Provider's obligations, under article 28(3)(h) of the GDPR or the powers of a supervisory authority.

12. Liability

12.1 Liability under this DPA follows section 12 of the Terms, including its limits, exclusions and exceptions, subject to article 82 of the GDPR. This DPA does not limit the rights of data subjects against the controller or processor under article 82. Between the parties, compensation under article 82 is governed by section 12 of the Terms to the extent the law permits.

12.2 Administrative fines imposed on a party under article 83 of the GDPR for that party's own infringement are borne by that party, as stated in section 12.4(d) of the Terms.

13. Term and changes

13.1 This DPA enters into force with the Agreement and ends when the Provider has deleted all Personal Data under section 10, after any return. Sections 10.2 and 10.3 continue to apply to backup copies, and to copies kept because the law requires it, until they are deleted.

13.2 The Provider may change this DPA under section 14 of the Terms. A change that is required by a binding legal act, such as new standard contractual clauses, may take effect earlier.

14. Order of precedence, governing law

14.1 On the processing of Personal Data this DPA prevails over the Terms and the Order, except that the Region and data location stated in the Order apply. Where standard contractual clauses apply, they prevail over this DPA.

14.2 Sections 15.6 and 16 of the Terms (language, governing law and disputes) apply to this DPA. Standard contractual clauses are governed by the law stated in them.

Annex 1: Details of the processing

Subject matter and nature. Hosting and operation of the Customer's Instance of the Service, which includes storing, retrieving, organising, displaying, editing, exporting, backing up and deleting Customer Data, and providing support. If the Customer uses AI chat, content the Customer or its Users choose to send is passed to the AI Provider. Click-to-dial opens the User's own phone's dialler and logs the outcome; the Provider does not carry or record calls.

Purpose. To provide the Service to the Customer under the Agreement.

Duration. The term of the Agreement, the Export Window and the period until deletion under section 10.

Categories of data subjects. The Customer's Users; the Customer's leads, prospects and customers and their contact persons; other persons the Customer chooses to record in the Service.

Types of Personal Data.

  • identification and contact data, such as name, title, employer, email address, telephone number and address;
  • business data about the contact, such as company, role, notes, tasks, quotes, deals and the outcome of calls;
  • User account data, such as name, email address, role and login and activity records;
  • technical data, such as IP addresses and logs from the operation of the Instance; and
  • other personal data that the Customer enters in free-text fields.

The Service is not designed for special categories of personal data or data about criminal offences (section 5.3 of the Terms).

Location. The Region stated in the Order.

Annex 2: Security measures

The Provider shall maintain the following measures at a level that is reasonable for the risk and for the Service. Customer-specific details, namely the hosting provider, the Region and the provider's certifications, are set in the Order before any processing starts.

  1. Separation. The Customer Data shall be kept in the Customer's own Instance and not mixed with other customers' data.
  2. Access control. Users shall sign in with their own accounts, and roles and permissions in the Service shall limit what each User can see and do. The Provider's own access to Instances shall be limited to authorised personnel who need it for operation and support. The Provider's personnel shall use individual administrator accounts with multi-factor authentication.
  3. Encryption. Traffic between Users and the Service shall be encrypted in transit. Stored data and backups shall be encrypted at rest.
  4. Network and access protection. The Service shall be protected by network and access services; the provider is Cloudflare (Annex 3).
  5. Hosting. The Instance shall be hosted in data centres of the cloud hosting provider and in the Region named in the Order, which shall provide physical security and infrastructure protection appropriate to the risk. The Order names the hosting provider and its certifications.
  6. Backup and recovery. The Provider shall take backups of the Instance so that Customer Data can be restored. Backups shall be taken daily and kept for 30 days.
  7. Logging and monitoring. The Provider shall log and monitor the operation of the Service to detect misuse and faults. Operational and access logs shall be kept for up to 90 days.
  8. Vulnerability management. The Provider shall keep software up to date and correct known security vulnerabilities within a reasonable time.
  9. Incident management. The Provider shall have a procedure to detect, handle and notify personal data breaches under section 9.
  10. Personnel. Personnel with access to Personal Data shall be bound by confidentiality and have access only as their work requires.
  11. Deletion. Personal Data shall be deleted and returned under section 10, and storage media disposed of securely.

Annex 3: Authorised sub-processors

The Customer authorises the sub-processors below.

  1. Cloud hosting provider for the Customer's Region: the provider named in the Order (Amazon Web Services, Microsoft Azure or Oracle Cloud), in the Region stated in the Order. Purpose: hosting of the Instance and backups.
  2. Cloudflare. Purpose: network, security and access to the Service. Cloudflare handles network traffic, including IP addresses, on its global network.
  3. Google Workspace (Google). Purpose: email correspondence with the Customer. Google Workspace handles the email correspondence.
  4. The AI Provider named in the Order. Purpose: delivery of AI chat, only when the Order includes an AI Provider supplied by the Provider; content sent in AI chat is processed by that provider and any underlying model provider named in the Order.