This Data Processing Agreement ("DPA") is an integral part of the Terms of Service (the "Terms"). It applies when Omiwato Ventures AB, registration number 559518-7674, operating as Yesper ("Yesper", "we"), processes Personal Data on behalf of a customer ("Customer", "you") as part of the Services. Capitalised terms that are not defined here have the meaning given in the Terms.
If you have a Customer Agreement with us, this DPA is part of that agreement as well. If your Customer Agreement includes a data processing agreement that both parties have signed, that signed agreement applies instead of this one. If this DPA and the Terms say different things about data protection, this DPA applies.
This DPA covers two kinds of Personal Data: the data you and your Users put into the Platform as Customer Content, and the data about your Users that we need to run the Platform for you, such as names, logins, and activity. For both, you are the controller and Yesper is your processor. The Annex describes the processing in more detail.
Personal Data that we process for our own purposes, such as account registration data and data about visitors to our website, is covered by our Privacy Policy instead.
We process Personal Data only on your documented instructions. Those instructions are this DPA, the Terms, any Customer Agreement, and the way you and your Users use the Platform: when a User uploads a document or runs an analysis, that is an instruction to process it. If you want us to do something the Platform does not do, we need to agree on it in writing first, and we may charge for it. If EU or Member State law requires us to process Personal Data in some other way, we tell you before we do it, unless the law forbids us to. If we think an instruction breaks the GDPR, we tell you immediately.
Everyone at Yesper who handles Personal Data is bound by confidentiality, either through their employment contract or through a written agreement.
We protect Personal Data with appropriate technical and organisational measures, as Article 32 GDPR requires. The Annex lists the measures. We may change them as technology and threats change.
We use other companies, called sub-processors, to help us provide the Platform, for example for cloud hosting. You authorise us to do so. The current list is published at yesper.ai/subprocessors. Before we add or replace a sub-processor, we update that list. You have 14 days from the update to object, and your objection must be based on reasonable and documented data protection reasons. If we cannot resolve your objection, your only remedy is to end the affected Subscription.
We put the same data protection obligations on each sub-processor as this DPA puts on us, and we remain responsible to you for how they perform those obligations.
Individuals have rights under the GDPR, such as seeing, correcting, or deleting their data. If someone makes such a request about data in the Platform, you handle it. If someone contacts us directly about your data, we send them to you. We help you where the Platform's functions and the information we hold allow.
We also help you meet your own duties under Articles 32 to 36 GDPR (security, breach notification, impact assessments, and prior consultation with the supervisory authority), mainly by providing our security documentation. Help that goes beyond the Platform's functions and our standard documentation may be charged at our usual rates.
If we become aware of a personal data breach that affects your Personal Data, we notify you without undue delay. The notice goes to the administrative contact registered for your account and contains what we know at that point.
We process Personal Data inside the EU/EEA. If Personal Data has to be transferred outside the EU/EEA, we use the safeguards that Chapter V GDPR requires, such as the European Commission's Standard Contractual Clauses, and you authorise those transfers.
You can export your Customer Content at any time while your Subscription runs. When the Subscription ends, you have an export period, set out in the Terms or your Customer Agreement, to take a copy of your data. You choose whether to export it or to let us delete it. When the export period is over, we delete the Personal Data we hold for you, unless EU or Member State law requires us to keep it. Backups are deleted when they are rotated out.
You can check that we follow this DPA. First, we give you the information you need, such as our security documentation and answers to a reasonable security questionnaire. If you need more, you may audit us, including by inspection, or have an auditor do it, as long as the auditor is not a competitor of ours. An audit takes place at most once every 12 months, after 30 days' written notice, during business hours, and under confidentiality. We agree the scope in advance, and you bear the cost. The audit covers how we process your Personal Data. Other customers' data and our source code are out of scope.
You are responsible for the Personal Data you process through the Platform: that you have a legal basis under the GDPR, that data subjects have received the notices and given the consents they are entitled to, and for the accuracy and contents of your Customer Content.
The Platform is built for construction and infrastructure project material. If you want to process special categories of Personal Data (Article 9 GDPR) or data about criminal convictions (Article 10 GDPR) in the Platform, you need our written agreement first.
If the EU AI Act applies to your use of the Platform, the obligations of a deployer are yours.
The limits and exclusions of liability in the Terms or your Customer Agreement also apply to this DPA. There is one cap for everything, not a separate cap for the DPA.
This DPA applies as long as we process Personal Data for you. We change it the same way we change the Terms, as set out in Section 24 of the Terms.
Swedish law governs this DPA. Disputes are handled as set out in the Terms.
Subject matter and purpose. We provide the Services under the Terms. That means hosting and processing Customer Content, AI-assisted analysis and document generation, indexing and search, authentication and access management, support, and the operation and security of the Platform.
Duration. As long as your Subscription runs, and until the data is deleted under Section 9.
Categories of data subjects. Your Users, and people who appear in your Customer Content, such as employees, clients, contractors, consultants, and contacts at authorities.
Categories of Personal Data. Whatever Personal Data you and your Users include in Customer Content, typically names, contact details, and roles in project documents, drawings, and correspondence. Also your Users' identifiers, roles, and activity in the Platform.
Technical and organisational measures. Hosting in Microsoft Azure, Sweden Central (EU); AI models run in EU regions of Microsoft Azure and Google Cloud. Encryption in transit and at rest. Role-based access control on a least-privilege basis, with single sign-on through your identity provider. Each customer's data is kept separate. Logging and monitoring of production systems. Backups. Confidentiality obligations for personnel. Incident response procedures.
Sub-processors. Listed at yesper.ai/subprocessors.