Data Processing Addendum (DPA) — IBAM solutions AB

This Data Processing Addendum ("DPA") forms part of the agreement between the Customer (controller) and IBAM solutions AB ("Processor") and applies whenever IBAM processes Personal Data in Customer Data on Customer's behalf in connection with an IBAM application (each an "Application"). It currently covers:

• the IBAM Enhanced Messaging Widget — see Annex I; and
• the IBAM Marketing Automation app for Zendesk ("Zendesk Marketing Tool") — see Annex II.

By accepting the Terms of Use and this DPA (including by ticking the acceptance box in an Application), the person accepting confirms that they have authority to bind their organisation.

Zendesk Marketing Tool — withdrawal and new versions. In Settings, an administrator can withdraw the acceptance of the Terms and this DPA. All sending then stops immediately (all active and scheduled campaigns are paused) and nothing is deleted. IBAM keeps the history of who accepted and withdrew and when (Zendesk user ID and time only), and the recipients of the account's notifications are told. Accepting again does not restart campaigns; Customer starts them again. When a new version of the Terms or this DPA is published, customers that accepted an older version are told once; running campaigns keep running, but new campaigns, uploads and sends require the new acceptance.

1. Definitions

Terms such as personal data, processing, controller, processor have the meanings in the GDPR.

"Customer Data" means data submitted to, uploaded to, or accessed through an Application from Customer's Zendesk environment or provided by Customer (for example CSV contact lists).

"Recipient" means an individual to whom Customer sends, or intends to send, email using the Zendesk Marketing Tool.

2. Roles

• Customer is the Controller of Customer Data (including Recipients' data)
• IBAM is the Processor, acting on Customer's documented instructions, which include what Customer configures and does in the Application

IBAM acts as controller for Customer's own account, installation and billing data (for example the administrator or billing contact and subscription status). That processing is described in the Privacy Policy and is not covered by this DPA.

3. Processor obligations (Art. 28 GDPR)

IBAM shall:

1. Process personal data only on Customer's documented instructions, including as necessary to provide the Application as configured by Customer and permitted by Zendesk.
2. Ensure persons authorized to process personal data are bound by confidentiality.
3. Implement appropriate technical and organizational measures (see Annex III).
4. Not engage another processor (sub-processor) except as permitted in Section 6.
5. Assist Customer, taking into account the nature of processing, with:
   • data subject requests (Section 9)
   • DPIAs/prior consultation where relevant
   • security/breach obligations (Sections 5 and 8)
6. At the end of services, delete or return personal data per Section 11 unless retention is required by law.
7. Make available information necessary to demonstrate compliance and allow audits per Section 10.

4. Customer obligations

Customer shall ensure it has a lawful basis to process and instruct IBAM, and that it configures Zendesk permissions and Application settings appropriately.

Zendesk Marketing Tool. Customer is responsible for having a lawful basis for sending email to Recipients (consent, or legitimate interest where permitted, and compliance with applicable e-marketing rules), for honouring opt-outs, for the accuracy of data it uploads, and for the content of its campaigns. Where an individual contacts IBAM about their data, IBAM will refer them to Customer and assist Customer as set out in Section 9.

Enhanced Messaging Widget. Where Customer enables the analytics feature, Customer is solely responsible for ensuring it has a lawful basis for collecting widget interaction data from end-users (e.g. legitimate interests or consent), and for making appropriate disclosures to end-users, including cookie notices or consent banners where required by applicable law.

Where Customer enables Google Analytics integration, Customer is responsible for ensuring lawful basis and appropriate disclosures for that data flow. IBAM transmits event names only to the Customer's configured GA4 property; Google Analytics data collection is governed by Customer's own agreement with Google LLC.

5. Security (Art. 32)

IBAM implements measures appropriate to risk, including access control, least privilege, secure secret handling, tenant isolation and platform security controls. See Annex III and our Security and data handling page.

6. Sub-processing

6.1 General authorization

Customer authorizes IBAM to use the sub-processors listed in Annex IV.

6.2 Changes and objections

IBAM will update Annex IV and give Customer at least 14 days' notice before a new sub-processor starts processing Customer Data, by email to the administrator contact on file.

Customer may object within 14 days of the notice on reasonable data protection grounds. If the parties cannot resolve the objection, Customer may terminate the affected service.

6.3 Flow-down

IBAM will impose contractual obligations on sub-processors no less protective than this DPA.

7. International transfers

Where transfers outside the EU/EEA occur, IBAM ensures appropriate safeguards (e.g., EU Standard Contractual Clauses) via IBAM and/or its sub-processors.

Relevant provider resources:

• Cloudflare Customer DPA
• Cloudflare SCCs
• Render DPA
• Render subprocessors/security overview

8. Personal data breaches

IBAM will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Data and will provide available information reasonably required for Customer's response obligations.

Where IBAM is the controller of the personal data concerned, IBAM will notify the Swedish Authority for Privacy Protection (IMY) within 72 hours where required.

9. Assistance with data subject requests

IBAM will provide reasonable assistance to enable Customer to respond to data subject requests. If IBAM receives a request directly, IBAM will redirect it to Customer unless legally required otherwise.

Zendesk Marketing Tool. Administrators can use the "Privacy & data" page in the Application to look up an email address, see what is held about that person, download it as a JSON file (right of access) and erase the person (right to erasure); the whole account can be downloaded under "Download everything" (see Section 11). Erasing anonymises the person's sends (address, name, merge values, ticket ID and error text are removed; counters such as sent, opened and clicked remain so that campaign statistics stay correct), deletes the rest (sequence entries, contact-list entries, trigger events, open and click events and usage records) and removes the person from notifications. An existing opt-out is kept as the plain email address, because a person who unsubscribed must never be emailed again; the administrator can also add the person to the opt-out list when erasing. Each export and erasure is logged with counts only.

Customer can also delete campaigns, segments, templates, CSV lists and unsubscribe entries itself. For requests that cannot be completed within the Application, IBAM will assist Customer on request from a verified Zendesk administrator.

10. Audits

Customer may audit IBAM's compliance:

• primarily via written responses and reasonable documentation requests
• on-site audits only where necessary, with reasonable notice, during business hours, subject to confidentiality/security constraints

Customer bears its costs, and IBAM may charge reasonable costs for extensive requests.

11. Deletion / return

Customer Data is kept while the Application is installed, unless Customer deletes it or its retention setting removes it.

Return of data (Zendesk Marketing Tool). At any time, an administrator can download everything held for the account as one JSON file in the Application (Settings > Privacy & data > "Download everything"): campaigns, sequences, templates, segments, contact lists, send and tracking history, unsubscribes, notifications and settings. The file never includes connection tokens, secrets or IBAM's billing records. The download stays available while sending is paused or a deletion is scheduled, and each export is logged with counts only. Customer can therefore download all data held for the account, delete it itself (below), or ask IBAM to do so.

Self-service deletion (Zendesk Marketing Tool). Administrators can delete all of Customer's data in the Application (Settings > Delete my data). The administrator reads what is and is not deleted, types the account's subdomain and then the words I AGREE. Sending is paused at once. The data is deleted 7 days later, or 7 days after the subscription ends (a subscription that still renews must be cancelled first), and the deletion can be cancelled until then. A "delete now" option cancels the subscription immediately without refund and deletes everything at once. Before deleting, IBAM tells the notification recipients and removes the webhook and triggers it created in Customer's Zendesk. The deletion runs in one transaction and is verified before it is committed; the audit record contains counts only (no subdomain and no personal data).

Requests to IBAM. Customer can still ask IBAM to delete or return data. Upon termination, uninstall or a verified request from Customer, IBAM will do so within 30 days.

The following is not deleted:

• invoices and payment records in Stripe, which are accounting records kept for the period required by applicable accounting law
• campaign tickets and emails in Customer's own Zendesk, which are Customer's to remove
• database backups: the database has a point-in-time recovery window of 3 days, so data deleted by IBAM or by Customer ages out of backups within 3 days

IBAM does not create routine logical exports of the database. If one is created on demand, the hosting provider keeps it for at least 7 days and IBAM deletes it when it is no longer needed.

Product-specific details are in Annex I (widget) and Annex II (Marketing Tool).

12. Liability and precedence

This DPA does not expand liability beyond the main agreement, except where required by law. If conflict exists, this DPA governs the data processing terms.

13. Governing law

Swedish law applies and Swedish courts have jurisdiction unless mandatory law provides otherwise.