1. Parties and scope
This DPA is between the business customer that is the controller of Customer Personal Data and Sveresa, Business ID 3592316-3, Finland, operating as SvereSystems, where SvereSystems processes that data on the customer’s behalf as processor.
This DPA forms part of the relevant accepted Project Confirmation and the applicable SvereSystems Terms, or another written service agreement where expressly applicable. Together, those documents are referred to in this DPA as the Main Agreement. This DPA applies only to processing in which SvereSystems acts on the customer’s documented instructions as processor. It does not apply to SvereSystems’ own controller-side records such as project enquiries, contracts, invoices, payment records, ordinary client correspondence, accounting, legal-compliance records or SvereSystems’ own business communications.
A Website or Website + AI Presenter project does not automatically make all project information Customer Personal Data. This DPA applies only to the extent the agreed work actually requires SvereSystems to process personal data for which the customer is controller.
2. Subject matter and duration
The processing covers Customer Personal Data that the customer instructs SvereSystems to handle for an agreed Website or Website + AI Presenter project. Depending on the confirmed delivery route, this may include preparing an implementation-ready package for an existing website, producing new HTML website files, preparing AI Presenter media, carrying out the agreed final public-page review after client or developer implementation, and preparing handoff or publication instructions.
Processing lasts for the relevant project and any limited period reasonably required for completion, agreed corrections, the final review, return or deletion, backup cycles or retention required by Union or Member State law. Section 14 governs return and deletion when the processing ends.
3. Nature and purpose
Processing may include receiving, viewing, organising, minimising, drafting, transforming, storing, transmitting and deleting Customer Personal Data only as reasonably necessary to prepare or deliver the agreed project.
For an existing-site project, this may include using relevant Customer Personal Data to prepare ready-to-paste copy, section-order and KEEP / CHANGE / ADD instructions, CTA wording, AI Presenter placement or embed instructions, page-level Search & AI Readiness notes and the agreed final public-page review. For a new-HTML project, it may include using the same categories of data in the agreed portable HTML website files, related media and AI Presenter deliverables. SvereSystems does not implement changes inside the customer’s CMS or publish the delivered website files to customer hosting.
Where the customer instructs SvereSystems to provide an implementation package to the customer’s own web developer or other named implementer, SvereSystems may transmit only the project information reasonably required for that handover. The customer remains responsible for deciding that the recipient is authorised to receive the information.
4. Data and data subjects
Depending on the project, data may concern the customer’s staff, customers, reviewers, reference contacts, contractors or other people appearing in customer-supplied material. Data may include names, work contact details, public professional information, approved testimonials, images, video or audio material, role information and other ordinary project content.
WordPress, Wix, Squarespace, other CMS, hosting, cPanel, FTP/SFTP, DNS, server and similar technical access credentials must not be submitted to SvereSystems for these website projects. Payment-card data must not be submitted. Special-category data, criminal-offence data and other sensitive information should not be submitted unless it is genuinely necessary for the agreed processing, specifically documented and legally justified.
5. Customer obligations
- provide lawful documented instructions;
- have a valid legal basis for Customer Personal Data;
- provide required privacy information to data subjects;
- submit only data reasonably necessary for the project;
- remove or anonymise unnecessary personal data where practical;
- ensure rights to supplied images, testimonials and other material;
- where the customer asks SvereSystems to hand project material to the customer’s own developer or other implementer, ensure that recipient is authorised to receive the relevant Customer Personal Data.
6. Processor obligations
- process Customer Personal Data only on documented instructions unless Union or Member State law requires otherwise, and inform the customer of that legal requirement before processing unless the law prohibits such information;
- maintain confidentiality and ensure persons authorised to process Customer Personal Data are subject to appropriate confidentiality obligations;
- apply appropriate technical and organisational measures proportionate to the service;
- assist reasonably with data-subject requests and, taking into account the nature of the processing and the information available to SvereSystems, with the customer’s obligations under Articles 32–36 GDPR where applicable, including security, personal-data breach assessment and notification, data-protection impact assessments and prior consultation;
- inform the customer without undue delay if an instruction appears to infringe applicable data-protection law;
- apply data minimisation where practical.
SvereSystems does not require or request WordPress, Wix, Squarespace, other CMS, hosting, cPanel, FTP/SFTP, DNS or server credentials for these website projects. For an existing-site route, the customer or the customer’s own developer implements the supplied changes. For a new-HTML route, the customer, hosting provider, IT support or web developer publishes the supplied files.
7. AI-assisted processing
Where reasonably necessary for the agreed project, SvereSystems may use AI-assisted tools for drafting, organisation, translation, visual/media preparation or other production tasks. SvereSystems applies data minimisation and avoids including unnecessary identifying details in prompts or production inputs.
AI-assisted outputs are working material and are human-reviewed before client-facing delivery. The service does not use solely automated decision-making that produces legal or similarly significant effects for data subjects.
8. Sub-processors
The customer gives general written authorisation for SvereSystems to use sub-processors reasonably necessary for the agreed processing. Categories may include website and hosting infrastructure, forms, cloud and email services, CRM, video and media hosting, and AI or media-production tools.
Before adding or replacing a sub-processor that will process Customer Personal Data under this DPA, SvereSystems will inform the customer in writing and give the customer a reasonable opportunity to object before the change takes effect.
Where SvereSystems engages a sub-processor to process Customer Personal Data, SvereSystems will impose data-protection obligations appropriate to that processing and substantially equivalent to the relevant obligations under this DPA. SvereSystems remains responsible to the customer for the performance of the sub-processor’s applicable data-protection obligations.
A developer or other implementer independently appointed and controlled by the customer is not a SvereSystems sub-processor merely because SvereSystems sends that recipient an implementation package on the customer’s documented instruction.
Information about the sub-processors relevant to a particular project is available from SvereSystems on request.
9. International transfers
Any transfer of Customer Personal Data outside the EU/EEA will take place only on the customer’s documented instructions, including the instructions reflected in the Main Agreement and this DPA, unless Union or Member State law requires otherwise. Where a transfer mechanism is required, SvereSystems will rely on an applicable lawful mechanism and safeguards, such as an adequacy decision or Standard Contractual Clauses where relevant.
10. Security measures
- need-based access to business systems;
- use of established service providers and account-security controls;
- data minimisation and separation of project records where practical;
- keeping credentials and payment-card data out of ordinary intake forms;
- reasonable deletion of unnecessary working data;
- secure transport provided by the relevant platforms.
11. Data-subject requests
If SvereSystems receives a request relating to Customer Personal Data for which the customer is controller, SvereSystems will notify or refer the request to the customer where appropriate and provide reasonable assistance, taking into account the nature of the processing.
12. Personal-data breach
SvereSystems will notify the customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data processed under this DPA and will provide reasonably available information needed for the customer’s assessment and notification duties.
13. Compliance information
On reasonable written request and subject to appropriate confidentiality, SvereSystems will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR and will allow for and contribute to audits, including inspections, as required by Article 28(3)(h). Where documentation can reasonably demonstrate compliance, the parties should use a documentation-first review. Any audit or inspection must be proportionate, protect other clients’ confidential information and personal data, and be arranged with reasonable notice where circumstances allow so as to minimise unnecessary disruption.
14. Return and deletion
After the relevant processing ends, SvereSystems will, at the customer’s choice, return or delete Customer Personal Data and delete existing copies unless Union or Member State law requires storage. Where technically applicable, limited copies may remain temporarily in backups or provider logs until overwritten through normal retention cycles, during which they remain protected and are not used for a new purpose.
This does not require deletion of separate controller-side records such as SvereSystems’ own contract, invoice, payment, accounting or legal-compliance records.
15. Liability, hierarchy and law
For data-protection matters, this DPA prevails over conflicting general terms to the extent of the conflict. The liability and dispute provisions of the Main Agreement otherwise apply subject to mandatory law.
This DPA is governed by Finnish law. Questions: info@sveresystems.com.
