Data Processing Agreement

This Data Processing Agreement forms part of the agreement between the customer as controller and Sansa Group AB, Swedish organisation number 559111-9507, as processor. It applies when Yieldline processes personal data on the customer’s behalf. If this DPA conflicts with the main agreement on data protection, this DPA controls.

• Process personal data only on documented customer instructions, unless Union or Member State law requires otherwise.
• Ensure authorized personnel are bound by confidentiality.
• Maintain appropriate technical and organizational security measures.
• Assist the customer with data-subject requests, security, breach assessment, impact assessments, and regulator consultations where applicable.
• Delete or return customer personal data at the end of service, subject to lawful retention and backup cycles.
• Provide information reasonably necessary to demonstrate compliance and support proportionate audits.

Measures include tenant-scoped authorization, least-privilege OAuth, encrypted credential storage, TLS, EU-region primary D1 and R2 storage, pseudonymous references, structured audit trails, expiring report links, Durable Object execution locks, idempotency keys, emergency stops, bounded queues, incident alerts, backup recovery, and access-controlled support procedures. Measures may evolve without reducing overall protection.

The customer gives general authorization to use the providers listed on the Subprocessors page. Sansa Group AB remains responsible for subprocessors to the extent required by applicable law and imposes materially equivalent data-protection duties. Material additions will be posted before use where practicable. A customer may object on reasonable data-protection grounds by contacting support; the parties will seek a commercially reasonable solution.

Personal data may be transferred only through an applicable adequacy decision, the European Commission Standard Contractual Clauses, or another lawful transfer mechanism with supplementary measures where required. If the SCCs are needed, Module Two (controller to processor) is incorporated, the customer is data exporter, Sansa Group AB is data importer, Swedish law governs the clauses, and the Swedish Authority for Privacy Protection is the competent supervisory authority where the GDPR permits.

For any request by a public, judicial, intelligence, regulatory, or law-enforcement authority, Sansa Group AB will verify the requester and compulsory legal basis, document a legality and jurisdiction assessment, and notify the customer before disclosure when legally permitted. Where there are reasonable grounds to consider a request unlawful, invalid, overbroad, or disproportionate, Sansa Group AB will challenge, reject, seek clarification of, or seek to narrow it and pursue available review or protective measures. Any permitted response is limited to the minimum information required by a reasonable interpretation of the lawful request, excludes unrelated tenants and secrets, and requires approval from the Privacy Lead and a second authorized officer. Requests, assessments, challenges, notices, approvals, production manifests, and responses are recorded under the Public Authority Request Policy.

Sansa Group AB will notify the customer without undue delay after becoming aware of a personal-data breach affecting customer data and provide available information needed for the customer’s duties. Yieldline will not respond substantively to a customer data subject except on customer instruction or where legally required, and will route verified requests to the relevant customer when appropriate.

The customer is responsible for lawful instructions, transparency, legal bases, connected-account authority, data accuracy, configured retention, and responding to data subjects. The customer must not use Yieldline for unlawful discrimination, prohibited sensitive targeting, or data it has no right to process.

On reasonable written request, Sansa Group AB will provide relevant compliance information and permit a proportionate audit no more than annually unless a regulator, breach, or demonstrated material concern requires otherwise. Audits must protect other customers and security information and avoid unreasonable disruption. Liability follows the main agreement except where applicable data-protection law requires otherwise.

Send DPA, transfer, audit, or privacy requests to support@sansavision.com. The registered address is Sansa Group AB, Soldathemsgatan 20, 415 28 Göteborg, Sweden.