1.1 This agreement (the "Agreement") has been entered into between the user company (the "Data Controller") and Crediwire ApS (the "Data Processor" or "Crediwire"), each referred to as a "Party" and collectively the "Parties".
1.2 The Data Processor processes the types of personal data on behalf of the Data Controller that are listed in Appendix 1, and which are necessary for the use of the Crediwire service. The personal data relates to the data subjects listed in Appendix 1.
1.3 When the Data Controller transfers financial data, the Data Controller instructs the Data Processor to anonymize all data for use in statistics and benchmarking.
2.1 The Data Processor may only process personal data for purposes that are necessary for the Data Controller to use the Crediwire service.
3.1 To the extent that the Data Controller processes personal data in connection with the use of the Crediwire service, the Data Controller is responsible for the existence of a legal basis for processing, including that any consent is specific, freely given, unambiguous and informed. The Data Controller is obliged, at the Data Processor's request, to explain in writing and / or document the basis for processing.
3.2 The Data Controller is responsible for providing data subjects with the information required under Articles 13 and 14 of the GDPR in relation to processing carried out on its behalf under this Agreement. The Data Processor shall provide information about its processing reasonably required to assist the Data Controller in meeting that obligation. Crediwire’s Privacy Policy at https://www.crediwire.com/privacy-policy describes processing for which Crediwire acts as controller.
4.1 The Data Processor shall process personal data only on the Data Controller’s documented instructions, including with regard to transfers to a third country or an international organisation, unless required to do so by Union or Member State law to which the Data Processor is subject. In that case, the Data Processor shall inform the Data Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. This Agreement and the agreed service constitute the initial documented instructions. Processing shall be limited to making the Crediwire service available under this Agreement and the terms and conditions at https://www.crediwire.com/terms-and-conditions ("Terms and Conditions"). The Data Processor shall comply with applicable data protection legislation.
4.2 The Data Processor must take all necessary technical and organizational security measures, including any additional measures, required to ensure that the personal data specified in sec. 1.2 and 1.3 is not accidentally or unlawfully destroyed, lost or impaired or brought to the knowledge of unauthorized third parties, abused or otherwise processed in a manner which is contrary to the Danish data protection legislation in force at any time.
4.3 The Data Processor must ensure that employees authorized to process the personal data have committed themselves to confidentiality or are under appropriate statutory obligations of confidentiality.
4.4 If so requested by the Data Controller, the Data Processor must state and/or document that the Data Processor complies with the requirements of applicable data protection legislation, including the requirement for documentation of data flows and written procedures/policies for the processing of personal data.
4.5 If the Data Processor processes personal data in another EU/EEA member state, the Data Processor is obligated to comply with applicable legislation regarding security measures in the country in question.
4.6 The Data Processor shall notify the Data Controller without undue delay and in any event within 48 hours after becoming aware of a personal data breach, a suspicion that data protection rules have been breached, or other irregularities in connection with the processing of personal data. Initial notification shall not await completion of the investigation or a full impact assessment. The Data Processor shall provide the information then available about the nature of the incident, affected data and data subjects, likely consequences and measures taken or proposed, together with a contact for further information. Missing information shall be provided without undue delay as it becomes available. The Data Processor shall assist the Data Controller in assessing the incident and meeting its obligations to notify the supervisory authority and communicate with affected data subjects under Articles 33 and 34 of the GDPR.
4.7 The Data Processor must notify the Data Controller if there is an interruption in operations of IT systems as soon as is reasonable.
4.8 The Data Processor shall make available to the Data Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and this Agreement, and shall allow for and contribute to audits, including inspections, conducted by the Data Controller or an auditor mandated by the Data Controller. Audits may take place at reasonable intervals and where there are indications of non-compliance, including following a relevant personal data breach. The Data Processor shall provide its latest annual ISAE 3402 audit report on request. Existing assurance reports may be taken into account to avoid unnecessary duplication but do not replace the Data Controller’s right to obtain relevant information or conduct necessary audits and inspections. The Parties shall coordinate scope, timing, reasonable notice and confidentiality safeguards proportionately, taking account of urgency and the need to protect other customers’ data. Such arrangements shall not prevent or unreasonably delay exercise of these rights. The Data Controller shall compensate the Data Processor for reasonable time spent assisting with audits, without making advance payment a condition for necessary cooperation or limiting statutory audit rights.
4.9 The Data Processor and any of its sub-data processors must send requests and objections from data subjects to the Data Controller, for the Data Controller's further handling, unless the Data Processor is entitled to handle such requests and objections itself. If requested by the Data Controller, the Data Processor must assist the Data Controller in handling any such requests and/or objections.
4.10 Taking into account the nature of the processing and the information available to it, the Data Processor shall assist the Data Controller in ensuring compliance with Articles 32 to 36 of the GDPR. This includes assistance with security of processing, personal data breaches, data protection impact assessments and prior consultation with the competent supervisory authority where required. On request, the Data Processor shall provide relevant available descriptions of the processing, data flows, recipients, locations, technical and organisational measures, identified risks and safeguards, and relevant supporting records. The Data Processor shall cooperate in clarifying those matters and responding to relevant questions from the supervisory authority. The Data Controller remains responsible for its assessment and consultation decisions.
4.11 The Data Processor shall immediately inform the Data Controller if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions, and shall seek clarification or a lawful revised instruction. An instruction does not relieve the Data Processor of its own obligations under applicable data protection law.
5.1 The Data Processor may engage sub-data processors in accordance with the general written authorisation and notification procedure in section 5.2. The Data Processor may otherwise disclose personal data to third parties only on the Data Controller’s documented instructions or where required by Union or Member State law to which the Data Processor is subject. In the latter case, the Data Processor shall inform the Data Controller of that legal requirement before disclosure, unless that law prohibits such information on important grounds of public interest. Transfers outside the EU/EEA are additionally subject to sections 5.4 and 5.5.
5.2 The Data Controller hereby grants the Data Processor a general written authorisation to engage Sub-processors. The Data Processor shall provide the Data Controller with at least one month’s prior written notice of any intended addition or replacement of a Sub-processor. The Data Controller may raise reasonable and relevant objections to such changes before they take effect.
5.3 The Data Processor shall enter into a binding written agreement with each sub-data processor imposing the same data protection obligations as those set out in this Agreement, in particular providing sufficient guarantees to implement appropriate technical and organisational measures so that the processing meets GDPR requirements. The Data Processor remains fully liable to the Data Controller for the performance of the sub-data processor’s data protection obligations.
5.4 The use of sub-data processors, including processing locations, remote access and onward transfers, shall comply with this Agreement and applicable data protection law. Any transfer of personal data outside the EU/EEA, including access constituting such a transfer, is subject to section 5.5 and Chapter V of the GDPR. A contractual choice of law does not itself constitute a lawful transfer mechanism.
5.5 Where Personal Data is transferred to a Sub-processor in a country outside the EU/EEA, or to an international organisation, the Data Processor shall ensure that the transfer is made in accordance with Chapter V of the General Data Protection Regulation.
5.5.1 Where the recipient is covered by an adequacy decision adopted by the European Commission pursuant to Article 45 of the General Data Protection Regulation, the transfer may be based on that adequacy decision. This includes transfers made under the EU–US Data Privacy Framework, provided that the recipient is validly certified and the transfer falls within the scope of that certification.
5.5.2 Where no applicable adequacy decision exists, the Data Processor shall ensure that appropriate safeguards are in place pursuant to Article 46 of the General Data Protection Regulation. Such safeguards may include the applicable module of the European Commission’s Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, together with any supplementary measures required in light of the circumstances of the transfer.
5.5.3 The Data Processor shall monitor the continued validity of the applicable transfer mechanism. If the transfer mechanism ceases to provide a lawful basis for the transfer, or if the relevant Sub-processor can no longer comply with its obligations, the Data Processor shall without undue delay implement an alternative lawful transfer mechanism or suspend the affected transfer and inform the Data Controller.
5.6 The sub-data processors used for the services covered by this Agreement are listed in Appendix 2, together with their services, relevant processing and access locations, and applicable transfer mechanisms. The applicable services depend on the Data Controller’s agreed use of Crediwire. Changes to sub-data processors are subject to section 5.2. The Data Processor shall keep Appendix 2 current and provide information about applicable transfer safeguards on request, subject to necessary redactions.
6.1 The Parties’ liability is regulated by ordinary Danish rules on tort and damages. However, no Party is entitled to claim damages for indirect losses or consequential damage irrespective of whether these are suffered by the Data Controller, the Data Processor or a third party. Losses in relation to lost business potential, loss of profit, operating loss, loss of goodwill, loss of data, including as part of the restoration of data, will always be considered indirect losses or consequential damage.
6.2 The Data Processor's total liability to pay damages under the Agreement is capped in accordance with sec. 12 in the Terms and Conditions.
7.1 The Agreement becomes effective according to sec. 15 of the Terms and Conditions.
7.2 The Agreement will terminate in accordance with sec. 15 of the Terms and Conditions. However, the Data Processor remains subject to the obligations stipulated in this Agreement, as long as the Data Processor processes personal data on behalf of the Data Controller.
7.3 Following termination of the services involving processing, the Data Processor shall, at the Data Controller’s choice, delete or return all personal data processed on its behalf and delete existing copies, including copies held by sub-data processors, unless Union or Member State law requires storage of the personal data. Returned data shall be supplied on an ordinary machine-readable medium determined by the Data Processor.
7.4 Where immediate removal from backups is not technically practicable, remaining backup copies shall be kept protected, excluded from normal use and deleted through the applicable documented backup expiry cycle. The Data Processor shall provide information about that cycle on request. If a backup is restored, the applicable deletion instructions shall be reapplied before the restored data is made available for normal use. This provision does not authorise retention beyond the applicable instructions or legal requirements.
7.5 The Data Processor shall confirm completion of return or deletion on request, identifying any remaining backup copies and their expiry arrangements or any legally required retention. Data retained because Union or Member State law requires storage shall remain protected and shall be processed only for that legal requirement until deletion is permitted.
8.1 This Agreement is governed by Danish law.
8.2 Any claim or dispute arising from or in connection with this Agreement is subject to Danish law. Any claim or dispute must be brought before the City Court of Copenhagen.
For user-companies that transfer/disclose data to other companies (e.g. accountants, lawyers, or estates in bankruptcy):
Data subjects:
Types of personal data:
For user-companies transferring/disclosing their own data (SMEs):
Data subjects:
Types of personal data:
For user-companies only accessing other user-companies’ data (e.g. banks)
Data subjects:
Types of personal data:
For each category above, the actual scope follows the agreed service and the Data Controller’s instructions. Where the agreed service includes processing third-party financial data or documents, the relevant data subjects include the individuals identified in those records and the data types include the information described above. Authorised access to another company’s data does not by itself determine controller or processor roles for that data.
Processing may include collection, import, storage, structuring, analysis, presentation, authorised sharing, export and deletion. Where included in the agreed service, this includes AI-assisted document extraction, text analysis and enrichment using public sources. Processing continues for the service duration and any subsequent return, deletion or lawful retention under section 7. Special-category data, identity documents and new processing purposes require prior assessment and agreed instructions before introduction.
The following providers are used insofar as they process personal data on behalf of the Data Controller for the agreed service. A provider’s processing solely for Crediwire’s own controller purposes is outside this Agreement. The services and permitted data below define the authorised scope.
Provider and relevant entities: Amazon Web Services, Inc. (United States). AWS infrastructure for the Frankfurt region is provided by A100 ROW GmbH (Germany).
Service and permitted data: Cloud infrastructure for the Crediwire platform, including hosting, storage, databases, backups, logs and AI-assisted document extraction through Amazon Bedrock. Document extraction is performed by AWS in Frankfurt using in-region inference only. The extraction-model developer does not receive the prompts or outputs. CloudFront distributes frontend application code; it does not distribute customer financial records or uploaded documents, but delivery involves IP addresses and request metadata.
Processing and access locations: Regional platform hosting and document extraction take place in Frankfurt, Germany (eu-central-1). Frontend assets are delivered through CloudFront’s global edge network. Where Crediwire agrees to share customer data for AWS support, AWS lists support processing locations in Australia, Canada, Costa Rica, Egypt, France, Germany, Hong Kong, India, Ireland, Italy, Japan, South Africa, South Korea, Taiwan and the United States. These are potential support locations, rather than a statement that data is routinely processed in every listed location.
Transfer safeguards: AWS’s Data Processing Addendum and Supplementary Addendum apply. Where required under the AWS terms for a transfer outside the EU/EEA, the European Commission’s 2021 Standard Contractual Clauses apply, including the processor-to-processor clauses where Crediwire acts as processor. All transfers remain subject to section 5.5 and any supplementary measures required for the relevant transfer.
Provider and relevant entities: Google Cloud EMEA Limited (Ireland). Relevant onward recipients include Google LLC (United States) and Google’s service and support subprocessors.
Service and permitted data: Business email and collaboration, including necessary correspondence, contact details, attachments and administration records, insofar as these are processed on behalf of the Data Controller. Processing solely for Crediwire’s own business administration is outside this Agreement.
Processing and access locations: International storage and processing under the Google Workspace Business Starter service; no EU-only storage or processing commitment applies. Google’s published Workspace arrangements include infrastructure, maintenance and support in the EU/EEA and other countries, including the United States, United Kingdom, Australia, Argentina, Brazil, Canada, Chile, Colombia, El Salvador, Hong Kong, India, Israel, Japan, Malaysia, Mexico, the Philippines, Singapore, South Korea, Sri Lanka, Switzerland and Taiwan. The applicable locations depend on the activity and service; this is not a claim that Crediwire’s data is processed in every listed country or an exhaustive list of possible locations. Maintenance and support access is limited and authorised under Google’s service arrangements.
Transfer safeguards: Google’s Cloud Data Processing Addendum applies. Covered transfers to Google LLC in the United States rely on the EU–US Data Privacy Framework while valid certification and coverage apply, including its onward-transfer requirements. Other restricted transfers are governed by the applicable Standard Contractual Clauses under that Addendum where no applicable adequacy decision or other lawful transfer solution applies.
Provider and relevant entities: The Rocket Science Group, LLC, trading as Mailchimp (United States), a covered entity under Intuit’s Data Privacy Framework certification.
Service and permitted data: Automated and transactional email delivery. Permitted data is limited to necessary recipient/contact details, message content, links and limited file names or listings. Uploaded file contents and financial datasets are excluded.
Processing and access locations: Mailchimp’s servers are located in the United States. Its published subprocessor arrangements also identify customer support in the United States and Greece, and integration services in Germany and Romania. Applicable onward processing depends on the service used; the listed locations do not constitute an exclusive processing or access-country commitment.
Transfer safeguards: Mailchimp’s Data Processing Addendum applies. Covered transfers to Mailchimp in the United States rely on the EU–US Data Privacy Framework under Intuit’s certification while valid certification and coverage apply. The applicable Standard Contractual Clauses are incorporated where required, including where a transfer is not covered by the Framework or the Framework no longer provides a lawful transfer basis.
Provider and relevant entities: Intercom R&D Unlimited Company (Ireland). Service and support affiliates include Intercom, Inc. (United States), Intercom Software UK Limited (United Kingdom) and Intercom Software Australia Pty Ltd (Australia).
Service and permitted data: Customer messaging and support, using necessary user/company identifiers, consent-based events and support messages. SMS, phone and AI features are not enabled and are outside the authorised scope described here.
Processing and access locations: The EU workspace is hosted in Dublin, Ireland (AWS region eu-west-1). Intercom’s EU-hosting arrangements also identify EU email infrastructure, including Belgium, with onward transmission through recipients’ email systems. Regional hosting does not exclude international support. Under Intercom’s regional terms, support issues requiring workspace access are normally handled by the regional team; urgent workspace access by support staff outside the designated region requires customer permission and is limited to the issue. Relevant support affiliates operate in Ireland, the United States, the United Kingdom and Australia.
Transfer safeguards: Intercom’s Data Processing Addendum and Regional Data Hosting Addendum apply. Covered transfers to Intercom, Inc. in the United States rely on its EU–US Data Privacy Framework certification while valid certification and coverage apply. The applicable Standard Contractual Clauses and any required supplementary safeguards govern other restricted transfers where required; Intercom’s DPA provides for SCCs as a fallback if DPF ceases to apply. DPF certification is attributed to Intercom, Inc., not to the entire Intercom group.
Provider and relevant entities: OpenAI Ireland Ltd. (Ireland). Onward recipients include OpenAI affiliates and the applicable infrastructure, support and other service providers used to deliver the API service.
Service and permitted data: Public web research and enrichment using public company identity, website and research context only. Confidential uploads, extracted information and extraction history are excluded. Public company information may still identify individuals, including sole traders and company representatives.
Processing and access locations: International processing; no EU-only processing commitment applies. OpenAI affiliate processing locations include Ireland, the United States, the United Kingdom and Japan. Its infrastructure and support providers operate in additional countries, including Canada, Australia, India, Singapore and the Philippines. These are examples of published locations, not an exhaustive country list or a statement that all locations are used for every request.
Transfer safeguards: OpenAI’s Data Processing Addendum applies. Transfers from OpenAI Ireland Ltd. to recipients outside the EU/EEA are subject to the applicable Standard Contractual Clauses or an applicable adequacy decision, as provided in that Addendum. OpenAI identifies SCCs as the transfer mechanism among its affiliates. No reliance on DPF certification is asserted for OpenAI in this Agreement.
Provider and relevant entities: Anthropic Ireland, Limited (Ireland). Onward recipients include the applicable Anthropic affiliates, infrastructure providers and service providers used to deliver the commercial API service.
Service and permitted data: Alternative provider for public web research and enrichment, using public company identity, website and research context only. Confidential uploads, extracted information and extraction history are excluded. Public information may still contain personal data. This entry concerns the commercial API service.
Processing and access locations: Data is stored in the United States. Under Anthropic’s published default arrangements, processing may take place in the United States and selected countries in Europe, Asia and Australia. Support, safety review and incident response may also take place where Anthropic and its affiliates operate. No EU-only processing or exhaustive country-list commitment applies.
Transfer safeguards: Anthropic’s Data Processing Addendum is incorporated into its Commercial Terms of Service. The applicable European Commission Standard Contractual Clauses, including Module Three where the parties act as processor and sub-processor, apply to the extent required for restricted transfers, together with applicable technical and organisational safeguards. No reliance on DPF certification is asserted for Anthropic in this Agreement.
All international transfers remain subject to section 5.5. A European contracting entity or hosting location does not itself exclude international access or onward processing. Where location descriptions are not exhaustive, the Data Processor shall make information about relevant recipients, processing and access countries, and applicable safeguards available to the Data Controller on request, subject to necessary redactions. Supplier changes remain subject to section 5.2; descriptions of possible supplier locations do not authorise processing beyond this Agreement or the Data Controller’s instructions.
.svg)
