Data Processing Agreement

Last modified: 2026-07-16

Disclaimer: This is a template document. Not legal advice. Have a Swedish data protection lawyer review before relying on it for production contracts. Last updated 2026-05-11.

Data Processing Agreement (DPA)

Version: v1.1-2026-05-11

This Data Processing Agreement ("DPA") forms part of the main service agreement ("Agreement") between the Customer ("Controller") and Naetive ("Processor") and governs the processing of personal data by Naetive on behalf of the Customer in accordance with Regulation (EU) 2016/679 ("GDPR").

1.Definitions

The following terms are used throughout this DPA with the meanings given below.

Agent — an automated software program operated by the Customer that sends requests to one or more AI language models (for example, a customer-service bot, a document-drafting assistant, or a prospecting tool).

AI Language Model (LLM) — a large language model such as Claude (Anthropic), GPT-4 (OpenAI), or Mistral, which receives a text prompt and returns a generated text response.

Routing Manifest — a structured document, generated by Naetive at onboarding and signed by both parties, that specifies for each category of task the Agent performs: which provider will handle requests, which data-handling rules apply, and which regulatory triggers are relevant. The Routing Manifest is the contractual basis for all data flows under this DPA.

Agent Audit Bundle — a compliance package produced by Naetive for each Agent, consisting of the Agent's capability profile, its Routing Manifest, automated compliance findings, and regulatory citations. The Bundle is cryptographically signed and each entry is linked to the previous one so that any tampering is detectable (see "Tamper-evident audit log" below).

Capability Class — a category describing the type of task an Agent performs, as declared in the Routing Manifest. Examples: execute_sql (the Agent can query a database), http_call_external (the Agent can make calls to external web services), code_execution (the Agent can run code). The Capability Class determines which Routing Tier applies to a given request.

Routing Tier — a named data-handling policy that governs where a request is sent and what sovereignty guarantees apply. Three tiers are used under this DPA; see Section 8 and Schedule A.

Auditor — Naetive's automated compliance reviewer: an AI model (hosted on EU-sovereign infrastructure) that periodically samples a share of the Customer's requests, checks them against the Routing Manifest, produces compliance findings, and proposes revisions. The Auditor never operates synchronously in the request path for standard requests; it runs asynchronously in the background.

Tamper-evident audit log — a log in which each new entry contains a cryptographic fingerprint (hash) of the previous entry. If any historical record is altered or deleted, the chain of fingerprints breaks and the tampering is detectable. Naetive's orchestration_logs table uses this mechanism.

BYOK (Bring Your Own Key) — an arrangement in which the Customer provides their own API credentials for a designated AI provider (e.g. their own Anthropic account key). Naetive routes requests using the Customer's key; the Customer is therefore the account-holder with that provider and is responsible for maintaining their own data-processing agreement with the provider.

EU-only mode — a per-Agent setting that, when enabled, forces all routing for that Agent to EU-resident providers only and blocks any request that cannot be served within the EEA. Every blocked attempt is recorded in the tamper-evident audit log.

2.Parties

Processor

• Legal form: Aktiebolag (Swedish AB), in formation
• Operating name: Naetive
• Represented by: Einar Näslund
• Organisation number: (registered upon incorporation — personnummer used until then)
• Country: Sweden
• Contact: einar.naslund@naetive.eu

Controller

• Legal entity name: Gozinto AB
• Organisation number: (completed at signing)
• Country: Sweden
• Contact (DPO or equivalent): einar.naslund@gozinto.se

3.Subject matter and duration

Subject matter: Provision of an AI proxy and compliance infrastructure service. The Customer connects their AI Agents to Naetive's endpoint instead of connecting directly to an AI provider. Naetive then routes each request to the appropriate provider according to the Customer's Routing Manifest, returns the model's response, and records a tamper-evident audit trail. Naetive also generates and maintains Agent Audit Bundles used as compliance evidence.

Duration: This DPA remains in force for as long as the Processor processes personal data on behalf of the Controller under the Agreement.

4.Nature and purpose of processing

The Processor processes personal data for the following purposes:

• Onboarding — generating the Customer's Routing Manifests and Agent Audit Bundles via the Auditor at the start of the service.
• Request routing — forwarding each AI request to the provider designated by the Routing Manifest for that Capability Class.
• Billing — recording actual provider costs versus the cost the Customer would have paid without Naetive, in order to calculate Shared Savings fees.
• Compliance audit trail — creating and retaining the tamper-evident log that serves as evidence under GDPR Articles 12–13 and EU AI Act Articles 13 and 26 (deployer obligations).
• Fault attribution — determining after the fact whether an unwanted outcome originated from the Customer's input, Naetive's routing logic, or the upstream AI provider.
• Performance optimisation — benchmarking provider latency and reliability, and tuning routing decisions.
• Ongoing compliance monitoring — the Auditor asynchronously samples a share of requests to verify that routing continues to match the Routing Manifest and to flag compliance risks.

5.Categories of data subjects

• The Controller's end users
• The Controller's employees, contractors, and operators
• The Controller's Agents (as automated actors)
• Any third party whose personal data is included in prompts submitted by the Controller to the service

6.Categories of personal data

• Prompt content — free-text submitted to the service. May contain personal data of any category that the Controller chooses to submit.
• Model responses — the AI provider's output.
• Identifiers and metadata — Agent ID, session ID, request timestamp, model selected, Routing Tier used.
• Routing Manifest declarations — Capability Class assignments, Routing Tier per class, regulatory trigger mappings.
• Auditor findings — automated compliance assessments and risk attributions stored as part of the Agent Audit Bundle.
• Performance metrics — latency, token counts, success or failure flags.

7.Special categories of data (Article 9 GDPR)

The Customer is responsible for ensuring that special categories of personal data under GDPR Article 9 (health data, biometric data, data concerning racial or ethnic origin, etc.) are only submitted under the EU-Managed Routing or Customer-Key Routing tiers. The Cost-Optimised Routing tier must not be used for special-category data or for the restricted data types declared by the Customer in their Agent configuration (for Gozinto: customer_pii, company_financials, contact_emails).

At onboarding, the Auditor will assign Capability Classes involving sensitive data to an approved tier and will not generate a Routing Manifest that maps special-category tasks to the Cost-Optimised Routing tier.

8.Sub-processors

The Controller grants the Processor general written authorisation to engage sub-processors, subject to: - A current public list maintained at https://naetive.eu/legal/subprocessors - Notification to the Controller of any addition or replacement, with at least 30 days' opportunity to object - Equivalent contractual data-protection obligations imposed on each sub-processor

Customer-Key Routing exception: Where the Customer uses the Customer-Key Routing tier and supplies their own API key for a designated provider (e.g. their Anthropic Team account), that provider processes data under the Customer's own direct agreement with the provider. In this case the provider is not acting as Naetive's sub-processor. The Customer warrants that they hold a valid data processing agreement with the designated provider before activating that tier for that provider.

9.Data location

Data residency is determined by the Routing Tier declared in the Customer's Routing Manifest for each Capability Class. The three tiers are:

Audit infrastructure — regardless of Routing Tier, the tamper-evident audit log and all Agent Audit Bundles are always stored EU-only (database hosted in Frankfurt; application server in EU West).

Auditor — the Auditor runs on EU-Managed infrastructure (OVH / Scaleway, France) in all cases.

Customers requiring all requests to stay within the EEA may activate EU-only mode on an Agent. When enabled, any request that cannot be served by an EU provider is blocked and the block is recorded in the audit log as compliance evidence.

10.Security of processing (Article 32 GDPR)

The Processor implements at minimum:

• Encrypted connections (TLS 1.2 or higher) for all data in transit
• Encrypted storage (AES-256) for all data at rest, including the audit database
• Per-Agent access control via bearer tokens (API keys)
• Customer API keys for third-party providers stored encrypted at rest using industry-standard symmetric encryption; never stored in plain text
• Tamper-evident, hash-chained audit log — each log entry is cryptographically linked to the previous one so that any alteration is detectable
• EU-only routing enforced at the application layer for EU-Managed Routing and when EU-only mode is activated
• Automated compliance monitoring by the Auditor
• Strict database access controls — no unauthenticated access permitted
• Right-to-erasure: the Customer may delete all personal data for an Agent by calling the erasure endpoint or by written request to einar.naslund@naetive.eu

11.Assistance to the Controller

The Processor will assist the Controller with:

• Responding to data subject requests under GDPR Articles 15–22 (access, rectification, erasure, restriction, portability, objection)
• Data Protection Impact Assessments (Article 35 GDPR)
• Personal data breach notification (Articles 33–34 GDPR) — without undue delay and at the latest within 72 hours of becoming aware
• EU AI Act Article 13 transparency obligations — a machine-readable and PDF compliance export is available at any time via the Customer portal
• EU AI Act Article 26 Deployer Evidence Pack — the Agent Audit Bundle serves as the primary evidence artefact

12.Audits

The Controller, or an auditor mandated by the Controller, may audit the Processor's compliance with this DPA at reasonable intervals (no more than once per twelve months absent a security incident) and with at least 30 days' written notice. Audit costs are borne by the Controller.

The tamper-evident audit log and Agent Audit Bundle exports are available at any time via the Customer portal and serve as the primary evidence for remote audits. For Customers subject to DORA (Digital Operational Resilience Act), these records and the audit rights in this clause satisfy the contractual requirements for ICT third-party risk management under DORA Article 28.

13.International transfers

Where personal data is transferred outside the EEA — under Customer-Key Routing to a US-based provider, or under Cost-Optimised Routing — such transfers are governed by Standard Contractual Clauses (Controller-to-Processor, Decision (EU) 2021/914) entered into by the Processor with each sub-processor. The current list of sub-processors and their transfer safeguards is published at /legal/subprocessors.

Customers who require strict EU-only processing must either set all Capability Classes to the EU-Managed Routing tier in their Routing Manifest, or activate EU-only mode on each relevant Agent.

14.Liability

Liability under this DPA is governed by the limitation-of-liability clauses of the main Agreement.

15.Termination and return / deletion of data

Upon termination of the Agreement, the Processor will, at the Controller's choice, delete or return all personal data within 30 days. Exception: the tamper-evident audit log must be retained for 7 years where required by EU AI Act Article 12 or applicable sector regulation, unless the Controller provides written exemption in advance. Customer API keys for third-party providers are deleted within 24 hours of termination.

16.Governing law and jurisdiction

This DPA is governed by Swedish law. Disputes are subject to the exclusive jurisdiction of the courts of Stockholm, Sweden.

17.Schedule A — Routing Tiers and Sub-processor Chains

17.1Inference (varies by Routing Tier)

17.2Audit infrastructure (all tiers)

18.Signatures