Data Processing Addendum

Public version 1.2 · 16 October 2026

1. Parties

This Data Processing Addendum is entered into between:

The Customer (the controller)

The Customer is the company that has entered into an agreement with Keystone Labs ApS to use Impakta (the Main Agreement).
This Data Processing Addendum forms part of the Main Agreement and takes effect when the Main Agreement is accepted. No separate signature is required.

The Processor

Name: Keystone Labs ApS
Danish company registration number (CVR): 46087399
Address: Webersvej 49, 7500 Holstebro

Contact for data protection and personal data breaches:

Name: Daniel Malmros
Email: dpa@impakta.io

2. Scope of this agreement

This agreement governs the Processor’s processing of personal data on behalf of the Customer in providing the platform. The purpose, scope and duration of the processing are described in Annex A.

The Customer is responsible for having a lawful basis for processing, informing data subjects and providing lawful instructions.

This agreement takes precedence over any other contractual terms concerning the processing of personal data.

Processing by the Processor for its own purposes, such as its own invoicing, falls outside this agreement and is described separately in the Processor’s privacy policy.

The Customer is responsible for having a lawful basis for processing, informing data subjects and providing lawful instructions.

This agreement takes precedence over any other contractual terms concerning the processing of personal data.

Processing by the Processor for its own purposes, such as its own invoicing, falls outside this agreement and is described separately in the Processor’s privacy policy.

3. Customer instructions

The Processor shall process personal data only on the Customer’s documented instructions. Those instructions comprise this agreement, the Customer’s actions within the platform within the scope of Annex A and any subsequent written instructions.

The Processor shall not use the Customer’s platform content for its own purposes.

If EU or national law requires other processing, the Processor shall inform the Customer before carrying out that processing, unless the law prohibits it from doing so.

The Processor shall immediately inform the Customer if, in its opinion, an instruction infringes data protection law. The processing concerned shall be suspended until the matter is resolved.

Reading uploaded documents, such as invoices and receipts, using OpenAI is part of the platform’s core service. AI-assisted suggestions, including matching, field completion and emission factor selection, are optional. The Customer’s choices in the platform’s security settings form part of its instructions. Only the necessary line-item and document content is transferred to OpenAI, and only when the Customer uploads or imports a file for document reading or uses AI suggestions.

When the Customer connects its own systems, such as ERP systems or an AI assistant via MCP, data is transferred to and from those systems on the Customer’s instructions. The providers of those systems are not sub-processors of the Processor.

The Processor shall not use the Customer’s platform content for its own purposes.

If EU or national law requires other processing, the Processor shall inform the Customer before carrying out that processing, unless the law prohibits it from doing so.

The Processor shall immediately inform the Customer if, in its opinion, an instruction infringes data protection law. The processing concerned shall be suspended until the matter is resolved.

4. Confidentiality and security

The Processor shall restrict access to personal data to individuals who need access for their work.

Individuals with access shall be subject to a duty of confidentiality or an appropriate statutory obligation of confidentiality. That duty shall continue after the contractual relationship ends.

The Processor shall implement appropriate technical and organisational security measures in accordance with Article 32 of the GDPR, including the measures set out in Annex B.

The measures shall be reviewed on an ongoing basis and may be updated provided that the level of protection is not reduced. The Customer shall be notified of material changes.

The Processor shall restrict access to personal data to individuals who need access for their work.

Individuals with access shall be subject to a duty of confidentiality or an appropriate statutory obligation of confidentiality. That duty shall continue after the contractual relationship ends.

The Processor shall implement appropriate technical and organisational security measures in accordance with Article 32 of the GDPR, including the measures set out in Annex B.

The measures shall be reviewed on an ongoing basis and may be updated provided that the level of protection is not reduced. The Customer shall be notified of material changes.

5. Sub-processors

The Customer grants general written authorisation for the sub-processors listed in the completed Annex B.

The Processor shall enter into written agreements with its sub-processors imposing the same data protection obligations as this agreement. The Processor shall remain fully liable to the Customer for the sub-processors’ performance of those obligations.

The Processor shall give at least 30 days’ notice before engaging a new or replacement sub-processor. The notice shall identify the provider, its role, the countries in which processing will take place and any applicable transfer mechanism.

The Customer may raise a reasoned objection on data protection grounds before the notice period expires.

If the parties cannot reach a resolution, the processing concerned must not be transferred to the new provider. The Customer may terminate the affected service without a termination fee and receive a refund of any fees paid in advance for the unused period.

The Customer grants general written authorisation for the sub-processors listed in the completed Annex B.

The Customer may raise a reasoned objection on data protection grounds before the notice period expires.

6. Processing outside the EU and EEA

Personal data may be processed outside the EU/EEA, including through remote access from third countries, only on the Customer’s documented instructions and with a valid transfer mechanism under Chapter V of the GDPR.

The recipients, processing countries and transfer mechanisms are set out in Annex B.

The Processor shall document the necessary assessments and supplementary safeguards and make them available to the Customer.

The recipients, processing countries and transfer mechanisms are set out in Annex B.

The Processor shall document the necessary assessments and supplementary safeguards and make them available to the Customer.

7. Assistance to the Customer

The Processor shall assist the Customer through appropriate technical and organisational measures so that the Customer can respond to requests to exercise data subject rights, including access, rectification, erasure, restriction, data portability and objection.

Requests from data subjects shall be forwarded to the Customer without undue delay. The Processor shall respond only on the Customer’s instructions, unless otherwise required by law.

The Processor shall also assist the Customer with its obligations under Articles 32 to 36 of the GDPR, including security, breach notification, impact assessments and prior consultation.

Assistance shall take account of the nature of the processing and the information available to the Processor and shall be provided in time for the Customer to meet its statutory deadlines.

Requests from data subjects shall be forwarded to the Customer without undue delay. The Processor shall respond only on the Customer’s instructions, unless otherwise required by law.

The Processor shall also assist the Customer with its obligations under Articles 32 to 36 of the GDPR, including security, breach notification, impact assessments and prior consultation.

Assistance shall take account of the nature of the processing and the information available to the Processor and shall be provided in time for the Customer to meet its statutory deadlines.

8. Personal data breaches

The Processor shall notify the Customer without undue delay after becoming aware of a personal data breach. The initial notification must not be delayed until an investigation has been completed.

As far as possible, the notification shall describe:

The nature and timing of the breach.
The categories and approximate numbers of affected individuals and personal data records.
The contact person for further information.
The likely consequences.
The measures taken or proposed to address the breach.

Any outstanding information shall be provided in stages without undue delay.

The Processor shall contain the breach, preserve relevant documentation and assist the Customer with any required notifications to authorities and affected individuals.

The Processor shall notify the Customer without undue delay after becoming aware of a personal data breach. The initial notification must not be delayed until an investigation has been completed.

As far as possible, the notification shall describe:

The nature and timing of the breach.
The categories and approximate numbers of affected individuals and personal data records.
The contact person for further information.
The likely consequences.
The measures taken or proposed to address the breach.

Any outstanding information shall be provided in stages without undue delay.

The Processor shall contain the breach, preserve relevant documentation and assist the Customer with any required notifications to authorities and affected individuals.

9. Documentation and audits

The Processor shall make available to the Customer all information necessary to demonstrate compliance with Article 28 of the GDPR.

The Processor shall allow for and contribute to audits and inspections carried out by the Customer or an auditor authorised by the Customer.

Audits and inspections shall normally be arranged with reasonable notice and with due regard for security and the confidentiality of other customers’ information. Documentation reviews and remote audits may be used first, but shall not restrict the right to carry out a necessary inspection.

A personal data breach, specific grounds for suspicion or a requirement from an authority may require shorter notice.

Any fees for extraordinary assistance shall be agreed in advance and must not prevent legally required oversight or timely assistance. The Processor shall remedy its own breach of contract at no charge.

The Processor shall make available to the Customer all information necessary to demonstrate compliance with Article 28 of the GDPR.

The Processor shall allow for and contribute to audits and inspections carried out by the Customer or an auditor authorised by the Customer.

A personal data breach, specific grounds for suspicion or a requirement from an authority may require shorter notice.

10. Termination and deletion

When the contractual relationship ends, the Customer shall choose whether personal data is to be returned and then deleted, or deleted without being returned.

Data shall be returned in a commonly used, machine-readable format together with the associated files.

Deletion shall cover active data, historical versions, report copies, temporary data and copies held by sub-processors, in accordance with the time limits in Annex A. The Processor shall confirm completion in writing and state any remaining backup retention period.

If EU or national law requires continued retention, the Processor shall inform the Customer of the legal basis, scope and duration, unless prohibited from doing so. The data shall be isolated and used only for the purpose required by law.

This agreement shall continue to apply to any remaining personal data until it has been deleted.

When the contractual relationship ends, the Customer shall choose whether personal data is to be returned and then deleted, or deleted without being returned.

Data shall be returned in a commonly used, machine-readable format together with the associated files.

This agreement shall continue to apply to any remaining personal data until it has been deleted.

11. Acceptance and amendments

Acceptance of the Main Agreement shall be recorded together with the agreement version, annexes, date and identity of the authorised person.

The Processor may update this version. The Customer shall receive at least 30 days’ notice before material changes take effect, and the version and date displayed on the page shall apply.

Danish law shall apply, subject to mandatory data protection law. The liability provisions of the Main Agreement shall not restrict the rights of data subjects or the powers of supervisory authorities.

Acceptance of the Main Agreement shall be recorded together with the agreement version, annexes, date and identity of the authorised person.

The Processor may update this version. The Customer shall receive at least 30 days’ notice before material changes take effect, and the version and date displayed on the page shall apply.

12. Liability

The parties’ liability for damages under this agreement shall be the same as under the Main Agreement, except to the extent that mandatory law, including Article 82 of the GDPR, provides otherwise.

A signed copy of this agreement is available on request from dpa@impakta.io.

The parties’ liability for damages under this agreement shall be the same as under the Main Agreement, except to the extent that mandatory law, including Article 82 of the GDPR, provides otherwise.

A signed copy of this agreement is available on request from dpa@impakta.io.

Annex A: Processing and deletion periods

Subject matter and purpose

The Processor processes personal data on behalf of the Customer in providing the platform. The purpose is to collect, structure, document, maintain versions of and reuse the Customer’s sustainability data for ongoing operations, emissions calculations and reporting. Reuse is limited to this purpose and does not entitle the Processor to use the Customer’s data for other purposes.

The processing covers personal data in the Customer’s platform content, as well as user, access and event data processed on the Customer’s instructions.

Categories of data subjects

The processing may include data about the Customer’s users and employees, contact persons at the Customer’s suppliers, customers and business partners, sole traders, and other individuals mentioned in documents and free-text fields within the agreed use of the platform.

Types of personal data

The processing may include:

Name, work email address, phone number, job title, company affiliation and address.
User identifiers, access roles and information about user actions.
Invoice, payment and transaction data relating to identifiable individuals.
Personal data in uploaded documents, supporting documents, reports, comments and support materials.
IP addresses, timestamps and technical event data necessary to provide and secure the service on behalf of the Customer.

Nature of the processing

Data is collected through the Customer’s entries, uploads, enabled ERP integrations and supplier submissions.

Processing includes recording, structuring, storage, data extraction from documents using OCR and AI, AI-assisted suggestions, calculations, aggregation, versioning, reporting, export, return, necessary support and deletion.

Document reading using OpenAI forms part of the core service as described in clause 3. Optional AI suggestions are processed in accordance with the Customer’s documented choices in the platform. Personal data must not be used to train general-purpose AI models.

Data is exchanged with the Customer’s connected systems, including AI assistants via MCP, on the Customer’s documented instructions and within the access permissions granted. The relevant sub-processors and processing locations are listed in Annex B.

Data outside the agreed scope of use

The agreed scope of use does not include Danish civil registration numbers (CPR numbers), special categories of personal data under Article 9 of the GDPR, or data relating to criminal convictions and offences under Article 10.

The Customer shall not submit such data and shall remove it from documents before uploading them. If the Processor becomes aware that it has received such data unintentionally, it shall notify the Customer without undue delay. The Processor shall delete the data on the Customer’s instructions without undue delay. Until deletion, the data shall be processed only on lawful instructions and with appropriate safeguards.

Any planned processing of these types of data requires a separate written agreement in advance covering the scope of processing, instructions and security measures.

Duration of the processing

Processing takes place during the term of the agreement and, after termination, for the limited period necessary to return and delete data in accordance with clause 10 and the time limits below. Any legally required retention shall be handled in accordance with clause 10.

Retention and deletion periods

During the term of the agreement, personal data is retained on the Customer’s instructions. Versioning does not in itself provide a basis for indefinite retention.

All Customer data shall be deleted no later than 38 days after termination: 30 days for deletion from active systems and a maximum of 8 further days in backups. This excludes logs held by sub-processors, which are subject to the time limits below.

The following time limits apply:

Return of data: No later than 30 days after termination.
Deletion from active systems: No later than 30 days after termination. Logs held by sub-processors are subject to the time limits below.
Remaining backup retention: No more than 8 days after deletion from active systems.
AI usage logs held by the Processor: 90 days. This period applies to usage metadata and is not a general retention period for documents or AI inputs.
MCP audit logs: 90 days.
Other logs and temporary data:
- Temporary import files: deleted when the import is complete.
- Internal job queue data, such as file names and paths: 7 days after the job is completed and, at the latest, on termination in accordance with clause 10.
- Notifications and copies of sent notification emails: retained during the term of the agreement. They are deleted immediately when the user deletes their account.
- IP addresses are not stored in the activity log.
- Logs held by sub-processors are deleted in accordance with the relevant provider’s retention period:
  - Vercel (hosting logs): up to 30 days.
  - Sentry (error reports): up to 90 days.
  - Resend (sent emails and delivery logs): 30 days, with backups retained for up to 7 days.
  - OpenAI (abuse monitoring logs): up to 30 days.
  - Fly.io (OCR service): uploaded files are processed in memory and are not stored.
Activities, version history, imported line items, reports and attachments: Retained during the term of the agreement as Customer data, then handled in accordance with clause 10.

When a user deletes their account, their user data is anonymised immediately.

Anonymisation covers the login account, name, email address, password, notifications and queued notification emails.

Access to backups is restricted, and backups are used only for recovery until they expire. Previous deletion instructions shall be reapplied before restored data is returned to normal use. The Processor’s written confirmation of deletion under clause 10 shall specify the date by which the Customer’s data will have expired from all backups.

Any legally required retention shall be handled in accordance with clause 10.

Annex B: Sub-processors

Supabase Inc.

Address: c/o Incorporating Services, Ltd., 3500 S. DuPont Highway, Dover, Kent County, Delaware 19901, USA. The affiliated company Supabase Pte. Ltd., Singapore, may be involved in the processing.
Contact: privacy@supabase.io.
Role: Database, file storage, user authentication and background jobs. Processes Customer data, files and user accounts.

Database location: Ireland, eu-west-1. The contracting entity is based in the USA, where relevant support and operational processing may also take place.

Supabase processes data under its Data Processing Addendum, which forms part of its Terms of Service, see supabase.com/legal/dpa, including the EU Standard Contractual Clauses under Commission Decision (EU) 2021/914. The Processor shall ensure that these terms provide at least the same level of protection as this agreement at all times.

OpenAI Ireland Ltd. (OpenAI)

Address: 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland.
Contact: privacy@openai.com.

Role: AI-assisted classification, field extraction and suggestions through the Chat Completions API, including document reading as part of the core service and optional AI suggestions. Processes the necessary imported line-item and document content.

Location: Processing takes place in the USA. Contracting entity: OpenAI Ireland Ltd.

OpenAI processes data under its data processing agreement, which forms part of its services agreement, including the EU Standard Contractual Clauses under Commission Decision (EU) 2021/914 for transfers to the USA. The data is not used to train OpenAI’s models. The Processor shall ensure that these terms provide at least the same level of protection as this agreement at all times.

Vercel Inc.

Address: 440 N Barranca Ave #4133, Covina, CA 91723, USA.
Contact: privacy@vercel.com.

Role: Hosting and server functions. Processes web requests, relevant Customer data and operational logs.

The contracting entity is based in the USA. Server functions run in Dublin (dub1). CDN, log and cookieless Web Analytics data may be processed globally.

Vercel processes data under its data processing agreement, including the EU Standard Contractual Clauses under Commission Decision (EU) 2021/914 and the EU-US Data Privacy Framework. The Processor shall ensure that these terms provide at least the same level of protection as this agreement at all times.

Fly.io, Inc.

Address: 2045 W Grand Ave Ste B, Chicago, Illinois 60612, USA.
Role: Operates the Processor’s OCR service for document processing. Uploaded files are processed in memory and are not stored.

Location: Stockholm, Sweden (arn). The contracting entity is based in the USA.

Fly.io processes data under its data processing agreement, entered into on 16 October 2026, including the EU Standard Contractual Clauses under Commission Decision (EU) 2021/914. The Processor shall ensure that these terms provide at least the same level of protection as this agreement at all times.

Functional Software, Inc. (Sentry)

Address: 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA.
Role: Error monitoring. Personal data is not sent by default; URLs and tokens are removed.

Location: EU (Germany). The contracting entity is based in the USA.

Sentry processes data under its data processing agreement, entered into on 17 October 2026, including the EU Standard Contractual Clauses under Commission Decision (EU) 2021/914 and the EU-US Data Privacy Framework. The Processor shall ensure that these terms provide at least the same level of protection as this agreement at all times.

Plus Five Five, Inc. (Resend)

Address: 2261 Market Street #5039, San Francisco, CA 94114, USA.
Role: Sends emails, including invitations, login and password emails, notifications and supplier requests. Data types: name, email address and message content.

Location: USA, regardless of the sending region. The contracting entity is based in the USA.

Resend processes data under its data processing agreement, accepted when the account was created, including the EU Standard Contractual Clauses under Commission Decision (EU) 2021/914 and the EU-US Data Privacy Framework. The Processor shall ensure that these terms provide at least the same level of protection as this agreement at all times.

The providers’ own sub-processor chains are documented in a list dated 15 October 2026. This annex shall be kept up to date in accordance with clause 5.

Other services (not sub-processors)

Google Cloud EMEA Limited (Google Maps Platform), 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Provides address lookup and distance calculations based on entered addresses and place names. Google processes this data as an independent controller under its own terms and is not a sub-processor of the Processor. The Processor does not send users’ personal data to Google Maps Platform.

The Customer’s own systems (not sub-processors)

Microsoft Business Central, Dinero/Visma, e-conomic, Odoo and the Customer’s AI assistant via MCP are enabled by the Customer.

Access control and data separation

Supabase Auth, server-side access controls and Row Level Security separate each customer’s data.

The Owner role manages team administration and deletion. The Member role handles day-to-day data. Sessions and roles are checked for every request.

Users can enable multi-factor authentication (MFA). The Processor’s administrative accounts with sub-processors are protected by MFA. Access permissions are reviewed every six months.

Supplier links

Submissions are restricted to the specific supplier and Customer. Links expire and can be revoked. They do not provide access to the Customer’s other data. Access tokens are removed from error and analytics logs.

Encryption

All data, including personal data and login credentials, is encrypted using AES-256 at rest and TLS in transit.

All traffic to the OCR service and other providers uses TLS. Credentials for the Customer’s ERP systems are stored encrypted in Supabase Vault and are automatically deleted when the connection or the Customer is deleted.

Logs and AI

The activity log and version history record changes. AI usage metadata is deleted after 90 days.

AI suggestions can be disabled for each company; document reading is part of the core service. All OpenAI traffic goes through a single OpenAI project with model training disabled.

Backups and incident response

Backup frequency and retention: daily, retained for 8 days. Files in Storage are not included in database backups. In the event of a personal data breach, the Processor shall follow its breach response procedure in accordance with clause 8.

Ongoing review

The Processor monitors vulnerabilities and assesses the effectiveness of its security measures.

Daniel Malmros
dpa@impakta.io

Back to Terms and Privacy