Start with Maditon

Data processing agreement

Last updated: 6 November 2026

This Data Processing Agreement (“DPA”) forms part of the Terms of service between Abiton Ventures AB (“Maditon”, “we”, the processor) and the organisation that uses the Service (the “Customer”, the controller). It governs our processing of personal data on the Customer’s behalf and is concluded pursuant to Article 28 GDPR (Regulation (EU) 2016/679). Where this DPA conflicts with the Terms of service on data protection, this DPA prevails.

1. Roles of the parties

The Customer is the controller of the personal data it and its users put into the Service (“Customer Content”) — for example the AI systems it describes, the evidence files it uploads, the colleagues it identifies, the suppliers it registers with the copies and readings of their documents, the identity it records for a supplier and the sanctions-screening results and review decisions attached to it, the support contacts it records, the systems and services it describes, its procurement records, the questionnaires it uploads and the answers it approves, and the documents it uploads, including those it marks as private. Maditon acts as the Customer’s processor for that Customer Content. For account, authentication, and billing data Maditon is an independent controller; that processing is described in our Privacy policy and is not governed by this DPA.

2. Subject matter, duration, nature, and purpose

We process Customer Content only to provide the Service — preparing draft EU AI Act risk classifications, compliance documents, and learning content; reading, comparing and watching suppliers' documents; screening the suppliers the Customer registers against the EU and UN consolidated sanctions lists on our own infrastructure, and recording the review decisions the Customer’s users make; drafting questionnaire answers; producing PDF packages on demand; and storing the records the Customer creates. The processing lasts for the term of the subscription and the 30-day export window after it ends. Maditon stores copies of documents for reading and comparison and is not a system of record for them; the Customer keeps its originals. The screening is an aid provided as part of the Service; the Customer, as controller, decides on every possible match and remains responsible for its own sanctions compliance.

3. Personal data and data subjects

The Customer decides what it puts into the Service. Typically the personal data is limited to business contact details of the Customer’s own staff (names, work emails, roles) and any personal data the Customer chooses to include in system descriptions or evidence files, and the contact details of people at the Customer’s suppliers and prospects that appear in support contacts, uploaded questionnaires or documents. Where a supplier is a sole trader, its business name and registration number are that person’s own; the Customer decides whether to record them. Data subjects are the Customer’s employees and authorised users, those contact persons, and sole traders among the Customer’s suppliers. The Service is not designed for special categories of data (Article 9 GDPR); the Customer should not upload them.

4. Our obligations as processor

In line with Article 28(3) GDPR, we will:

  • process Customer Content only on the Customer’s documented instructions — the Terms of service, this DPA, and the use of the Service’s features are those instructions — unless EU or Member State law requires otherwise, in which case we inform the Customer first unless that law forbids it;
  • ensure that people authorised to process the data are bound by confidentiality;
  • implement the technical and organisational measures in Schedule 2 (Article 32 GDPR);
  • respect the conditions in Section 5 for engaging sub-processors;
  • assist the Customer, by appropriate technical and organisational measures, to respond to data-subject requests — the in-product export and deletion tools cover access, portability, and erasure directly;
  • assist the Customer with security, breach notification, data protection impact assessments, and prior consultation (Articles 32–36 GDPR);
  • at the Customer’s choice, delete or return all Customer Content at the end of the service (Section 7); and
  • make available the information needed to demonstrate compliance and allow for audits (Section 8).

5. Sub-processors

The Customer gives general authorisation for us to engage the sub-processors listed in Schedule 1. Each is bound by a written contract imposing data-protection obligations equivalent to this DPA. We remain fully liable to the Customer for a sub-processor’s performance. We will give at least 30 days’ notice before adding or replacing a sub-processor; the Customer may object on reasonable data-protection grounds, and if we cannot resolve the objection the Customer may terminate the affected part of the Service.

6. International transfers

We process Customer Content in the EU/EEA. AI inference runs on Mistral's EU regional endpoint. Email addresses and phone numbers in Customer Content are masked before the text reaches the model; a supplier's published document is sent as published, so that the reading can quote it word for word. The sub-processors established outside the EU/EEA are Zitadel (Switzerland) and MailPace (United Kingdom). Both benefit from a European Commission adequacy decision, so no additional transfer safeguards are required. We do not transfer Customer Content to the United States or to any other third country lacking an adequacy decision.

One route is deliberately global and carries no Customer Content: the published regulatory corpus — the text of EU legislation itself — is uploaded to Mistral's Files API, which is not served from the regional endpoint. That upload contains public legislative text only.

7. Personal data breach

We will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Content, and will assist the Customer with its own notification obligations under Articles 33 and 34 GDPR.

8. Return and deletion

On termination the Customer can export all Customer Content itself, in machine-readable JSON or CSV, for 30 days through the self-serve tools. After that window we permanently delete or anonymise Customer Content, except where EU or Member State law requires us to retain it.

9. Audits

We will make available the information necessary to demonstrate compliance with Article 28 GDPR. The Customer may audit no more than once a year (and after a breach) on reasonable prior notice; we may satisfy an audit by providing our security documentation and third-party reports where available, to protect the confidentiality and security of other customers in our multi-tenant environment.

10. Liability and governing law

Liability under this DPA is subject to the limitations in the Terms of service. This DPA is governed by the laws of Sweden, and disputes are resolved as set out in the Terms of service.

Schedule 1 — Authorised sub-processors

Each sub-processor acts under a signed data processing agreement and processes data only for the purpose shown.

  • Zitadel Cloud — identity provider, SSO, MFA — Switzerland (EU adequacy decision).
  • MailPace (OhMySMTP Ltd) — transactional email (the sign-in codes and magic links the identity provider sends, trial and billing notices, invitations, deadline reminders, the daily change email and weekly digest, assessment notifications); message bodies are retained by MailPace for up to 30 days — United Kingdom (UK adequacy decision), EU-hosted.
  • Brevo (Sendinblue SA) — marketing email and newsletter only — France (EU).
  • Bugsink B.V. — hosted error tracking. Error events can contain IP addresses, user identifiers, stack traces and application data; raw events are retained for 60 days — Netherlands (EU).
  • Mistral AI SAS — AI classification, content generation, and the reading of suppliers' published legal documents. Inference runs on Mistral's EU regional endpoint. Model training on submitted data is switched off for our account — France (EU).
  • UpCloud Ltd — production hosting: compute, managed PostgreSQL (the production database) and object storage — Germany (Frankfurt, EU).
  • Plausible Insights OÜ — aggregate analytics. No cookies and no persistent cross-site identifier. IP address and user-agent are processed transiently to derive a daily identifier and are not stored; the salt rotates every 24 hours — Estonia (EU, hosted on Hetzner DE).
  • BunnyWay d.o.o. (bunny.net) — website content delivery (EU-only edge nodes); from 7 December 2026 also Maditon's off-site backup: the encrypted nightly database backup and a copy of uploaded files, stored in Stockholm, Sweden, with no replication outside the EU — Slovenia (EU).

Stripe Payments Europe Ltd processes billing data, for which Maditon is an independent controller (Section 1). It receives no Customer Content and is therefore not a sub-processor under this DPA. That processing, including Stripe’s onward transfer of billing data to the United States, is described in the Privacy policy.

Schedule 2 — Technical and organisational measures

  • Encryption: TLS in transit and encryption at rest for Customer Content. Documents the Customer marks as private are in addition encrypted by the application under a per-Customer data key (AES-256-GCM) — the file, its text, the readings of it and their translations — with the master key held only in the application's runtime environment. This protects such content in database dumps, backups and storage read outside the application; it does not protect against a compromise of the application host itself.
  • Access control: Zitadel-managed authentication with MFA available, role-based access, and least-privilege service credentials.
  • Tenant isolation: logical separation so one customer can never read another customer’s data.
  • Logging: structured audit logging of security-relevant events, retained for at least 90 days; no plaintext personal data in logs.
  • Resilience: automated daily encrypted database dumps kept for 30 days on EU object storage, in addition to the database provider's own short-term snapshots. Restoring a dump into a separate database is tested; the Security page gives the date of the latest test. A full recovery of the Service has not yet been rehearsed, nor has a restore from the provider's snapshots.
  • Incident response: a documented runbook and a 72-hour breach-notification commitment.

Contact

Data-protection enquiries and requests to sign a countersigned copy of this DPA: privacy@maditon.com .