Data processing agreement – Insight

This Data Processing Agreement is entered into between:

1. The Customer, as defined in the Agreement (“Data Controller”); and
2. Brilliant Future AB, Reg. No. 556392-3332 (“Data Processor”), with its registered address at Drottninggatan 26, 111 51 Stockholm, Sweden.

This Data Processing Agreement constitutes an integral part of the Agreement for Brilliant’s Services between the Data Controller and Brilliant Future AB (the “Agreement”), including the general terms and conditions for Brilliant’s services that form part of the Agreement (the “Terms”).

The Data Controller and the Data Processor are hereinafter referred to separately as “Party” and jointly as “Parties”.

1. Background

1.1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “General Data Protection Regulation”) requires a written agreement to be established between the Data Controller and the Data Processor when the Data Processor processes personal data on behalf of the Data Controller. Consequently, the Parties have entered into this Data Processing Agreement to comply with the rights and obligations that each Party has under the Applicable Data Protection Legislation.

1.2 In situations where other agreements entered into by the Parties are inconsistent with this Data Processing Agreement, the provisions of this Data Processing Agreement shall take precedence in situations related to Processing.

2. Definitions

2.1 In this Data Processing Agreement, the following terms shall have the meanings set forth below:

“Personal Data” – All types of information that can be directly or indirectly attributed to a living individual.

“Data Controller” – The individual who, alone or jointly with others, determines the purposes and means of the processing of Personal Data.

“Processing” – Any operation or set of operations which is performed on Personal Data, whether by automated means or not, including but not limited to collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making data available, alignment or combination, blocking, erasure or destruction.

“Sub-processor” – A third party engaged by the Data Processor for Processing on behalf of the Data Controller.

“SCC” – Standard Contractual Clauses for the transfer of Personal Data to third countries, as per the European Commission’s decision of 4 June 2021, or any other standard contractual terms amending or replacing the SCC.

“Data Processor” – A physical or legal person processing Personal Data on behalf of the Data Controller.

“Registered” – A physical person whose Personal Data is processed.

“Applicable Data Protection Legislation” – The General Data Protection Regulation, the Data Protection Act, other applicable legislation, legal precedents and/or decisions from the Swedish Authority for Privacy Protection.

Unless otherwise specified in this Data Processing Agreement, terms used in this Data Processing Agreement shall be interpreted in accordance with the Applicable Data Protection Legislation.

3. Processing

3.1 The Data Processor is responsible for ensuring that all Processing is carried out in accordance with the terms of this Data Processing Agreement and the Applicable Data Protection Legislation.

3.2 In addition to the Processing to be carried out in accordance with the terms of Section 3.1 above, the Data Processor may only perform Processing in accordance with the Data Controller’s current and documented instructions, unless the Data Processor is required by applicable law to process the Personal Data, as specified in Appendix 1. In the latter case, the Data Processor shall inform the Data Controller of such obligation before commencing Processing, to the extent permitted for the Data Processor to provide such information to the Data Controller under the current regulations.

3.3 In the event that the Data Processor lacks instructions that it deems necessary for Processing, or if the Data Processor believes that an instruction from the Data Controller contradicts this Data Processing Agreement and the Applicable Data Protection Legislation, the Data Processor shall promptly notify the Data Controller and then await instructions from the Data Controller.

4. Obligation to assist the Data Controller

4.1 The Data Processor shall, upon the request of the Data Controller, provide information about the Personal Data, and rectify, block, erase, restrict and transfer it to the Data Controller. The Data Processor shall act on such requests without undue delay. In the event that the Data Controller deletes, or instructs the Data Processor to delete, Personal Data held by the Data Processor, the Data Processor shall ensure that the deleted Personal Data cannot be restored by either Party or any other party.

4.2 In the event that a Data Subject requests information from the Data Controller, the Data Processor shall promptly refer the request to the Data Controller and assist the Data Controller in responding to such request in accordance with the Applicable Data Protection Legislation.

4.3 The Data Processor shall, taking into account the nature of the Processing and the information available to the Data Processor, assist the Data Controller in conducting impact assessments and assist in conducting prior consultations with the Swedish Authority for Privacy Protection in the event that an impact assessment indicates a high risk.

5. Obligation to report personal data breaches

5.1 The Data Processor shall, upon becoming aware of a personal data breach, promptly notify the Data Controller. The Data Processor shall assist the Data Controller in informing the Data Subject of the personal data breach if such a personal data breach is likely to result in a high risk to the Data Subject’s rights and freedoms. Such notification shall, at least, include:

• the nature of the personal data breach;
• the categories of Data Subjects;
• the approximate number of Data Subjects affected;
• the categories and approximate number of personal data records involved;
• the name and contact details of the Data Processor’s data protection officer, if one has been designated, or another contact person from whom more information can be obtained; and
• the likely consequences of the personal data breach and the measures taken or to be taken by the Data Processor to address the personal data breach or mitigate its potential negative effects.

5.2 To the extent that it is not possible for the Data Processor to provide the information specified in Section 5.1 above simultaneously, the information may be provided by the Data Processor in phases without undue further delay.

6. Obligation to maintain records of processing

6.1 The Data Processor shall maintain a record of all Processing carried out on behalf of the Data Controller and, upon the express request of the Data Controller or the Swedish Authority for Privacy Protection, provide a written record that shall include, at a minimum:

1. the name and contact details of the Data Processor and, where applicable, the name and contact details of Sub-processors engaged by the Data Processor, as well as their data protection officer;
2. the Processing of the Personal Data performed by the Data Processor on behalf of the Data Controller;
3. where applicable, the transfer of Personal Data to third countries, the third country in which the data is processed, and the protective measures taken in connection with the transfer; and
4. a general description of the technical and organisational measures implemented to maintain an appropriate level of protection.

7. Information regarding changed processing

7.1 The Data Processor shall, in writing and no later than thirty (30) days before a planned change in Processing, including but not limited to technical and organisational changes that may affect the Data Processor’s compliance with the Applicable Data Protection Legislation, inform the Data Controller. Before implementing such a change, the Data Controller shall provide its written consent.

8. Contacts with the Swedish Authority for Privacy Protection

8.1 The Data Processor shall assist the Data Controller in contacting the Swedish Authority for Privacy Protection, including but not limited to providing information requested by the Swedish Authority for Privacy Protection upon the Data Controller’s request. For the avoidance of doubt, the Data Processor may not disclose Personal Data or information about the Processing without the explicit and prior instruction of the Data Controller.

8.2 The Data Processor shall promptly notify the Data Controller if the Data Controller is contacted by the Swedish Authority for Privacy Protection regarding the Processing. The Data Processor may not represent the Data Controller or act on behalf of the Data Controller in relation to the Swedish Authority for Privacy Protection or any other third party.

9. Confidentiality

9.1 The Parties’ confidentiality undertakings are governed by Section 8 (Confidentiality) of the Terms, which also apply to the Processing of Personal Data under this Data Processing Agreement.

10. Security

10.1 The Data Processor commits to taking technical and organisational measures to protect the Personal Data processed under this Data Processing Agreement in accordance with the Applicable Data Protection Legislation. The Data Processor shall ensure, in particular, that the technical and organisational measures comply with applicable standard agreements, industry standards, and guidelines issued and approved by the Swedish Authority for Privacy Protection.

10.2 Technical and organisational measures include, but are not limited to, pseudonymisation and encryption of Personal Data, the ability to continuously ensure the confidentiality, integrity, availability and resilience of the systems used in Processing, the ability to restore the availability of and access to Personal Data in a timely manner in the event of a physical or technical incident, and a process for regularly testing, assessing and evaluating the effectiveness of the technical and organisational measures to ensure the security of Processing. A more detailed description of the Data Processor’s technical and organisational security measures is set out in Appendix 2.

10.3 The Data Processor shall be able to ensure that the Processing is carried out in accordance with this Data Processing Agreement and the Applicable Data Protection Legislation, and shall maintain sufficient documentation to confirm that the Data Processor complies with its obligations under this Data Processing Agreement.

11. Use of Sub-processors

11.1 The Data Processor has a general written authorisation from the Data Controller to engage and replace Sub-processors for Processing under this Data Processing Agreement. The Data Processor shall inform the Data Controller of any plans to engage or replace Sub-processors so that the Data Controller has the opportunity to object to such changes. The Data Processor shall ensure that all Sub-processors are bound by written agreements imposing on Sub-processors the same obligations regarding Processing as those applicable under this Data Processing Agreement. In the event that a Sub-processor fails to fulfil its obligations under this Data Processing Agreement and the Applicable Data Protection Legislation, the Data Processor is fully responsible to the Data Controller for the Sub-processor’s performance of those obligations.

11.2 Appendix 3 contains a list of Sub-processors as of the date of commencement of this Data Processing Agreement.

11.3 If the Data Controller objects to a change regarding Sub-processors, the Parties shall, in good faith, discuss the consequences of the change to reach a solution that is satisfactory to both Parties. If no solution can be reached that is satisfactory to both Parties, each Party has the right to terminate the Data Processing Agreement with thirty (30) days’ notice.

12. Transfers to third countries

12.1 The Data Controller instructs the Data Processor not to transfer Personal Data to a third country or international organisation in situations where: (i) the recipient country or organisation has not been recognised by the European Commission as having an adequate level of protection for Personal Data; or (ii) the recipient country or organisation is not covered by an appropriate safeguard (including but not limited to SCC and binding corporate rules) recognised by relevant authorities or courts as providing sufficient protection for Personal Data.

12.2 If the Data Controller wishes to change its instructions regarding transfers to a third country or international organisation, the Parties shall, in good faith, discuss the consequences of the changed instructions. If no solution can be reached that is satisfactory to both Parties, each Party has the right to terminate the Data Processing Agreement with thirty (30) days’ notice.

13. Report on actions taken

13.1 The Data Processor shall, at the request of the Data Controller, provide a written report once (1) per year specifying the actions taken by the Data Processor to fulfil its obligations under this Data Processing Agreement.

14. Control of the Data Processor’s processing

14.1 The Data Processor agrees that, upon request from the Data Controller, with the assistance of an independent third party, it may verify that the Data Processor’s Processing complies with the Applicable Data Protection Legislation and this Data Processing Agreement, including but not limited to providing the independent third party with access to the Data Processor’s premises and computer equipment to the extent necessary for this purpose. The verification under this provision shall be carried out no later than fourteen (14) days after the request from the Data Controller has been received. The verification shall be conducted during regular working hours.

15. Liability

15.1 If a Party wishes to claim compensation from the other Party for damage suffered by the other Party or a third party as a result of the Party’s or its subcontractor’s Processing in violation of this Data Processing Agreement and/or the Applicable Data Protection Legislation, the liability for such damage shall be limited in accordance with Section 10 (Limitation of liability) of the Terms.

15.2 The limitation on the Parties’ liability for compensation under Section 15.1 above shall not apply to an administrative fine imposed by the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten) or a court pursuant to Article 83 of the General Data Protection Regulation. The Parties agree that a Party cannot seek compensation from the other Party for an administrative fine that the Party is obliged to pay according to a decision by the Swedish Authority for Privacy Protection and/or a court. It is noted that the Data Processor and the Data Controller may thus be liable for administrative fines pursuant to Article 83 of the General Data Protection Regulation.

15.3 The Data Processor shall have liability insurance that covers the Processing and is valid for a satisfactory amount during the term of this Data Processing Agreement. The liability insurance shall cover liability for pure economic loss. Pure economic loss refers to financial loss that occurs without a connection to any personal or property damage. Upon request by the Data Controller, the Data Processor shall provide an insurance certificate or other proof of the existence of such liability insurance.

16. Remuneration and payment terms

16.1 The Parties agree that the Data Processor is not entitled to any specific remuneration from the Data Controller for the performance of the tasks under this Data Processing Agreement.

16.2 Any requests for the Data Processor’s assistance, or inquiries regarding specific data formats, for exporting the Data Controller’s personal data to another database will be subject to the Data Processor’s standard hourly rate.

17. Term and termination

17.1 This Data Processing Agreement applies for the same contract period as the Agreement, in accordance with Section 5 (Term and termination) of the Terms, and for as long as Processing of Personal Data is carried out under this Data Processing Agreement.

17.2 The right to terminate the Agreement prematurely is governed by Section 5 (Term and termination) of the Terms.

17.3 When this Data Processing Agreement has terminated, the Data Processor shall promptly return or, if so requested by the Data Controller, delete all Personal Data, including all copies thereof, and shall thereafter provide written confirmation to the Data Controller that the return or destruction has occurred.

18. Miscellaneous

18.1 Transfer of the Data Processor’s rights and obligations under this Data Processing Agreement to a third party may only occur with the explicit, prior and written consent of the Data Controller.

18.2 Amendments to this Data Processing Agreement must be in writing and signed by both Parties to be binding.

19. Contact information

19.1 Notifications between the Parties under this Data Processing Agreement shall be made in accordance with Section 11.1 (Notifications) of the Terms.

19.2 Contact information for Brilliant Future AB:

Brilliant Future AB
Drottninggatan 26, 4 tr
111 51 Stockholm, Sweden
+46 (0)8 692 91 00
dpo@brilliantfuture.se

19.3 Contact information for the Data Controller shall be the contact information set out in the Agreement or as otherwise communicated to the Data Processor.

20. Governing law

20.1 For the application and interpretation of this Data Processing Agreement, Section 11.4 (Applicable law and dispute resolution) of the Terms shall apply.

Appendix 1 – Instructions for Processing in customer and employee surveys and 360° Feedback

This appendix constitutes the Data Controller’s instructions to the Data Processor regarding the Processing, as defined in Section 3.2 of this Data Processing Agreement, concerning customer and employee surveys and 360° Feedback. In the event that the Processing is to be altered, the Data Processor must, as specified in Section 7, obtain written consent from the Data Controller for such changes.

Purpose

Customer surveys

The data is used for customer surveys related to the Data Controller’s customers’ experiences. The data is used for analysis and the generation of reports and key figures. Customer surveys are not anonymous, but personal data is stored in pseudonymised and encrypted form. Data transfers between system components, to underlying systems and to Sub-processors are encrypted.

Employee surveys

The data is used for employee surveys related to the employee experience and leadership assessment. The data is used for analysis and the generation of reports and key figures. Responses are anonymised before being transferred, with no connection to any personal data, to an analysis database used to improve the Data Processor’s future recommendations, create benchmarks and provide overall insights, for example in blog posts.

360° Feedback

The manager’s and colleagues’ responses in a 360° survey are never anonymous, meaning that responses can be attributed to an individual and therefore constitute personal data. The employee’s responses are anonymous and subject to the same anonymity rules as those applied to employee surveys.

Categories of data

Customer and employee surveys and 360° Feedback

Name, email and background information provided by the customer (e.g. gender, age, segmentation). The background information may vary over time.

Employee surveys

Survey responses are stored in pseudonymised and encrypted form and are processed as personal data in accordance with this Data Processing Agreement. Background information is used to analyse results at an aggregate level.

360° Feedback

Responses are stored in pseudonymised and encrypted form (back end/data at rest) and are processed as personal data in accordance with this Data Processing Agreement. Managers’ and colleagues’ responses in a 360° survey are not anonymous.

Categories of data subjects

Customer surveys: customers.

Employee surveys and 360° Feedback: employees and managers.

Processing activities

Distribution of surveys and reports. Analysis and presentation of results in the platform, where specific roles have access to the results.

Place of processing

All processing and storage take place in data centres within the European Union (EU). Some temporary and limited processing may occur in the United States with Sub-processors covered by the EU-US Data Privacy Framework. For further details, see Appendix 3.

Duration of processing

The following rules apply to data storage (respondents, respondent answers, history and organisational data):

1. All data is stored in the platform as long as the agreement/subscription is active. The platform includes features that allow the Data Controller to delete individual users/respondents and their responses.
2. Upon termination of the agreement/subscription, all data and history within the platform are deleted.
3. The Data Controller has the right to “pause” the agreement/subscription. The Data Processor then retains respondent data, history and organisational data for a fee in accordance with the Data Processor’s price list in force from time to time. During a paused subscription, the Data Controller does not have access to the platform and needs to request access again through our customer support.

Brilliant Future has the right to use anonymised respondent data to create benchmarks for further and in-depth analysis. Brilliant Future guarantees that benchmark data is anonymised and cannot be attributed to any physical or legal person.

Information security

The Data Processor is certified under ISO/IEC 27001:2022 and operates in accordance with the standard’s requirements, including the associated requirements for encryption; ensuring the confidentiality, integrity, availability and resilience of processing systems; the ability to restore the availability of and access to personal data in a timely manner in the event of a personal data breach; regular testing; data deletion; and investigation and evaluation of the effectiveness of security measures. In accordance with ISO/IEC 27001, the Data Processor regularly conducts new risk analyses with corresponding measures as needed.

Appendix 2 – Technical and organisational security measures

This appendix supplements Section 10 of the Data Processing Agreement between the Data Controller and Brilliant Future AB (Data Processor). It provides a consolidated description of the technical and organisational security measures used to ensure the confidentiality, integrity, availability and resilience of processing activities performed within Brilliant Future’s portfolio of products and platforms.

The controls described in this appendix form part of Brilliant Future’s Information Security Management System (ISMS), which is certified under ISO/IEC 27001:2022.

1. Governance and organisational security measures

1.1 Information Security Management System (ISMS)

Brilliant Future is certified under ISO/IEC 27001:2022 and maintains a formal Information Security Management System (ISMS) in accordance with the standard’s requirements. The ISMS covers:

• Risk management
• Incident management
• Security and privacy policy, including internal awareness training
• Endpoint and asset management, including access control policy and identity management
• Supplier and sub-processor management
• Software development lifecycle process
• Business continuity planning

1.2 Roles and responsibilities

• Chief Executive Officer (CEO): ultimately responsible and accountable for ensuring that our security policies and their objectives are met.
• Chief Technology Officer (CTO): overall accountability for implementing technical controls to achieve policy and security objectives.
• Data Protection Officer (DPO): ensures GDPR compliance and DPIAs, and oversees privacy governance.
• Management team: accountable for ensuring that all staff within their teams follow processes and procedures.

All employees undergo pre-employment screening and receive regular mandatory training in policies, security and privacy.

2. Product governance and product development

Brilliant Future maintains a structured product governance framework (e.g. SDLC) in accordance with ISO/IEC 27001 to ensure that all platform functionality is designed, implemented and maintained in accordance with security, privacy and regulatory requirements.

2.1 Product governance structure

• Strategic oversight: product governance is anchored in the management team and supported by cross-functional product strategy forums that ensure alignment between business objectives, security requirements and regulatory obligations.
• Dedicated accountability: all products have defined product managers, UX designers, tech leads and architects responsible for roadmap prioritisation, technical integrity and compliance.
• Change control: all feature development, configuration changes and architectural updates follow a formal change and release management process, including impact assessments on confidentiality, integrity, availability and data protection.

2.2 Software development lifecycle (SDLC)

Brilliant Future follows a documented SDLC process that includes:

• Security-by-design and privacy-by-design principles.
• Business case and risk assessment for new features.
• Code review and peer review processes for all changes.
• Automated and manual testing, including unit, regression, performance and acceptance testing.
• Continuous integration and continuous deployment with approval gates.
• Clear separation of development, test and production environments.
• Security and code scanning built into the development and release pipeline.

3. Technical security measures

3.1 Infrastructure security

• All production systems are hosted in EU-based data centres (on-premises and Azure Cloud) with high physical security standards (ISO 27001 and SOC 2 compliance).
• Redundant network and power infrastructure ensures high availability.
• Firewalls, segmentation and virtual networks restrict network traffic.
• Monitoring using Microsoft Defender, Microsoft Defender for Cloud, Microsoft Front Door and OpenVAS.

3.2 Encryption

• Data in transit: encrypted using TLS 1.2 or higher.
• Data at rest: encrypted using industry-standard database and storage encryption (TDE or equivalent). Encryption keys are stored separately using secure key vault services.

3.3 Access control

• Role-based access control (RBAC) enforcing least privilege.
• Multi-factor authentication (MFA) for privileged accounts.
• Segregation between production, staging and development environments.
• All administrative access is logged and monitored.

3.4 Authentication and tenant isolation

• Support for single sign-on (SSO) based on SAML or OIDC.
• Logical separation of customer data using tenant isolation mechanisms.
• No cross-tenant visibility or access is possible.

3.5 Logging, monitoring and detection

• Centralised logging of user activity, administrative actions and system events (including application logging and Microsoft Front Door/WAF).
• Security event monitoring on applications and endpoints (including Microsoft Defender, Microsoft Defender for Cloud, Microsoft Defender for Endpoint and E5 Security).

3.6 Vulnerability management

• Vulnerability scanning across infrastructure and applications.
• Annual third-party penetration testing by certified partners.
• Patch management and hardening ensuring timely updates of operating systems, frameworks and dependencies.

3.7 Application security

• Secure development lifecycle (SDLC) with privacy and security “shift left”.
• Code reviews, automated dependency scanning and OWASP secure code scanning.
• QA and testing include unit, performance, functional and regression testing.

3.8 AI and data processing safeguards

• AI features are not trained on customer data.
• AI is not used for automated decisions affecting individuals.
• Prompt engineering, pseudonymisation, PII masking and content filtering are applied where applicable.

4. Risk management

Brilliant Future operates a formalised risk management process as part of its Information Security Management System (ISMS), in accordance with ISO/IEC 27001 and the GDPR accountability requirements.

4.1 Risk identification and assessment

• Risks are identified through continuous workshops with management, system owners, security specialists and operational teams.
• Each risk is assessed based on likelihood, impact and potential consequences for confidentiality, integrity, availability and privacy.
• Personal data processing risks are evaluated specifically according to Article 32 of the GDPR, taking into account the nature, scope, context and purposes of processing.
• All risks are documented in Brilliant Future’s central risk register, where treatment activities are tracked and reviewed regularly.

5. Incident management

Brilliant Future maintains a structured incident management process in accordance with ISO/IEC 27001 and GDPR requirements. The process ensures detection, escalation, mitigation and reporting of business-critical incidents, security incidents and potential personal data breaches.

• Defined incident management process with escalation routines, communication management, and roles and responsibilities.
• Notification to the Data Controller of personal data breaches and security incidents without undue delay.
• Post-incident reviews (e.g. post-mortems) to prevent recurrence.

6. Sub-processor and supplier management

• All Sub-processors are subject to data protection and security requirements in accordance with Brilliant Future’s policy.
• All suppliers are evaluated and reviewed in accordance with our supplier management policy.
• Transfers outside the EU/EEA only occur under the EU-US Data Privacy Framework or appropriate SCCs.
• Appendix 3 lists all approved Sub-processors.

Appendix 3 – Sub-processors

Name	Registration number	Address	Location of processing	Purpose
Twilio Inc. (SendGrid)	4518652	101 Spear Street, Fifth Floor, San Francisco, USA	EU and US. Covered by and certified under the EU-US Data Privacy Framework.	SMS and email invitations and reminders to respondents
Microsoft Corporation	256796	One Microsoft Way, Redmond, Washington, USA	Sweden and EU. Covered by and certified under the EU-US Data Privacy Framework.	Services, applications and operations in Azure (e.g. App/Web Services, database/storage, Functions, Azure OpenAI)
Pendo.io Inc.	463519724	301 Hillsborough St, Raleigh, NC 27603, USA	EU. Covered by and certified under the EU-US Data Privacy Framework.	Help centre, customer support and user analytics
HubSpot Inc.	11717417	Ground Floor, Two Dockland Central, Guild St, North Wall, Dublin, D01 K2C5, Ireland	EU. Covered by and certified under the EU-US Data Privacy Framework.	Customer relationship management (CRM) and customer support