Data Processing Agreement

Parties and precedence

This Data Processing Agreement (“DPA”) forms part of the agreement between the Customer and Drömlik for the Drömlik UCaaS hosted communication platform, including the Terms of Service, any order form and any statement of work (together, the “Agreement”).

Processor: Drömlik AB, a Swedish limited company (org. nr 556863-5261, VAT nr SE556863526101), Lidvägen 29C, 177 40 Järfälla, Sweden (“Drömlik”).

Controller: the customer entity named in the order form or account registration (“Customer”).

This DPA applies whenever Drömlik processes Personal Data on the Customer’s behalf under the Agreement. It takes effect when the Customer accepts the Agreement or signs an order form that references it, and no separate signature is required. Either Party may request a countersigned copy.

Order of precedence on data protection matters: (1) the Standard Contractual Clauses, where they apply; (2) this DPA; (3) the rest of the Agreement.

Data protection contact at Drömlik: info@dromlik.com.

1. Definitions

Terms not defined here (including “controller”, “processor”, “personal data”, “processing”, “data subject”, “personal data breach” and “supervisory authority”) have the meaning given in the GDPR.

• Applicable Data Protection Law: the GDPR; the UK GDPR and UK Data Protection Act 2018; the Swiss Federal Act on Data Protection; national laws implementing Directive 2002/58/EC (ePrivacy); and any other data protection law that applies to the processing under the Agreement.
• GDPR: Regulation (EU) 2016/679.
• Customer Personal Data: Personal Data that Drömlik processes on the Customer’s behalf under the Agreement, as described in Annex A.
• Services: the Drömlik UCaaS platform and related services described in the Agreement, including optional add-ons the Customer enables.
• Sub-processor: any third party Drömlik engages that processes Customer Personal Data.
• SCCs: the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
• UK Addendum: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
• Hosting Region: the data centre region the Customer selects for its phone system (see Annex A).

2. Roles and scope

2.1 For Customer Personal Data, the Customer is the controller and Drömlik is the processor. Where the Customer acts as a processor for its own clients (for example, a reseller or managed service provider), Drömlik acts as its sub-processor, and the Customer warrants that its controller has authorised this DPA, including the use of Drömlik’s Sub-processors.

2.2 Drömlik acts as an independent controller, and this DPA does not apply, when it processes Personal Data for its own purposes. These are:

• account administration, billing, invoicing and collections;
• fraud prevention, network security and abuse detection;
• obligations Drömlik has as a provider of electronic communications services, including emergency call handling, number portability, traffic data retention and lawful requests from authorities;
• service analytics and product improvement using de-identified or aggregated data;
• direct relationship communications with the Customer’s account contacts.

Drömlik will provide information about that processing on request.

2.3 Drömlik does not sell Customer Personal Data and does not use it, including call recordings and transcripts, to train AI models, except as needed to provide features the Customer has enabled.

3. Processing on instructions

3.1 Drömlik processes Customer Personal Data only on the Customer’s documented instructions, including for international transfers, unless Union or Member State law requires otherwise. In that case Drömlik will inform the Customer of the legal requirement before processing, unless the law prohibits it.

3.2 The Customer’s instructions are: the Agreement and this DPA; the configuration the Customer or its users set in the Services (for example, enabling call recording, AI transcription, call summaries, the AI receptionist or integrations); and any further written instructions agreed by the Parties.

3.3 Drömlik will tell the Customer promptly if, in its opinion, an instruction infringes Applicable Data Protection Law. Drömlik may suspend the affected processing until the instruction is confirmed or changed.

3.4 Instructions that go beyond the Services, or that require material extra work, may be charged at Drömlik’s then-current rates, agreed in advance.

4. Drömlik’s obligations

4.1 Confidentiality. Drömlik ensures that everyone authorised to process Customer Personal Data is bound by a duty of confidentiality that continues after their engagement ends, and has access only as needed for their role.

4.2 Security. Drömlik implements the technical and organisational measures in Annex C, appropriate to the risk as required by Article 32 GDPR. Drömlik may update these measures, provided the overall level of protection does not decrease.

4.3 Personal data breaches. Drömlik will notify the Customer without undue delay, and where feasible within 24 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will include, as far as then known:

• the nature of the breach, including the categories and approximate number of data subjects and records concerned;
• the likely consequences;
• the measures taken or proposed to address the breach and mitigate its effects;
• a contact point for further information.

Drömlik will provide further information as it becomes available and will cooperate with the Customer’s notifications to supervisory authorities and data subjects. A notice is not an admission of fault.

4.4 Data subject requests. Drömlik will assist the Customer, through the Services’ self-service tools and otherwise as reasonably needed, to respond to requests to exercise data subject rights. If Drömlik receives a request directly, it will forward it to the Customer without undue delay and will not respond except to direct the person to the Customer.

4.5 Other assistance. Taking into account the nature of the processing and the information available to it, Drömlik will assist the Customer with its obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultation with a supervisory authority.

4.6 Records. Drömlik keeps a record of processing activities carried out on the Customer’s behalf, as required by Article 30(2) GDPR.

4.7 Costs. Assistance under 4.4 and 4.5 is free where it is covered by the Services’ standard tools or arises from Drömlik’s own breach. Other assistance may be charged at reasonable rates agreed in advance.

5. Sub-processors

5.1 General authorisation. The Customer gives Drömlik general written authorisation to engage Sub-processors. The Sub-processors on Drömlik’s list on the date this DPA takes effect (see Annex B) are approved.

5.2 Changes. Drömlik will give at least 30 days’ notice before adding or replacing a Sub-processor, by email to the Customer’s account contact. The notice will describe the change, and full details of the new Sub-processor are available on request. Shorter notice applies only where an urgent replacement is needed for security or continuity of the Services, in which case Drömlik will notify the Customer as soon as possible.

5.3 Objection. The Customer may object on reasonable data protection grounds within the notice period. The Parties will discuss the objection in good faith. If Drömlik cannot offer a reasonable alternative, such as not using the new Sub-processor for the Customer’s data, the Customer may terminate the affected Services without penalty and receive a pro-rata refund of prepaid fees for the remaining term.

5.4 Flow-down and liability. Drömlik will impose on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA. Drömlik remains fully liable to the Customer for each Sub-processor’s performance of those obligations.

6. Data location and international transfers

6.1 Customer Personal Data stored in the phone system (recordings, voicemails, call logs, chat history, contacts) is hosted in the Hosting Region the Customer selects. Drömlik will not move it to another Hosting Region without the Customer’s agreement.

6.2 Some processing may still take place outside the EEA, for example remote support or optional features whose Sub-processors are located elsewhere. Drömlik will transfer Customer Personal Data outside the EEA, the UK or Switzerland only where:

• the destination has an adequacy decision (including the EU-US Data Privacy Framework for certified recipients); or
• the transfer is covered by the SCCs, the UK Addendum or the Swiss amendments in Annex D, together with any supplementary measures needed after a transfer impact assessment.

6.3 Drömlik will make available, on request, a copy of the relevant transfer mechanism and a summary of its transfer impact assessments. Commercially sensitive terms may be redacted.

7. Audits and information

7.1 Drömlik will make available to the Customer the information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA. This includes answers to reasonable security questionnaires and, where available, current third-party certifications or audit reports of Drömlik or its hosting Sub-processors.

7.2 If that information is not enough to demonstrate compliance, or a supervisory authority requires it, the Customer may carry out an audit, itself or through an independent auditor bound by confidentiality, subject to these conditions:

• at least 30 days’ written notice, or less where a supervisory authority or a personal data breach requires it;
• no more than once in any 12-month period, except after a personal data breach or at a supervisory authority’s request;
• during business hours, in a way that does not disrupt Drömlik’s operations or compromise other customers’ data;
• audits of Sub-processors are carried out by relying on their own certifications and audit reports.

7.3 Each Party bears its own audit costs, unless the audit reveals a material breach of this DPA by Drömlik, in which case Drömlik bears the Customer’s reasonable costs.

8. Customer’s obligations

The Customer is responsible for its own compliance with Applicable Data Protection Law as controller, including:

• Lawful basis and transparency: having a lawful basis for the processing and giving data subjects the required information.
• Call recording, transcription and AI features: informing callers and users before recording, transcribing, summarising or handling calls through the AI receptionist, and obtaining consent where the law requires it.
• Special category data: deciding whether the Services are appropriate for health or other special category data the Customer processes (for example, as a clinic), and configuring retention and access accordingly.
• Instructions: giving only lawful instructions.
• Accuracy: keeping the data it provides accurate and current.
• Access management: managing its users, permissions, passwords and which features are enabled.
• Retention settings: setting retention periods for recordings, voicemails and transcripts that fit its own obligations.
• Impact assessments: carrying out data protection impact assessments where required.
• Third-party integrations: data the Customer chooses to send to its own third-party tools (such as its CRM, helpdesk, WhatsApp Business or Microsoft Teams) leaves this DPA once delivered, and those providers are not Drömlik’s Sub-processors.

9. Return and deletion

9.1 During the term, the Customer can export or delete its data using the Services’ tools, or ask Drömlik for help.

9.2 When the Agreement ends, the Customer has 30 days to export its data. Drömlik will then delete Customer Personal Data from the live systems within 30 further days, unless the Customer asks in writing for it to be returned first.

9.3 Copies in backups are overwritten in the normal backup cycle, within 90 days. Until then they stay protected under this DPA and are not actively processed.

9.4 Drömlik may keep data only where Union or Member State law requires it, for example traffic data under telecom rules. Such data stays protected under this DPA and is deleted when the legal requirement ends.

9.5 Drömlik will confirm deletion in writing on request.

10. Liability, term and governing law

10.1 Liability. Each Party’s liability under this DPA is subject to the limitations and exclusions of liability in the Agreement. Nothing limits either Party’s liability to data subjects under Article 82 GDPR, or any liability that cannot be limited by law.

10.2 Indemnities. Each Party will indemnify the other against fines, claims and reasonable costs arising from its own breach of this DPA or of Applicable Data Protection Law, subject to 10.1. The indemnified Party must notify the other promptly and let it control the defence.

10.3 Term. This DPA stays in force as long as Drömlik processes Customer Personal Data, including after the Agreement ends.

10.4 Changes. Drömlik may update this DPA to reflect changes in law, guidance or the Services, with at least 30 days’ notice. Changes that materially reduce the protection of Customer Personal Data require the Customer’s agreement.

10.5 Governing law. This DPA is governed by Swedish law, and disputes go to the courts of Stockholm, except where the SCCs require otherwise.

Annex A: Details of processing

Annex B: Sub-processors

Drömlik keeps a list of its Sub-processors, including the sub-processors engaged by its platform provider. For each, the list shows the service provided, the data processed and the processing location. The list in force on the date this DPA takes effect is the authorised list for section 5.1 and Clause 9(a) of the SCCs.

The Customer can request the current list at any time by writing to info@dromlik.com, and Drömlik will provide it within 10 business days. The list is Drömlik’s confidential information. The Customer may share it only with its personnel, advisers, its own controllers (where section 2.1 applies) and supervisory authorities, as needed to assess compliance.

Sub-processors that support optional features, such as call transcription, call summaries, the AI receptionist, video meetings and team chat, process Customer Personal Data only when the Customer enables those features.

Annex C: Technical and organisational measures

These measures also serve as Annex II to the SCCs.

Annex D: International transfer mechanisms

D.1 SCCs. Where a transfer from the Customer to Drömlik needs a transfer mechanism, the SCCs are incorporated by reference. Module 2 (controller to processor) applies where the Customer is a controller; Module 3 (processor to processor) applies where the Customer is a processor. The Parties’ choices are:

D.2 Onward transfers. For Sub-processors outside the EEA without an adequacy decision, Drömlik has entered into Module 3 SCCs (or the Sub-processor’s equivalent) and assessed the transfer.

D.3 UK. For transfers subject to the UK GDPR, the UK Addendum applies, with Table 1 completed using the preamble, Tables 2 and 3 using this Annex, and either Party may end it as set out in Table 4.

D.4 Switzerland. For transfers subject to the Swiss FADP, the SCCs apply with references to the GDPR read as the FADP, and the Swiss Federal Data Protection and Information Commissioner as a competent supervisory authority.

D.5 Drömlik will keep records of international transfers and provide copies of the applicable clauses on written request.

© 2026 Drömlik AB. All rights reserved.