Syntrace AB

Processing Agreement

Syntrace AB • Last updated: June 2026 • Version 1.0

Syntrace AB (“Syntrace”, “we”, “us” or “our”) provides a platform for meeting intelligence and decision traceability for the investment management industry (the “Service”). Using the Service, the Subscriber and its Users record, import, transcribe, store and process meetings and related content (“Customer Data”).

To the extent Customer Data includes personal data under the GDPR, we process such personal data as a processor on behalf of the Subscriber. This data processing agreement (the “DPA”) governs that processing and forms an integral part of our Terms of Service for Businesses (the “Terms”).

1. Introduction

1.1 Role of the parties

We process personal data in Customer Data on behalf of the Subscriber as a processor, in accordance with the Subscriber’s Instruction set out in Schedule 1. The Subscriber is the controller and we are the processor in respect of that processing.

1.2 Model Clauses

The Parties recognise that the EU Commission has adopted standard contractual clauses between controllers and processors under Article 28(7) of the GDPR. The Parties agree that those clauses (the “Model Clauses”) apply to our processing of personal data on behalf of the Subscriber, with the additions in this DPA and in Schedule 2. The Subscriber is the “controller” and we are the “processor” under the Model Clauses. Any references to Regulation (EU) 2018/1725 in the Model Clauses are removed.

1.3 Definitions

Lower-case terms used but not defined in this DPA — such as “controller”, “processor”, “personal data” and “processing” — have the meaning given in Article 4 of the GDPR. Capitalised terms not defined here have the meaning given in the Terms. Additional definitions are set out in section 4.

1.4 Priority

If there is any conflict between this DPA and the Terms (including any Order Form), this DPA prevails. If there is any conflict between this DPA and the Model Clauses, the Model Clauses prevail in accordance with their Clause 4.

1.5 Docking clause

The docking clause in Clause 5 of the Model Clauses does not apply.

2. Obligations of the parties

2.1 Instructions

We process personal data on behalf of the Subscriber only in accordance with the Subscriber’s Instructions and Applicable Data Protection Laws. The Subscriber’s Instruction is set out in Schedule 1; further Instructions must be given in writing in accordance with section 3.10 (Notices). If the Subscriber issues new Instructions that go beyond what Applicable Data Protection Laws require or that the Service does not support, and the Subscriber maintains them, we are entitled to reasonable compensation for the resulting cost, or to agree separate terms.

We process Customer Data solely to provide and support the Service. We do not use Customer Data to train generally available or third-party AI models, and we do not use it for our own purposes, except to create aggregated and anonymised data as permitted by the Terms.

2.2 Documentation and audits

Any audit or inspection under Clause 7.6 of the Model Clauses shall be requested in accordance with section 3.10. The Subscriber shall give us at least one (1) month’s notice so the Parties can plan the audit. An audit shall cover only information necessary to verify our compliance with this DPA and Applicable Data Protection Laws, and not information unrelated to our processing on the Subscriber’s behalf. Each Party bears its own costs. Where available and reasonable, we may satisfy audit requests by providing relevant third-party certifications, reports or assessments. If an audit shows that we have not met our obligations, we will remedy the issue without undue delay at our own cost.

2.3 Sub-processors

The Subscriber gives us a general written authorisation to engage the sub-processors listed in our sub-processor list. We will notify the Subscriber of any intended addition or replacement of a sub-processor within the time frame in Clause 7.7 of the Model Clauses, by email to the Subscriber’s designated contact. The list and any change notice will include, for each sub-processor:

  1. its identity (full legal name, registration number and address);
  2. the type(s) of service it provides;
  3. the location where it processes personal data on the Subscriber’s behalf; and
  4. the measures it has taken to protect personal data (or where information on them can be found).

The Subscriber may object to a change within thirty (30) days of our notice, in accordance with section 3.10. The Parties will then seek a mutually acceptable solution. If none is agreed within thirty (30) days of the objection (or a later date agreed in writing) and we cannot provide the Service without the sub-processor, the Subscriber may terminate the Terms to take effect at the end of that thirty (30)-day period. A copy of a sub-processing agreement may be requested in accordance with section 3.10.

2.4 International transfers

Subject to Clause 7.8 of the Model Clauses, the Subscriber accepts that we transfer personal data to sub-processors in third countries outside the EU/EEA where necessary to provide the Service — in particular cloud hosting and AI/transcription providers. Where such transfers occur, we rely on appropriate safeguards, including the EU Commission’s Standard Contractual Clauses for international transfers (Decision 2021/914) and any necessary supplementary measures.

2.5 Assistance to the controller

We will notify the Subscriber by email to its designated contact of any request we receive from a data subject regarding processing carried out on the Subscriber’s behalf, and will not respond to such a request ourselves except on the Subscriber’s instruction. Requests for assistance under Clause 8 of the Model Clauses shall be made in accordance with section 3.10. We are entitled to reasonable compensation for assistance provided under Clause 8 of the Model Clauses, or as otherwise agreed.

2.6 Notification of personal data breach

Notification of a personal data breach under Clause 9 of the Model Clauses shall be sent by email to the Subscriber’s designated contact. Without prejudice to that obligation, immediately after becoming aware of a personal data breach concerning personal data processed on the Subscriber’s behalf we will:

  1. investigate the breach to determine its scope, nature and likely consequences;
  2. take appropriate remedial measures to mitigate its possible adverse effects; and
  3. consult with the Subscriber to help it determine whether it must notify the competent supervisory authority and/or affected data subjects.

2.7 Requests from a supervisory authority

If a competent supervisory authority requests information from us about the processing under this DPA, or requests that we disclose personal data we process on the Subscriber’s behalf, we will notify the Subscriber without undue delay (by email to its designated contact) and the Parties will consult on the request, unless we are legally prohibited from notifying or consulting. We will not act as the Subscriber’s agent.

3. Final provisions

3.1 Confidentiality of personal data

We will keep personal data processed on the Subscriber’s behalf strictly confidential and will not disclose it to any third party unless authorised in writing in advance by the Subscriber, required by law, or necessary to perform this DPA or provide the Service. Personnel with access are bound by appropriate confidentiality obligations.

3.2 Term and termination

This DPA is effective for the same term as the Terms and for any additional period during which we process personal data on the Subscriber’s behalf. If either Party terminates this DPA with immediate effect on a ground permitted by the Model Clauses, the Terms also terminate with immediate effect.

3.3 Return or deletion of personal data

On termination of the Terms or this DPA, and with reference to Clause 10(d) of the Model Clauses, the Subscriber shall instruct us in writing whether the personal data we (or our sub-processors) process on its behalf shall be (i) returned to the Subscriber or (ii) securely and irreversibly deleted. If the Subscriber does not provide such an instruction within sixty (60) days of termination, we will delete the personal data without undue delay. The instruction shall be sent in accordance with section 3.10.

3.4 Survival

Sections 3.1, 3.3, 3.5, 3.6, 3.7, 3.8, 3.9 and 3.10 survive termination of this DPA for any reason.

3.5 Liability

Each Party is liable for any administrative fine imposed on it due to its own failure to comply with this DPA or Applicable Data Protection Laws. Liability for claims for damages by data subjects is governed by Article 82 of the GDPR. Subject to the foregoing, the limitation of liability in section 11 of the Terms applies to this DPA, except that it does not apply to damages arising from a breach of section 3.1 (Confidentiality of personal data).

3.6 Severability

If any provision of this DPA is or becomes invalid, illegal or unenforceable, the remainder continues in effect, and the deficient provision shall be replaced by a valid provision with an effect as close as possible to the original.

3.7 No waiver

A delay in exercising a right or remedy under this DPA does not waive it, and a waiver of one breach is not a waiver of any subsequent breach.

3.8 Governing law

This DPA is governed by Swedish law, without regard to its conflict-of-laws rules.

3.9 Disputes

Section 14 of the Terms (Governing law and disputes) applies to any dispute arising out of or in connection with this DPA, including its breach, termination or invalidity.

3.10 Notices

Notices to Syntrace under this DPA shall be made in English or Swedish and sent by email to legal@syntrace.com.

4. Additional definitions

“Applicable Data Protection Laws” — the GDPR and all other data protection laws and regulations (including guidance from supervisory authorities) that apply to the processing under this DPA.

“GDPR” — Regulation (EU) 2016/679 (General Data Protection Regulation).

“Instruction(s)” — the documented instruction of the Subscriber setting out the subject-matter, duration, nature and purpose of the processing, the types of personal data and categories of data subjects, and any specific requirements, including Schedule 1.

“Model Clauses” — the standard contractual clauses between controllers and processors in the Annex to EU Commission Implementing Decision (EU) 2021/915 of 4 June 2021, incorporated into this DPA by reference (available at https://eur-lex.europa.eu/eli/dec_impl/2021/915/oj).

“Parties” — Syntrace and the Subscriber.

Schedule 1 — Instruction regarding the processing of personal data

This Schedule sets out the Subscriber’s Instruction for our processing of personal data in Customer Data on the Subscriber’s behalf.

Subject-matter and purpose

We process personal data in Customer Data only to provide and support the Service. This includes capturing meetings through a meeting assistant that joins the Subscriber’s video calls and through calendar and conferencing integrations; transcribing, summarising and analysing meetings (including by automated and AI/ML techniques); generating action items, insights and the decision trail; and storing, indexing and making this content available for search, export and sharing as configured by the Subscriber. We do not process Customer Data for any other purpose, and we do not use it to train generally available AI models.

Categories of data subjects

Any individual whose personal data is included in Customer Data — typically the Subscriber’s personnel and the participants in, and persons referred to during, meetings, which may include external attendees, clients, counterparties, portfolio-company representatives and other third parties.

Categories of personal data

Any category included in Customer Data, but typically:

The Service is not intended for special categories of personal data. The Subscriber controls what is recorded and uploaded and shall not include special-category data in Customer Data unless expressly agreed in writing, consistent with section 3.2 of the Terms.

Nature of the processing

Collection (recording and import), transcription, automated and AI-assisted analysis, organisation, storage, retrieval, use to generate outputs, disclosure to the Subscriber’s authorised Users, and erasure — all to provide the Service.

Duration of the processing

For as long as the Service is provided to the Subscriber, plus the return/deletion period in section 3.3.

Schedule 2 — Appendices to the Model Clauses

Annex I — List of parties

Processor: Syntrace AB, reg. no. 559576-3904, Östra Hamngatan 52, 411 09 Gothenburg, Sweden. Notices: privacy@syntrace.com (and legal@syntrace.com per section 3.10).

Controller: the Subscriber, as identified in the applicable Order Form or account registration.

The Model Clauses are deemed signed by both Parties when the Subscriber accepts the Terms.

Annex I.C — Competent supervisory authority

The competent supervisory authority is the Swedish Authority for Privacy Protection (IMY), or, where the Subscriber acts as controller, the supervisory authority competent for the Subscriber under the GDPR.

Annex II — Description of the processing

See Schedule 1 of this DPA.

Annex III — Technical and organisational measures

We maintain technical and organisational measures designed to ensure a level of security appropriate to the risk, including the following.