Legal

Data Processing Agreement (DPA).

How Kintra processes personal data on your behalf under Article 28 of the GDPR. The agreement is part of the subscription and applies from the day you become a customer. Version 1.0 · October 2026.

1. Parties and roles

The agreement applies between the Customer, who is the controller, and SeniorPartner Sverige AB (org.nr 559578-0460), which runs Kintra and is the processor. It is accepted together with the General terms when the subscription is taken out, and takes precedence over the terms in matters concerning personal data.

2. What is processed and why

Kintra processes only personal data contained in the material the Customer itself enters in the portal, and only in order to produce and deliver content to the Customer. This may include:

• names, roles and descriptions of staff in the fact bank
• photos in which people can be identified
• names and e-mail addresses of the users the Customer gives access to the portal

Kintra has no access to the Customer’s social media accounts and does not process data about the Customer’s followers or customers.

3. Kintra’s commitments

• Process the data only in accordance with the Customer’s instructions, as set out in this agreement and in how the Customer uses the portal.
• Ensure that anyone working with the data is bound by confidentiality.
• Protect the data with appropriate technical and organisational measures, including encrypted transfer, login via one-time link and access rights per customer.
• Never use the data to train AI models, and never sell or disclose it.
• Help the Customer respond to requests from data subjects, for example for an extract or erasure.
• Notify the Customer without undue delay, and no later than within 48 hours, of a personal data breach affecting the Customer’s data, so that the Customer can report it to IMY within 72 hours.

4. Sub-processors

The Customer approves Kintra’s use of the following sub-processors. Kintra is responsible for ensuring that they are bound by equivalent obligations.

• Supabase — database, photo storage and login for the client portal.
• Netlify — hosting of the website and the portal.
• Anthropic — AI service used when the texts are produced. The data is sent via API and is not used to train models.
• one.com — e-mail to and from info@kintra.se.

Stripe and Formspree process Kintra’s own customer and contact data, not the Customer’s material, and are therefore not sub-processors under this agreement. They are described in the privacy policy.

Kintra notifies the Customer by e-mail at least 30 days before a new sub-processor is engaged. The Customer may object and, if the objection cannot be resolved, cancel the subscription notwithstanding the notice period.

5. Transfers outside the EU/EEA

Some sub-processors are American companies, and data may therefore be processed outside the EU/EEA. Transfers take place only on the basis of the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

6. Audit

The Customer has the right to request the information needed to demonstrate that the agreement is being complied with. Kintra replies in writing within 30 days.

7. When the agreement ends

When the subscription ends, the Customer can read and download its material in the portal for 90 days. After that the data is deleted, unless it must be kept by law. The Customer can also request erasure earlier. Erasure is carried out within 30 days and cannot be undone.

Questions?

Write to info@kintra.se. If you need a signed copy for your own records, we will send one.

Version 1.0 · October 2026. SeniorPartner Sverige AB, org.nr 559578-0460, Koppom, Sweden.