The Parties

This data processing agreement (the "Agreement" or the "DPA") is entered into between:

The Processor
VIMESO.marketing v/ Lasse Berg Svenningsen
CVR no. 35124225
Merkurvej 4, 4200 Slagelse
(hereinafter "Nemma" or "the Processor")

and

The Controller
[Customer's full legal name]
[CVR no.]
[Address]
(hereinafter "the Customer" or "the Controller")

each a "Party" and together the "Parties".

The Agreement forms an integral part of the Terms of Service for Nemma entered into between the Parties (the "Main Agreement"). In case of inconsistency between the Agreement and the Main Agreement as regards the processing of personal data, the Agreement prevails.

1. Background, purpose and definitions

1.1 Nemma provides an AI-based helpdesk service for online stores (the "Service"), which receives, classifies and answers customer service enquiries and can carry out specifically defined actions in the Customer's connected systems (cf. Annex A).

1.2 In providing the Service, Nemma processes personal data on behalf of the Customer. This Agreement sets out the Parties' rights and obligations in that connection and fulfils the requirement in Article 28(3) of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") for a legally binding document between controller and processor.

1.3 The terms "personal data", "processing", "data subject", "controller", "processor", "sub-processor", "personal data breach" and "supervisory authority" have the meaning given in GDPR Article 4.

1.4 "Sub-processor" means a third party that Nemma uses to process personal data on the Customer's behalf as part of the provision of the Service, cf. Annex B.

1.5 "Applicable Data Protection Law" means the GDPR and the Danish Data Protection Act with associated executive orders and the current practice of the Danish Data Protection Agency (Datatilsynet), including later amendments.

2. The Parties' roles

2.1 The Customer is the controller of the personal data processed through the Service and determines the purposes and means of the processing. The Customer warrants that the Customer has a valid basis for processing under GDPR Article 6 for the processing that the Customer has Nemma carry out.

2.2 Nemma is the processor and processes personal data solely on documented instructions from the Customer, cf. clause 3.

2.3 The data subjects are in particular the Customer's own customers (end customers) who contact the Customer's customer service, and the persons whose details appear in such enquiries (cf. Annex A).

2.4 Outside this Agreement. The Customer's own Shopify store is the Customer's own system under the Customer's own responsibility as controller. Nemma accesses Shopify via the Customer's own API access (token) and is not a processor for the Customer's Shopify installation. Nemma's processing of personal data originating from Shopify as part of the Service is, however, covered by this Agreement.

3. Instructions and scope of processing

3.1 Nemma processes personal data only on the Customer's documented instructions, unless otherwise required under EU law or Danish law; in that case Nemma informs the Customer of the legal requirement before the processing, unless such notification is prohibited.

3.2 The Customer's instructions consist of (i) this Agreement with annexes, (ii) the Main Agreement and (iii) the Customer's actual use and configuration of the Service, including the choice of operating modes (Manual/Draft/Auto-send), categories created, the content of the Customer's "Skills" (reply policies) and settings for actions and retention. Additional or changed instructions must be given in writing.

3.3 The subject matter, duration, nature and purpose of the processing, as well as the categories of data subjects and personal data, appear in Annex A.

3.4 Nemma notifies the Customer without undue delay if, in Nemma's opinion, an instruction infringes Applicable Data Protection Law.

3.5 Special categories. The Service is not intended for the processing of special categories of personal data (GDPR Article 9) or data relating to criminal offences (Article 10). The Customer must not knowingly submit or allow such data to be included in the Service. If such data appears unintentionally in free text (e.g. in an end customer's email), it is processed solely as part of the ordinary delivery of the Service and deleted within the periods stated in clause 10 and Annex A. The Customer bears responsibility for the consequences of its own submission of such data.

4. Confidentiality

4.1 Nemma ensures that the persons authorised to process personal data under the Agreement have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4.2 Nemma limits access to personal data to the employees and Sub-processors for whom access is necessary to fulfil Nemma's obligations, and ensures that access is role-based (cf. Annex C).

5. Security (GDPR Article 32)

5.1 Nemma implements appropriate technical and organisational measures to ensure a level of security appropriate to the risks of the processing, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing.

5.2 The measures implemented appear in Annex C. Nemma may update the measures from time to time, provided that the level of security is not reduced.

5.3 Nemma assists the Customer in ensuring compliance with the Customer's obligations under GDPR Article 32, to the extent relevant given the nature of the processing and the information available to Nemma.

6. Sub-processors

6.1 The Customer hereby gives Nemma a general prior authorisation to use Sub-processors for the provision of the Service. The Sub-processors used at the time the Agreement is entered into appear in Annex B and in Nemma's publicly available sub-processor list.

6.2 Nemma imposes on each Sub-processor data protection obligations that are in essence equivalent to the obligations in this Agreement (flow-down), including requirements for appropriate security measures, cf. GDPR Article 28(4). Nemma remains fully liable to the Customer for the Sub-processor's performance of its obligations.

6.3 Notification and objection. On an intended addition or replacement of a Sub-processor, Nemma notifies the Customer with at least 30 days' notice by email and/or by updating the public sub-processor list. The Customer may raise a reasoned objection to the change within the notice period. In case of objection, the Parties jointly seek a solution to a reasonable extent. If agreement cannot be reached, and Nemma cannot provide the Service without the Sub-processor in question, the Customer may terminate the affected part of the Service with effect from the date the change takes effect.

6.4 Transfer of personal data to Sub-processors outside the EEA takes place solely on the basis stated in clause 7 and Annex B.

7. Transfers to third countries (GDPR Chapter V)

7.1 Primary storage of personal data takes place within the EEA (cf. Annexes B and C).

7.2 To the extent the provision of the Service involves transfer of personal data to a country outside the EEA, Nemma ensures a valid transfer basis under GDPR Chapter V, including:

(a) Standard Contractual Clauses (SCCs) adopted by the European Commission (Commission Implementing Decision (EU) 2021/914), in the relevant module, as incorporated in the data processing agreement of the Sub-processor in question; and/or

(b) the EU-U.S. Data Privacy Framework (DPF), where the US Sub-processor in question is validly DPF-certified.

7.3 SCCs are used as the primary and robust transfer basis. DPF certification is used as a supplementary basis where available. Nemma monitors the validity of the DPF on an ongoing basis and adapts the transfer basis if the status of the framework changes.

7.4 The specific transfers and their basis appear in Annex B.

8. Assistance to the Controller

8.1 Data subjects' rights. Taking into account the nature of the processing, Nemma assists the Customer with appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to requests to exercise the data subjects' rights under GDPR Chapter III (access, rectification, erasure, restriction, data portability and objection). The Service provides functionality for the export and deletion of data about a given contact.

8.2 If a data subject contacts Nemma directly to exercise rights, Nemma forwards the request to the Customer without undue delay and does not answer it itself, unless the Customer has instructed otherwise.

8.3 Impact assessments, etc. Nemma assists the Customer in ensuring compliance with the obligations under GDPR Articles 32-36, including any data protection impact assessments (DPIA) and prior consultation of the supervisory authority, taking into account the nature of the processing and the information available to Nemma.

8.4 Nemma may charge a reasonable fee for assistance under clause 8 that goes beyond what can reasonably be expected as part of the ordinary delivery of the Service, subject to mandatory requirements in Applicable Data Protection Law.

9. Personal data breaches

9.1 Nemma notifies the Customer without undue delay after becoming aware of a personal data breach concerning personal data processed under this Agreement.

9.2 The notification must, to the extent the information is available, at least contain:

(a) a description of the nature of the breach, including, where possible, the categories and approximate number of data subjects and personal data records concerned;

(b) the name and contact details of a contact point where more information can be obtained;

(c) a description of the likely consequences of the breach; and

(d) a description of the measures Nemma has taken or proposes to take to address the breach, including to mitigate its possible adverse effects.

9.3 If not all information can be provided at the same time, it may be provided in phases without undue further delay.

9.4 Nemma assists the Customer to a reasonable extent with the Customer's possible notification to the supervisory authority (GDPR Article 33) and communication to the data subjects (Article 34). It is for the Customer, as controller, to make such notification and communication.

10. Deletion and return on termination

10.1 On termination of the Service, Nemma deletes or returns, at the Customer's choice, all personal data processed under the Agreement and deletes existing copies, unless EU law or Danish law requires retention.

10.2 The Customer may request return in a structured, commonly used format within 30 days after termination. Thereafter, or if the Customer does not request return, Nemma deletes personal data within 30 days after termination. Personal data in backups is deleted or overwritten in the ongoing backup cycle, cf. Annex C.

10.3 Ongoing deletion during operation. Independently of termination, Nemma automatically deletes the raw email as received (the RFC 822 copy) and attached files 12 months after receipt. The text of the enquiry itself forms part of the case history in the Service and is deleted in accordance with clauses 10.1-10.2 on termination, cf. Annex A. Aggregated and anonymised key figures that cannot be attributed to a data subject may be retained.

10.4 At the Customer's request, Nemma confirms in writing that deletion has been carried out.

11. Audit and inspection

11.1 Nemma makes available to the Customer all information necessary to demonstrate compliance with GDPR Article 28 and allows for and contributes to audits, including inspections, conducted by the Customer or an independent auditor authorised by the Customer.

11.2 Nemma may fulfil the obligation in clause 11.1 by presenting relevant documentation, including descriptions of security measures (Annex C), results of internal tests and any independent audit or security statements.

11.3 Audits must be announced with reasonable notice, carried out during normal working hours, must not unnecessarily disrupt Nemma's operations and must respect confidentiality and other customers' data. Each Party bears its own costs, unless the audit reveals material non-compliance on Nemma's part.

11.4 The Danish Data Protection Agency (Datatilsynet) is the supervisory authority. The Parties assist each other to a reasonable extent in connection with any enquiries from the supervisory authority.

12. Liability and limitation of liability

12.1 The Parties' liability to each other is governed by the Main Agreement, including the Main Agreement's limitation of liability (clause 14 of the Terms of Service), which also applies to matters covered by this Agreement, unless mandatory law precludes this.

12.2 Each Party is liable for damage caused by its own processing in breach of Applicable Data Protection Law. The Customer indemnifies Nemma against claims arising from (i) the Customer's instructions in breach of Applicable Data Protection Law, (ii) the Customer's lack of a basis for processing, or (iii) the Customer's submission of data in breach of clause 3.5.

12.3 Notwithstanding clause 12.1, a data subject's right to compensation under GDPR Article 82 and the supervisory authority's powers under Article 83 cannot be limited by agreement between the Parties. The allocation of liability between the Parties follows Article 82(5).

12.4 The limitation of liability does not apply in the case of intent or gross negligence.

13. Term and termination

13.1 The Agreement takes effect when the Customer accepts the Main Agreement and is in force for as long as Nemma processes personal data on behalf of the Customer.

13.2 The Agreement terminates automatically when the Main Agreement terminates. Clause 10 (deletion and return) and provisions that by their nature are intended to survive also apply after termination.

14. Changes

14.1 Nemma may change the Agreement where necessary to reflect changes in the Service, in the Sub-processors used or in Applicable Data Protection Law. Material changes are notified with reasonable notice, subject to the special notification procedure for Sub-processors in clause 6.3.

14.2 Changes that are necessary to comply with mandatory legal requirements may be implemented without notice where required.

15. Governing law and venue

15.1 The Agreement is governed by Danish law.

15.2 Any dispute arising out of the Agreement shall be decided by Næstved District Court (Retten i Næstved) as the court of first instance, unless otherwise follows from mandatory rules on venue.

Signatures

The Agreement may be entered into electronically. When the Customer accepts the Terms of Service on creating an account, the Agreement is deemed entered into, regardless of whether a physical signature exists.

Annex A - Subject matter and nature of the processing

Subject matter. Processing of personal data as part of Nemma's provision of an AI-based helpdesk service in which enquiries to the Customer's customer service are received, classified and answered, and in which defined actions are carried out in the Customer's connected Shopify store.

Nature of the processing. Collection, recording, organisation, storage, adaptation, retrieval, use (including AI-based classification and generation of draft replies), disclosure by transmission of replies, combination with order data, and deletion.

Purpose. To answer and handle customer service enquiries for the Customer, including order lookup, status information, cancellation and address change of orders that have not yet been dispatched, and proposals for refunds.

Duration. For as long as the Service is provided, cf. clause 13 of the Agreement. Ongoing deletion of the raw email and attached files after 12 months, cf. clause 10.3.

Categories of data subjects:

• The Customer's end customers who contact the Customer's customer service.
• Other natural persons whose personal data may appear in an enquiry or in a related order (e.g. a recipient of a delivery).
• The Customer's own users of the Service (employees: owner/support agent) - as regards account details for use of the Service.

Categories of personal data:

• Identification and contact details: name, email address.
• Content of enquiries (free text): what the end customer writes, as well as email metadata (sender, subject, times, thread ID and SPF/DKIM/DMARC results).
• Order-related information retrieved from Shopify: order number, the order's email address, delivery and billing address, order lines and amounts, shipping and tracking status.
• Action and audit information: actions carried out or proposed (cancellation, address change, refund proposals) and logging thereof.
• Account details for the Customer's users: name, email, role.

Expressly excluded:

• Special categories of personal data (GDPR Article 9) and data relating to criminal offences (Article 10) are not processed intentionally, cf. clause 3.5 of the Agreement.
• Payment card details are not processed by Nemma. Refunds are carried out in the Customer's Shopify/payment solution; Nemma handles only the instruction for and amount of the refund.

Annex B - Sub-processors

The Sub-processors used at the time the Agreement is entered into for the provision of the Service:

Not a Sub-processor: The Customer's own Shopify store, for which the Customer is the controller, and which Nemma accesses via the Customer's own API access, cf. clause 2.4 of the Agreement.

Notification. Changes to the list are notified with at least 30 days' notice and with a right to object, cf. clause 6.3 of the Agreement. The list in force from time to time is published at nemma.dk/en/legal/subprocessors. Objections and questions are sent to info@nemma.dk.

Annex C - Technical and organisational security measures (TOMs)

The measures reflect the Service's actual security architecture. Nemma may update them from time to time, provided that the level of security is not reduced.

C.1 Encryption

• In transit: all communication between client, Service, Sub-processors and external integrations takes place over TLS/HTTPS. Incoming webhooks are accepted only over HTTPS.
• At rest: personal data is stored encrypted at rest at Supabase. Access tokens for the Customer's Shopify are additionally encrypted at application level with AES-256-GCM; the encryption key is kept solely in the runtime environment's environment variables, never in client code, log files or the user interface, and the token is shown only masked.

C.2 Access control and isolation between customers

• Isolation at database level (deny-by-default): Row Level Security is enabled on all tables with customer data. The client accesses data only with a public key combined with the individual user's authentication token; the database rejects any request across organisations.
• Privileged access: keys with extended privileges are used exclusively in server code, where an organisation filter is enforced on all queries.
• Role-based access: users are assigned roles (owner/support agent); access is granted on a need basis and managed via invited team members.
• End customer isolation: order details are disclosed only when the order's email address matches the sender's email address. If there is no match, nothing about the order is returned. The check is enforced in the code, not solely in the AI instruction.

C.3 AI-specific security measures (elaborated in Annex D)

• Capability limitation: there is no function by which the AI can send email, choose a recipient, disclose data to external addresses or grant discounts. Sending always takes place to the end customer's own email address retrieved from the database.
• Actions with financial effect (refunds and cancellation/change of orders that have already been dispatched or are older) require human approval.
• Control of outgoing content: before automatic sending, drafts are scanned for addresses and references outside an approved list; if any are found, human handling is forced.
• Limits: refund amounts are limited to the order total; the maximum number of AI tool calls per case is limited.

C.4 Verification of incoming data

• Incoming email webhooks are cryptographically verified (HMAC signature) before processing.
• Webhooks from other integrations are verified with signing keys; development endpoints are protected with a secret token compared in constant time.

C.5 Logging and audit

• Immutable audit log: every AI action (sent draft, action carried out, state change, activation of the emergency stop) is recorded and cannot be changed or deleted. Actions are shown in the individual case's timeline.
• Log hygiene: log files may contain identifiers, statuses and error codes, but never email content, access tokens or addresses.

C.6 Availability and operations

• Emergency stop (kill switch): an organisation-level function that immediately halts all automatic sending.
• Rate limiting: limitation of concurrent AI runs and of the number of automatic sends per unit of time; if exceeded, human handling is forced and an alert is triggered.
• Alerting: monitoring of error rates, bounce/spam rates for outgoing email and abnormal usage.

C.7 Backup

• Automatic backups via the database provider (Supabase) in accordance with the chosen plan. Backups are encrypted at rest.

C.8 Testing and verification

• Automated isolation tests in CI: a cross-tenant test is run on every change; a new table without a passing isolation test fails the build.
• Testing of end customer isolation in the tool layer.
• Red-team review with hostile enquiries (including prompt injection and attempts to access others' orders) before going into production.

C.9 Deletion

• The raw email (the RFC 822 copy) and attached files are deleted automatically after 12 months. The text of the case history is retained so that the Customer can still see the course of events, and is deleted on termination in accordance with clause 10.
• A tool for exporting or deleting all information about a given contact is available for use in fulfilling data subjects' rights.

Annex D - AI addendum (AI-specific terms and the EU AI Act)

D.1 Description of the AI processing

The Service uses AI models to (i) classify incoming enquiries and (ii) generate draft replies and proposals for actions on the basis of the content of the enquiry and relevant order details. AI inference is provided via Anthropic's API (cf. Annex B).

D.2 No training on customer data and data storage

• Personal data processed through the AI Sub-processor is not used to train or improve AI models.
• Nemma uses AI inference in a configuration without data storage for training purposes. This is documented and verified against the AI Sub-processor's terms in force from time to time.

D.3 Reservation for misuse monitoring

To the extent the AI Sub-processor carries out limited security or misuse monitoring, this takes place in accordance with the Sub-processor's own terms and does not constitute training on the Customer's data.

D.4 Roles under the EU AI Act (Regulation (EU) 2024/1689, "AI Act")

• Nemma is the provider of the AI system that forms part of the Service.
• The Customer is the deployer, as the Customer uses the AI system in the course of its own business.
• The AI system interacts with and generates content directed at natural persons (end customers) and is in that connection covered by the transparency obligations in Article 50 of the AI Act. The system is not a high-risk system under Annex III of the Regulation.

D.5 Transparency towards end customers (Article 50)

• Nemma ensures that, as provider, it is clear from the Service's outgoing communication that the reply was prepared with the help of an AI assistant. This disclosure is switched on by default and cannot be disabled by the Customer.
• The disclosure applies to AI-generated replies. Purely automatic acknowledgements (fixed templates that the Customer writes and activates per category) are not produced by an AI system and are therefore not covered by the transparency obligation in Article 50; they do not carry the AI disclosure, as it would be misleading to indicate AI involvement where there is none.
• The transparency obligations in Article 50 apply from 2 August 2026. The obligation under Article 50(1) (disclosure that one is interacting with an AI system) has not been postponed.
• The obligation under Article 50(2) (machine-readable marking of AI-generated content) is under technical development (code of conduct/Code of Practice). Nemma follows developments and implements such marking to the extent and from the time it becomes relevant to the Service.

D.6 The Customer's responsibility as deployer

The Customer retains its independent responsibility as deployer, including for:

• Human oversight of the AI's output to the extent the Customer chooses operating modes that involve independent sending (Auto-send), and for arranging this appropriately.
• The content of the Customer's reply policies ("Skills") and of the information the Customer allows to be included in the Service.
• The Customer's own use of the Service towards its own end customers, including compliance with marketing and consumer law rules.

Nemma does not assume the Customer's obligations as deployer.

D.7 Precedence

In case of inconsistency between this Annex D and the Agreement's other provisions regarding AI-specific matters, this Annex takes precedence.