Data Processing Agreement
Last updated August 20, 2026
Last updated August 20, 2026
This Data Processing Agreement, including its annexes (this "DPA"), governs the processing of personal data that Ablo Inc., a Delaware corporation ("Ablo", "Provider") carries out on behalf of a Subscriber ("Customer") in providing the Services.
This DPA forms part of the General Terms and Conditions and any Order Form entered under them (together, the "Agreement"), and takes effect when the Agreement does. No separate signature is required. A countersigned copy is available on written request to lukas@abloatai.com.
Capitalized terms not defined here have the meaning given in the Agreement.
Definitions
"Applicable Data Protection Laws" means the privacy, data protection and data security laws applicable to Ablo's processing of Personal Data under the Agreement, including, to the extent applicable, the State Privacy Laws and the GDPR.
"Controller" means the entity that, alone or jointly with others, determines the purposes and means of the processing of Personal Data, including any "business" or "controller" as defined in the State Privacy Laws.
"Customer Data" means information provided or otherwise made available by or on behalf of Customer to Ablo for processing on Customer's behalf to perform the Services.
"Data Subject" means the identified or identifiable natural person to whom Personal Data relates.
"EEA" means the European Economic Area. "FADP" means the Swiss Federal Act on Data Protection of 25 September 2020 and its implementing legislation.
"GDPR" means, as applicable to the processing concerned, Regulation (EU) 2016/679 (the "EU GDPR") and that regulation as it forms part of the law of the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018 (the "UK GDPR"), together with any national implementing or supplementary legislation and any successor to either.
"Information Security Incident" means a breach of Ablo's security resulting in the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Personal Data in Ablo's possession, custody or control. Unsuccessful attempts that do not compromise the security of Personal Data, such as failed log-in attempts, pings, port scans and network attacks repelled at the perimeter, are not Information Security Incidents.
"Personal Data" means Customer Data that constitutes personal data, personal information, or personally identifiable information under Applicable Data Protection Laws. It does not include information Ablo receives, collects or generates independently of the Services rather than on Customer's behalf, which is covered by the Privacy Policy instead.
"Process" and "Processing" mean any operation performed on Personal Data, whether or not by automated means, including collection, recording, storage, retrieval, use, disclosure, transmission, restriction, erasure and destruction.
"Processor" means the entity that processes Personal Data on behalf of the Controller, including any "service provider" or "contractor" as those terms are defined in the State Privacy Laws.
"Restricted Transfer" means a disclosure, grant of access or other transfer of Personal Data to a person located in a country that does not benefit from an adequacy decision of, as the context requires, the European Commission (an "EU Restricted Transfer"), the UK Government (a "UK Restricted Transfer"), or the Swiss Government (a "Swiss Restricted Transfer"), where the transfer would otherwise be prohibited without a legal basis under Chapter V of the GDPR or its equivalent.
"SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
"Security Measures" has the meaning given in Annex 4.
"State Privacy Laws" means the comprehensive state privacy laws of the United States, and their implementing regulations, in effect and applicable to Ablo's processing of Personal Data under the Agreement.
"Subprocessors" means Ablo's Affiliates and the third parties Ablo engages to process Personal Data in relation to the Services.
"Supervisory Authority" means any body with authority to enforce Applicable Data Protection Laws, including in the United Kingdom the Information Commissioner's Office and in Switzerland the Federal Data Protection and Information Commissioner.
"UK Transfer Addendum" means template Addendum B.1.0 issued by the Information Commissioner's Office and laid before Parliament under section 119A of the Data Protection Act 2018 on 2 February 2022, as revised under Section 18 of its Mandatory Clauses.
Duration and Scope
This DPA remains in effect for as long as Ablo processes Personal Data, notwithstanding expiry or termination of the Agreement.
Processing of Personal Data subject to the GDPR is additionally governed by Annex 2 (European Annex). Processing subject to the State Privacy Laws is additionally governed by Annex 3 (State Privacy Laws Annex).
As between the Parties, Customer is the Controller and Ablo is the Processor, except where Customer is itself a processor for a further controller, in which case Ablo is a subprocessor and this DPA is read accordingly.
Customer Instructions
Ablo will process Personal Data only on Customer's documented instructions, including as set out in this DPA, the Agreement, any Order Form, and any further written instructions consistent with them. By entering into this DPA, Customer instructs Ablo to process Personal Data to provide the Services and to perform Ablo's other obligations and exercise its rights under the Agreement.
Where Customer requests instructions that fall outside the scope of the Services, or that would require Ablo to materially change the Services or undertake work the Agreement does not contemplate, the Parties will agree those instructions in a mutually executed amendment.
Ablo will inform Customer if, in its reasonable opinion, an instruction infringes Applicable Data Protection Laws. Ablo will not process Personal Data for its own purposes, will not sell or share it, and will not retain, use or disclose it outside the direct business relationship with Customer or otherwise than as this DPA and the Agreement permit.
The details of the processing, including its subject matter, duration, nature, purpose, the categories of Data Subject and the categories of Personal Data, are set out in Annex 1.
Security
Ablo will implement and maintain the technical and organizational measures described in Annex 4 (the "Security Measures"), designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure or access, taking into account the state of the art, the cost of implementation, the nature, scope, context and purposes of the processing, and the risks to Data Subjects. Ablo may update the Security Measures, including to improve security or to address changes in Applicable Data Protection Laws, provided the updated measures do not materially decrease the overall protection of Personal Data.
Ablo will ensure that personnel authorized to access Personal Data are bound by appropriate obligations of confidentiality, and that access is limited to those who need it to perform the Services.
Ablo will notify Customer without undue delay after becoming aware of an Information Security Incident. The notification will describe, to the extent then known, the nature of the incident, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the steps Ablo has taken to mitigate it, and the steps Ablo recommends Customer take. Ablo will cooperate reasonably with Customer in investigating the incident. Notification is not an acknowledgement of fault or liability.
Customer is responsible for meeting its own notification obligations to Supervisory Authorities, Data Subjects and others. Where such a notice refers to or identifies Ablo, Customer will, where the law permits, tell Ablo in advance and consider in good faith any corrections Ablo reasonably proposes as to Ablo's involvement.
Without limiting Ablo's obligations above, Customer is responsible for its own use of the Services, including making appropriate use of the Services to achieve a level of security appropriate to the risk, securing the credentials, systems and devices it uses to reach the Services, securing the database and systems it makes available to Ablo, and keeping its own backups. Customer confirms it has evaluated the Services, the Security Measures and Ablo's commitments here, and determines that they meet its needs.
Data Subject Rights
Taking into account the nature of the processing, Ablo will give Customer the assistance reasonably necessary and technically feasible for Customer to meet its obligations to respond to Data Subject requests in relation to Personal Data in Ablo's possession or control.
If Ablo receives a request directly from a Data Subject, Ablo will promptly notify Customer, unless prohibited by law, and will direct the Data Subject to Customer. Customer is responsible for responding.
Where assistance under this Section requires work beyond the Services, Ablo may charge its then-current professional services rates, and will give Customer a good faith estimate before starting.
Customer Responsibilities
Customer will ensure that it has given all notices to, and obtained all consents and permissions from, Data Subjects and other third parties, and has reserved all necessary rights, as required for Ablo to process Personal Data as the Agreement contemplates. Customer will ensure there is a valid legal basis for that processing throughout the term, including under Articles 6, 9(2) and 10 of the GDPR where they apply.
Customer represents and warrants that Customer Data will not contain government-issued identification numbers, protected health information subject to HIPAA or other information about an individual's medical history, condition, treatment or diagnosis, health insurance information, biometric information, credentials for third-party accounts other than those created to access the Services, credentials to financial accounts, tax return data, payment card information subject to the Payment Card Industry Data Security Standard, personal data of children under 16, or any other special category of data under Applicable Data Protection Laws ("Restricted Data"), unless the Parties have agreed otherwise in writing in advance.
Customer decides what its own database holds and what the Services are pointed at. Ablo has no practical means of inspecting Customer Data for Restricted Data before it is processed, and Customer accepts responsibility for that choice.
Subprocessors
Customer specifically authorizes Ablo to engage its Affiliates as Subprocessors, and generally authorizes Ablo to engage third parties as Subprocessors in accordance with this Section. The Subprocessors engaged as at the date of this DPA, their functions and their locations are listed in Annex 5.
Before a Subprocessor processes Personal Data, Ablo will enter into a written contract with it imposing data protection obligations no less protective than those in this DPA, to the extent applicable to the nature of that Subprocessor's services. Ablo remains responsible for the performance of the obligations it subcontracts, and is liable for its Subprocessors' acts and omissions to the same extent as if it had performed the processing itself.
Ablo will give Customer written notice, which may be by email to Customer's designated contact, before engaging a new Subprocessor, naming it, its location and what it will do. Customer may object within 15 days of that notice on reasonable grounds relating to the protection of Personal Data, and the Parties will work in good faith toward a resolution. If none is reached within a reasonable time, Customer may terminate the affected Services as its sole and exclusive remedy, paying amounts due as at the date of termination.
Audits
Customer may audit Ablo's compliance with this DPA once per year, and on such other occasions as Applicable Data Protection Laws require of Customer or a competent Supervisory Authority requires, on written request giving reasonable detail and, where available, supporting documentation of the requirement. Ablo will contribute by providing the information and assistance reasonably necessary.
Customer must submit a proposed audit plan at least two weeks before the proposed start date, describing scope, duration and timing. Any third-party auditor must sign a customary non-disclosure agreement acceptable to both Parties, acceptance not to be unreasonably withheld. Ablo may object to an auditor that is, in its reasonable opinion, not independent, a competitor, or otherwise manifestly unsuitable, in which case Customer will appoint another or conduct the audit itself. Audits take place during regular business hours, follow the agreed plan and Ablo's security policies, and may not unreasonably interfere with Ablo's business. Nothing in this Section requires Ablo to breach a duty of confidentiality owed to anyone else.
Where the controls in question are covered by a SOC 2 Type 2, ISO, NIST or comparable report from a qualified third-party auditor issued within the preceding 12 months, and Ablo confirms no known material change in those controls since, Customer will accept that report in place of an audit of them.
Customer will promptly notify Ablo of any non-compliance found, and will share the resulting audit reports with Ablo unless prohibited by Applicable Data Protection Laws, using them only to meet its regulatory audit requirements or to confirm compliance with this DPA. Audits are at Customer's expense, and Customer will reimburse Ablo's reasonable documented costs at its then-current professional services rates.
Return and Deletion
On the date the Services involving processing of Personal Data cease (the "Cessation Date"), Ablo will promptly stop processing Personal Data for any purpose other than storage and the processing needed to return, delete or anonymize it, or as this DPA or applicable law otherwise permits or requires.
On written request made within 30 days after the Cessation Date (the "Post-cessation Storage Period"), and to the extent technically feasible, Ablo will within a commercially reasonable period either return a complete copy of the Personal Data in its possession by a secure method and then delete or anonymize its other copies, or delete or anonymize all Personal Data in its possession, as Customer elects.
If Customer gives no such instruction during the Post-cessation Storage Period, Ablo will within a commercially reasonable time afterwards delete or anonymize, at its option, the Personal Data then in its possession, custody or control, to the fullest extent technically feasible.
Ablo may retain Personal Data to the extent applicable law permits or requires, for no longer than that law requires, provided it keeps the data confidential and protected by the Security Measures, processes it only for the purpose the law specifies, and deletes or anonymizes it once retention is no longer permitted or required. Ablo will certify deletion in writing on request.
Customer's own records remain in Customer's own database throughout, and are unaffected by this Section. What Ablo returns or deletes is what Ablo holds, described in Annex 1.
Artificial Intelligence and Automated Processing
Ablo will not use Personal Data to train, fine-tune, develop or improve any artificial intelligence or machine learning model, whether its own or a third party's, unless doing so is reasonably necessary to provide the Services on Customer's documented instructions, or Customer has authorized it in writing.
Ablo will prohibit its Subprocessors, including any model providers, from using Personal Data for their own training, fine-tuning, development or improvement, except as Customer has authorized in writing.
The Services coordinate writes made by Customer's people, agents and applications. Ablo does not itself make automated decisions about Data Subjects that produce legal or similarly significant effects. If that changes, Ablo will disclose it to Customer, provide meaningful information about the logic involved so far as that is available without disclosing trade secrets, and cooperate reasonably so Data Subjects can exercise their rights.
Miscellaneous
Except as this DPA expressly modifies it, the Agreement remains in full force. The Parties agree that Ablo's access to Personal Data forms no part of the consideration exchanged under the Agreement.
Notices Ablo gives under this DPA may be given under any notice clause of the Agreement, to Customer's data protection contact in Annex 1, to Ablo's primary contacts at Customer, or to any email address Customer designates for Services-related communications. Customer is responsible for keeping those addresses valid.
Ablo may vary this DPA on written notice solely so far as necessary to maintain compliance with Applicable Data Protection Laws, provided the variation does not materially reduce the protections for Personal Data or materially increase Customer's obligations without Customer's written agreement. This includes replacing the SCCs under paragraph 3.4 of Annex 2.
So far as Applicable Data Protection Laws and the SCCs permit, each Party's total aggregate liability under or in connection with this DPA and the SCCs is subject to the limitations, caps and exclusions of liability agreed in the Agreement. Nothing in this clause affects any person's liability to Data Subjects under the third-party beneficiary provisions of the SCCs.
Where this DPA conflicts with the Agreement, this DPA prevails. Where SCCs entered into under Annex 2 conflict with this DPA or the Agreement, the SCCs prevail in respect of the Restricted Transfer they apply to.
Contact
Questions about this DPA, requests for a countersigned copy, and data protection correspondence go to lukas@abloatai.com, marked for the attention of Elias Agardh, or by post to Ablo Inc., Torstenssonsgatan 7A, 114 56 Stockholm, Sweden.
Data Processing Details
Provider, acting as data importer
Name: Ablo Inc.
Address: Torstenssonsgatan 7A, 114 56 Stockholm, Sweden
Contact for data protection: Elias Agardh, lukas@abloatai.com
Activities: Provision of the Ablo coordination platform: accepting writes from Customer's people, agents and applications, keeping the record of those writes and the coordination state that governs them, and applying them to Customer's own database.
Role: Processor, or subprocessor where Customer is itself a processor
Customer, acting as data exporter
Name: The entity that is Ablo's counterparty under the Agreement
Address and data protection contact: As stated in the Order Form, or as Customer otherwise notifies Ablo in writing
Activities: Customer's use and receipt of the Services under the Agreement, as part of its ongoing business operations
Role: Controller, or processor where a further controller stands behind it
The processing
Categories of Data Subject: Customer's personnel, including employees and contractors; agents operating on Customer's behalf; end users and other users of Customer's own products and services; and Customer's business contacts and representatives, in each case where Customer causes their Personal Data to be processed through the Services.
Categories of Personal Data: Identifiers and contact details such as name and email address; authentication details such as account credentials, API keys and access tokens; technical details such as IP addresses, device identifiers and application activity; and whatever further categories Customer chooses to route through the Services in the content of its writes.
Sensitive categories: None. Under Section 6.2, Restricted Data must not be submitted to the Services without the Parties' prior written agreement. No additional safeguards are therefore specified.
Nature and purpose: The operations needed to provide the Services and perform Ablo's obligations under the Agreement and this DPA, on Customer's documented instructions.
What Ablo holds: Ablo does not host Customer's records. Those stay in Customer's own database. What Ablo stores is the durable record of writes made through the Services, the coordination state around them such as claims and their holders, and the account and authentication data needed to operate the Services.
Frequency of transfer: Continuous, as initiated by Customer through its use of the Services.
Duration and retention: For the period determined under the Agreement and Section 9 of this DPA.
Transfers to Subprocessors: As described in Annex 5, for the purposes stated there.
European Annex
This Annex applies to processing of Personal Data subject to the GDPR.
1. Processing
1.1 Where Ablo receives an instruction that, in its reasonable opinion, infringes the GDPR, Ablo will inform Customer.
1.2 Customer's instructions in respect of processing under the Agreement will comply with the GDPR and all other applicable law.
2. Impact assessments and prior consultation
2.1 Taking into account the nature of the processing and the information available to it, Ablo will give Customer reasonable assistance, at Customer's cost and on written request, with data protection impact assessments and prior consultations with Supervisory Authorities required of Customer under Articles 35 and 36 of the GDPR, in each case only in relation to Ablo's processing of Personal Data.
2.2 Except where prohibited by law, Customer will reimburse Ablo's time at its then-current professional services rates.
3. Restricted transfers
3.1 Where processing under this DPA involves an EU Restricted Transfer from Customer to Ablo, the Parties will comply with the SCCs, which are deemed populated in accordance with paragraph 3.5 below and entered into by the Parties and incorporated by reference into this DPA.
3.2 Where it involves a UK Restricted Transfer, the Parties will comply with the SCCs as varied by the UK Transfer Addendum, deemed varied to meet the requirements of the UK GDPR, populated in accordance with paragraph 3.5, and incorporated by reference.
3.3 Where it involves a Swiss Restricted Transfer, the Parties will comply with the SCCs, deemed varied to address the requirements of the FADP, populated in accordance with paragraph 3.5, and incorporated by reference. Nothing in them limits the right of a Data Subject habitually resident in Switzerland to bring proceedings before the Swiss courts under Clause 18(c).
3.4 Ablo may on notice vary this DPA to replace the relevant SCCs with a new or replacement form of them, or with another valid transfer mechanism it reasonably determines is necessary to maintain compliance with Chapter V of the GDPR, provided the replacement does not materially decrease the overall protection of Personal Data.
3.5 Population of the SCCs. Each Party is deemed to have signed the SCCs at the relevant signature block. Module Two applies where Customer is a Controller in its own right, and Module Three applies where Customer is itself acting as a processor for another person. In Clause 7 the optional docking clause does not apply. In Clause 9, Option 2 (general written authorization) applies, with the notice period set at 15 days as provided in Section 7.3. In Clause 11 the optional independent dispute resolution language does not apply. In Clause 17 the governing law is the law of Ireland, and in Clause 18(b) the forum is the courts of Ireland. Annexes I, II and III to the SCCs are populated by Annex 1, Annex 4 and Annex 5 of this DPA respectively. For UK Restricted Transfers, Tables 1 to 3 of the UK Transfer Addendum are populated by the same annexes, and in Table 4 neither Party may end the Addendum under Section 19.
3.6 On specific written request from Customer, supported by suitable evidence that a Supervisory Authority, Data Subject or further controller has asked for it, Ablo will within a reasonable time provide an executed version of the relevant SCCs for countersignature.
3.7 In meeting its transparency obligations under Clause 8.3 of the SCCs, Customer will not make available, and will take appropriate steps to protect, Ablo's and its licensors' trade secrets and other commercially sensitive information.
3.8 For Clause 10(a) of Module Three, Customer acknowledges there are no circumstances in which it would be appropriate for Ablo to notify a third-party controller of a Data Subject request, and that any such notification is Customer's sole responsibility. For Clause 15.1(a), Customer is solely responsible for notifying Data Subjects where required, except so far as law or a public authority prohibits it.
3.9 Section 7 of this DPA applies to Ablo's appointment and use of Subprocessors under the SCCs, and any approval given or deemed given under it constitutes Customer's documented instruction to make the corresponding onward transfers under Clause 8.8. The audits described in Clauses 8.9(c) and 8.9(d) are subject to Section 8, and certification of deletion under Clauses 8.5 and 16(d) is provided on written request.
State Privacy Laws Annex
This Annex applies to processing of Personal Data subject to the State Privacy Laws, and the terms it uses carry the meanings those laws give them.
Ablo acts as a service provider, contractor or processor, as the applicable law defines those roles, and processes Personal Data solely for the business purpose of providing the Services under the Agreement.
Ablo will not:
- sell or share Personal Data, as the State Privacy Laws use those terms, including for cross-context behavioral advertising;
- retain, use or disclose Personal Data for any purpose other than the business purposes specified in the Agreement, including outside the direct business relationship between the Parties, except as the applicable law permits;
- combine Personal Data with personal information received from or on behalf of anyone else, or collected from its own interactions with consumers, except as the applicable law permits a service provider or contractor to do.
Ablo will notify Customer if it determines it can no longer meet these obligations. Customer may, on notice, take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Data, and Customer has the right to take those steps under this DPA.
Ablo will comply with the obligations applicable to it under the State Privacy Laws and provide the same level of privacy protection those laws require, and will assist Customer in responding to consumer rights requests as described in Section 5.
Security Measures
These are the technical and organizational measures Ablo maintains. They are the Security Measures referred to in Section 4.
Encryption. Personal Data is encrypted in transit using current TLS, and at rest in Ablo's databases and object storage.
Network isolation. Ablo's database runs in a private network segment that is not reachable from the public internet. Only the application tier can open a connection to it.
Tenant isolation. Data belonging to different Customers is separated at the database level by row-level security, enforced by the database itself rather than by application code, so a query that omits the scope returns nothing rather than returning another Customer's rows.
Least privilege. The application connects using narrowly scoped database roles that hold only the permissions their function requires. Writes to a Customer's own database are made through a separately scoped role granted by that Customer.
Access control. Access to production systems requires individual authenticated accounts with multi-factor authentication, is granted on the principle of least privilege, and is removed when no longer needed. Personnel with access are bound by confidentiality obligations.
Credential management. Credentials for Customer databases are held in a managed secrets store, separated per environment, and are rotatable without redeploying the Services.
Auditability. Writes accepted through the Services are recorded in a durable, append-only transaction log that records what was written and by which identity, which is available to Customer through the Services.
Monitoring. Application errors and infrastructure metrics are collected and alerted on, and access to those systems is restricted to authorized personnel.
Resilience. Ablo's databases are backed up automatically with point-in-time recovery, and backups are encrypted.
Change management. Changes to production code are version controlled, reviewed before release, and deployed through an automated pipeline.
Subprocessors
These are the Subprocessors engaged as at the date of this DPA. Ablo will give notice before engaging a new one, as Section 7.3 describes.
| Subprocessor | Purpose | Processing location |
|---|---|---|
| Amazon Web Services | Hosting and storage for the platform, including the transaction log | European Union, with logging and monitoring in the United States |
| Vercel | Hosting for the Ablo websites and dashboard | United States and European Union |
| Sentry | Application error monitoring | European Union |
| Resend | Delivery of transactional and service email | United States |
Ablo's Affiliates, including our Swedish subsidiary, are authorized Subprocessors under Section 7.1.