DPA
Data Processing Agreement
These are Forj AB's standard data-processing terms, forming part of your agreement. To execute a signed DPA, contact privacy@forj.se.
This Data Processing Agreement ("DPA") applies where Forj AB (org.nr 559019-9161, currently registered as Zmart Com West AB) ("Processor") processes personal data on behalf of a customer ("Controller") in connection with the Alloy platform, and forms part of the agreement between the parties.
1. Roles & scope
The Controller determines the purposes and means; the Processor processes personal data only on the Controller's documented instructions, including the Alloy service itself. Subject-matter, duration, nature and purpose, types of personal data and categories of data subjects are set out in Annex A.
2. Processor obligations (GDPR Art. 28)
- Process only on documented instructions from the Controller.
- Ensure persons authorised to process are bound by confidentiality.
- Implement appropriate technical and organisational measures (Art. 32): see Trust & Security.
- Engage sub-processors only under Section 3 and flow down equivalent obligations.
- Assist the Controller in responding to data-subject requests.
- Assist with security, breach notification, and DPIAs (Art. 32-36).
- At the Controller's choice, delete or return personal data at the end of the service.
- Make available information needed to demonstrate compliance and allow audits.
3. Sub-processors
The Controller grants general authorisation to use the sub-processors listed in Annex B. We will give prior notice of intended changes and a chance to object on reasonable data-protection grounds.
4. International transfers
Where personal data is transferred outside the EU/EEA, the parties rely on Standard Contractual Clauses and appropriate safeguards. Primary hosting is in the EU.
5. Personal data breach
The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, with the information reasonably available.
6. Liability & term
This DPA follows the term and liability provisions of the main agreement.
Annex A: Processing details
| Item | Detail |
|---|---|
| Subject-matter | Provision of the Alloy multicloud prospecting & co-sell platform |
| Nature & purpose | Identifying, enriching, contacting and managing B2B opportunities |
| Data types | Business contact data: name, title, work email, business phone, professional profile, employer; user account data |
| Data subjects | The Controller's prospects and business contacts; the Controller's users |
| Duration | For the term of the agreement |
Annex B: Sub-processor list
| Sub-processor | Purpose | Region |
|---|---|---|
| Amazon Web Services | Hosting, deployment, AI inference (Amazon Bedrock), pricing & data APIs | EU (Stockholm) |
| HubSpot | CRM sync, only when a customer connects it | per HubSpot |
| OnePageCRM | CRM sync, only when a customer connects it | per OnePageCRM |
| Recall.ai | Meeting capture, only when a customer connects it | US |