DPA

Data Processing Agreement

Last updated 16 July 2026

These are Forj AB's standard data-processing terms, forming part of your agreement. To execute a signed DPA, contact privacy@forj.se.

This Data Processing Agreement ("DPA") applies where Forj AB (org.nr 559019-9161, currently registered as Zmart Com West AB) ("Processor") processes personal data on behalf of a customer ("Controller") in connection with the Alloy platform, and forms part of the agreement between the parties.

1. Roles & scope

The Controller determines the purposes and means; the Processor processes personal data only on the Controller's documented instructions, including the Alloy service itself. Subject-matter, duration, nature and purpose, types of personal data and categories of data subjects are set out in Annex A.

2. Processor obligations (GDPR Art. 28)

• Process only on documented instructions from the Controller.
• Ensure persons authorised to process are bound by confidentiality.
• Implement appropriate technical and organisational measures (Art. 32): see Trust & Security.
• Engage sub-processors only under Section 3 and flow down equivalent obligations.
• Assist the Controller in responding to data-subject requests.
• Assist with security, breach notification, and DPIAs (Art. 32-36).
• At the Controller's choice, delete or return personal data at the end of the service.
• Make available information needed to demonstrate compliance and allow audits.

3. Sub-processors

The Controller grants general authorisation to use the sub-processors listed in Annex B. We will give prior notice of intended changes and a chance to object on reasonable data-protection grounds.

4. International transfers

Where personal data is transferred outside the EU/EEA, the parties rely on Standard Contractual Clauses and appropriate safeguards. All hosting and storage is in the EU. The only routine transfer outside the EU/EEA is AI inference for tasks that require live web search, which runs on the Anthropic API in the United States (see Annex B); no customer records are stored there.

5. Personal data breach

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, with the information reasonably available.

6. Liability & term

This DPA follows the term and liability provisions of the main agreement.

Annex A: Processing details

Annex B: Sub-processor list

All Forj-operated storage runs in the EU (Stockholm, eu-north-1): your workspace, pipeline and contact records never leave the EU. AI inference runs in the EU on Amazon Bedrock by default; a limited set of tasks that need live web search runs on the Anthropic API in the United States, because that capability is not available on Amazon Bedrock. Both are listed below. Customer-connected services (marked below) run only where a customer chooses to connect them.