Data Processing Agreement

1.1. This DPA applies to the processing of personal data by biosuite ApS on behalf of the Customer in connection with the provision of the biosuite platform and related services ("Service").

1.2. The purpose of the processing is to deliver procurement, spend, and financial workflow features, including document processing, spend analytics, approvals, and data storage.

1.3. The Controller determines the purpose and means of all Customer Uploaded Data (documents and financial records). The Processor determines the purpose and means of Platform Usage Data (logs, security events, device data) as separate Data Controller, solely for security, service operation and improvement, as described in the Privacy Policy.

1.4. Role split: For clarity, biosuite acts as:

• (a) Data Processor for Customer Uploaded Data; and
• (b) Independent Data Controller for Platform Usage Data and for Account and Billing Data processed for security, fraud prevention, service improvement, analytics, contract administration, billing, and compliance purposes.

This role split reflects the nature of the Service and ensures GDPR compliance.

Unless otherwise specified, "personal data" in this section refers to Customer Uploaded Data processed in our role as Data Processor.

4.1. The Controller is responsible for ensuring a lawful basis for all personal data uploaded or processed in the Service.

4.2. The Controller may not upload data that violates applicable laws or infringes third-party rights.

4.3. The Controller is responsible for handling data subject requests except where the Processor is required to assist under this DPA.

4.4. The Controller must not upload restricted data as defined in Section 2.7 of the Terms of Service, which applies to all uploads under this DPA.

4.5. The Controller acknowledges that ordinary supplier invoices may contain the supplier's bank or payment account details as part of the document itself, and that such details remain part of the stored source document. The Processor does not extract, index, or otherwise process such details as structured data, and the Service does not process, initiate, or otherwise contribute to payments. The Controller remains responsible for determining whether its upload of such documents is lawful and appropriate under its own policies and applicable law.

5.1. The Controller authorizes the Processor to use the sub-processors listed below. These sub-processors process personal data solely to provide the Service and under written agreements ensuring GDPR-compliant protections. The listed sub-processors may engage their own sub-processors (such as cloud infrastructure providers) under equivalent data protection obligations. An overview of such providers is available upon request.

5.2. The Processor will notify the Controller (by email or in-app notice) at least 30 days before adding or replacing a sub-processor. The Controller may object on reasonable data protection grounds within 14 days of such notice. If the objection cannot be resolved, the Controller may terminate the affected Service as its sole remedy.

5.3. International transfers outside the EU/EEA are conducted using appropriate safeguards such as Standard Contractual Clauses (SCCs), encryption, and minimized data exposure, as described in our Privacy Policy.

5.4. For information about how biosuite processes data using AI features, see our AI Data Processing Policy. That policy applies to the AI-assisted features described in it. Automated reading of uploaded invoice documents forms part of the standard document workflow; the other AI features apply only where they have been activated or expressly requested within the platform.

6.1. Personal data may be transferred outside the EU/EEA when necessary for the Service, including through the sub-processors listed above and through sub-processors engaged by those sub-processors. This includes sub-processors engaged by our AI document-reading provider, which is established in the European Union but may use its own sub-processors located outside the EU/EEA. Uploaded invoice documents are stored in an object storage bucket configured with European Union jurisdiction. The Processor does not represent that the Service involves no processing outside the EU/EEA.

6.2. The Processor ensures that any such transfer complies with GDPR requirements and provides a level of protection essentially equivalent to that of the EU.

6.3. References to the GDPR in this DPA include, where applicable, the UK GDPR and the Swiss Federal Act on Data Protection (FADP). Transfers of personal data originating from the UK or Switzerland are protected by the Standard Contractual Clauses supplemented by the UK International Data Transfer Addendum or Swiss-specific amendments, as applicable.

7.1. The Controller may request documentation demonstrating our compliance with this DPA.

7.2. Audit rights are primarily satisfied through written documentation and available certifications or audit reports from our infrastructure providers. Where the Controller reasonably requires further verification under Article 28(3)(h) GDPR, the Controller may conduct (or mandate an independent auditor to conduct) an audit no more than once per 12-month period, upon at least 30 days' written notice, during normal business hours, at the Controller's own cost, and in a manner that does not disrupt Service operations.

Liability under this DPA follows the limitations set out in the Terms of Service. This DPA does not create additional liability beyond what is stated in the Terms.

9.1. This DPA remains in force for as long as the Processor processes personal data on behalf of the Controller.

9.2. Upon termination of the Service, the Processor will delete or anonymize data in accordance with our Privacy Policy and the retention periods described therein. Prior to deletion, the Controller may export the structured records held in the application database using the Service's standard export functionality, and may download original document files from the Service.

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the Customer and biosuite ApS.

This DPA becomes binding when the Customer creates a company workspace within the Service and expressly accepts this DPA through the acceptance step provided during the company creation process.

The Customer must accept this DPA before submitting or storing any personal data within the Service.

The creation of an individual user account without creating a company workspace does not constitute acceptance of this DPA.

By accepting this DPA, the Customer confirms that it acts as Data Controller with respect to any personal data uploaded to the Service.

biosuite ApS may update this DPA from time to time. Where changes materially affect the Customer's rights or obligations, biosuite ApS will provide reasonable notice. Continued use of the Service after such notice constitutes acceptance of the updated DPA, unless the Customer objects before the changes take effect and ceases use of the Service.

This DPA becomes effective on the date the Customer expressly accepts it during company workspace creation in the Service.

This DPA is governed by the laws of Denmark. Any disputes shall be resolved in the courts of Copenhagen, Denmark.

For questions regarding this DPA or data protection matters, please contact us at hello@biosuite.io or through the contact form on our website.