Data processing agreement

Version of 13 September 2026. Draft for counsel: roles, 30-day sub-processor objection, termination with pro-rata refund. Breach notice remains without undue delay. Annex B says what FullEnrich and Serper receive, including decision-makers found in public search results.

These are Forgeby's standard data-processing terms, and they form part of your agreement. To execute a signed DPA, write to privacy@forgeby.com.

Last updated 13 September 2026

This Data Processing Agreement ("DPA") applies to Zmart Com West AB, Swedish organisation number 559019-9161, trading as Forgeby (a registered name change to Forgeby AB is in progress; it is the same company either way) and a customer in connection with the Forgeby platform (formerly Alloy). It forms part of the agreement between the parties. The two roles below do not collapse into one.

1. Roles and scope

Forgeby is the controller of the library: the company and contact records compiled from the four named sources, the Article 14 notice published for them, and the requests those people send to us.

The customer is the controller of its own outreach: who it writes to, what it says, and the record of anyone who tells it to stop.

Where Forgeby processes the customer's own data on the customer's behalf (workspace accounts, pipeline, a connected mailbox or calendar, CRM sync, meeting capture the customer turns on), the customer is the Controller and Forgeby is the Processor. The rest of this DPA applies to that processing. Subject-matter, duration, nature and purpose, types of personal data and categories of data subjects for that processing are set out in Annex A.

2. Processor obligations (GDPR Art. 28)

• Process only on documented instructions from the Controller.
• Ensure persons authorised to process are bound by confidentiality.
• Implement appropriate technical and organisational measures (Art. 32): see Trust and security.
• Engage sub-processors only under Section 3 and flow down equivalent obligations.
• Assist the Controller in responding to data-subject requests.
• Assist with security, breach notification, and DPIAs (Art. 32-36).
• At the Controller's choice, delete or return personal data at the end of the service.
• Make available information needed to demonstrate compliance and allow audits.

3. Sub-processors

The Controller grants general authorisation to use the sub-processors listed in Annex B. We will give at least 30 days' prior notice of an intended addition or replacement, by email to the address we hold for the Controller and by updating this page. Objection is sent to privacy@forgeby.com, on reasonable data-protection grounds, within those 30 days. A sustained objection that we cannot accommodate is a ground for the Controller to terminate the processing under this DPA; unused prepaid fees for the remaining term are refunded pro rata.

4. International transfers

Where personal data is transferred outside the EU/EEA, the parties rely on Standard Contractual Clauses and appropriate safeguards. Your workspace, pipeline and contact records are stored in the EU (Stockholm, eu-north-1), and the application that serves them runs in the EU (Stockholm, arn1).

Four sub-processors sit outside the EU/EEA and each is listed in Annex B with its role. Sign-in and identity (WorkOS) holds user email addresses, names and session records in the United States, and holds the read-only token for any mailbox or calendar a partner chooses to connect. Company and decision-maker research (Serper) receives company names and role words, and a business contact's name when resolving that contact's public professional profile link; what comes back is public search results, from which decision-makers are found. Voice (ElevenLabs) synthesises Rune's spoken lines in the United States; only the sentence to be spoken leaves the EU. AI inference runs on Amazon Bedrock EU inference profiles by default; the Anthropic API in the United States remains configured as a fallback and for tasks needing live web search, which Bedrock does not offer, and it carried no calls at all in the ten days to 21 August 2026. No customer records are stored outside the EU by any of the four.

5. Personal data breach

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, with the information reasonably available.

6. Liability and term

This DPA follows the term and liability provisions of the main agreement. If the Controller terminates because of a sustained sub-processor objection under section 3, unused prepaid fees for the remaining term are refunded pro rata.

Annex A: Processing details

Annex B: Sub-processor list

All Forgeby-operated storage runs in the EU (Stockholm, eu-north-1): your workspace, pipeline and contact records never leave the EU. AI inference runs in the EU by default, on Amazon Bedrock EU inference profiles. The Anthropic API in the United States remains configured for tasks needing live web search, which Bedrock does not offer, and as fallback when the EU route is unavailable; it carried no calls in the ten days to 21 August 2026. Sign-in, voice, and some company and decision-maker research and enrichment run outside the EU and are marked below. Customer-connected services run only where a customer chooses to connect them.

Questions about this DPA, or a request for a countersigned copy, go to privacy@forgeby.com.