termseng

www.agreem.se

General Terms and Conditions

These General Terms and Conditions (“General Terms”) apply to agreements between Agreem AB (“Agreem” or the “Provider”) and the legal entity entering into a subscription agreement with Agreem (the “Customer”) regarding the use of Agreem’s digital contract management service (the “Service”).

The General Terms, together with the versions in force from time to time of: (i) the Service Level Agreement (SLA), (ii) the Data Processing Agreement (DPA), and (iii) Agreem’s security, privacy and other policies referred to in these General Terms, jointly constitute the complete agreement between the parties governing all matters relating to the contractual relationship (the “Agreement”).

In the event of any conflict between these General Terms and any appendix or policy, the General Terms shall prevail unless expressly stated otherwise.

The Service is provided exclusively for business use (B2B). By entering into the Agreement, the Customer confirms that it is acting in the capacity of a business entity. 1. Scope of the Agreement • The Agreement grants the Customer a non-exclusive right to use the Service in accordance with these terms. • The Service is provided exclusively for business use (B2B). • Each user must have individual login credentials. 1.1 Users and Licences The Service is provided based on a licence and user model. The subscription includes a number of user licences with different permission levels as specified in the applicable product description, price list, quotation, or order confirmation in force from time to time. The Customer may expand its subscription by purchasing additional user licences in accordance with Agreem’s applicable terms. Additional licences are charged in accordance with the applicable price list or quotation and apply for the remainder of the current subscription period. The Customer is responsible for ensuring that the number of users does not exceed the number of licences included in the subscription. 2. Term, Termination and Renewal 2.1 Subscription Types The Customer may choose between a monthly subscription and an annual subscription. The terms applicable to each subscription type are set out below. 2.2 Monthly Subscription A monthly subscription runs on a one (1) month rolling basis and may be terminated by either party with one (1) month’s notice. Termination takes effect at the end of the current subscription period. 2.3 Annual Subscription An annual subscription is entered into for a fixed term of twelve (12) months and is paid in advance. Annual subscriptions are normally offered at a discounted price compared to monthly subscriptions. 2.4 Termination of Annual Subscription An annual subscription may be terminated with one (1) month’s notice prior to the end of the subscription term. Termination of an annual subscription does not affect the Customer’s payment obligation for the ongoing subscription period and does not entitle the Customer to any refund of fees already paid. 2.5 Renewal If an annual subscription is not terminated in accordance with Section 2.4, the Agreement shall automatically renew for successive twelve (12) month periods unless otherwise agreed. 3. Fees and Payment Terms • The Customer may choose monthly payment via direct debit or annual payment by invoice. • All prices are stated exclusive of value added tax (VAT). • Agreem reserves the right to adjust prices prior to a new subscription period. • In the event of late payment, statutory default interest and reminder fees may apply. 4. Delivery of the Service • Delivery is deemed to have occurred when the Customer receives login credentials by email. 5. No Right of Withdrawal (B2B) • As the Agreement is entered into between business entities, no statutory right of withdrawal applies. 6. Maintenance and Changes • Agreem may update and modify the Service in order to improve functionality and security. 7. Assignment • The Customer may not assign the Agreement without Agreem’s prior written consent. 8. Termination for Breach Agreem may terminate the Agreement with immediate effect if: • the Customer breaches these terms, • the Customer fails to pay an overdue invoice, or • the Customer is deemed insolvent (bankruptcy, liquidation, etc.). 9. Personal Data and GDPR • Agreem acts as a data processor when the Customer stores contracts and internal information in the Service. • The Customer is the data controller for the content it stores. • A separate Data Processing Agreement (DPA) is always entered into. 10. Limitation of Liability • Agreem’s liability is limited to direct damages and, in total, to an amount corresponding to three (3) months of subscription fees. • Agreem shall not be liable for indirect losses, loss of profit, or data loss unless caused by gross negligence. 11. Intellectual Property Rights • All software, documentation and other materials belong to Agreem. • The Customer is granted only a right of use in accordance with the Agreement. 12. Force Majeure Neither party shall be liable for failure to fulfil its obligations due to events beyond its reasonable control, including natural disasters, war, pandemics, strikes, or major IT disruptions. 13. Governing Law and Dispute Resolution • Swedish law shall apply. • Any dispute shall be settled in the first instance by the Stockholm District Court.

14. Renegotiation Agreem may, at the Customer’s request, assist with the review and renegotiation of existing agreements. The process generally includes the following steps: • The Customer submits a renegotiation request through the Service. • Agreem contacts the Customer to collect and share relevant information and, where necessary, prepare the required documentation (NDA, power of attorney, cooperation agreement). • Agreem analyses the relevant agreement and may, where appropriate, conduct market analysis and independent procurement processes in order to identify improved terms and conditions. • The Customer is kept continuously informed and remains responsible for all decisions and any agreements entered into as a result of the renegotiation. Agreem does not guarantee that a renegotiation will result in any specific outcome. Submitting a request is free of charge and non-binding for the Customer. For more information about the service, please contact Agreem: info@agreem.se

Data Security

Agreem provides a contract management service designed for businesses with high requirements for security, data protection and traceability. We prioritise confidentiality, integrity and full transparency in how data is handled.

1. Data Centres and Infrastructure • All customer data is stored in Microsoft Azure Sweden (Sweden). • Databases, servers, logs and backups are processed and stored exclusively within Sweden. • Azure Sweden meets relevant security standards, including ISO 27001, ISO 27018 and SOC reports.

2. Secure Login and Account Protection • All accounts are protected with two-factor authentication (2FA). • A six-digit security code is sent to the registered email address upon login. • Passwords are always stored as hashed and salted values.

3. Data Protection and Confidentiality • Customer data is used solely to provide Agreem’s services. • We do not scan, sell or share customer data with third parties except documented sub-processors under the DPA. • No customer data is used to train AI models.

4. Encryption and Transmission Security • All communication to and from the Service is protected by TLS/SSL encryption. • Data in transit is protected using modern encryption protocols. • Data at rest is protected using Azure platform encryption features.

5. Backups and Recovery • Databases are backed up continuously. • Backups are stored within Sweden using Azure infrastructure. • Recovery procedures are tested regularly.

6. Audit Logs and Traceability All system activity is logged, including: • who has opened or edited a contract, • who has created new contracts, • who has made decisions regarding renewal or termination. Audit logs are retained in accordance with internal security policies and GDPR.

7. Access Control • Roles and permissions can only be managed by company administrators.

This policy describes how Agreem processes personal data when companies use the Service.

1. Data Controller and Processor Roles • When Agreem processes the Customer’s own user data (contact persons, account details, etc.), Agreem acts as data controller. • When the Customer uploads and stores contracts and internal information, Agreem acts as data processor. • This is regulated by a separate Data Processing Agreement.

2. Categories of Personal Data Agreem may process: • name, • email address, • telephone number, • username, • IP addresses, • usage-related logs.

3. Purpose and Legal Basis As data controller: • Administration of customer relationships (contracts, invoicing) — Contract • Communication, support and operational information — Legitimate interest As data processor: • Providing storage and functionality for contract management — Contract

4. Retention Periods • Customer data is stored as long as necessary to fulfil the Agreement. • Logs may be stored for up to 12 months. • Marketing-related data may be stored for up to 12 months after the customer relationship ends. • Backups are deleted in accordance with internal routines.

5. Third Parties and Sub-Processors Agreem uses only: • Microsoft Azure Sweden as infrastructure provider. Other sub-processors are documented in the DPA.

6. Security Measures • Encryption of data in transit and at rest. • Restricted access rights. • Logging of all access attempts. • Regular security updates and controls.

7. Your Rights Customers have the right to request: • access to personal data, • rectification, • erasure, • restriction of processing, • data portability. Requests should be sent to: support@agreem.se

8. Changes to the Privacy Policy Agreem may update this policy as needed. The latest version is always available on the website.

Service Level Agreement (SLA)

This Service Level Agreement (“SLA”) governs Agreem’s commitments regarding availability, support and incident management for the Service. This SLA applies in addition to the General Terms. In the event of any conflict, the General Terms shall prevail.

1. Definitions Availability (Uptime) The time during which the Service is accessible to the Customer via the standard web interface and functions in its essential parts. Unavailability When the Service is completely inaccessible to all users. Partial errors, performance degradation or errors in individual features do not constitute unavailability unless expressly stated otherwise. Business Hours Weekdays 09:00–17:00 (CET), excluding Swedish public holidays.

2. Availability Agreem aims for the Service to be available 99.95% per calendar month, calculated on a monthly basis. Availability is measured using Agreem’s internal monitoring tools. The following does not count as unavailability: • planned maintenance, • emergency security measures, • force majeure events, • disruptions caused by the Customer’s network, equipment or third-party providers, • outages in third-party services on which the Service depends.

3. Planned Maintenance Agreem may perform planned maintenance to ensure security, stability and functionality. Maintenance is normally communicated at least 24 hours in advance and is scheduled outside business hours where possible. In exceptional cases, shorter notice may apply.

4. Incident Management 4.1 Incident Classification • P1 – Critical Incident: Service completely unavailable • P2 – Major Incident: Significant parts of functionality unavailable • P3 – Normal Incident: Errors affecting functionality but work can largely continue • P4 – Minor Incident / Improvement Request The Customer may not unilaterally determine incident priority. 4.2 Response Times Response time refers to the time until Agreem begins investigation, not resolution. • P1: Within 2 hours during business hours • P2: Within 4 hours during business hours • P3: Within 1 business day • P4: Handled as part of regular development Status updates are provided in reasonable intervals for P1 incidents.

5. Support Support hours: Weekdays 09:00–15:00 (CET) Contact: support@agreem.se Support includes technical helpdesk, troubleshooting, account management and guidance on Service functionality. Support does not include training, business or legal advice, or work in the Customer’s internal IT environment.

6. Backup and Recovery Agreem performs regular backups stored within the EU (Azure Sweden). In the event of major incidents leading to data loss, Agreem may restore data where possible in accordance with internal procedures. Full data restoration is not guaranteed.

7. SLA Credits If availability is not met in a calendar month, the Customer may request a credit of up to 10% of the fixed subscription fee for that month. Credits must be requested within 30 days, are issued as a credit against future invoices, and constitute the Customer’s sole remedy. No credit is granted if the outage falls under the exclusions above or if the Customer fails to cooperate.

8. SLA Changes Agreem may update this SLA with at least 30 days’ notice. Changes may not materially reduce availability without valid reason.

Data Processing Agreement (DPA)

This Data Processing Agreement (“Agreement”) is entered into between: Data Controller: The Customer Data Processor: Agreem AB, reg. no. 559567-7948 (“Agreem”)

The Agreement governs Agreem’s processing of personal data on behalf of the Customer in accordance with GDPR (EU) 2016/679 and forms an integral part of the Agreement for the Service.

1. Purpose Agreem processes personal data solely on documented instructions from the Customer in order to provide the Service.

2. Definitions Terms shall have the meanings set out in GDPR unless otherwise stated.

3. Scope and Duration Processing occurs for the duration of the Agreement and ends when the contractual relationship terminates.

4. Categories of Data and Data Subjects Includes employees, contract counterparties, contact persons and users. Personal data includes names, contact details, roles, login credentials, contract data and usage logs. No special categories of data are intentionally processed.

5. Instructions Agreem processes data only in accordance with this Agreement, Customer instructions and applicable law.

6. Security Appropriate technical and organisational measures are implemented in accordance with Article 32 GDPR. Data is stored within the EU/EEA.

7. Sub-Processors The Customer authorises Agreem to use sub-processors, including cloud infrastructure providers. Equivalent data protection obligations apply.

8. Assistance Agreem assists the Customer with data subject rights, incident notifications and DPIAs to a reasonable extent.

9. Personal Data Incidents Agreem shall notify the Customer without undue delay and provide relevant information.

10. Deletion and Return Upon termination, personal data shall be deleted or anonymised unless retention is required by law.

11. Audit The Customer may request reasonable information demonstrating compliance. Audits shall be conducted with notice and at the Customer’s expense.

12. Liability Liability is limited in accordance with the main Agreement.

13. Governing Law and Disputes Swedish law applies. Disputes are resolved in accordance with the main Agreement. The General Terms prevail in case of conflict.

Last updated: 2026-02-05