Last Revised Version: 2021-03-12
This agreement has on this day been concluded between Roaring Apps AB, corporate identification number 559067-2613 and the Customer.
Roaring enables Customers to digitize and automate their customer processes. Roaring provides access to data and information about companies and persons through different delivery channels such as API, Web applications, Webhooks (monitoring), Plugins and other integrations.
Most data provided in Roaring Services originates from national authorities such as tax authorities, company registries, statistical registries, credit information bureaus or other reliable sources. All data has very high credibility and accuracy. Nevertheless, Roaring, as well as all suppliers of data including any authority, cannot guarantee that the data is error free, updated or fit for use.
This Agreement sets forth under what conditions the Services is provided to the Customer and the terms and conditions for the Customer's use of the Services.
You are not allowed to access Roaring services if you are considered a direct competitor to Roaring or for purposes of monitoring service availability, performance or functionality, or for any other benchmarking or competitive purposes.
Roaring own all right, title, and interest in and to the Services, and all related technology and intellectual property rights. Subject to the terms of this Agreement, we grant you a worldwide, royalty-free, non-exclusive, non-sublicensable, non-transferable license to do the following:
Roaring represents and warrants to the Customer that Roaring intellectual property constitutes all the intellectual property rights necessary to provide the Services to the Customer, and that Roaring intellectual property will not infringe upon or violate any patent or copyright, misappropriate any trade secret, or violate any third party's other intellectual property right.
Roaring only process your personal data in accordance with Roaring Privacy Policy. The Privacy Policy is available on roaring.io/privacy-policy
Last Revised Version: 2021-03-12
This Data Processing Agreement (the "Data Processing Agreement") has been entered into by
The Data Controller and the Data Processor are hereinafter also referred to as "Party" and jointly for the "Parties".
1.1 The terms "Data controller", "Data processor", "Personal data", "Registered" and other terms in this Data Processing Agreement, which are related to personal data, shall be interpreted and applied in accordance with what follows from the GDPR.
1.2 Roaring Business Agreement, Roaring Enterprise Agreement or any other agreement between Roaring Apps and another Party that involves personal data is referred to as "Roaring Agreement".
1.3 "Included personal information" refers to Personal data which is defined below and which under the Roaring Agreement is processed by the Data Processor on behalf of The Data Controller.
1.4 "Data controller" refers to the entity who, in the preamble above, is stated as Data Controller and who alone or together with others determines the purposes and means of processing the Included personal information.
1.5 "Data Processor" refers to the entity stated in the preamble above as Data processor and who deals with Included personal information on behalf of the Data Controller.
1.6 "GDPR" refers to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (General Data Protection Regulation), as well as other data protection legislation that supplements or implements the general data protection regulation.
1.7"Registered" refers to the person to whom a personal data relates.
2.1 According to the General Data Protection Regulation (EU) 2016/679 ("GDPR"), an agreement is required when a legal entity handles personal data on behalf of another legal entity. The Parties have therefore agreed to enter into this Data Processing Agreement.
2.2 The Data Controller and the Data Processor have an agreement through which Data Processor shall provide certain Services to The Data Controller (hereinafter referred to as " Roaring Agreement "). According to the Roaring Agreement, Data Processor shall provide one or more Services, which are defined in the Roaring Agreement and below (the "Services").
2.3 The Parties consider that Data Processor will process personal data on behalf of the Data Controller on the provision of the Services in accordance with the Roaring Agreement. The Data Controller must therefore be Data Controller and the Data Processor must be Data Processor according to the GDPR for the personal data processed within the framework of the provision of the Services.
3.1 Data Processor shall provide the Services to The Data Controller to the extent and in the manner described in the Roaring Agreement. Unless otherwise stated in the description of the Services in the Roaring Agreement, the Services shall include the following: Web applications, API services, Webhooks (monitoring), Plugins and Integrations that contain personal information necessary for the Data Controller to follow the GDPR and have updated customer records, be able to carry out checks required by the Money Laundering Act and otherwise be able to ensure that business is conducted in securely way with their customers.
3.2 The processing of personal data in accordance with this Data Processing Agreement covers the following categories of data subjects: The Data controller's customers, suppliers, partners, employees, consultants and end users.
3.3 The processing of personal data under this Data Processing Agreement covers the following categories of personal data: Information from National population registers that The Data Controller is authorized to obtain, name, personal identification number, title, role, e-mail address, information about PEP or RCA, connection to sanction lists and information about the real beneficiary.
3.4 The Data Controller is responsible for ensuring that Included Personal Information is accurate and updated at any given time.
3.5 Within the framework of the Services, personal data may be retrieved from providers of public records and other sources. The providers of such registers are, in relation to the Parties, independent data controllers for their respective registers and personal data in them. This means that the Data Processor can neither guarantee nor be responsible for the fact that Included Personal Information from such sources is correct or updated, which The Data Controller accepts.
3.6 Data Processor shall only process Included Personal Information in accordance with the written instructions of the Data Controller, which is mainly stated in the Roaring Agreement and this Data Processing Agreement. Data Processor shall not use or disclose Included Personal Data for any other purpose.
3.7 If the Data Processor considers that an instruction from the Data Controller is in violation of GDPR, the Data Processor shall immediately inform The Data Controller of this and await further instructions.
3.8 Data Processor shall not, without order from the relevant supervisory authority or mandatory legislation, disclose Included Personal Data to any third Party unless otherwise agreed in writing or needed for Data Processor to be able to provide the Services.
3.9 In the nature of the processing, Data Processor shall, at the request of the Data Controller, assist The Data Controller through appropriate technical and organizational measures, to the extent that this is possible, so that The Data Controller can fulfil his obligation to respond to the request for the exercise of the Registered's rights in according to the GDPR Chapter III.
3.10 The Data Processor shall assist The Data Controller in ensuring that the obligations under Articles 32-36 of the GDPR are fulfilled, taking into account the type of processing and the information available to the Data Processor.
4.1 Data Processor shall implement and maintain appropriate technical and organizational measures in accordance with the instructions of the Data Controller. The Data Controller acknowledges that certain measures may be sensitive to technical progress and development, which is why Data Processor is given the right to implement and maintain alternative measures that achieve a corresponding or higher level of security in relation to what is instructed by the Data Controller.
4.2 If the Data Controller instructs Data Processor to take technical and / or organizational measures of such a nature that Data Processor does not consider these to be generally necessary or applicable to the other Data Processor's customers, and thus customer unique to the Data Controller, the Data Processor shall inform The Data Controller of this before the additional measures are taken. The Parties must agree on a reasonable remuneration for Data Processor to take the proposed measures.
4.3 Data Processor shall ensure that all employees, consultants and other persons that Data processor is responsible for and who deal with Included Personal Information, have undertaken to observe confidentiality or are subject to an appropriate statutory duty of confidentiality.
5.1 Data Processor shall, without undue delay, inform The Data Controller of any contacts with the Privacy Authority or any other authority that concerns or may be of importance for the processing of Included Personal Data, unless the Data Processor is prevented from providing such information to the Data Controller. Data Processor is not entitled to represent The Data Controller or in any other way act on behalf of The Data Controller against the Privacy Authority or other third Party without the written consent of the Data Controller.
5.2 The Data Controller is entitled to carry out audits himself or through well-reputed and appropriate third Parties against the Data Processor, in the least possible way possible in order to verify that the Data Processor's processing of Included Personal Information follows article 28 GDPR. In such audits or inspections, the Data Processor shall provide The Data Controller with the assistance that may reasonably be needed for the performance of the audit on the basis of the purpose. Data Processor is entitled to compensation from The Data Controller for the reasonable costs that arise as a result of such an audit or control.
6.1 The Data Controller is aware of and accepts that Data Processor may use Sub-processors and suppliers to fulfil his obligations under the Roaring Agreement and the Data Processing Agreement (hereinafter "Sub-processors"). Included personal data, which are processed by Data Processor on behalf of the Data Controller, may also be treated by sub-processors.
6.2 Data Processor shall inform The Data Controller of any plans to employ new sub-processors or replace sub-processors, so that The Data Controller is able to object to such changes. Any objections must be notified to the Data Processor within thirty (30) days. If the Data Controller have reasonable objections, the Data Processor must consider these objections. If the Data Processor considers that it is not commercially possible and / or reasonable to consider the objections, the Data Processor has the right to terminate the Roaring Agreement and the Data Processing Agreement in writing at one (1) month notice. Such termination shall not in any circumstances be regarded as a breach of contract.
6.3 Data Processor shall have a Data Processing Agreement with each Sub-processor. In such a Data Processing Agreement, the Sub-processor shall be subject to the same obligations with respect to data protection as those laid down in this Data Processing Agreement. If the sub-processor does not fulfil his obligations with respect to data protection, Data Processor shall be fully liable to The Data Controller for the performance of the Sub-processor's obligations.
7.1 If a security incident occurs which leads to accidental or unlawful destruction, loss or alteration or to unauthorized disclosure of or unauthorized access to the Included Personal Information transmitted, stored or otherwise processed ("incident"), the Data Processor shall notify the Data Controller without unnecessary delay and at the latest 48 hours after getting to know the incident. Thereafter, the Data Processor shall assist the Data Controller with such information as may reasonably be required by the Data Controller, which The Data Controller does not possess himself, to notify the incident to the competent supervisory authority and inform the Registered.
8.1 If a Registered raises an action against The Data Controller for damages, which is based on an injury that has been deliberately or through gross negligence caused by Data Processor or his sub-processors in the processing of Included Personal Information, the Data Processor shall compensate the Data Controller for the damages imposed on The Data Controller by judgment in a court of law. This applies provided that The Data Controller can demonstrate that the requirement is based on the Data Processor's wilful or grossly negligent non-fulfilment of his obligations under the Data Processing Agreement.
8.2 The Parties confirm that they are responsible in accordance with their respective roles as personal data controller and data processor according to the requirements of the applicable Data Protection Regulation and this Agreement. Article 82 (5) of the General Data Protection Regulation shall apply to any recourse requirements relating to administrative penalties.
8.3 Any compensation that the Data Processor has to pay to The Data Controller in accordance with this section 8 regarding damages and / or claims for damages shall be limited per calendar year to the maximum amount of SEK 2 million covered by Roaring's Professional Liability Insurance for information and communications companies at IF Skadeförsäkring AB. The Data Processor undertakes to receive the insurance cover during the agreements contract period.
8.4 The Data Controller shall, in relation to the Data Processor, be liable for damage that affects Data Processor, provided that the claim is due to the Data Controller's inadequate instructions to the Data Processor, violation of this Data Processing Agreement or GDPR.
8.5 A Party shall avoid liability for damage if it shows that the Party is in no way responsible for the event that caused the damage.
8.6 The Data Controller is responsible for ensuring that the processing is done in accordance with the GDPR and for issuing adequate and legal instructions to Data Processor. Data Processor, processes as Data Processor personal information as received from The Data Controller and has no responsibility for any consequences of the personal data received being found to be incorrect. The Data Controller is furthermore responsible for ensuring that Included Personal Information is collected and that the Registrants are informed according to the GDPR and that a legal basis exists for the processing.
9.1 Data Processor is entitled to compensation from The Data Controller for work carried out within the framework of the provisions of this Data Processing Agreement, sections 3.9, 3.10 and 5.2. Compensation may also be paid under section 4.2. Compensation under Section 11 shall be payable if the Data Controller's choice of means for returning or deleting Included Personal Data means additional work for Data Processor, however, that Data Processor shall at his own discretion offer the Data Controller a free alternative. Data Processor also has the right to compensation for work resulting from the Data Controller issuing additional instructions, modifying existing instructions or otherwise instructing the Data Processor to take measures of such nature that the Data Processor does not consider these to be generally necessary or applicable to the other Data Processor's customers.
9.2 Remuneration shall be paid in accordance with the Data Processor's price list in force at any time, excluding VAT, unless otherwise agreed in writing between the Parties.
10.1 This Data Processing Agreement shall enter into force on the date of its signature and shall remain in force for as long as Data Processor processes the Included Personal Data to provide the Services. Termination of the agreement takes place in the manner specified in the Roaring Agreement. Date of signature is considered as the date when the Data Controller agrees to the Roaring Agreement by signing up to any of Roaring's Services as defined in the Roaring Agreement.
11.1 In the event of termination of this Data Processing Agreement, Data Processor shall delete the Included Personal Data or return them to the Data Controller in accordance with the Data Controller's instructions and ensure that no Included Personal Data or copies thereof remain in the Data Processor's possession. If The Data Controller does not within thirty (30) days from the termination of the Roaring Agreement announce his instructions to Data Processor in accordance with this section or, within this period, requested reasonable additional time, the Data Processor shall be entitled to delete the Included Personal Information which the Data Processor continues to process.
12.1 Swedish law shall apply to this Data Processing Agreement.
12.2 Disputes regarding the interpretation or application of the Data Processing Agreement shall be settled in accordance with what is stated regarding the dispute in the Roaring Agreement.
Last Revised Version: 2021-03-12
This Roaring Service Level Agreement ("SLA") accompanies the Roaring General Agreement, available at app.roaring.io/signup or a successor URL (the "Agreement") entered into between you ("Customer") and Roaring. Capitalized terms used in this SLA that are not defined herein have the meanings given to them in the Agreement.
Roaring will use commercially reasonable efforts to make each Service available with an uptime of 99.8% of each calendar month ("Target Availability").
The calculation of uptime will not include unavailability to the extent due to: (a) use of the Service by Customer in a manner not authorized in this Agreement or the applicable Documentation; (b) general Internet problems, force majeure events or other factors outside of Roaring's reasonable control; (c) Customer's equipment, software, network connections or other infrastructure; (d) third party systems, acts or omissions; or (e) Service Windows or reasonable emergency maintenance.
"Service Windows" refer to Roaring's scheduled routine maintenance of the Services for which Roaring notifies Customer at least forty-eight (48) hours in advance. By notification we mean posting Service Windows on our web roaring.io/developer and emailing the Customer contact. Service Windows will not exceed eight (8) hours per month. Roaring typically don't have service windows unless there are major changes.
Note: Any down time in our services caused by our suppliers of data such as for example Swedish Tax Authorities or Creditsafe is regarded as Exclusions (see 2 above, (d) third party systems, acts or omissions).
The following Service Levels and consequences of breach of Service Level Availability including Credits shall apply for the Services:
|
Availability (Calculated per service on a monthly basis and measured 24*7 hours) |
Service Level breach consequence (Percentage is calculated per-service on credits consumed during the month and is credited on next month's invoice) |
|
> 99.80% |
N/A |
|
99.79% - 99.00% |
5% of the Monthly Credit amount for the affected Service. |
|
98.99% - 95.00% |
15% of the Monthly Credit amount for the affected Service. |
|
94.99% - 90.00% |
25% of the Monthly Credit amount for the affected Service. |
|
< 90.00% |
100% of the Monthly Credit amount for the affected Service. |
To be eligible for receiving credits, the credit request must be received by us within thirty (30) days after the end of the month in which the incident occurred and must include:
All credit requests shall be sent to customer@roaring.io
If there is a verified failure of a Service to meet Target Availability in two (2) consecutive months the Customer can, by using written notice of termination within thirty (30) days after the end of the second such month, retrieve a refund of up to 25% of any fees Customer has paid for use of the Service that has failed. The percentage of credit refund stated by Service availability together with the termination and refund right is the Customer's sole and exclusive remedy, and Roaring's sole and exclusive liability, for Roaring's failure to meet the Target Availability.