Vetz Data Processing Agreement

Version and effective date: 2026-11-02. This Data Processing Agreement ("DPA") is entered into between the customer that accepts it (the "Customer", as controller) and Vetz AB, org. no. 559519-4217, Surbrunnsgatan 26, 113 48 Stockholm, Sweden ("Vetz", as processor). Questions about this DPA: legal@vetz.ai.

1. Scope

1.1 This DPA forms part of the agreement between the Customer and Vetz for the Vetz service, made up of the Vetz Terms of Service and any Order Form (the "Terms"). It sets out the terms required by Article 28 of the GDPR for Vetz's processing of personal data on behalf of the Customer.

1.2 The Customer accepts this DPA when it accepts the Terms. No separate signature is required.

1.3 This DPA applies only to Customer Personal Data. Vetz's processing of personal data as a controller, such as account, billing and usage data, is described in the Vetz Privacy Policy.

1.4 If this DPA and the Terms conflict on the processing of personal data, this DPA prevails. Capitalised terms not defined in this DPA have the meaning given in the Terms.

2. Definitions

Anonymised Data: has the meaning given in the Terms. Anonymised Data is not personal data and is not covered by this DPA.

Customer Personal Data: personal data in Customer Data that Vetz processes on behalf of the Customer.

Data Protection Laws: the GDPR and the national laws that supplement it, including the Swedish Data Protection Act (2018:218), as applicable to the processing.

GDPR: Regulation (EU) 2016/679.

Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

SCCs: the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, as amended or replaced.

Sub-processor: a third party that Vetz engages to process Customer Personal Data.

3. Roles and instructions

3.1 The Customer is the controller and Vetz is the processor of Customer Personal Data. If the Customer processes the data on behalf of its own customers, the Customer is a processor and Vetz is its sub-processor. In that case, the Customer confirms that its instructions to Vetz are authorised by its controllers, and it passes on to them the information and notices from Vetz that they need.

3.2 Vetz processes Customer Personal Data only on the Customer's documented instructions. The Customer's complete instructions are the Terms, this DPA, and the Customer's configuration and use of the Service. Under these instructions, Vetz may process Customer Personal Data to:

1. provide the Service to the Customer;
2. maintain, secure and support the Service, and prevent misuse;
3. anonymise Customer Personal Data to create Anonymised Data.

3.3 Further instructions require Vetz's agreement and may be subject to additional fees.

3.4 Vetz will inform the Customer if, in its opinion, an instruction infringes Data Protection Laws. Vetz may then suspend the affected processing until the instruction is confirmed or changed.

3.5 If Union or Member State law requires Vetz to process Customer Personal Data in other ways, Vetz will inform the Customer before the processing, unless the law prohibits this.

3.6 Vetz does not use Customer Personal Data to train AI models, unless the Customer has agreed to it in writing.

4. The Customer's obligations

The Customer shall:

1. ensure that it has a legal basis for the processing, including consent where required;
2. inform the people concerned, such as animal owners and other people present, that the Service is used before a consultation or meeting is recorded, and provide the information required by Articles 13 and 14 of the GDPR;
3. avoid submitting personal data that is not needed for the purpose, such as personal identity numbers, payment card details or information about a person's health;
4. ensure that its instructions comply with Data Protection Laws.

5. Vetz's obligations

5.1 Confidentiality. Vetz ensures that people authorised to process Customer Personal Data are bound by confidentiality.

5.2 Security. Vetz implements the technical and organisational measures described in Annex 2. Vetz may update the measures, provided that the overall level of security is not reduced.

5.3 Assistance. Taking into account the nature of the processing and the information available to Vetz, Vetz assists the Customer:

1. in responding to requests from data subjects exercising their rights, mainly through the functions available in the Service;
2. with data protection impact assessments and prior consultations with supervisory authorities.

Assistance beyond what the Service and this DPA provide is charged at Vetz's current rates. This assistance does not require Vetz to disclose source code, model details or security-sensitive information.

5.4 Requests to Vetz. If a data subject or an authority contacts Vetz directly about Customer Personal Data, Vetz will forward the request to the Customer without undue delay, unless the law prohibits this. Vetz will not respond to the request itself, except to refer the person to the Customer.

6. Sub-processors

6.1 The Customer gives Vetz a general written authorisation to engage Sub-processors. Annex 3 names Vetz's main Sub-processors and lists the categories of the others. Vetz provides the complete list of its current Sub-processors to the Customer on request to legal@vetz.ai. The complete list is Vetz's confidential information.

6.2 Vetz imposes data protection obligations on each Sub-processor, by written contract, that are no less protective than those in this DPA. Vetz remains responsible to the Customer for its Sub-processors.

6.3 Vetz will notify the Customer's administrators by email or in the Service at least 14 days before it engages a new Sub-processor. The notice describes the Sub-processor's function and location.

6.4 The Customer may object to the change on reasonable data protection grounds by writing to legal@vetz.ai within 14 days of the notice. The parties will then discuss the objection in good faith. If they cannot resolve it, the Customer's sole remedy is to stop using the affected part of the Service, or to cancel its Subscription with effect from the end of the current billing period. If the Customer does not object within 14 days, it accepts the change.

7. Location and transfers

7.1 By default, Vetz stores Customer Personal Data within the EU/EEA.

7.2 Vetz and its Sub-processors may process Customer Personal Data outside the EU/EEA, provided the transfer meets the requirements of Chapter V of the GDPR. Examples are an adequacy decision of the European Commission, including the EU-US Data Privacy Framework, or the SCCs with supplementary measures where needed.

7.3 The Customer authorises Vetz to enter into the SCCs (Module 3, processor to processor) with Sub-processors on the Customer's behalf where the SCCs are the transfer mechanism.

8. Personal Data Breach

8.1 Vetz will notify the Customer without undue delay after becoming aware of a Personal Data Breach.

8.2 The notice will describe, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information may be provided in phases as it becomes available.

8.3 Vetz will take reasonable measures to contain the breach and will assist the Customer with its notifications to supervisory authorities and data subjects. A notice from Vetz is not an admission of fault or liability.

9. Information and audits

9.1 Vetz makes available the information necessary to demonstrate compliance with Article 28 of the GDPR, such as written documentation and answers to security questionnaires. The Customer shall rely on this information first.

9.2 If that information is not sufficient, or if a supervisory authority requires it, the Customer may carry out an audit at most once per calendar year, with 30 days' written notice and at its own cost. The auditor must be bound by confidentiality and must not be a competitor of Vetz. Audits do not cover source code, model details, security-sensitive information or other customers' data.

10. Return and deletion

10.1 During a Subscription and the read-only period under the Terms, Users can view, copy and print Customer Personal Data in the Service. Vetz returns Customer Personal Data by providing a copy in a common machine-readable format within 30 days of a request to legal@vetz.ai.

10.2 After the Trial or Subscription ends, Vetz deletes Customer Personal Data according to the deletion timeline in the Terms: no later than 30 days after the end of the 90-day read-only period. Copies in backups are deleted in the ordinary backup cycle and are not otherwise processed until then.

10.3 The Customer may ask Vetz to delete Customer Personal Data earlier by writing to legal@vetz.ai. On request, Vetz confirms the deletion in writing.

10.4 Vetz may keep Customer Personal Data where Union or Member State law requires it. This DPA continues to apply to that data.

11. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms. This does not limit either party's liability towards data subjects under Article 82 of the GDPR.

12. Term, changes and governing law

12.1 This DPA applies for as long as Vetz processes Customer Personal Data.

12.2 Vetz may change this DPA under the change procedure in the Terms. Changes to Sub-processors follow section 6.

12.3 This DPA is governed by Swedish law. Disputes are resolved under the dispute resolution clause in the Terms. If this DPA is translated, the English version prevails.

Annex 1: Description of the processing

Subject matter and duration. Vetz processes Customer Personal Data to provide the Service under the Terms, for the duration of the Agreement and until the data is deleted under section 10.

Nature and purpose. The processing consists of the following functions:

Categories of data subjects.

• Animal owners and other people present at, or mentioned in, a consultation or meeting
• Users and other staff of the Customer
• Other people whose data the Customer submits, such as clients and insurance policyholders

Categories of personal data.

• Identification and contact details, such as name, address, phone number and email
• Information relevant to the care, service or claim, such as history, symptoms, treatment and costs, about an animal and its owner
• Consultation content: audio recordings, transcripts, notes and other Output
• Data received from the Customer's integrated systems
• User data, such as name, role and activity in the Service

Incidental data. Because a recording captures what is said, it may include personal identity numbers, payment details, or information about a person's health or other special categories of personal data. Such data is not requested by the Service. It is processed only because it appears in a recording or input, and only for the purposes above. The Customer shall limit such data under section 4.

Retention.

• Audio recordings are kept only for a limited period after processing, so that a failed processing can be repeated, and are then deleted automatically.
• Requests and answers sent through the API are kept in identifiable form only for a limited period after processing, and are then anonymised.
• Transcripts, notes and other Customer Personal Data are kept until a User deletes them, or until they are deleted under section 10.

Location. As set out in section 7.

Annex 2: Technical and organisational security measures

Vetz maintains measures appropriate to the risk, taking into account that recordings may contain incidental sensitive data.

Annex 3: Sub-processors

Vetz's main Sub-processors are listed below. Vetz also uses other Sub-processors in the categories that follow. The complete list is available to the Customer on request (section 6.1).

Main Sub-processors

Other Sub-processor categories