Data Processing Agreement
Effective 2026-10-15. This agreement under article 28 of the EU General Data Protection Regulation (GDPR), and the UK GDPR where it applies, is part of the Terms of Service between the customer (the controller) and Jepela Sverige AB (Jepela, the processor). It applies whenever personal data is part of what the customer sends to the Jepela API.
1. What is processed
| Subject matter and purpose | Answering the customer's typed questions about states it sends, and keeping the subject memories it writes, so it can make decisions in its own software |
| Nature | Storage (memories, decision records), computation by the decision engine, deletion |
| Duration | As long as the customer's account exists, then until deletion under section 9 |
| Personal data | Whatever the customer puts in states, questions, memory lines, values and labels; the customer decides this |
| Data subjects | Whoever that data is about, for example the customer's users, clients or staff |
| Special categories | Only if the customer sends them; the customer then needs its own legal basis under article 9 |
2. Instructions
Jepela processes the personal data only on the customer's documented instructions: these terms, the API requests the customer makes, and the settings it chooses. Jepela tells the customer if it believes an instruction breaks data protection law.
3. Confidentiality
Everyone Jepela authorises to process the data is bound to confidentiality.
4. Security (article 32)
Jepela keeps at least these measures:
- TLS on every public connection; the engine accepts only requests carrying a secret token.
- Each customer's data is kept apart from other customers' (separate tenants; memories stored per tenant and subject).
- API keys and passwords stored only as hashes; logins locked after repeated failures.
- Request contents are not written to logs.
- Decision records deleted automatically after 30 days, and batches (the uploaded requests and their results) 30 days after the upload; memories deleted on the customer's request (the API's forget and delete calls) or with the account.
- Server access limited to Jepela's operator.
5. Subprocessors
The customer authorises the subprocessors named in the list that Jepela gives the customer with this agreement and on request; the subprocessors page says what kind of provider each is and where the data is. Jepela gives at least 30 days' notice by email before adding or replacing one; the customer may object, and if the parties cannot agree, may end the agreement and receive a refund of unused credit. Jepela binds each subprocessor to data protection obligations at least as protective as these, and remains responsible for them.
6. Help with data subjects' requests
Jepela helps the customer answer requests from data subjects. The API already lets the customer read (GET /v1/memory), correct (forget the wrong line, then remember the right one) and delete (POST /v1/memory/delete) a subject's memory. Reading, forget and deleting work even when the customer's credit is used up or the account is suspended; remember needs an active account with credit.
7. Personal data breaches
Jepela tells the customer without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach affecting the customer's data, with the information the customer needs to meet its own duties.
8. Other assistance
Jepela helps the customer, as far as it can and with the information it has, with data protection impact assessments and prior consultations.
9. Deletion at the end
When the account ends, Jepela deletes the customer's memories, decision records and golden sets within 30 days, unless law requires storage. The customer can read its memories through the API before then. Usage and billing records are kept as bookkeeping law requires; they include the subject id each priced request named.
10. Audits
Jepela makes available the information needed to show compliance with this agreement, and allows for audits by the customer or an auditor it appoints, with reasonable notice, at the customer's cost, and at most once a year unless a breach or an authority requires more.
11. Transfers outside the EU and EEA
The customer chooses the region where its data is processed. In the United States region, data is processed in the United States. For transfers of personal data from the EU or EEA, the parties agree to the European Commission's Standard Contractual Clauses (decision 2021/914), module two (controller to processor), which are incorporated by reference; the governing law and courts for those clauses are those of Sweden, and the supervisory authority is the Swedish Authority for Privacy Protection (IMY), imy.se. Jepela uses equivalent clauses with its subprocessors.
12. Contact
Data protection questions: info@jepela.com.