Data Processing Agreement & Sub-processors

Last updated 4 June 2026

These are Forj AB's standard data-processing terms, forming part of your agreement. To execute a signed DPA, contact privacy@forj.se.

This Data Processing Agreement ("DPA") applies where Forj AB (org.nr 559019-9161, currently registered as Zmart Com West AB) ("Processor") processes personal data on behalf of a customer ("Controller") in connection with the Alloy platform, and forms part of the agreement between the parties.

1. Roles & scope

The Controller determines the purposes and means; the Processor processes personal data only on the Controller's documented instructions, including the Alloy service itself. Subject-matter, duration, nature and purpose, types of personal data and categories of data subjects are set out in Annex A.

2. Processor obligations (GDPR Art. 28)

Process only on documented instructions from the Controller.
Ensure persons authorised to process are bound by confidentiality.
Implement appropriate technical and organisational measures (Art. 32): see Trust & Security.
Engage sub-processors only under Section 3 and flow down equivalent obligations.
Assist the Controller in responding to data-subject requests.
Assist with security, breach notification, and DPIAs (Art. 32–36).
At the Controller's choice, delete or return personal data at the end of the service.
Make available information needed to demonstrate compliance and allow audits.

3. Sub-processors

The Controller grants general authorisation to use the sub-processors listed in Annex B. We will give prior notice of intended changes and a chance to object on reasonable data-protection grounds.

4. International transfers

Where personal data is transferred outside the EU/EEA, the parties rely on Standard Contractual Clauses and appropriate safeguards. Primary hosting is in the EU.

5. Personal data breach

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, with the information reasonably available.

6. Liability & term

This DPA follows the term and liability provisions of the main agreement.

Annex A: Processing details

Item	Detail
Subject-matter	Provision of the Alloy prospecting & co-sell platform
Nature & purpose	Identifying, enriching, contacting and managing B2B opportunities
Data types	Business contact data: name, title, work email, business phone, professional profile, employer; user account data
Data subjects	The Controller's prospects and business contacts; the Controller's users
Duration	For the term of the agreement

Annex B: Sub-processor list

Sub-processor	Purpose	Region
Amazon Web Services	Hosting, deployment, pricing/data APIs	EU
Supabase	Database, auth, edge functions	EU
Anthropic	AI (Smith) reasoning	US (SCCs; EU via Bedrock in progress)
HubSpot	CRM sync (only if Controller connects it)	EU/US per portal
OnePageCRM	CRM sync (only if Controller connects it)	EU/US per account
Recall.ai	Meeting notetaker (only if used)	US (SCCs)