SaaS Subscription Terms & Data Processing Agreement

1.1. Electronic acceptance. These Terms form a binding contract between Sajva AB ("Sajva", "we") and the legal entity identified in the Order Confirmation ("Customer", "you"). The contract is formed when an authorised representative of the Customer completes the online ordering process and expressly accepts these Terms and the Data Processing Agreement (DPA), and Sajva confirms the order electronically.

No handwritten or qualified electronic signature is required for self-service subscriptions. The checkbox at checkout — "I confirm that I am authorised to bind [Customer] and I accept the SaaS Subscription Terms and DPA" — constitutes express acceptance.

1.2. Authority to bind. The person completing the order represents and warrants that they have authority to bind the Customer. Sajva may request evidence of such authority. If the person does not have authority, they may be personally liable for obligations under these Terms.

1.3. What forms the agreement. The following documents together constitute the complete agreement ("Agreement"): these SaaS Subscription Terms; the Order Confirmation issued by Sajva after payment; the Data Processing Agreement (accepted at checkout); and the applicable Plan Description (current version at time of order). In case of conflict, the Order Confirmation takes precedence over these Terms for Customer-specific matters; these Terms take precedence over the Plan Description for legal matters.

1.4. Version history. Sajva maintains a version history of these Terms. The version number and date at the top of this document identify the version accepted by each Customer. Prior versions remain binding for subscriptions entered into under them.

2.1. What Sajva provides. Subject to payment and these Terms, Sajva grants the Customer a non-exclusive, non-transferable right to access and use the Sajva AI-powered ESG questionnaire automation platform ("the Service") during the subscription term. The Service includes the features specified in the Plan Description for the Customer's chosen plan.

2.2. AI-generated outputs — drafts requiring human approval. The Service uses artificial intelligence to generate draft responses to ESG questionnaires. Every AI-generated draft must be reviewed and approved by an authorised user of the Customer before it is submitted to any third party. The Service is designed to assist human decision-making, not to replace it.

• AI disclosure: the Sajva platform uses AI to produce draft questionnaire responses.
• No response is submitted automatically — all outputs require human review and approval before submission.
• The Customer is responsible for the accuracy of any approved and submitted response.

2.3. EU AI Act transparency. Article 50 of the EU AI Act imposes transparency obligations on providers and deployers of certain AI systems, including a duty to label AI-generated text published to inform the public on matters of public interest. That duty does not apply where the content has undergone a process of human review or editorial control and a natural or legal person holds editorial responsibility for its publication (Art. 50(4)) — which describes exactly how outputs move through the Service under § 2.2: no draft is ever submitted without the Customer's own review and approval. Sajva discloses AI use under § 2.2 regardless of whether Article 50 would independently require it for this Service's business-tool use case. Article 50(2)'s separate duty to machine-mark synthetic content takes effect 2 December 2026; Sajva will update this section ahead of that date if it becomes applicable to the Service's outputs.

2.4. What Sajva does not provide. The Service is a drafting and automation tool. Sajva does not: guarantee the accuracy or legal compliance of AI-generated outputs; provide legal, accounting, or professional advisory services; guarantee that responses will be accepted by the Customer's buyers or any regulatory body; or verify the accuracy of the Customer's underlying sustainability data.

2.5. Changes to the Service. Sajva may update, improve, or modify the Service. Where a change materially reduces the functionality of the Customer's plan, Sajva will give thirty (30) days' prior written notice. The Customer may cancel before the change takes effect if it does not accept a material reduction.

3.1. Self-service payment. For self-service subscriptions, the subscription fee is charged in advance to the payment method provided at checkout. The Customer authorises Sajva and its payment service provider to charge the applicable recurring fees (and VAT where applicable) automatically at the start of each billing period. Invoice payment is available only where expressly approved by Sajva in writing.

3.2. Pricing and VAT. Prices are as shown at checkout and in the Order Confirmation, excluding VAT. VAT is added at the applicable rate where required by law. Sajva will issue a VAT invoice or receipt to the Customer's registered email address after each successful payment.

3.3. Failed payments. If a recurring payment fails, Sajva will: retry the payment using reasonable intervals; notify the Customer by email; and allow a grace period of seven (7) days from the failed payment date. If payment is not received within the grace period, Sajva may suspend access to the Service. Access is restored when payment is received. Suspension does not release the Customer from the obligation to pay.

3.4. Price changes. Sajva may adjust subscription fees by giving thirty (30) days' written notice before the renewal date. Price changes take effect from the next renewal period. If the Customer does not accept the new price, it may cancel before the renewal date.

3.5. Automatic renewal. Subscriptions renew automatically at the end of each billing period (monthly or annual) unless cancelled before the renewal time shown in the Customer's account.

3.6. Cancellation. The Customer may cancel at any time through the account settings. Cancellation takes effect at the end of the current prepaid billing period — the Customer retains access until then. No refund is issued for the remaining prepaid period, except where required by mandatory law or where Sajva terminates the Agreement other than for the Customer's breach.

• Monthly subscriptions: cancel any time; access ends at the end of the current month.
• Annual subscriptions: cancel any time; access ends at the end of the current annual period. Sajva sends a renewal reminder at least 14 days before the annual charge.

4.1. Ownership of Customer Data. "Customer Data" means all sustainability information, documents, questionnaires, and other data uploaded to or processed through the Service by the Customer. The Customer retains all rights in Customer Data. Sajva acquires no intellectual property rights in Customer Data.

4.2. Licence to process. The Customer grants Sajva a limited licence to store and process Customer Data solely to provide the Service. Sajva will not use Customer Data for any other purpose — including training or improving AI models — without the Customer's prior written consent.

4.3. AI model training. Customer Data is not used to train, fine-tune, or improve any AI model operated by Sajva or by Sajva's AI service providers. Sajva configures its AI providers, where contractually and technically available, to disable training on Customer inputs and outputs. The applicable providers and their data-use terms are listed in the Subprocessor List (available at sajva.ai/legal).

4.4. Data processing agreement. The DPA accepted at checkout governs Sajva's processing of personal data contained in Customer Data and forms part of this Agreement. Sajva processes personal data as a data processor on behalf of the Customer as data controller under the GDPR.

4.5. Data location and international transfers. Customer Data is primarily hosted on servers within the European Economic Area (EEA). Some approved sub-processors may process limited data outside the EEA where a lawful transfer mechanism is in place. Where that mechanism is the European Commission's adequacy decision for the United States (the EU–US Data Privacy Framework), Sajva also puts the European Commission's standard contractual clauses in place as a backstop. The current Subprocessor List identifies each provider, their role, and applicable transfer mechanisms.

4.6. Security. Sajva implements technical and organisational measures to protect Customer Data, including encryption at rest and in transit, role-based access controls, audit logging, and regular security reviews. Current technical details are described in the Security Overview (available on request). Sajva will notify the Customer without undue delay — and in any event within 48 hours — of a personal data breach affecting Customer Data.

4.7. Retention and deletion. Sajva retains Customer Data for the duration of the subscription and for thirty (30) days after termination, during which the Customer may export their data. After this period, Customer Data is securely deleted unless longer retention is required by law. Written confirmation of deletion is available on request.

See the standalone Acceptable Use page for a reader-friendly version of this section — it restates the same rules, not different ones.

5.1. Permitted use. The Customer may use the Service solely for its own internal business purposes — specifically, to assist in responding to ESG and sustainability questionnaires received from its buyers. The Customer may not resell or sublicense access to the Service.

5.2. Customer responsibilities. The Customer is responsible for: ensuring all uploaded information is accurate and lawful; reviewing and approving all AI-generated drafts before submission; maintaining the security of login credentials; ensuring authorised users comply with these Terms; and obtaining any consent required to provide personal data to Sajva.

5.3. Prohibited conduct. The Customer must not: use the Service to submit false or misleading sustainability information; attempt to reverse-engineer or extract the source code of the Service; access or attempt to access other customers' data; upload unlawful content; or use the Service in breach of applicable law.

6.1. Sajva's IP. Sajva retains all intellectual property rights in the Service, including the platform, AI models, algorithms, software, documentation, and brand. These Terms do not transfer any ownership of Sajva's IP to the Customer.

6.2. Customer's rights in outputs. The Customer retains all rights in Customer Data. To the extent Sajva may acquire any rights in Customer-specific outputs generated by the Service, Sajva assigns those rights to the Customer on approval by the Customer. The Customer may use, modify, and submit approved outputs to its buyers without restriction. Sajva retains all rights in the platform, generic templates, models, and general know-how — none of which are transferred by this clause.

Each party will keep confidential all non-public information received from the other in connection with this Agreement and will not use it for any purpose other than performing obligations under this Agreement. This obligation does not apply to information that is publicly available through no fault of the receiving party, was already known, is independently developed, or must be disclosed by law. Confidentiality obligations survive termination for two (2) years, and without time limit for trade secrets.

8.1. Sajva's warranty. Sajva warrants that the Service will perform materially in accordance with the Plan Description and that Sajva will implement and maintain appropriate security measures. If the Service fails to meet this warranty, the Customer's remedy is for Sajva to use reasonable efforts to correct the failure within a reasonable period.

8.2. Disclaimer. Except as stated in § 8.1, the Service is provided "as is". Sajva does not warrant that the Service will be uninterrupted or error-free, or that AI-generated drafts will be accurate, complete, or accepted by any third party. The Customer is responsible for reviewing and approving all outputs before use. This does not limit Sajva's responsibility for operating the Service materially in accordance with this Agreement, maintaining agreed security measures, or processing Customer Data in accordance with documented instructions.

8.3. Liability cap. Sajva's total aggregate liability under or in connection with this Agreement (whether in contract, tort, or otherwise) shall not exceed: for general claims, the total fees paid or payable by the Customer in the twelve (12) months preceding the event giving rise to the claim; for data protection and security claims, two (2) times the annual subscription fee.

8.4. Excluded losses. To the fullest extent permitted by law, Sajva shall not be liable for: indirect, consequential, or special losses; loss of profits or revenue; loss of contracts; or loss of data — even if advised of the possibility of such losses.

8.5. Exceptions. The limitations in §§ 8.3 and 8.4 do not apply to: death or personal injury caused by negligence; fraud or fraudulent misrepresentation; or any liability that cannot be excluded under mandatory Swedish law.

8.6. Customer's indemnity. The Customer shall indemnify Sajva against third-party claims arising from: Customer Data that is unlawful, infringing, or materially inaccurate; or the Customer's wilful misuse of the Service in breach of these Terms. This indemnity does not apply where the claim arises from Sajva's failure to provide the Service in accordance with this Agreement.

9.1. Term. This Agreement commences on the date of the Order Confirmation and continues until terminated in accordance with these Terms.

9.2. Termination for cause. Either party may terminate immediately by written notice if the other party materially breaches this Agreement and fails to remedy the breach within fourteen (14) days of written notice, or becomes insolvent or ceases to trade.

9.3. Effect of termination. On termination: access to the Service ceases at the end of the prepaid period; the Customer has thirty (30) days to export Customer Data; after thirty (30) days, Customer Data is deleted; and all accrued payment obligations remain. Sections 6, 7, 8, and 10 survive termination.

10.1. Updates to these Terms. Sajva may update these Terms where reasonably necessary due to changes in the Service, applicable law, security requirements, or business operations. Material changes will be notified at least thirty (30) days in advance by email. Changes take effect from the next renewal period unless earlier application is required by law or to address an urgent security risk. If a change materially disadvantages the Customer, it may cancel before the change takes effect. Sajva maintains a version history of all prior Terms.

10.2. Assignment. The Customer may not assign this Agreement without Sajva's prior written consent. Sajva may assign this Agreement to a successor entity on written notice.

10.3. Force majeure. Neither party is liable for failure to perform due to events beyond its reasonable control, provided prompt notice is given and reasonable efforts are made to resume performance.

10.4. Notices. Notices are sent by email to the addresses in the Order Confirmation. A notice is deemed received on the next business day after sending. Either party may update its notice address in writing.

10.5. Entire agreement. This Agreement constitutes the entire agreement between the parties relating to the Service and supersedes all prior discussions. Any Customer purchase order does not form part of this Agreement.

10.6. Governing law. This Agreement is governed by Swedish law. Disputes shall be resolved first by good-faith negotiation. If not resolved within thirty (30) days, by the general courts of Sweden, with Stockholm District Court as the court of first instance.

10.7. Language. This Agreement is published in English and in Swedish. The English text is the original and governs; the Swedish text is a translation provided for accessibility. In the event of any discrepancy between the two, the English text prevails.

Incorporated into and forming part of the SaaS Subscription Terms. This DPA governs Sajva's processing of personal data on behalf of the Customer as required by Article 28 of the GDPR. It is accepted electronically together with the SaaS Subscription Terms at checkout.

D.1 Subject matter, nature, purpose, and duration. Subject matter: Sajva processes personal data to provide the ESG questionnaire automation Service. Nature: collection, storage, retrieval, use, and deletion of personal data. Purpose: delivery of the Service as described in the SaaS Subscription Terms. Duration: for the term of the subscription and for thirty (30) days after termination, after which data is deleted.

D.2 Categories of personal data and data subjects. Data processed may include: names, email addresses, job titles, and signatures of the Customer's employees or the signatories of uploaded documents. Data subjects are the Customer's employees and any individuals named in uploaded questionnaires or sustainability documents.

D.3 Sajva's obligations as processor:

• Process personal data only on the Customer's documented instructions (including as set out in this DPA), unless required by EU or Swedish law — in which case Sajva will inform the Customer unless prohibited by law
• Ensure that persons authorised to process personal data are bound by confidentiality obligations
• Implement appropriate technical and organisational security measures per Article 32 GDPR
• Not engage new sub-processors without giving thirty (30) days' prior notice — the Customer may object on reasonable grounds
• Assist the Customer in responding to data subject rights requests (access, rectification, erasure, portability, restriction, objection)
• Assist the Customer in meeting its obligations under Articles 32–36 GDPR, including security, breach notification, data protection impact assessments, and prior consultation
• Notify the Customer without undue delay — and within 48 hours — of a personal data breach
• Delete or return all personal data on termination as instructed — default is deletion after thirty (30) days; the Customer may request return before that point
• Make available all information reasonably necessary to demonstrate compliance, and permit and contribute to audits conducted by the Customer or an appointed auditor with reasonable notice
• Inform the Customer if, in Sajva's opinion, an instruction infringes the GDPR or other applicable data protection law

D.4 Sub-processors. Sajva uses sub-processors to deliver the Service. The current Subprocessor List (published at sajva.ai/legal) identifies each sub-processor, their role, location, and applicable transfer mechanisms. Sajva will give thirty (30) days' prior notice of any new or changed sub-processor. If the Customer reasonably objects, the parties will work in good faith to find a solution; if no solution is found, the Customer may terminate on notice.

D.5 International transfers. Where a sub-processor requires transfer of personal data outside the EEA, Sajva ensures a lawful transfer mechanism is in place before the transfer occurs. That mechanism is not the same for every provider, and the Subprocessor List states which applies to each. For transfers to the United States it is either the European Commission's adequacy decision (the EU–US Data Privacy Framework) where the provider self-certifies under it, backed by the European Commission's standard contractual clauses; or, where the provider does not self-certify, those standard contractual clauses standing alone under Article 46(2)(c) GDPR. The DPF's adequacy decision was upheld by the EU General Court on 3 September 2025 and remains in force; an appeal is pending before the CJEU (Case C-703/25 P) with no hearing date set. Sajva monitors this and will update the transfer mechanism without waiting for the next scheduled revision of this Agreement if the outcome requires it. Details are set out in the Subprocessor List.

D.6 Customer's obligations as controller. The Customer confirms that it has a lawful basis for providing personal data to Sajva, that data subjects have been informed of the processing in accordance with Articles 13–14 GDPR, and that the Customer will comply with its obligations as data controller.

D.7 Liability. Each party is liable to the other for damages caused by its breach of this DPA. As between the parties, the liability provisions of § 8 of the SaaS Subscription Terms apply, except that there is no cap on liability for wilful or grossly negligent breach of data protection obligations.

Sajva AB, org.nr 559591-2212, Stockholm, Sweden. The Subprocessor List and Security Overview are maintained as separate versioned documents at sajva.ai/legal. Enterprise customers should use the Enterprise Order Form rather than self-service checkout.