Howwe Data Processing Agreement
Version 2026-10-22 ยท Last updated 22 October 2026
This Data Processing Agreement ("DPA") applies when a customer ("Customer") uses the Howwe service ("Service") provided by Howwe Technologies AB (publ), org. no. 556655-7509 ("Howwe"), and the Customer has not signed another data processing agreement with Howwe. If the Customer has signed one, that agreement applies instead. This DPA forms part of the Customer Agreement and the Terms of Service. It fulfils the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").
1. Roles
1.1 The Customer is the controller and Howwe the processor of personal data that the Customer and its users enter into the Service or that the Service generates on the Customer's behalf ("Customer Personal Data").
1.2 Howwe is an independent controller for the limited processing described in its Privacy Policy for its own purposes: securing the Service, product analytics, usage logs for AI assistants connected through the MCP server, and customer relationship management. This processing uses user IDs, organisation IDs, usage events and logs, and does not use the content of Customer Data. Howwe may also create aggregated statistics from Customer Data, from which neither the Customer nor any person can be identified, as described in section 5.1 of the Terms of Service. The Customer agrees that Howwe may carry out this processing.
2. Instructions
2.1 Howwe processes Customer Personal Data only on the Customer's documented instructions. The Customer Agreement, the Terms of Service, this DPA and the Customer's use and configuration of the Service are the Customer's instructions.
2.2 Howwe informs the Customer without delay if, in Howwe's opinion, an instruction breaches the GDPR or other data protection law.
2.3 The subject matter, nature, purpose, duration and categories of processing are set out in Annex 1.
3. Howwe's obligations
3.1 Confidentiality. Everyone at Howwe who processes Customer Personal Data is bound by confidentiality.
3.2 Security. Howwe takes the technical and organisational measures in Annex 2 and in its security overview. Howwe may update the measures as long as the overall level of protection is not reduced.
3.3 Assistance. Taking into account the nature of the processing, Howwe helps the Customer respond to requests from data subjects and meet its obligations under Articles 32 to 36 GDPR, including impact assessments and prior consultation. Howwe may charge reasonable costs for assistance beyond what the Service itself provides.
3.4 Requests from data subjects. If Howwe receives a request from a data subject about Customer Personal Data, Howwe forwards it to the Customer and does not respond itself unless the Customer instructs it to.
3.5 Requests from authorities. Howwe informs the Customer about requests from authorities for Customer Personal Data, unless the law prohibits it.
4. Personal data breaches
4.1 Howwe notifies the Customer without undue delay, and no later than 48 hours after becoming aware of a personal data breach affecting Customer Personal Data.
4.2 The notification describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences and the measures taken or proposed. Information that is not available at once is given as soon as it is.
5. Sub-processors
5.1 The Customer gives general authorisation for Howwe to use sub-processors. The current sub-processors are listed at howwe.io/legal/subprocessors.
5.2 Howwe notifies the Customer at least 30 days before adding or replacing a sub-processor, by email to the Customer's contact person or in the Service. The Customer may object on reasonable data protection grounds within that period. The parties then discuss the objection in good faith. If they cannot resolve it, the Customer may terminate the affected part of the Service, and Howwe refunds prepaid fees for the remaining period.
5.3 Howwe binds each sub-processor by written agreement to data protection obligations that offer at least the same protection as this DPA, and remains responsible to the Customer for its sub-processors.
5.4 AI assistants that the Customer or its users connect to Howwe through the MCP server are chosen by the Customer or user and are not Howwe sub-processors.
6. Transfers outside the EU/EEA
6.1 Howwe transfers Customer Personal Data outside the EU/EEA only where the GDPR allows it, such as under an adequacy decision, including the EU-U.S. Data Privacy Framework, or the European Commission's Standard Contractual Clauses.
6.2 The sub-processor list states each sub-processor's location and transfer safeguard.
7. Audits
7.1 Howwe makes available to the Customer the information needed to demonstrate compliance with this DPA, such as its security overview, summaries of penetration tests and answers to reasonable security questionnaires.
7.2 If that information is not sufficient, the Customer may, at its own cost and at most once a year, have an audit carried out by an independent auditor bound by confidentiality, with at least 30 days' notice and without unreasonable disruption to Howwe's business. Audits required by a supervisory authority are not limited in this way.
8. Duration, return and deletion
8.1 This DPA applies for as long as Howwe processes Customer Personal Data.
8.2 After the Customer Agreement ends, the Customer may ask for an export of its data. Howwe deletes or anonymises Customer Personal Data six months after the end of the Customer Agreement, unless the Customer asks for earlier deletion or the law requires longer storage. Backups are deleted within a further 90 days.
9. Liability and precedence
9.1 The limitation of liability in the Customer Agreement, or in the Terms of Service where the Customer Agreement has none, applies to this DPA to the extent the GDPR allows.
9.2 If this DPA conflicts with the Customer Agreement or the Terms of Service on the processing of personal data, this DPA applies.
9.3 This DPA is governed by Swedish law, and disputes are settled as set out in the Terms of Service.
Annex 1. Description of the processing
| Item | Description |
|---|---|
| Subject matter | Provision of the Howwe strategy execution service |
| Duration | The term of the Customer Agreement plus six months |
| Nature and purpose | Hosting, storage, display, analysis and transmission of Customer Data, so that the Customer can plan, follow up and execute its strategy, including through Howwe's AI features, support and notification emails |
| Data subjects | The Customer's employees, consultants and other users of the Service, and people named in Customer Data |
| Categories of personal data | Name, email address, user ID, role, team, goals, initiatives, activities, comments and other content entered by users, login events and IP addresses, support conversations |
| Special categories | None. Users are instructed not to enter special categories of personal data |
| Sub-processors | As listed at howwe.io/legal/subprocessors |
Annex 2. Technical and organisational measures
- Hosting in the EU on Google Cloud Platform, database by ArangoDB in the EU.
- Encryption in transit with TLS 1.2 or higher, and at rest with AES-256.
- Role-based access control, least privilege for staff, multi-factor authentication for all administrative access.
- Single sign-on through Auth0, with support for the Customer's own identity provider.
- Separated development, test and production environments.
- Daily encrypted backups in the EU, kept for up to 90 days, with regular restore tests.
- Automated vulnerability scanning and an independent penetration test at least once a year.
- Logging and monitoring of the production environment.
- A documented incident response process.
- Confidentiality agreements and yearly security training for all staff.
- Assessment of and data processing agreements with all sub-processors.