Terms and Conditions

1.1 These terms and conditions and appendices (together, the Agreement) are between Twiceme Technology AB (Supplier) and the person or entity agreeing to these terms (Customer). This Agreement does not apply if you have a written agreement executed by Supplier for the provision of the Service, in which case such agreement will govern your use of the Service. The Service is intended for business use only. By entering into the Agreement, the Customer confirms that it is acting in the course of its business, trade or profession and not as a consumer.

You warrant that you have the authority to enter into and perform your obligations under this Agreement. If you enter into this Agreement on behalf of your company, then "Customer" in the remainder of this Agreement means your company, and you warrant that you are authorised to bind your company to this Agreement. 

This Agreement governs the Customer’s access to and use of the Supplier’s safety management portal and related services (collectively, the Service). 

1.2 The Customer accepts the Agreement by submitting an Order, creating an account to access or use the Service, or clicking the “I agree” button that is presented to you at the time of submitting your Order. If Customer does not agree to the terms of this Agreement, do not click the “I agree” button and stop using the Service. The Agreement takes effect on the date that Supplier accepts an Order or first makes the Service available to Customer, whichever is earlier (Commencement Date). 

1.3 In this Agreement: Order means the Online Order or Order Form described in Section 11.1; User means a person whom the Customer has invited or allowed to use the Service through the Customer’s workspace; Customer Data means the data that the Customer and its Users enter into or upload to the Service; Documentation means Appendix 1 and the user guides that the Supplier makes available for the Service; and Uptime means the time during which the Service is operational and available to Users.

 2.1 The Agreement comprises: (a) these terms and conditions (the General Terms); (b) the Order; (c) Appendix 1 – Service Description; and (d) Appendix 2 – Data Processing Agreement, including its Annexes I–IV.

2.2 If there is any conflict or inconsistency among the documents that make up the Agreement, the following order of precedence applies (highest first): (i) any duly signed amendments/supplementary terms; (ii) the Order; (iii) these General Terms; (iv) the Documentation (including Appendix 1). Notwithstanding the foregoing, Appendix 2 (including the SCC incorporated therein) shall prevail over any other part of the Agreement in respect of the processing of personal data, in accordance with Clause 4 of the SCC.

3.1 About the Service. The Supplier provides the Safety Management Portal (SMP)—a portal designed to support workplace safety management. It enables safety oversight personnel and team leaders to digitally manage safety and compliance at jobsites through a seamless experience among Supplier‑enhanced equipment, the Supplier app, and the SMP. The Supplier is responsible for providing the Service with the functionality stated in the Documentation during the Term. 

3.2 Changes to the Service. The Supplier may make changes, modifications, and updates to the Service (including adding or removing features) in accordance with Section 15. 

3.3 Access. Each User accesses the Service via the Supplier’s designated products or interfaces. Data uploaded by a User through the User’s own account is personal and may be shared only with Customer personnel who need it to perform their tasks. The Customer shall promptly deactivate Users who are no longer authorized to use the Service and remains responsible to the Supplier for all Users’ use of the Service as if for the Customer’s own account. 

3.4 Right to Use. Upon full payment of fees and compliance with the Agreement, the Supplier grants the Customer a limited, non‑exclusive right during the Term to access and use the Service for its business and to make it accessible to Customer personnel, in accordance with the Agreement and Documentation. 

3.5 Contact fields and configurable information. The Service may include features where the Customer configures and populates fields in the SMP, including free‑text or label‑based contact fields (for example contact details to a supervisor, on‑site nurse, or next of kin). These features are provided as part of the Service functionality only. The Supplier does not determine which information is entered into such fields and does not use the content of these fields for any purpose other than providing and operating the relevant functionality of the Service in accordance with this Agreement and Appendix 2. 

3.6 Customer Responsibilities. The Customer is responsible for: (a) complying with all laws, rules, and regulations applicable to its use of the Service; (b) ensuring only authorized personnel have access; (c) not divulging to unauthorized parties information obtained by personnel when using the Service; (d) informing Users and obtaining their permission to access the data they choose to store in their accounts; (e) communications between the Customer’s IT systems and the Service; and (f) the hardware and software required to use the Service (including any faults or defects that interfere with access). The Customer shall use commercially reasonable efforts to prevent unauthorized access or use and to avoid transmitting malware to the Service, including protecting usernames and passwords and promptly notifying the Supplier of suspected unauthorized access. 

3.7 Ownership Changes. The Customer shall notify the Supplier in writing without delay of material changes in ownership of the Customer or its parent company (if any). 

3.8 Restrictions on use. The Customer undertakes not to: access the Service by means other than through the interfaces designated by the Supplier, store, distribute or transmit any material through the Service that is (i) unlawful, or (ii) defamatory, infringing, obscene, pornographic, racist, terrorist or otherwise likely to cause injury or harm to any person or organization, use the Service in a way that infringes the intellectual property rights of the Supplier or third parties, attempt, or knowingly permit or enable anyone else to, sell, rent, lease, license, distribute, publish, copy, modify, duplicate, create derivative works from, frame, mirror, republish, download, display or transmit all or any part of the Service attempt to decipher, decompile, disassemble or reverse engineer any software used to provide the Service, monitor the availability, performance or functionality of the Service for competitive purposes, including using the Service to develop or operate a competing product or service or copying the features or user interface of the Service; or take any action that damages or adversely affects, or may damage or adversely affect, the security, integrity, performance or proper functioning of the Service. 

4.1 Supplier may offer certain Services to you at no charge, trial use, and access to pre-release, early release and beta products (No-Charge Services). You agree that pre-release, early release and beta products are still in development and may contain errors and bugs. Supplier may terminate your right to use No-Charge Services at any time and for any reason at Supplier’s sole discretion, without liability to you. Sections 13 and 14 do not apply to No-Charge Services.

5.1 The Customer shall ensure that each User has a named account and that accounts are not shared. 

5.2 The Customer administers Users and is responsible for all actions taken through its accounts. The Supplier is not responsible for the Customer’s internal administration of User access. 

6.1 Supplier IP. The Supplier and its licensors own all intellectual property rights in and to the Service. No rights are granted to the Customer other than as expressly set out in the Agreement. 

6.2 Third‑Party Products. For any third‑party products or related documentation used with the Service, the applicable third‑party owner retains all rights. Use is subject to the third party’s terms. 

6.3 Customer Data. The Customer and its licensors own all rights in Customer Data. The Supplier may use Customer Data only to the extent necessary to perform its obligations under the Agreement. 

6.4 Feedback. If the Customer offers suggestions for developing, improving, or altering the Service (Feedback), the Supplier may use such feedback freely and without any obligation to the Customer.

7.1 The Customer acknowledges that the use of Customer Data in the Service is determined by the Customer and/or Users, and that the Supplier does not assume responsibility for the Customer’s and/or Users’ use of such data. 

7.2 Contact fields as Customer Data. Information entered into contact fields or other customer‑configured fields in the SMP, including any names, phone numbers, roles, or relationships to a user, constitutes Customer Data under this Agreement. The Customer is solely responsible for the content and use of such fields and for ensuring that any processing of personal data in these fields – including personal data relating to individuals who are not Users, such as next of kin, supervisors, or other contacts – complies with applicable data protection laws, including (where relevant) providing appropriate information to the data subjects and ensuring a valid legal basis for the processing. The Supplier does not assume any responsibility for the legality, accuracy, or completeness of the information entered into such fields and will process such data only on the Customer’s instructions and only to the extent necessary to provide, maintain, and support the relevant functionality of the Service. The Customer shall indemnify and hold the Supplier harmless from and against any third‑party claims, damages, losses, or expenses arising out of or in connection with information the Customer or its Users enter into such fields, without prejudice to Section 18.2. 

7.3 The Customer warrants it has all necessary rights to authorize the Supplier (and its subcontractors) to store and otherwise process Customer Data in the Service as set out in the Agreement and Documentation. 

7.4 Backup. The Supplier performs daily backups of Customer Data. Each backup is retained for 30 days, and data can be restored from any of these backups if necessary. The Supplier uses a primary database and a standby database in a different data center, with replication to the standby database. The Supplier’s liability for any loss of Customer Data is limited to loss resulting from the Supplier’s failure to fulfill its obligations under this Section 7.4 and excludes loss due to external factors beyond its control. 

7.5 Personal Data. The Customer is responsible for obtaining Users’ permission for the processing of their personal data for the Service. The Customer is the data controller; processing of personal data by the Supplier (as processor) is governed by the data processing agreement in Appendix 2. 

 8.1 The Service may interoperate with certain third‑party products if selected by the Customer. The Customer’s use of any third‑party product is subject to the third party’s terms. The Supplier is not responsible for any access to or use of Customer Data by such third parties. 

9.1 Each party undertakes not to disclose to third parties during the Term and for five (5) years thereafter any information relating to the content of the Agreement or otherwise obtained due to the Agreement, whether written or oral and regardless of format (Confidential Information). Confidential Information may be used solely to fulfill obligations under the Agreement. Each party will use at least reasonable care to prevent unauthorized disclosure, including by its employees, sub‑consultants, and intermediaries. 

9.2 The obligations in Section 9.1 do not apply to information that: (a) is public or later becomes public other than through breach; (b) was already known to the receiving party or independently developed without breach; or (c) must be disclosed under law, court/authority decision, or exchange/marketplace rules; provided the receiving party promptly notifies the other party where lawful and uses best efforts to ensure confidential treatment by the recipient. 

10.1 The Supplier will implement appropriate technical and organizational measures to protect Customer Data against unauthorized processing, accidental loss, destruction, or damage, consistent with the Agreement and Appendix 2. 

10.2 The Customer will comply with applicable data‑protection laws and ensure it has obtained all necessary consents from Users for the Supplier to provide the Service. 

11.1 To use the Service you must complete an Order by either: a. completing the online order page (Online Order) which contains details of: - the Service being ordered; - the applicable fees (Fees); - the number of paid users that will form part of your workspace - the Subscription Term applicable to the Service; and - the applicable billing details, and the currency in which you will be billed; 

b. execute a paper-based quote, order form or statement of work (Order Form) provided by Twiceme which sets out the relevant information in section (11)(a). 

12.1 As compensation for the Service, the Customer shall pay the fees specified in the Order. Unless otherwise specified, all fees are invoiced in advance either for a monthly or yearly depending on choice made by Customer. Fees are stated in the currency set out in the Order and exclude VAT, GST, sales tax and similar taxes. 

12.2 Unless otherwise agreed in writing, the Supplier may adjust the prices in the Order once per calendar year. 

12.3 Payment terms are set out in the Order. If the Order does not specify payment terms, invoices are payable within thirty (30) days of the invoice date. If the Customer is in arrears, the Supplier may charge penalty interest under the Swedish Interest Act (1975:635) and statutory reminder/late‑payment fees. 

12.4 If the Customer is 15 days or more in arrears, the Supplier may suspend access under Section 16.2 and/or terminate under Section 16.3(b). 

13.1 Uptime Commitment. The Supplier commits to ensuring Uptime of at least 99.6% during the Uptime Window, defined as Monday to Friday, 08:00–17:00 in the time zone of the hosting region assigned to the Customer’s account (US Eastern Time for the USA region, Australian Eastern Time for the Australia region, and for a region added later the time zone stated by the Supplier), when the Service is intended to be operational and available to Users (the Minimum Uptime). 

13.2 Measurement. Uptime is calculated monthly by dividing the number of minutes the Service is operational during the Uptime Window by the total minutes in that window for the month, excluding Downtime. Downtime means: (a) scheduled maintenance under Section 13.3; (b) emergency maintenance under Section 13.4; and (c) time outside the Supplier’s reasonable control or attributable to the Customer and/or Users (including: use in violation of the Agreement, Documentation, or reasonable instructions; failure to reasonably assist with troubleshooting; interruptions of communications services; and force majeure or third‑party‑caused incidents). 

13.3 Scheduled Maintenance. The Supplier may perform scheduled maintenance and will take commercially reasonable steps to schedule it when use is normally limited and give prior notice. 

13.4 Emergency Maintenance. If the safety or stability of the Service is at risk, the Supplier may perform emergency maintenance and will take commercially reasonable steps to inform the Customer and indicate the expected impact. 

14.1 If, in a calendar month, actual Uptime is less than the Minimum Uptime, the Customer is entitled to a credit against the Fees for that month, calculated as follows: 

14.2 To receive a credit, the Customer must send a written request within 15 days of the Supplier’s confirmation of the Customer’s notice of unavailability. Credits are applied to the next invoice. 

14.3 This Section 14 sets out the Supplier’s sole and entire liability for failure to achieve Minimum Uptime in a month. 

15.1 The Supplier may modify the Service (including adding or removing features). 

15.2 The Supplier may develop and introduce new modules or features different from and/or complementary to existing functionality (New Services). The Supplier may charge new, separate, or additional fees and impose additional conditions for New Services. 

16.1 Suspension (Security/Compliance). The Supplier may immediately and temporarily suspend access to the Service if necessary to protect the security, availability, or integrity of the Service, or if the Customer and/or a User violates the Agreement or applicable law, or where the Supplier can reasonably assume such a violation. 

16.2 Suspension (Payment). The Supplier may suspend the Service if the Customer is 15 days or more in arrears. 

16.3 Term and Termination. (a) The Agreement takes effect on the Commencement Date and continues until terminated (the Term). The Customer may terminate the Agreement with effect from the end of the current billing period (monthly or yearly, as applicable). The Supplier may terminate the Agreement on at least thirty (30) days’ notice with effect from the end of a billing period. (b) The Supplier may terminate if the Customer is in default of payment for 15 days or more. (c) Either party may terminate with immediate effect if the other party commits a material breach not capable of remedy, or (if capable) fails to remedy within 15 days of written notice referring to this Section 16.3; or if the other party is insolvent, bankrupt, in liquidation/receivership, enters composition with creditors, is subject to analogous proceedings, or is otherwise deemed insolvent. (d) Termination must be made in writing or through the Service. 

17.1 Upon termination for any reason, the Customer’s right to use the Service ceases immediately. The Customer shall cease all use and, if applicable, delete or destroy any software, Documentation, or other Service‑related materials in its possession. 

17.2 Within a reasonable time after termination, the Supplier will, upon the Customer’s request made no later than 15 days after termination, provide a copy of Customer Data in a commonly used format. The Supplier may charge a reasonable fee. The Supplier’s obligations under this Section 17.2 apply unless the Agreement was terminated by the Supplier under Section 16.3(b) or for the Customer’s material breach under Section 16.3(c). 

17.3 Provisions intended by their nature to survive termination (including confidentiality, IP, limitations of liability, dispute resolution, and this Section 17) will survive. 

18.1 Supplier Indemnity (IP). The Supplier shall indemnify the Customer against all costs, expenses, damages, and/or losses resulting from a third‑party claim that the Customer’s use of the Service infringes such third party’s intellectual property rights, except where the claim arises from: (i) the Customer’s breach of the Agreement or law; (ii) use contrary to the Documentation or reasonable instructions; (iii) the Supplier’s compliance with the Customer’s specific technical design or instructions; or (iv) operation or use of the Service with services/products not provided or authorized by the Supplier. The Customer shall notify the Supplier without undue delay after becoming aware of the claim. At the Customer’s request, the Supplier shall defend the claim and/or cooperate in the defense. The Supplier shall not admit or settle any infringement claim without the Customer’s prior written consent. If actual or likely infringement occurs, the Supplier shall promptly, at its expense, either (A) secure the Customer’s right to continue using the Service, or (B) replace the infringing component to ensure non‑infringement while maintaining functionality. If, using best efforts, the Supplier cannot achieve (A) or (B), the Agreement shall terminate unless the Customer objects. This Section 18.1 states the Supplier’s sole and entire liability for third‑party IP infringement. 

18.2 Customer Indemnity (Customer Data). The Customer shall indemnify the Supplier against all costs, expenses, damages, and/or losses resulting from a third‑party claim that the Supplier’s use of Customer Data infringes such third party’s intellectual property rights or otherwise arises from the Customer’s or its Users’ collection, input, or use of Customer Data in the Service (including data entered into contact fields or other customer‑configured fields in the SMP, such as details of next of kin or other contacts) in breach of applicable law. The Supplier shall notify the Customer without undue delay after becoming aware of the claim. At the Supplier’s request, the Customer shall defend the claim and/or cooperate in the defence, and shall not admit or settle without the Supplier’s prior written consent. If actual or likely infringement occurs, the Customer shall promptly and at its expense either (A) secure the Supplier’s right to continue using the Customer Data, or (B) replace the infringing component to ensure non‑infringement. If, using best efforts, the Customer cannot achieve (A) or (B), the Agreement shall terminate unless the Supplier objects. This Section 18.2 states the Customer’s sole and entire liability for infringement arising from Customer Data. 

19.1 Disclaimer. Unless otherwise expressly stated in the Agreement, the Supplier makes no warranties—express, implied, statutory, or otherwise—with respect to the Service, and specifically disclaims all implied warranties, including merchantability, fitness for a particular purpose, and non‑infringement, to the fullest extent permitted by applicable law. 

19.2 Exclusion. Neither party is liable for any loss of profit, revenue, goodwill, or other indirect damages. 

19.3 Cap. The total liability of either party shall not exceed the fees paid by the Customer to the Supplier during the 12‑month period preceding the event giving rise to liability. 

19.4 Carve‑outs. The limitations in Sections 19.2 and 19.3 do not apply to damages (i) caused by gross negligence or willful misconduct, or (ii) resulting from breaches of Section 3.4 (right to use), Section 3.6 (Customer responsibilities), Section 3.8 (use restrictions), or Section 18 (IP/Customer Data indemnities). 

19.5 Claim Notice. No party is liable for damages unless the injured party presents a written claim within 2 months from when it became aware, or should have become aware, of the facts giving rise to the claim. 

20.1 A party is excused from penalties for failure to perform obligations to the extent caused by circumstances beyond its control that could not reasonably have been foreseen at signing, such as war, civil war, fire, flood, interruption of public communications, interruption of public energy supply, or similar circumstances. The affected party shall promptly notify the other party and use reasonable efforts to mitigate. Performance timelines are extended by the duration of the event. Either party may terminate with 1 month’s notice if performance is delayed for more than 2 months. 

21.1 Supplier may update or modify the terms of this Agreement from time to time, to respond to changes in Supplier’s products, services, business or as required by law, by giving notice to Customer at least fourteen (14) days before the change takes effect. A change required by law may take effect sooner. 

21.2 If the Customer does not accept the change, the Customer may terminate this Agreement upon providing notice to Supplier before the change takes effect; and obtain a refund of any advance payments relating to parts of the Service not performed. Continued use after the effective date constitutes acceptance of the amended terms. 

22.1 Notices between the parties shall be sent by e‑mail to the contact persons at the addresses specified by each party. Notices are deemed received when the electronic message arrives in the recipient’s inbox. 

23.1 Aggregated Data. The Supplier may collect and use data resulting from the Customer’s use of the Service to create aggregated and anonymized datasets (Aggregated Data), provided that (i) personal data is anonymised and aggregated for this purpose only as instructed in Appendix 2; and (ii) Aggregated Data does not include information attributable to individual natural persons or to the Customer. The Supplier may use Aggregated Data to improve and develop products and services, perform analysis, and produce statistics. 

23.2 Subcontractors. The Supplier may use subcontractors in providing the Service and remains responsible for their acts, omissions, and negligence as if its own. 

23.3 Publicity. The Supplier may use the Customer as a reference customer for marketing purposes. 

23.4 Assignment. The Customer may not assign the Agreement in whole or in part without the Supplier’s prior written consent. 

23.5 Entire Agreement. This Agreement is the entire agreement between the parties regarding its subject matter and supersedes all prior written or oral warranties, undertakings, representations, and agreements. 

23.6 Equipment Brands. Manufacturers of equipment used with the Service (Brands) have access to a Twiceme partner portal that shows how their equipment is used. Notwithstanding Sections 9 and 23.1, the partner portal shows a Brand, for each customer holding that Brand's equipment, the Customer's workspace name together with figures about that Brand's equipment held by the Customer, such as the number of units held, the number and results of inspections performed on them, their age and end-of-life status, the number of Users in the workspace, how many units are assigned to Users, how many of those Users have a Medical ID on their equipment, and totals of valid, expiring and expired certificates held by those Users. The partner portal does not show a Brand the names, contact details or other information identifying individual Users, the content of any Medical ID or document, or information about other manufacturers' equipment. For workspaces with fewer than 5 Users, figures relating to Users are not shown.

23.7 Usage Data. The Supplier records how the Service is used, such as which features are used and when, the type of device and software used, and technical details of the requests made to the Service, linked to an internal identifier for each User and to the Customer’s workspace (Usage Data). The Supplier processes Usage Data as controller, for its own purposes of operating, securing, supporting and improving the Service and of communicating with Users about the Service, as described in the Supplier’s Privacy Notice. Usage Data is not Customer Data, and Sections 6.3 and 7.5 and Appendix 2 do not apply to it.

24.1 Governing Law. This Agreement and any dispute or claim arising out of or in connection with it is governed by Swedish law, without regard to conflicts of law rules, and excluding the UN Convention on Contracts for the International Sale of Goods. 

24.2 Arbitration. Any dispute, controversy, or claim arising out of or in connection with this Agreement, or the breach, termination, or invalidity thereof, shall be finally settled by arbitration administered by the Arbitration Institute of the Stockholm Chamber of Commerce (SCC). The Rules for Expedited Arbitrations apply unless the SCC decides, considering the complexity, amount in dispute, and other circumstances, that the Arbitration Rules shall apply (and in that case the SCC shall decide whether the tribunal consists of one or three arbitrators). The seat of arbitration is Stockholm, Sweden. The language of the arbitration is English. 

Last updated: 2026-11-10

The Safety Management Portal (SMP) offered by Twiceme Technology AB is a solution designed to support various aspects of workplace safety management. It empowers safety oversight personnel and team leaders to digitally transform their approach to safety and compliance at their jobsites, enabling better oversight, efficiency, and adherence to safety standards.

The SMP serves as a centralized desktop platform that aggregates data and transforms it into actionable insights derived from the Twiceme app, which is seamlessly connected to Twiceme-enhanced equipment. This integrated digital ecosystem—comprising the SMP, Twiceme app, and Twiceme-enhanced equipment—ensures that safety personnel can operate more efficiently by streamlining processes and improving collaboration across these three essential components.

If you are using No-Charge Services, please observe that Twiceme Technology AB will not be able to guarantee that it will be operating at all times.

SMP operates on an architecture powered by Microsoft Azure. Customer Data is hosted in the hosting region assigned to the Customer’s account. The region is assigned from the location the Customer states when the account is set up and is shown in the account settings. Hosting regions are available in the USA and Australia, and the Supplier may add regions. Where no hosting region is available for the Customer’s location, the account is assigned the USA region. This cloud-based infrastructure allows the platform to adapt to varying user demands, offering high availability, potential scalability, and the ability to meet stringent performance requirements.

SMP is compatible with most modern web browsers and operating systems, ensuring accessibility and ease of use across diverse environments.

The SMP provides an integrated system designed to enhance workplace safety and operational efficiency. This system encompasses several key features to support the secure and effective management of work-related safety processes:

SMP enables employers to securely manage, verify, and store essential work-related documentation, such as employee certifications, training records, and work permits. The service includes a structured way to check the educational credentials of your staff and other relevant information that each individual has uploaded to their account. When Twiceme-enhanced equipment assigned to a User is scanned, the name and validity of the User’s Work Related Documents, the inspection status of the equipment and the Customer’s contact number are displayed to the person scanning, without login.

When using this service, it is important to note that you do not have the right to redistribute the information to people who do not need this information in their professional role in your company or to third parties.

The platform enables insights into how many members on a job site have activated their Twiceme-enhanced equipment by uploading a Medical ID or any work-related documentation to their equipment. It also indicates the activation status and functionality strength of the equipment.
Importantly, the content of a member’s Medical ID is never transferred from the member’s Twiceme app or the equipment to the SMP. This ensures that this data remains secure while still enabling oversight personnel to monitor overall equipment readiness on-site.

Members using the Twiceme app and equipment receive continuous notifications reminding them to check the health of their safety equipment. Through the app, they can follow a step-by-step guide to inspect their personal protective equipment (PPE) independently. The results of these self-inspections are summarized and displayed in the SMP, providing administrators with valuable insights into the condition and usage of equipment from a safety perspective. This feature helps ensure equipment is properly maintained and compliant with safety standards, while also empowering users to take an active role in equipment management.

Moreover, the Twiceme app includes an inspection feature tailored for Equipment Inspectors or other competent persons to perform professional inspections of safety equipment, specifically fall protection harnesses. The results of these professional inspections are also logged in the SMP, enabling centralized tracking and reporting.

A supervisor can start a shift for a team or for the whole workspace and record which members are present. Members can be checked in and out by a supervisor, or check in and out themselves in the Twiceme app. For each member, the service records the time of check-in and check-out, who recorded it, and a reason for check-out chosen from a fixed list (end of shift, left early, sick or injured, other). The records are shown in the Twiceme app and the SMP and can be exported by the Customer.

Members can report a safety issue at a location. A report contains a title, a description, a severity level, the location, and optional photos. Authorised members can respond to, reject or resolve a report, and can add messages and photos when doing so. Reports and responses are shown with the name of the member who made them.

We aim to provide the service with essentially unchanged functionality over time but reserve the right to change the range of modules available to meet market needs and comply with applicable laws and other regulatory requirements. This may include adding, removing or modifying existing modules.

This DPA is entered into by and between Twiceme Technology AB and Customer as set out below (each, a "Party" and collectively, the "Parties") constitutes an annex to the agreement between the Parties which forms the basis of the agreement between Twiceme and Customer whereby both parties cooperate in a project to use Twiceme's platform (the "Agreement") and is deemed to be signed at the same time and date as the Agreement was signed (the "Effective Date").

The Parties hereby agree that the standard contractual clauses for use between controllers and processors set out in the Annex to Commission Implementing Decision (EU) 2021/915 of 4 June 2021 (OJ L 199, 7.6.2021, p. 18) (the "SCC"), in their English language version, are incorporated by reference into and form an integral part of this DPA, and constitute the contract between the Parties under Article 28(3) of the GDPR in accordance with Article 28(6) and (7) of the GDPR. The SCC are available at https://eur-lex.europa.eu/eli/dec_impl/2021/915/oj. Terms with capitalised initials that are not otherwise defined in this DPA shall have the meaning assigned to them in the GDPR.

To the extent the processing of the Controller's Personal Data is subject to the UK GDPR (as defined in section 3(10) of the Data Protection Act 2018) and the Data Protection Act 2018, the SCC and this DPA shall apply to that processing as contractual terms between the Parties for the purposes of Article 28(3) of the UK GDPR. For that processing, references to the GDPR and its provisions, including Chapter V, shall be read as references to the UK GDPR and its equivalent provisions, and references to the supervisory authority as references to the Information Commissioner.

The SCC contains four annexes which form an integral part of this DPA and are to be completed by the Parties ("Annexes"). The Annexes are attached to this DPA as Annex I - IV.

Clause 2 of the standard contractual clauses states that the parties may not modify the clauses, except to add or update information in the annexes. The parties may also not add clauses that directly or indirectly contradict the clauses of the standard contractual clauses or restrict the fundamental rights and freedoms of data subjects. However, the SCC requires parties to make certain choices. Where such choices are available, the following shall apply in relation to this DPA:

In addition to the above, the following provisions shall apply to the processing of Personal Data under the Agreement.

The Data Processor (as defined in Annex I) shall notify the Data Controller (as defined in Annex I) of any personal data breaches referred to in clause 9(2) of the SCC without undue delay after becoming aware of the breach.

For an additional entity to be considered a party to the Agreement in accordance with Clause 5(b), the entity's details must be completed in Annex I and a separate access agreement must be signed by all parties.

Unless otherwise agreed in writing between the Parties, the Data Processor (as defined in Annex I) shall not receive any compensation for the performance of its obligations under the DPA, including compliance with the Data Controller's (as defined in Annex I) instructions regarding the processing of the Data Controller's Personal Data, other than the compensation payable under the Agreement.

Notwithstanding the provisions of the previous paragraph, the Data Processor is entitled to compensation for actual and justified additional costs incurred by the processor as a result of

• the extent of the processor's involvement in the controller's compliance with the data subject's rights under Clause 8(b) substantially exceeds what the processor could reasonably have foreseen at the time the DPA entered into force.

• the processor's assistance with a data protection impact assessment under Clause 8(c)(1) initiated by the controller,

• the processor's assistance to the controller in the event of a personal data breach in accordance with clause 9.1 where the breach is caused by the controller,

• the processor's assistance to the controller in the event of an audit or review of the processor and/or its sub-processors initiated by the controller, provided that such compensation is reasonable and does not prevent the controller from exercising its rights under Clause 7.6 of the SCC,

• after the DPA has entered into force, the controller issues new or amended instructions regarding the processing of Personal Data by the processor; and

• that the processing of the Controller's Personal Data by subcontractors has been terminated at the Controller's request after the Controller has been informed in accordance with clause 7.7(a).

This DPA shall be governed by and construed in accordance with the choice of law made in the Agreement.

The Data Controller instructs the Data Processor to anonymise and aggregate personal data processed in the Service to the extent necessary to create Aggregated Data as defined in, and subject to the conditions set out in, Section 23.1 of the Agreement. The Data Controller further instructs the Data Processor to make information available to manufacturers of equipment as described in, and subject to the conditions set out in, Section 23.6 of the Agreement.

Details of the data controller are set out in the Agreement (herein referred to as the "Customer").

By signing the Agreement, the Controller shall also be deemed to have signed this DPA which constitutes Appendix 2 to the Agreement.

Details of the Data Processor are set out in the Agreement (herein referred to as the "Supplier").

By signing the Agreement, the Processor shall also be deemed to have signed this DPA which constitutes Appendix 2 to the Agreement.

Personal data that a User stores in the Twiceme app or on Twiceme-enhanced equipment, such as a Medical ID, is processed under a separate agreement between the Supplier and the User and is not covered by this DPA. Work Related Documents that a User uploads are linked to the Customer’s workspace when uploaded and are processed on behalf of the Customer under this DPA.

List of all security measures, including technical and organizational measures, taken by the processor to ensure the security of the data.

List of sub-processors used by the Processor as of the effective date.

Where a sub-processor processes personal data outside the EU/EEA, the transfer is based on an adequacy decision, including the EU-U.S. Data Privacy Framework where the sub-processor is certified, or the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, in accordance with Clause 7.8 of the SCC. For processing subject to the UK GDPR, the corresponding UK transfer mechanisms apply.