Data Processing Agreement

PassportReader is a Service for reading and verifying e-passports, e-ID cards and wallet credentials for purposes such as identity verification, hereinafter referred to as the "Service".

The Service is provided by Iris Development AB, a company registered with Bolagsverket in Sweden with registration number 556755-7201, hereinafter referred to as "we", "us" or "our".

By using the Service, this Data Processing Agreement ("DPA") will automatically apply to you.

This DPA identifies how Your Data will be processed when using the Service, as well as either party's obligations with respect to applicable Data Protection Legislation (defined below).

Your Data will be processed pursuant to the terms set forth herein and as required by the General Data Protection Regulation (Regulation (EU) 2016/679, which repealed Directive 95/46/EC), Directive 2002/58/EC (as amended by Directive 2009/136/EC) and any legislation or regulation pursuant to them, or which amends, replaces, re-enacts or consolidates any of them, and all other applicable laws relating to processing of personal data and privacy that may exist in any relevant jurisdiction (“Data Protection Legislation”). For purposes of the DPA, “Your Data” shall mean “Personal Data” as defined by the Data Protection Legislation. Additionally, “Controller”, “Processor”, “Data Subject”, “Processing”, “Sub-processor”, and “Appropriate Technical and Organizational Measures” shall also have the meanings specified in the Data Protection Legislation.

You agree that we act as Processor of Personal Data and that you act as Controller of Personal Data, and that your users accordingly allow us to process their Personal Data: (i) for the purpose of identifying the user; (ii) as specified in the Services' terms of use and privacy policy; and (iii) as permitted by Data Protection Legislation.

You agree that we act as both Processor and Controller of Personal Data: (i) for access to and use of the Service; (ii) as specified in the Services' terms of use; and (iii) as permitted by Data Protection Legislation.

Both parties agree to use Appropriate Technical and Organizational measures to ensure the proper treatment of Personal Data and the ability to accordingly respond to Data Subject requests pertaining to use of Personal Data. Specifically, and among other rights that may be available to Data Subjects, the parties agree that Data Subjects have a right to: consent withdrawal, access to and modification of Personal Data, object to processing of their Personal Data and erasure of their Personal Data. We shall implement and maintain appropriate technical and organizational measures to protect Data against unauthorized or unlawful processing, including protecting against loss, destruction, modification, or disclosure. These measures will be reasonable and appropriate with respect to the Data which is processed.

Both parties will comply with Data Subject requests as required by applicable Data Protection Legislation and any other applicable law.

The Service temporarily stores personal data to perform identity verification and provide the results to you. Retention and deletion are described in our Data practices. The data available to respond to a Data Subject request depends on what is still retained when the request is received.

You agree to immediately forward each Data Subject request to our Data Protection Officer.

In all cases, you agree to promptly notify us of all Data Subject disputes and work in good faith to resolve any dispute to the Data Subject satisfaction. You are not to resolve any dispute or conflict on our behalf.

If either party becomes aware of a personal data breach involving destruction, loss, alteration, unauthorized disclosure of, or access to personal data, it will immediately notify the other party. The affected party shall notify data subjects and appropriate parties as required by applicable Data Protection Legislation. It shall investigate the breach and use industry-standard technology, methods, and practices to mitigate its effects and prevent further breaches.

In the event either party engages a third-party Sub-processor to assist with the performance of its duties under this DPA that party shall ensure that any Sub-processor complies with applicable laws, rules, and regulations, and maintain no less stringent requirements than those of this DPA.

Both parties shall, as reasonably requested and reasonably necessary or required by applicable law, allow the other party to conduct an audit or inspection to confirm compliance with this DPA, which may include providing reasonable access to the premises, resources and personnel used by you in connection with the provision of the Service, specifically to verify the processing of Data in accordance with that party's obligations under the DPA and applicable Data Protection Legislation. Such audit shall consist solely of: (i) written information (such as security policies) and (ii) interviews with personnel as may be reasonably necessary to verify compliance. For clarity, no access to any part of a party's IT system, data hosting service providers, sites, or centers, or infrastructure will be permitted.

The terms and conditions of this DPA shall prevail over any additional or conflicting terms with respect to the treatment of Personal Data.

To reach our Data Protection Officer or for any other correspondence related to privacy, contact us.

We may update this DPA from time to time and recommend periodic review.

Last updated 2026-11-06.