Appendix — Data Processing Agreement (DPA)

Parties: BIMTech Innovations AB ("Upskiller") and the customer under the Master Agreement
DPA version: v1.0 · Effective date: 2026-09-01 · Last updated: 2026-09-10
Canonical location: https://docs.upskiller.xyz/dpa
Companion documents: LUX Revit Plugin — Terms of Use · LUX Revit Plugin — Privacy Policy

This DPA is incorporated into the LUX License and Service Agreement / beta / pilot agreement ("Master Agreement") between BIMTech Innovations AB and the customer, by reference (see "How this DPA applies" below). No separate signature is required; a signed PDF of the current version is provided on request.

How this DPA applies (incorporation by reference)​

This DPA is incorporated into the Master Agreement by reference. The Master Agreement contains a clause to the effect of:

"The Data Processing Agreement published by Upskiller at https://docs.upskiller.xyz/dpa, in the version in force on the Effective Date, is incorporated into and forms part of this Agreement. Upskiller may issue new versions of the DPA from time to time; it will give the Controller at least 30 days' prior notice of any change that would materially reduce the protection of personal data or the Controller's rights, and the Controller may object to such a change on reasonable data-protection grounds and, failing resolution, terminate the affected services. Sub-processor changes are governed by Section 6 of the DPA and are not treated as amendments to it."

Each published version carries a version number and effective date. The version agreed between the parties is the one in force on the Master Agreement's Effective Date, unless they later agree in writing to adopt a newer version. A Change log is maintained at the end of this document. On request, Upskiller provides a PDF of the agreed version for the Controller's records or for signature as an appendix.

This Data Processing Agreement ("DPA") forms part of the Master Agreement between:

• BIMTech Innovations AB, org. nr 559518-2881, Jungfrudansen 6, 171 56 Solna, Sweden ("Upskiller", the "Processor"), and
• the customer identified in the Master Agreement (the "Controller").

It reflects the parties' agreement on the processing of personal data by the Processor on behalf of the Controller in connection with the LUX software and services, as required by Article 28(3) of Regulation (EU) 2016/679 ("GDPR").

1. Definitions​

Terms such as "personal data", "processing", "controller", "processor", "sub-processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given in the GDPR. "Applicable Data Protection Law" means the GDPR and any national law supplementing it that applies to the processing, including the Swedish Data Protection Act (2018:218). "Sub-processor" means any processor engaged by the Processor to process personal data on behalf of the Controller.

2. Roles and scope​

2.1 For the processing described in Annex I, the Controller is the controller and the Processor is the processor. Where the Controller is itself acting as a processor for a third party, the Processor acts as a sub-processor and the Controller warrants it has the authority and instructions to engage the Processor on these terms.

2.2 The Processor also processes certain personal data as an independent controller (user identification, licensing/seat management, security and product-improvement telemetry, support). That processing is not governed by this DPA but by the LUX Revit Plugin — Privacy Policy.

2.3 This DPA applies for as long as the Processor processes personal data on behalf of the Controller under the Master Agreement.

3. Processing instructions​

3.1 The Processor shall process personal data only on documented instructions from the Controller, including with regard to transfers, unless required to do otherwise by EU or Member State law; in that case the Processor shall inform the Controller of that legal requirement before processing, unless the law prohibits it.

3.2 The Controller's complete and final instructions are set out in this DPA, in Annex I, and in the Master Agreement (including the Controller's ordinary use of the software). Additional or changed instructions must be agreed in writing and may be subject to a reasonable adjustment of fees or timelines.

3.3 The Processor shall inform the Controller without undue delay if, in its opinion, an instruction infringes Applicable Data Protection Law.

3.4 The Processor shall not sell personal data and shall not use it for its own purposes. Personal data contained in a Controller model is used only to deliver the requested prediction or simulation and is not retained for model improvement or research.

4. Confidentiality​

The Processor shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access is limited to personnel who need it to perform the Master Agreement.

5. Security​

5.1 The Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account Article 32 GDPR. The measures in place as at the date of this DPA are described in Annex II.

5.2 The Processor may update the measures over time provided the level of protection is not diminished.

6. Sub-processors​

6.1 The Controller gives the Processor general written authorisation to engage sub-processors. The sub-processors engaged as at the date of this DPA are listed in Annex III.

6.2 The Processor shall inform the Controller of any intended addition or replacement of a sub-processor at least thirty (30) days in advance (by email to the Controller's contact or via a subscribable list), giving the Controller the opportunity to object on reasonable data-protection grounds. If the parties cannot resolve a well-founded objection, the Controller may terminate the affected part of the Master Agreement.

6.3 The Processor shall impose on each sub-processor, by written contract, data-protection obligations equivalent to those in this DPA, and remains fully liable to the Controller for the sub-processor's performance.

7. International transfers​

7.1 The Processor shall not transfer personal data to a country outside the EEA, or to an international organisation, without the Controller's prior authorisation, unless an appropriate safeguard under Chapter V GDPR is in place.

7.2 As at the date of this DPA, all processing takes place within the EEA (see Annex III). If the Processor later needs a sub-processor to process personal data outside the EEA, it shall first put in place the European Commission's Standard Contractual Clauses (Decision 2021/914) with the relevant module and any necessary supplementary measures, make a copy available to the Controller on request, and update Annex III.

8. Assistance to the Controller​

8.1 Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the Controller's obligation to respond to requests to exercise data subject rights (access, rectification, erasure, restriction, portability, objection). If a data subject contacts the Processor directly, the Processor shall forward the request to the Controller without undue delay and shall not respond itself except to confirm receipt.

8.2 Taking into account the nature of processing and the information available to it, the Processor shall assist the Controller in ensuring compliance with the obligations in Articles 32–36 GDPR (security, breach notification, data protection impact assessments, prior consultation).

9. Personal data breach​

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's personal data. The notification shall, to the extent known, describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. The Processor shall document breaches and cooperate with the Controller in its own notification duties. Initial notification is not an acknowledgement of fault.

10. Audit​

10.1 The Processor shall make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR and this DPA, and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor it mandates.

10.2 In the first instance the Processor may satisfy this obligation by providing its current security documentation, sub-processor list, and any third-party certifications or audit reports it holds. On-site or in-depth audits shall be limited to once per 12 months (unless required by a supervisory authority or following a breach), on 30 days' notice, during business hours, subject to confidentiality, without disrupting the Processor's operations, and at the Controller's cost. The auditor may not be a competitor of the Processor.

11. Deletion or return of data​

On termination or expiry of the Master Agreement, the Processor shall, at the Controller's choice, delete or return all personal data processed on behalf of the Controller and delete existing copies, unless EU or Member State law requires storage. Routine backups are deleted on their ordinary cycle. Anonymised data is not affected. The Processor shall confirm deletion in writing on request.

12. Liability and precedence​

12.1 The liability provisions of the Master Agreement apply to this DPA. Nothing in this DPA limits either party's liability towards a data subject or a supervisory authority under the GDPR.

12.2 In the event of conflict between this DPA and the Master Agreement on matters of data protection, this DPA prevails. In the event of conflict between this DPA and the Standard Contractual Clauses, the Clauses prevail.

12.3 This DPA is governed by the law of Sweden, and disputes are resolved as set out in the Master Agreement.

Annex I — Description of the processing​

Annex II — Technical and organisational measures (as at 2026-09-02)​

• Transport security: HTTPS/TLS for all client–cloud and inter-service communication.
• Storage security: encryption at rest for stored LUX Certify snapshots, results and exports; access-controlled object storage.
• Access control: role-based access for Upskiller personnel; least-privilege; individual named accounts; MFA on administrative access; access reviews.
• Segregation: logical separation of customers' data; per-project grouping; per-snapshot share ACL; Auth0 per-user authentication for the LUX Certify web interface.
• Pseudonymisation: user identifiers in telemetry pseudonymised/hashed where feasible; project identified by random GUID, not name.
• Hosting: EU/EEA data centres (see Annex III).
• Logging & monitoring: audit logging of access to stored snapshots; error and security monitoring; log retention 90 days.
• Resilience & backup: regular backups; documented restore procedure.
• Data minimisation: full Revit model not transmitted for predictions; only structured geometry.
• Organisational: confidentiality undertakings for all personnel and contractors; security and data-protection responsibility assigned to the CEO; documented incident-response procedure; sub-processor due diligence and contracts.
• Deletion: documented deletion/return procedure on contract end.

Annex III — Sub-processors (as at 2026-09-02)​

All sub-processors below process the relevant personal data within the EU/EEA.

The current list is available to the Controller on request and changes are notified under Section 6.2.

Change log​