Data Processing Agreement (DPA)

This DPA defines the contractual framework for how personal data is processed, controller-processor obligations and auditability.

PassportReader is a Service for reading and verifying e-passports, e-ID cards and wallet credentials for purposes such as identity verification, hereinafter referred to as the "Service".

The Service is provided by Iris Development AB, a company registered with Bolagsverket in Sweden with registration number 556755-7201, hereinafter referred to as "we", "us" or "our".

By using the Service, this Data Processing Agreement ("DPA") will automatically apply to you.

This DPA identifies how Your Data will be processed when using the Service, as well as either party's obligations with respect to applicable Data Protection Legislation (defined below).

Your Data will be processed pursuant to the terms set forth herein and as required by European Directives 95/46/EC and 2002/58/EC (as amended by Directive 2009/136/EC) and any legislation or regulation pursuant to them, or which amends, replaces, re-enacts or consolidates any of them (including the General Data Protection Regulation (Regulation (EU) 2016/279)), and all other applicable laws relating to processing of personal data and privacy that may exist in any relevant jurisdiction (“Data Protection Legislation”). For purposes of the DPA, “Your Data” shall mean “Personal Data” as defined by the Data Protection Legislation. Additionally, “Controller”, “Processor”, “Data Subject”, “Processing”, “Sub-processor”, and “Appropriate Technical and Organizational Measures” shall also have the meanings specified in the Data Protection Legislation.

DPA compliance

For your users

You agree that we act as Processor of Personal Data and that you act as Controller of Personal Data, and that your users accordingly allow us to process their Personal Data: (i) for the purpose of identifying the user; (ii) as specified in the Services' terms of use and privacy policy; and (iii) as permitted by Data Protection Legislation.

For you

You agree that we act as both Processor and Controller of Personal Data: (i) for access to and use of the Service; (ii) as specified in the Services' terms of use; and (iii) as permitted by Data Protection Legislation.

Appropriate Technical and Organizational Measures

Both parties agree to use Appropriate Technical and Organizational measures to ensure the proper treatment of Personal Data and the ability to accordingly respond to Data Subject requests pertaining to use of Personal Data. Specifically, and among other rights that may be available to Data Subjects, the parties agree that Data Subjects have a right to: consent withdrawal, access to and modification of Personal Data, object to processing of their Personal Data and erasure of their Personal Data. We shall implement and maintain appropriate technical and organizational measures to protect Data against unauthorized or unlawful processing, including protecting against loss, destruction, modification, or disclosure. These measures will be reasonable and appropriate with respect to the Data which is processed.

Data Subjects request and dispute resolution

Both parties will comply with Data Subject requests as required by applicable Data Protection Legislation and any other applicable law.

For your users

The Service has been designed with privacy in mind and does not store any Personal Data. As such, we are unable to provide data for Data Subject requests. In case we unknowingly receive uncharacterized Personal Data (for instance via the URL of API requests), you will be responsible for correcting your implementation of the Service, and for immediately notifying our Data Protection Officer to remove the relevant data.

For you

You agree to immediately forward each Data Subject request to our Data Protection Officer.

In all cases, you agree to promptly notify us of all Data Subject disputes and work in good faith to resolve any dispute to the Data Subject satisfaction. You are not to resolve any dispute or conflict on our behalf.

Personal data breach

If either party becomes aware of a Potential Data Breach that causes destruction, loss, modification, disclosure, or access to it will immediately notify the other party. The party that was subject to the Personal Data Breach shall notify Data Subjects and appropriate parties as required by the Data Protection Legislative. The party subject to the Personal Data Breach shall conduct an investigation regarding the same and will use industry standard technology, methods and other related practices to mitigate the effects and to mitigate the effects of any Personal Data Breach and shall use industry standard measures to prevent any further breaches in the future.

Sub-processors

In the event either party engages a third-party Sub-processor to assist with the performance of its duties under this DPA that party shall ensure that any Sub-processor complies with applicable laws, rules, and regulations, and maintain no less stringent requirements than those of this DPA.

Audit

Both parties shall, as reasonably requested and reasonably necessary or required by applicable law, allow the other party to conduct an audit or inspection to confirm compliance with this DPA, which may include providing reasonable access to the premises, resources and personnel used by you in connection with the provision of the Service, specifically to verify the processing Data in accordance with that party's obligations under the DPA and applicable Data Protection Legislation. Such audit shall consist solely of: (i) written information (such as security policies) and (ii) interviews with personnel as may be reasonably necessary to verify compliance. For clarity, no access to any part of a party's IT system, data hosting service providers, sites, or centers, or infrastructure will be permitted.

Conflicts

The terms and conditions of this DPA shall prevail over any additional or conflicting terms with respect to the treatment of Personal Data.

Contact

To reach our Data Protection Officer or for any other correspondence related to privacy, contact us at info@passportreader.app.

Changes to this DPA

We may update these Terms and Conditions from time to time and recommend periodic review.

Last updated 2026-03-25.