How OKQ Solutions AB handles your data

Operation Knowledge Quantum Solutions, trading as OKQ Solutions AB, Org. No. 559600-6881, with its registered office at Bäckvägen 23, 93252 Bureå, Sweden ("OKQ Solutions AB," "we," "us," or "our"), builds AI-assisted operational intelligence software for regulated, process-driven industries. Our Services connect operational knowledge management, standard work and documentation, workforce learning and competency development, troubleshooting and root-cause support, and standards and compliance governance.

The Services include OKQ Core™, OKQ Flow™, OKQ Academy™, OKQ Insight™, OKQ Resolve™, OKQ Guard™, and the Operational Maturity Assessment™ (OMAT), including QuickScan™ and Deep Diagnostic™.

This Privacy Policy (the "Policy") describes how OKQ Solutions AB collects, uses, shares, and otherwise processes personal data belonging to subscribers, their administrators and end users, and visitors ("you" or "your") to our website, platform, and services (together, the "Services").

Please read this Policy alongside our Terms of Service and where you are a company the Data Processing Agreement (the "DPA") and its accompanying sub-processor list (the "Sub Processor List") concluded between OKQ Solutions AB and the Subscriber under Section 10 of the Terms of Service. Further detail is available on our Security Page.

By using our Services, you acknowledge this Policy. Our legal basis for processing may be contract performance, legitimate interests, or legal obligations, as explained in Section 3. If there is any conflict between this Policy and a signed DPA, the DPA prevails for personal data processed on the Subscriber's behalf. If you do not agree with this Policy, please stop using our Services. Existing Subscribers with contractual commitments should contact us to discuss the applicable terms.

1.1 Our Roles Under Data Protection Law

Controller processing. OKQ Solutions AB acts as a controller (within the meaning of Article 4(7) GDPR) where we determine the purposes and means of processing, including to: (i) manage Subscriber accounts and authenticate users; (ii) handle billing and financial administration; (iii) secure the Services and detect, prevent, and investigate fraud, abuse, and security incidents; (iv) meet our legal and regulatory obligations; (v) carry out business-to-business marketing and communications with business contacts; (vi) produce service analytics from aggregated or de-identified data; and (vii) develop, train, and improve our AI and machine learning models, solely as described in Section 5.2 and subject to the limits set out there.

Processor processing. OKQ Solutions AB acts as a processor (within the meaning of Article 4(8) GDPR) where we process personal data on a Subscriber's behalf, following the Subscriber's documented instructions, in connection with the Subscriber's use of the Services. If this Policy and the DPA conflict in respect of processing carried out in this capacity, the DPA prevails.

Independent controller activities. Even where OKQ Solutions principally acts as a processor for a Subscriber, it acts as an independent controller in relation to: (a) security monitoring, fraud and abuse prevention, and the integrity and availability of the Services; and (b) compliance with its own legal and regulatory obligations, including responding to lawful requests from competent authorities.

Enterprise Subscribers. Where the Subscriber is a legal entity, the Subscriber is the controller for the personal data of its administrators and end users processed through the Services on its instructions. End users should raise questions or requests about such processing with their own organisation.

Individual users. Where you sign up for the Services as an individual rather than through an enterprise Subscriber, OKQ Solutions AB is the sole controller for your personal data, and you may exercise your rights directly with us as described in Section 8.

No joint controllership. OKQ Solutions AB and the Subscriber are not joint controllers within the meaning of Article 26 GDPR for processing carried out under or in connection with this Policy and the DPA.

Sub-processors. Where OKQ Solutions AB acts as a processor, it engages sub-processors in line with Article 28(2) and (4) GDPR and the DPA.

1.2 Definitions

• "Affiliate" means any entity that, directly or indirectly, controls, is controlled by, or is under common control with OKQ Solutions.
• "Cookies" means small text files or similar technologies stored on your device when you interact with the Services, as further described in Section 2.4.
• "Input" means any data, documents, prompts, files, workforce records, competency data, assessment responses, troubleshooting records, or other content that you, your administrators, or your end users upload, submit, or otherwise supply to the Services.
• "Output" means any content, results, analyses, simulations, reports, recommendations, or other material that the Services generate in response to Input.
• "Sub Processor List" means the list of authorised sub-processors that OKQ Solutions AB maintains, as updated from time to time, including each sub-processor's name, location, and processing purpose.
• "Subscriber" means the legal entity or individual that has entered into a Terms of Service or subscription agreement with OKQ Solutions AB for the use of the Services.
• "Trial Period" has the meaning given in the Terms of Service namely, the period during which a user evaluates the Services before activating a paid subscription plan.

2.1 Definition of Personal Data

For this Policy, "personal data" means any information relating to an identified or identifiable natural person, as defined under the EU General Data Protection Regulation (GDPR), the Swedish Data Protection Act (lagen (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning), and any other applicable data protection legislation. Examples include names, business email addresses, IP addresses, device identifiers, authentication tokens, and usage logs.

OKQ Solutions AB does not require you to submit special categories of personal data (such as health information, biometric data, or data revealing racial or ethnic origin) to use its Services.

However, because the Services support regulated, process-driven industries, users may choose to upload Input containing special category data (for example, health-related fitness-to-work information in workforce records), provided they have established an appropriate legal basis under GDPR Articles 6 and 9 (or equivalent provisions of applicable law) and, where relevant, have obtained any explicit consent required from the data subjects concerned. Subscribers and users remain responsible for ensuring that any special category data they upload is lawfully collected and that processing it through the Services is compatible with the legal basis on which it was originally obtained.

2.2 Information You Provide Directly

When you create an account, subscribe to a plan, raise a support ticket, or otherwise engage with our Services, you may provide personal data such as:

• Name, job title, and business email address;
• Phone number;
• Industry, product interest, and company information;
• Invite codes or licence keys used to access the Services;
• Company name, company registration number, and billing address;
• Payment information (handled by our third-party payment processor identified in the Sub Processor List; OKQ Solutions AB does not store full payment card details);
• Input including data, documents, prompts, uploaded documentation, SOPs, work instructions, training and qualification records, competency assessment data, troubleshooting and incident records, OMAT questionnaire responses, and other content uploaded to or submitted through the Services; and
• Communications with our support team, feedback, and correspondence.

2.3 Information Collected Automatically

When you use the Services, we automatically collect technical and usage data, including:

• IP address and approximate (region-level) geographic location;
• Browser type and version and operating system;
• Device identifiers and session identifiers;
• Pages and features accessed within the Services, timestamps, and duration of use;
• Session recordings, cursor movements, and clicks;
• Error logs and debugging codes; and
• Referral source and interactions with our website.

2.4 Cookies and Similar Technologies

OKQ Solutions uses only a minimal set of cookies that are strictly necessary to operate and secure the Services. We do not use tracking cookies, third-party advertising cookies, or cross-site tracking technologies. We use the following categories of Cookies:

• Strictly Necessary Cookies: Support core functions such as sign-in, session management, fraud prevention, and storing consent. This includes payment-processing cookies set by our payment provider (identified in the Sub Processor List) to prevent fraud and secure transactions, which are required for payment functionality to work. These cookies do not require consent.
• Functional Cookies: Remember your preferences (for example, language or theme).

2.5 Children's Data

The Services are not intended for anyone under the age of eighteen (18). We do not knowingly collect personal data from anyone under that age. By using the Services, you represent that you are at least 18 years old, or the age of majority in your jurisdiction. If we learn that we have collected personal data from a minor without appropriate consent, we will delete that information promptly.

OKQ Solutions AB processes personal data only where a valid legal ground exists under applicable data protection legislation, including the GDPR, the Swedish Data Protection Act, and any privacy laws applicable in the jurisdictions where our Subscribers operate.

3.1 Legal Bases We Rely On

• Performance of a Contract: We process personal data to provide, maintain, and support the Services you have requested under our Terms of Service or another agreement, including account administration, billing, and customer support.
• Legitimate Interests: We process personal data to secure the platform, detect fraud, produce aggregate analytics, and improve our Services and AI features, where these interests are not overridden by your data protection rights.
• Consent: Where relevant, we rely on your opt-in consent for non-essential Cookies, marketing communications, and any other processing that requires consent under applicable law. You may withdraw consent at any time.
• Special Categories of Personal Data: OKQ Solutions AB's Services are not specifically designed to process special categories of personal data within the meaning of GDPR Article 9(1). Users may nevertheless upload such data where they have established a valid condition for processing under GDPR Article 9(2). Subscribers and users are solely responsible for identifying and maintaining the applicable Article 9(2) condition.
• Legal Obligations: We retain and disclose personal data as needed to meet applicable legal obligations, including bookkeeping requirements under Swedish law, export-control and sanctions regulations, court orders, and other legal duties.
• Protection of Vital Interests: In rare cases, we may process personal data to protect an individual's vital interests, for example to prevent serious harm.

We process personal data for the purposes below:

• Service Delivery and Support: Providing, running, and maintaining the Services, including processing Input, generating Output, managing accounts, and offering customer support.
• Service Integrity and Security: Maintaining the security and integrity of the Services and detecting and preventing fraud, abuse, or unauthorised access.
• Service Improvement and Research: Analysing usage data and platform performance to improve functionality, reliability, and user experience. Where feasible, we perform this analysis on de-identified or aggregated data.
• AI Model Development: As described in Section 5.2 and subject to the applicable agreement, using Input and Output to develop, train, and improve OKQ Solutions AB's AI and machine learning models. This purpose applies only to users during the Trial Period and not to Subscribers who have activated a paid subscription plan.
• Billing and Payments: Handling subscription fees, invoicing, and related financial transactions.
• Communications: Sending transactional or administrative communications (for example, account alerts, security notifications, and billing messages) and, where you have opted in, product updates and marketing communications.
• Legal and Regulatory Compliance: Meeting applicable laws, regulations, and legal processes in Sweden, the EEA, and other relevant jurisdictions.
• Auditing and Corporate Governance: Carrying out audits, accounting, reporting, and corporate-governance activities.

OKQ Solutions AB does not carry out automated individual decision-making that produces legal or similarly significant effects (GDPR Article 22).

5.1 How OKQ Uses AI

The Services use AI-assisted features to process Subscriber Input and generate Output, including drafting or restructuring work instructions and SOPs, generating learning content, scoring competency assessments, suggesting root-cause and troubleshooting pathways, assisting standards-alignment review, and calculating OMAT maturity scores. AI-generated Output may contain errors or inaccuracies, and the Subscriber is responsible for evaluating Output as appropriate for its use case, including through human review.

5.2 Use of Input and Output for AI Training

Whether OKQ Solutions uses Input and Output for AI model training depends on your subscription tier. For Trial Period users, OKQ Solutions AB may use Input and Output to develop, train, improve, and operate its AI and machine learning models after the trial period ends. For Subscribers who have activated a paid subscription plan, OKQ Solutions AB does not use Input or Output for AI model training. For all users, OKQ Solutions AB may use aggregated, anonymised application usage data (including, but not limited to, application performance logs, errors, failures, and user-filed bug reports) to improve the user experience and the performance of later product updates.

Where Input used for AI training contains personal data, OKQ Solutions AB will process it in accordance with applicable data protection laws and, where applicable, the DPA. Free-tier users who wish to opt out of AI model training may contact us at support@okqsolutions.com. Where such processing relies on legitimate interest (GDPR Article 6(1)(f)), you also have the right to object under GDPR Article 21.

5.3 Third-Party AI Providers

The Services may send Input to third-party AI providers for processing and to generate responses. When this happens, the data is processed in accordance with our agreements with those providers, which include appropriate data protection terms. OKQ Solutions AB maintains data processing agreements with all third-party AI providers.

6.1 Categories of Recipients

We may share personal data with the following categories of recipient:

• OKQ Solutions AB Personnel: Employees, contractors, and consultants who need access to perform their duties and who are bound by confidentiality obligations.
• Affiliates: OKQ Solutions AB's parent company and affiliated entities, for providing and supporting the Services.
• Sub-Processors: Third-party service providers that process personal data on our behalf to support the Services, such as cloud infrastructure providers, AI model providers, payment processors, analytics providers, and customer-support tools.
• Professional Advisors: Legal counsel, auditors, and consultants, subject to professional confidentiality obligations.
• Authorities: Regulatory authorities, courts, or law-enforcement agencies, where required by law or to protect our legal rights.

6.2 Sub-Processor Management

All sub-processors are bound by contractual obligations equivalent to those in our DPA, ensuring compliance with applicable data protection laws. A current list of authorised sub-processors (the "Sub Processor List") is maintained and kept up to date and records each engagement before that sub-processor is given access to personal data.

We notify Subscribers who have entered into a DPA with OKQ Solutions of sub-processor changes, giving them a reasonable period to object as set out in the DPA. If a Subscriber objects to a new sub-processor and the objection cannot be resolved, the Subscriber may terminate the affected Services in accordance with the DPA.

6.3 No Sale of Personal Data

OKQ Solutions AB does not sell personal data and does not share personal data for cross-context behavioural advertising.

OKQ Solutions AB's primary data processing occurs within the European Economic Area (EEA). Some of our sub-processors, or their infrastructure, may nonetheless sit outside the EEA. Where Personal Data is transferred to a country not deemed to offer an adequate level of data protection, we rely on appropriate safeguards under Applicable Data Protection Law, including (as applicable) the EU Standard Contractual Clauses (Modules 2 and 3 under Commission Implementing Decision (EU) 2021/914), the UK International Data Transfer Addendum, the Swiss Addendum to the SCCs, and/or the EU–US Data Privacy Framework. To request a copy of the safeguards that apply to a specific transfer, contact support@okqsolutions.com.

Depending on your location and applicable law, you may have the following rights over your personal data:

• Right of Access: Request a copy of the personal data we hold about you, along with information about how it is processed.
• Right to Rectification: Ask us to correct inaccurate or incomplete personal data.
• Right to Erasure: Ask us to delete your personal data, subject to legal and contractual exceptions.
• Right to Restriction: Ask us to restrict the processing of your personal data in certain circumstances.
• Right to Data Portability: Receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: Object to processing based on legitimate interests, or to direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of earlier processing.
• Right to Lodge a Complaint: Lodge a complaint with the competent data protection authority in your jurisdiction.

To exercise your rights, contact us using the details in Section 13. We will respond to verified requests within thirty (30) days, or longer where applicable law permits in which case we will tell you of the delay and the reason.

If you are an end user of a Subscriber's account, please direct data subject requests to your organisation (the Subscriber), since it is the data controller for the personal data processed through the Services on its behalf.

OKQ Solutions AB is committed to protecting personal data through appropriate technical and organisational security measures, including:

• Encryption in Transit: All traffic between your browser or client application and our servers is protected by industry-standard encryption (TLS 1.2 or higher).
• Encryption at Rest: Data held in our databases and storage systems is encrypted using strong encryption standards with secure key management.
• Access Controls: Role-based access controls, multi-factor authentication for administrative access, and regular access reviews, so that only authorised personnel can access personal data.
• System Resilience: Regular backups with defined recovery objectives to minimise downtime and data loss.
• Security Monitoring: Logging and monitoring of access to systems holding personal data, with security logs retained in line with applicable requirements.
• Incident Response: We maintain an incident-response process and will notify affected Subscribers without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, consistent with Article 33 GDPR.
• Staff Oversight: All employees and contractors with access to personal data are bound by confidentiality obligations and receive security-awareness training.
• Vendor Oversight: Sub-processors are vetted and contractually required to maintain equivalent security protections.

Although we implement commercially reasonable safeguards, no method of transmission or storage is entirely secure. We cannot guarantee absolute security and disclaim liability for security incidents caused by third-party providers or by events beyond our reasonable control.

Please keep your account credentials confidential and enable multi-factor authentication where it is available.

We keep personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law. The following general retention periods apply:

• Account and contact data: Duration of the Subscriber relationship plus 3 years after termination.
• Billing and payment records: Seven (7) years from the end of the relevant financial year.
• Input and Output (as processor): As instructed by the Subscriber, or on termination per the DPA (default: deleted within 30 days of termination).
• Automatically collected data (log data): 90 days, unless required by law or for security investigations.
• Cookie data: Deleted at the end of the browser session (session cookies) or within twelve (12) months (functional preference cookies).
• Support and communication records: 3 years after resolution.
• Marketing consent records: Duration of consent plus 3 years for compliance documentation.

When an account is terminated or expires, we will delete personal data processed in our capacity as data processor within the timeframe set out in the DPA, except for data needed for legal compliance, fraud prevention, or legal defence. Backups may hold data for a limited additional period before permanent deletion. We may keep personal data in anonymised and aggregated form indefinitely for analytics and service-improvement purposes.

OKQ Solutions AB may investigate and disclose personal data, where the law permits, if we believe in good faith that doing so is:

• Necessary to comply with a valid legal process or government request (for example, a subpoena, court order, or law-enforcement demand). Unless legally barred, we will notify the affected Subscriber before producing data, consistent with our DPA obligations.
• Necessary to detect, prevent, or investigate fraud, security incidents, or other wrongdoing connected with the Services.
• Necessary to protect the rights, reputation, or property of OKQ Solutions, our users, Affiliates, or the public.

Any disclosure will comply with applicable data protection laws and be limited to what is strictly necessary.

This Policy is governed by the substantive law of Sweden. Any dispute, controversy, or claim arising out of or in connection with this Policy or its breach, termination, or invalidity is subject to the exclusive jurisdiction of the courts of Stockholm, Sweden, with the Stockholm District Court (Stockholms tingsrätt) as the court of first instance. Nothing in this clause limits any mandatory right you may have to bring proceedings before a court in your country of residence under applicable consumer or data protection law.

If you are located in the EEA, UK, or Switzerland, you have the right to lodge a complaint with your local supervisory authority including the Swedish Authority for Privacy Protection (IMY), the relevant EEA supervisory authority, the UK Information Commissioner's Office (ICO), or the Swiss FDPIC.

If you have questions or concerns, or wish to exercise your data protection rights, please contact us:

• Email: support@okqsolutions.com
• Data Protection Officer / Privacy Lead: contact support@okqsolutions.com
• Postal address: OKQ Solutions AB, Attn: Privacy, Bäckvägen 23, 93252 Bureå, Sweden

We aim to respond to verified data-subject requests within thirty (30) days, or longer where applicable law permits, in which case we will inform you of the delay and the reason.

The Services may include links to, or integrations with, third-party services that OKQ Solutions AB does not control. Your dealings with those third-party services are governed by their own privacy policies and terms. We encourage you to review those policies before providing any personal data. OKQ Solutions AB is not responsible for the privacy or security practices of external services.

By using the Services, you consent to receive transactional and administrative electronic communications from OKQ Solutions, such as account alerts, security notifications, and billing messages. To send formal privacy notices to OKQ Solutions, please use the contact details in Section 13. OKQ Solutions AB may give you legal or privacy notices by email, through in-product notifications, or by any other method permitted by law.

OKQ Solutions AB may update or revise this Policy to reflect changes in our practices, legal requirements, or the Services. We will post any revised Policy at the URL shown at the top of this document and update the "Last Updated" date. For material changes that reduce your rights or broaden our processing purposes, we will give at least thirty (30) days' advance notice by email or in-product notification. Continuing to use the Services after the new Policy takes effect constitutes acceptance of the revised terms.

17.1 European Economic Area, UK, and Switzerland

• We process personal data in accordance with the GDPR, the UK GDPR, and the revised Swiss FADP, respectively.
• International transfers are safeguarded as described in Section 7.
• You have the right to lodge a complaint with your local supervisory authority.

17.2 United States

• OKQ Solutions AB does not sell personal data as defined under the CCPA/CPRA or similar US state privacy laws.
• OKQ Solutions AB does not use or share personal data for cross-context behavioural advertising.
• You may exercise applicable rights (access, deletion, correction, opt-out) by contacting us as described in Section 13.

17.3 Other Jurisdictions

OKQ Solutions makes the Services available to Subscribers and users in jurisdictions beyond the EEA, UK, Switzerland, and the United States. Where mandatory local data protection or privacy requirements apply to our processing of your personal data in such a jurisdiction, we will comply with those requirements to the extent the law requires. If this Policy conflicts with mandatory local law, the mandatory local law prevails to the extent of the conflict.

18.1 Severability

If any provision of this Policy is found to be unlawful, void, or unenforceable, it will be interpreted to give effect to its intent as closely as possible, or else treated as severed, and the remaining provisions will stay in full force and effect.

18.2 Entire Agreement

This Policy, together with the Terms of Service and the DPA, forms the entire agreement between you and OKQ Solutions regarding privacy and data protection in connection with the Services. In the event of a conflict, the DPA prevails for personal data processed on the Subscriber's behalf, followed by this Privacy Policy, and then the Terms of Service.