What to find here
In this section, you will find important legal and compliance documents regarding our use of data in our communications and products, as well as our compliance with important topics.
For more information, please see our FAQ or contact Retriever’s DPO.
Privacy Policy
How we collect, use, and protect personal information.
Data Processing Agreement (DPA)
Retriever’s Data Processing Agreement, together with its accompanying exhibits (DPA Package), sets out the terms and conditions applicable when Retriever processes personal data on behalf of its customers. The full DPA package describes the processing activities, applicable data protection requirements, subprocessors, and other relevant GDPR obligations.
Version 2.0 | Publication date: 2026-09-01
Cookie Information
How and why cookies are used to collect and store information about your activity on our websites in Sweden, Denmark, Norway, Finland, and internationally.
Data Processing Agreement FAQ
Why does Retriever recommend using its standard DPA?
Retriever’s DPA has been developed specifically for Retriever’s services and the personal data processing involved in providing them.
Using the Retriever DPA helps ensure that the contractual terms reflect the actual services, processing activities, sub-processors and safeguards in place. It therefore provides a more accurate and efficient starting point than a general supplier template designed for many different types of services.
What are the benefits for customers of using Retriever's DPA package?
Customers receive a DPA package that is aligned with how Retriever actually delivers its services and protects personal data.
The DPA and its Exhibits bring together the relevant contractual and practical information in a single structure. This makes it easier for customers to understand and assess the processing and helps both parties focus on requirements that are genuinely relevant to the service.
Can customers request changes to Retriever's DPA?
Yes. Customers are welcome to raise specific legal, regulatory or organisational requirements that they believe are not adequately addressed.
We recommend first reviewing the complete Retriever DPA package and then identifying the specific provisions or requirements that need further consideration. This allows the parties to focus on the relevant issue rather than renegotiate matters already covered.
Why are the Exhibits important?
The DPA and its Exhibits constitute a single data protection package and should be reviewed together. The DPA sets out the legal framework and responsibilities, while the Exhibits provide more detailed information about the processing instructions, sub-processors, relevant transfer arrangements, and technical and organisational measures.
Reviewing the complete package, therefore, provides a clearer picture than reviewing the DPA alone.
Can reviewing Retriever's DPA package simplify legal and due diligence reviews?
Yes. Many of the questions commonly raised during privacy and customer due diligence are already addressed in the DPA and its Exhibits.
Reviewing the package first can reduce duplicate questions and help customers identify any areas where additional information is actually needed. This allows both parties to focus their time on relevant customer-specific requirements.
What should customers do if their internal requirements differ from Retriever's standard DPA?
Customers should identify the specific requirement or concern and raise it with Retriever.
Retriever can then assess it in the context of the relevant service, processing and existing safeguards. This helps distinguish requirements that are necessary for the customer’s particular circumstances from general supplier requirements that may already be addressed or may not be applicable to the service.
Why does Retriever assess customer-specific requirements individually?
Contractual privacy and security commitments need to reflect how the service is actually provided and how the relevant processing is performed.
Customer requirements can differ depending on industry, regulation and internal policies. Individual assessment helps ensure that any additional commitment is relevant, proportionate and capable of being implemented in practice.
This is particularly relevant because customer templates increasingly contain requirements developed for very different types of suppliers or highly critical IT outsourcing arrangements.
Why can extensive customer-specific requirements make the contracting process take longer?
Additional requirements may need legal, privacy, security, technical or operational review before Retriever can accept them.
Starting with the Retriever’s DPA package allows the parties to identify the points that genuinely require discussion, rather than reviewing an entirely separate set of requirements. This can make the contracting process more focused and efficient for both parties.
How can customers make the DPA review process more efficient?
We recommend starting with the complete Retriever DPA package, including all Exhibits.
Customers can then identify any specific requirements they believe are missing or require clarification and raise those points with Retriever. This helps avoid duplication and allows the review to focus on issues that are material to the customer’s use of the service.
How does Retriever keep its DPA package relevant over time?
Retriever regularly reviews its DPA package to ensure that it continues to reflect its services, processing arrangements and applicable data protection requirements.
When the DPA package is updated, customers will be informed of relevant changes in accordance with the DPA. An overview of the changes will also be made available so that customers can easily identify and assess what has been updated.
Making the current DPA package and information about updates available online does not replace or alter any contractual notification or objection rights. Where the DPA provides customers with a notification or objection period, that period and the applicable conditions will continue to be respected.
