The personal data about the data subjects which the Data Controller authorises the Data Processor to process for the Purpose as described in section 1.1 and 1.2 of the DPA include, with reservation that this is not an exhaustive list as the categories of personal data and data subjects depends on the Data Controller's use of the Services, the following:

• Various contact information related to employees, customers or any other persons connected to the Customer’s business, which is not strictly necessary for Strise to process to be able to provide the Customer with the Services. This includes personal data such as names, email addresses and IP addresses, which are typically provided when an employee of the Customer registers as a user in Strise,

• Personal data included in user-generated notes and user generated ownership structures,

• Personal data included in additional services specifically requested by and agreed with the Customer, such as PEP-data, population register data, and other personal data used for unambiguous matching purposes, and

• Various usage data generated by the Customer’s users in connection with the Services.

The purpose of Strise’s processing of personal data on behalf of the Customer, is for the Customer’s users being able to use the Services, including any extra features available to the Customer, for its own defined purposes.

Customer's employees, users or any other persons connected to the Customer’s business.

Data collection, analysis, storage, and deletion after its purpose is served or retention period expires. Data is processed to assess potential risks and ensure compliance with regulatory standards.