Appendix 3 – Cybersecurity Incidents

Appendix to the Service Agreement for Callmaker, CM Software Callmaker AB, Reg. No. 556999-9971

Applies from 2026-10-09.

1. Introduction

1.1 This appendix governs our security commitments for the Service, how Cybersecurity Incidents are handled, the conditions under which we are liable for damage resulting from a Cybersecurity Incident, and the extent of that liability.

1.2 The appendix forms part of the Agreement and supplements the section “Liability and limitation of liability” in the Service Agreement. In matters governed by this appendix, the appendix takes precedence over the Service Agreement. The appendix applies without a separate signature when the Order is entered into.

1.3 The processing of personal data in connection with a Cybersecurity Incident is also governed by Appendix 1 – Data Processing Agreement, to the extent stated in sections 5.5 and 7.5.

2. Definitions

In addition to the definitions in the Service Agreement and Appendix 1 – Data Processing Agreement, the following apply in this appendix:

• Cybersecurity Incident – an event in which an unauthorised third party, through an attack on or intrusion into the Service or the infrastructure that we or our Sub-processors use to provide the Service, gains access to, alters, destroys, encrypts or disseminates Customer Data, or makes the Service or Customer Data unavailable. The following do not count as a Cybersecurity Incident: (i) downtime or operational disruption not caused by such an attack or intrusion, which is governed by the section “Liquidated damages for downtime” in the Service Agreement, (ii) events arising on the Customer Side under section 6, or (iii) planned maintenance.
• the Security Configuration – the four measures set out in section 4.1.
• Least Privilege – the principle of least necessary privilege under sections 4.1 d) and 4.2.
• the Customer Side – your and your Users’ devices, networks, accounts, login credentials, MFA factors, API keys, integrations and third-party systems, and the permissions and settings in the Service that you control.
• Compensable Damage – the costs set out in section 7.2.
• Fault on Our Part – that the Cybersecurity Incident was made possible by (i) a vulnerability in software that we develop or in the configuration of infrastructure that we control, (ii) our failure to install a security update, within thirty (30) days of it becoming available, in third-party software, including open-source components, that we use for the Service, (iii) a breach of our commitments under section 3, or (iv) negligence on the part of us or our staff. The exploitation of a vulnerability in third-party software before a security update has been available for thirty (30) days does not in itself constitute Fault on Our Part. Nor does a Cybersecurity Incident arising from a vulnerability, attack or deficiency in a Sub-processor’s or other subcontractor’s own platform or infrastructure constitute Fault on Our Part, even if it is due to negligence on the part of the Sub-processor or subcontractor, unless it was also made possible by a circumstance under (i)–(iii) or by negligence on the part of us or our staff.

3. Our security commitments

3.1 We shall take appropriate technical and organisational measures to protect the Service and Customer Data against Cybersecurity Incidents, taking into account the state of the art, the costs of implementation and the risks. The measures shall at least include encryption of Customer Data in transit and at rest, logging of access to Customer Data, logical separation between customers’ data, access control with multi-factor authentication for our staff with administrative access, ongoing security updating of systems, and backups at least daily with storage separate from the production environment.

3.2 At least once a year, we have an independent vulnerability assessment of the Service carried out and remedy identified vulnerabilities in order of priority according to severity.

3.3 We provide the functions required for the Security Configuration as part of the Service at no additional fee.

3.4 We are entitled to update the measures under this section provided that the level of security is not reduced.

4. The Security Configuration – a condition for our liability

4.1 Our liability under section 7 requires that you have expressly ordered all of the following measures in the Order, that they were enabled and applied for all your Users and integrations at the time of the Cybersecurity Incident, and that the intrusion cannot be attributed to a time when any of the measures was not enabled:

• a) mandatory multi-factor authentication (MFA policy) for all Users when logging in to the Service, without exceptions for individual Users or roles;
• b) IP restriction (IP lock) for access to the Service, so that login is only permitted from the IP addresses or IP ranges you have specified;
• c) IP restriction (IP lock) and authentication for all integrations with the Service, meaning that (i) each integration that connects to the Service, such as API reading, API writing, automated file import and lead ingestion, is only permitted from the IP addresses or IP ranges you have specified, (ii) each integration is authenticated with its own access credentials that are unique to the integration and are not shared between integrations, Users or systems, and (iii) outbound data flows initiated by the Service, such as webhooks and automated file export, are only sent to recipients that require authentication and receive data over an encrypted connection. Export and import carried out by a logged-in User in the Service are covered by points b) and d), not by this point; and
• d) Least Privilege, meaning that you have actively, and in a documented manner, limited each User’s permissions to (i) the workflows – campaigns, projects, lists and data sets – that the User needs for their work tasks (workflow scope), and (ii) the functions – such as export, import, administration, access to recordings and reporting – that the User needs for their work tasks (function scope).

4.2 Least Privilege under section 4.1 d) is deemed to be met only if you can show that

• (i) you have a written permission model for the Service that specifies which roles exist and which workflows and functions each role has access to;
• (ii) administrator rights are limited to named persons with a documented need and to no more than twenty (20) per cent of the Users, rounded up to the nearest whole number, but you may always have two (2) Administrators;
• (iii) the permissions have been reviewed, and permissions without a current need removed, at least every six (6) months and when work tasks change;
• (iv) User accounts for persons who have left your organisation or their assignment have been deactivated within five (5) Working Days; and
• (v) there are no joint or shared User accounts.

4.3 You bear the burden of proving that the Security Configuration was met. Our logs and settings in the Service constitute, in the absence of evidence to the contrary, sufficient evidence of what was enabled at a given time.

4.4 If you, temporarily or permanently, request or yourselves cause any part of the Security Configuration to be disabled, exempted or weakened – for example an MFA exemption for a User, the addition of an open IP range or permissions beyond what is needed – our liability under section 7 lapses for Cybersecurity Incidents occurring while the deviation persists, and for incidents made possible by the deviation even if it has later been reversed.

4.5 The Security Configuration can be ordered in the Order or by a later written addendum to the Order. Our liability under section 7 applies only to Cybersecurity Incidents occurring after all four measures have been enabled.

5. Handling of Cybersecurity Incidents

5.1 We shall notify you in writing of a Cybersecurity Incident that affects or is likely to affect your Customer Data or your use of the Service without undue delay, and no later than forty-eight (48) hours after the incident came to our attention, to the contact details you stated in the Order or have subsequently notified to us in writing. The notification shall, where applicable, contain the information set out in Appendix 1, section 4.2.3. Information that is not available at the time of notification may be provided in phases.

5.2 We shall, without undue delay, take measures to contain, stop and remedy the incident, including restoring Customer Data from backup where possible.

5.3 Within thirty (30) days of the incident being remedied, we shall, at your request, provide a written incident report setting out the cause or, if the cause could not be determined, the investigative measures taken, as well as the impact, the measures taken and the measures to prevent recurrence. We may omit information that would increase the risks to the Service or that concerns other customers.

5.4 You shall notify us immediately if you discover or suspect unauthorised access to your User accounts, API keys or Customer Data, and cooperate with us in the investigation, including by providing information about the Customer Side.

5.5 If the incident also constitutes a Personal Data Breach, Appendix 1, section 4.2, also applies. A notification under section 5.1 also fulfils the notification obligation under Appendix 1, section 4.2.1, if it contains the information prescribed there.

5.6 We are entitled, without prior notice, to suspend Users, integrations, API keys or IP addresses where necessary to contain an ongoing or suspected Cybersecurity Incident. Such suspension does not constitute downtime under the section “Liquidated damages for downtime” in the Service Agreement and does not give rise to any right to compensation.

6. The Customer Side and exclusions

6.1 You are responsible for the Customer Side. We are not liable for damage resulting from a Cybersecurity Incident that arises wholly or partly from

• a) login credentials, MFA factors, API keys or sessions belonging to you or your Users having been disclosed, shared, stolen or obtained through phishing or social engineering;
• b) malicious code, intrusions or vulnerabilities on the Customer Side;
• c) you, your Users or anyone authorised by you having acted in breach of the Agreement or our written security instructions;
• d) third-party systems or integrations that you have chosen, configured or connected, including their handling of data exported from the Service;
• e) your failure to take, without delay, protective measures that we have recommended following a notification under section 5; or
• f) your failure to notify us under section 5.4.

6.2 Customer Data exported from the Service is not covered by this appendix after the export.

7. Liability

7.1 We compensate you for Compensable Damage resulting from a Cybersecurity Incident made possible by Fault on Our Part, provided that the Security Configuration was met under section 4, and subject to the limitations set out below. If it cannot be established that the Cybersecurity Incident was made possible by Fault on Our Part, no compensation is payable under this section.

7.2 Compensable Damage means your documented, reasonable and necessary direct costs of

• a) technical investigation (forensic analysis) of the incident;
• b) restoring or recreating Customer Data that has been lost or corrupted, to the extent it could not be restored by us under section 5.2, notwithstanding that loss of data is stated as indirect damage in the Service Agreement;
• c) notifications to Data Subjects or authorities that you are required by law to make as a result of the incident; and
• d) changing passwords, keys and access credentials that have been affected.

Compensable Damage does not include other indirect or consequential damage under the Service Agreement’s section “Liability and limitation of liability”, ransom payments, administrative fines or penalties imposed on you, third-party claims beyond what is stated in c), damage to reputation or goodwill, or the costs of your own staff.

7.3 Our liability for each individual Cybersecurity Incident is limited to one (1) price base amount under Chapter 2, Section 7 of the Swedish Social Insurance Code, calculated for the year in which the incident occurred. Cybersecurity Incidents that have the same or related causes constitute one (1) incident, which shall be deemed to have occurred at the time of the first of them. Amounts payable under this appendix are counted against the shared cap under the Service Agreement’s section “Liability and limitation of liability” and Appendix 1, section 7.2, and our aggregate liability for all Cybersecurity Incidents can never exceed that cap.

7.4 This appendix exhaustively governs our liability for damage resulting from Cybersecurity Incidents. If the Security Configuration was not met under section 4, or if it cannot be established that the Cybersecurity Incident was made possible by Fault on Our Part, you are not entitled to compensation for such damage under the Agreement, except for recourse claims under Appendix 1, section 7.3. The right to liquidated damages for downtime under the Service Agreement is not affected, but liquidated damages paid are counted against the cap for that incident under section 7.3 to the extent the downtime was caused by the Cybersecurity Incident.

7.5 The limitations of and conditions for our liability in this appendix, including section 4 and section 7.4, do not apply to damage caused intentionally or through gross negligence, nor to liability that cannot be limited under mandatory law. Appendix 1, sections 7.3 and 7.4, apply unchanged. Recourse claims under Appendix 1, section 7.3, are subject to the limitation of liability in Appendix 1, section 7.2, not to the cap under section 7.3 of this appendix, and require neither that the Security Configuration was met nor that there is Fault on Our Part. Amounts paid as such recourse claims are counted against the shared cap.

7.6 Claims for compensation shall be made in writing without undue delay, and no later than three (3) months after the damage was discovered or should have been discovered. Claims made later are forfeited. On request, you shall provide documentation substantiating the costs.

8. Indemnity, precedence and survival

8.1 You shall indemnify us against third-party claims arising from a Cybersecurity Incident caused by a circumstance on the Customer Side, in accordance with the Service Agreement’s section “The customer’s indemnity”.

8.2 This appendix takes precedence over the Service Agreement in the matters it governs.

8.3 This appendix continues to apply after the termination of the Agreement for as long as we store Customer Data under Appendix 2 – Data Portability, but no longer than until the Customer Data has been deleted under Appendix 2, section 9. Section 7 also continues to apply to Cybersecurity Incidents that occurred before then.

9. Amendments

9.1 Amendments to this appendix are made in accordance with the section “Amendments to the Agreement” in the Service Agreement.

9.2 The measures under section 3 may be updated on an ongoing basis without this constituting an amendment to the Agreement, provided that the level of security is not reduced.

10. Contact

Notifications of suspected unauthorised access under section 5.4 and questions about this appendix can be sent to info@callmaker.se or made by phone on +46 31 313 22 00.