1.1. These general terms and conditions of Indirect Purchases (the "GTC") apply to all transactions between Mölnlycke Health Care AB (registered in Sweden, company reg. No. 556547-5489), including any Mölnlycke Affiliate (“Mölnlycke”) and Mölnlycke’s contractual counterpart (the "Supplier"). To the extent any separately negotiated written agreement between Mölnlycke and Supplier covers the same subject matter, such agreement shall prevail over these GTC.

1.2. By accepting a Mölnlycke order, Supplier is deemed to accept these GTC. Mölnlycke may amend these GTC at any time, provided it gives Supplier reasonable prior written notice of material amendments. Amendments do not apply to orders placed and confirmed before the amendment date.

1.3. Supplier’s deviating, conflicting, or supplementary general terms and conditions shall not apply, even if received or acknowledged by Mölnlycke, unless Mölnlycke expressly accepts them in writing. Mölnlycke’s placement of an order does not constitute acceptance of Supplier’s terms. 

2.1. “Agreement Number” means the unique reference number assigned to an order, being the purchase order number issued by Mölnlycke.

2.2. “Indirect Purchases” means purchases of Products that are not directly incorporated into Mölnlycke’s products, including but not limited to IT equipment and services, machinery, facilities management, consultancy, office supplies, and professional services, but excluding raw materials, components, and other items directly used in the manufacture of Mölnlycke’s products.

2.3. “Mölnlycke Affiliate” means any entity, directly or indirectly, controlling, controlled by, or under common control with Mölnlycke Health Care, where “control” means holding fifty per cent (50%) or more of the voting rights or otherwise having the power to direct its affairs or the composition of its board of directors or equivalent body.

2.4. "Products" means all products, goods, or services to be supplied, delivered, or provided by Supplier to Mölnlycke or any person or entity designated by Mölnlycke.

2.5. "Party" means either Mölnlycke or Supplier, "Parties" means both. 

2.6. “Privacy Laws” means any applicable data protection and/or privacy related laws, statutes, directives, or regulations (and any amendments or successors thereto) to which Supplier or Mölnlycke is subject in respect of the Products (including the EU General Data Protection Regulation 2016/679 (“GDPR”) as may be amended or superseded).

2.7. “Trade Sanctions Laws” shall mean any economic or financial sanctions laws, regulations or trade embargoes imposed, administered, or enforced from time to time by applicable governments, governmental institutions or agencies such as (i) the European Union (or any of its member states or successor states), (ii) the United Kingdom, (iii) the United States of America, or (iv) the United Nations.

3.1. Orders, and any changes or additions to them, are valid if issued in writing by Mölnlycke, including by email or through an electronic system authorised by Mölnlycke.

3.2. Mölnlycke may cancel an order free of charge if Supplier does not confirm it in writing to Mölnlycke in unmodified form within five (5) working days of receipt.

3.3. All offers submitted to Mölnlycke by Supplier are binding. Cost estimates submitted to Mölnlycke by Supplier are provided in good faith and shall be provided free of charge.

3.4. An offer by Supplier is irrevocable for the period specified in the offer, or, if no period is specified, for thirty (30) days. 

3.5. No Agreement arises between the Parties unless (i) Mölnlycke has placed a written order that Supplier has confirmed within the applicable time, or (ii) Supplier has not confirmed the order within the applicable time but proceeds to deliver the Products or commence performance, in which case the Agreement is formed upon such delivery or commencement of performance. Upon formation, the order together with these GTC, constitutes the “Agreement”, which supersedes all prior written and oral communications regarding that order.

4.1. Prices are fixed unless the Parties have expressly agreed otherwise in writing. Unless otherwise agreed in writing, prices include all costs for which Supplier is responsible under the Incoterm applicable to the relevant order, whether the Incoterm specified in section 6.1 or another Incoterm agreed between the Parties. Additional costs not expressly agreed in writing in advance are not chargeable.

4.2. All agreed prices are exclusive of VAT and all other applicable taxes, duties, and surcharges.

4.3. Products shall be invoiced upon delivery or supply, unless otherwise agreed in writing. 

4.4. Invoices must clearly set out at a minimum: (i) contact person at Mölnlycke, (ii) unique invoice number, (iii) invoice date, (iv) Supplier’s address, registration number, and VAT number, (v) Supplier’s complete IBAN bank account details, (vi) the Agreement Number, (vii) description and quantity of Products supplied, and (viii) net amount, VAT rate, VAT amount, and gross amount.

4.5. Payment is due within sixty (60) days of receipt of a valid invoice, unless otherwise agreed in writing. Payment does not waive any of Mölnlycke’s rights and does not constitute acceptance of the Products. 

4.6. Mölnlycke may suspend payment of the disputed portion of an invoice if it has reasonable grounds to believe the Products do not comply with sections 7.1 or 7.2, if there is a material breach of the Agreement by Supplier, or if it has reasonable grounds to doubt the accuracy of the invoice. Mölnlycke shall promptly notify Supplier of any suspension and the reasons for it.

4.7. Mölnlycke’s suspension of payment, under section 4.6, does not entitle Supplier to suspend or terminate performance of its contractual obligations.

4.8. Supplier may not set off counter-claims against Mölnlycke's claims, unless (i) the counter-claim has been expressly accepted by Mölnlycke in writing or (ii) it has been finally determined by a competent court. Supplier may not withhold delivery or exercise any right of retention on account of any claim or alleged breach by Mölnlycke.

5.1. Supplier warrants that the Products, including any software, documentation, and deliverables and their use by Mölnlycke, will not infringe any third-party intellectual or industrial property rights.

5.2. To the extent the Products or their use are subject to any intellectual or industrial property rights of Supplier or third parties, Supplier grants to Mölnlycke a non-exclusive, worldwide, perpetual, royalty-free license (with the right to sublicense to its affiliates and contractors) to use, operate, maintain, modify and integrate the Products for its business purposes. 

5.3. Each Party shall retain ownership of all intellectual or industrial property rights owned by it prior to the commencement of the Agreement or developed independently of the Agreement ("Background IP").

5.4. To the extent any intellectual or industrial property rights are created specifically for Mölnlycke under this Agreement ("Foreground IP"):

a) such rights shall vest in Mölnlycke; and
b) to the extent such rights do not automatically vest, Supplier hereby assigns such rights to Mölnlycke.

5.5. To the extent any Supplier Background IP or generic know-how is incorporated into the Foreground IP or is necessary for Mölnlycke to use the Products, Supplier grants Mölnlycke a license in accordance with section 5.2.

5.6. Supplier is prohibited, whether or not with the engagement of third parties, from copying, disclosing or exploiting products for which Mölnlycke holds the intellectual or industrial property rights. 

5.7. Supplier shall indemnify and defend Mölnlycke against any third-party claim arising from or connected with any infringement of the said rights and shall compensate Mölnlycke for all losses, damages and costs incurred.

5.8. In the event of such claim, Supplier shall, at its own expense and without prejudice to Mölnlycke’s rights:

a) procure the right for Mölnlycke to continue using the Products;
b) replace or modify the Products so that they become non-infringing; or
c) if neither (a) nor (b) is possible, refund all amounts paid and compensate Mölnlycke for any resulting losses.

6.1. Unless otherwise agreed in writing, Products that constitute goods shall be delivered DAP (Incoterms 2020) to the agreed destination, within the agreed delivery period. To the extent Products constitute services, Supplier shall perform and complete such services at the agreed location, and within the agreed timeframe, in accordance with the Agreement.

6.2. To the extent Products constitute goods, Supplier shall ensure such Products are properly packed, and where relevant in accordance with Mölnlycke’s instructions or specifications. Packaging must not be environmentally hazardous or suspected to be so, according to provisions of law or current science, or in any other way be a threat to health, safety or welfare. Each delivery must include a packing list stating the quantity and nature of the Products, the Agreement Number, the Mölnlycke contact person and the delivery address. Mölnlycke may refuse Products delivered without a packing list without liability for the purchase price or other compensation.

6.3. Products must be delivered, or where they constitute services, provided with all documentation, manuals, licences, certifications, and other materials reasonably necessary for their intended use, even if not specifically listed in the Agreement.

6.4. Supplier must immediately notify Mölnlycke in writing if it knows or suspects any delay to delivery, stating the reason; anticipated duration; and steps being taken to prevent further delay. Such notice does not limit Mölnlycke’s rights under section 6.5 or elsewhere in these GTC.

6.5. Supplier shall deliver the Products, or complete performance of the Products where they constitute services, at the agreed time or within the agreed delivery period(s). In the event delivery or performance is not made in time, Mölnlycke shall notify the Supplier in writing and, except in the case of force majeure, if Supplier fails to deliver or complete performance within five (5) working days of such notice, Supplier will be in material breach of contract. In such case, Mölnlycke may terminate the Agreement in whole or in part; refuse any subsequent delivery or performance of the Products; recover from Supplier the reasonable and documented expenses incurred by Mölnlycke in obtaining the Products in substitution from another supplier; and/or claim damages for any cost, loss, expenses and liquidated damages incurred by Mölnlycke which are attributable to Supplier’s delay. It is agreed that Mölnlycke may select one or more of the above listed remedies.

7.1. Supplier warrants and represents that the Products, whether supplied as goods and/or services, continuously meet the terms of the Agreement.

7.2. Supplier further warrants that the Products conform to the specifications, descriptions, and quality standards set out in the Agreement, are free from defects in construction, materials, finish, form, nature, composition, and content (where applicable) and are fit for their intended use.

7.3. The warranty period is twelve (12) months from the delivery date, unless a longer period is required by statute, case law or applicable industry practice. If a warranty breach occurs, the warranty period restarts for the affected Products from the date remediation is completed to Mölnlycke’s satisfaction.

7.4. If Mölnlycke considers that Products do not comply with sections 7.1 or 7.2, it shall notify Supplier in writing. Supplier shall remedy the non-compliance at its sole cost within ten (10) working days of such notice (or a shorter period if circumstances require). If Supplier fails to do so, Mölnlycke may, within the warranty period, at its sole discretion and at Supplier’s sole risk and expense: (i) where Products constitute goods, return the Products and recover remuneration paid; (ii) require repair, adaptation, re-performance, or replacement, free of charge; (iii) refuse further delivery or performance of the Products; (iv) claim compensation for costs, losses, expenses, or damages, or (v) terminate the Agreement in whole or in part with immediate effect. Upon termination, Mölnlycke has no obligation to pay for rejected Products. Supplier shall refund any remuneration received and, where Products constitute goods, collect the Products at its own cost and risk; and Mölnlycke may source replacement Products from an alternative supplier.

8.1. To the extent Products constitute goods, the ownership and risk of the Products shall transfer to Mölnlycke at such time as the Products are delivered, or deemed to have been delivered, to Mölnlycke, provided that the Products have not been rejected by Mölnlycke. Supplier warrants to transfer full and unencumbered ownership of such Products.

8.2. To the extent that Products constitute goods, if Mölnlycke deems the Products to not be in accordance with the Agreement, or claims the right to terminate the Agreement in accordance with section 6 or 7 of these GTC or the right to replacement Products, the delivered Products shall remain owned by, and be at the risk of, Supplier.

8.3. To the extent any physical items, materials, spare parts, documentation, or other deliverables are produced, supplied, or left with Mölnlycke in the course of Supplier performing services, ownership and risk in such items shall transfer to Mölnlycke only upon their delivery to, and acceptance by, Mölnlycke in accordance with the Agreement, and section 8.1 shall apply to such items as if they were goods.

9.1. Subject to section 9.5, Supplier is liable for all direct loss, costs, expenses, and damages suffered by Mölnlycke or any third party arising from Supplier’s breach of the Agreement or any unlawful act or omission of Supplier, its employees, or any third party it engages. To the extent Products constitute services, Supplier bears the risk of loss of, or damage to, any equipment, materials, data, or other items used, handled, or in Supplier's care, custody, or control in the course of performing the services, until such services have been completed and accepted by Mölnlycke, regardless of fault.

9.2. Supplier indemnifies Mölnlycke against all third-party claims arising from acts or omissions of Supplier, its personnel, or any third party it engages, or relating to the use of the Products. 

9.3. Supplier must maintain adequate liability insurance at its own expense (including business and professional liability coverage), with coverage proportionate to the nature, risk profile, and value of the Agreement. On Mölnlycke’s request, Supplier shall provide proof of cover and premium payment.

9.4. Each Party shall take all reasonable steps to mitigate any loss or damage it suffers in connection with the Agreement. 

9.5. Neither Party shall be liable to the other Party for any special, indirect, incidental or consequential damages (including loss of profit, business, or revenue), except in cases of gross negligence or wilful misconduct. This exclusion applies equally to claims by each Party against the other.

9.6. Notwithstanding section 9.1, Supplier's total liability to Mölnlycke across all claims arising under or in connection with any individual order (and the Agreement arising from it) shall not exceed the higher of: (i) the total fees or purchase price paid or payable under that order, or (ii) EUR 50,000. Where a claim spans more than one order and cannot reasonably be attributed to a single order, the cap is the highest single-order cap from any order placed in the twelve (12) months preceding the event giving rise to the claim. This cap does not apply to: (a) willful misconduct or fraud; (b) death or personal injury caused by Supplier's negligence; (c) Supplier's IP indemnification obligations under section 5.7; (d) breach of section 12 (Compliance and Business Ethics), (e) breach of section 14 (Confidentiality) or (f) breach of section 13 (Data Protection).

10.1. A force majeure event means any circumstance beyond a Party’s reasonable control, including war, civil war, terrorism, military mobilisation, fire, flood, earthquake or other natural catastrophe, epidemic or pandemic, government or administrative action, strike, lockout or other industrial dispute.

10.2. Neither Party is liable for failure to perform its obligations under the Agreement, to the extent that failure is caused by a force majeure event, provided the non-performing Party promptly notifies the other in writing.

10.3. If a force majeure event continues for more than thirty (30) days, either Party may terminate the Agreement without liability to the other Party.

11.1. Either Party may terminate the Agreement with immediate effect by written notice if the other Party becomes subject to bankruptcy, insolvency, liquidation or similar proceedings. In addition, Mölnlycke may terminate the Agreement with immediate effect if well-founded reports from third parties (including credit agencies), indicate insolvency or financial difficulties of Supplier. 

11.2. Mölnlycke may also terminate the Agreement with immediate effect if Supplier fails to fulfil its obligations under MDR or any corresponding applicable regulatory framework, and fails to remedy such non-compliance within ten (10) working days of written notice from Mölnlycke specifying the non-compliance.

12.1. Supplier warrants and represents that, to the extent applicable, it will comply with the principles set out in Mölnlycke’s most recent version of the Business Partner Code of Conduct outlined on the Mölnlycke website (www.molnlycke.com) (the “Business Partner Code of Conduct”) in fulfilling its obligations under the Agreement and in any of its interactions with Mölnlycke and Mölnlycke’s Affiliates. 

12.2. Supplier hereby warrants and represents that the Supplier is not in breach with and will continue to comply with Trade Sanctions Laws. Upon Mölnlycke’s request, the Supplier hereby undertakes to issue and provide Mölnlycke with a confirmation of its compliance with Trade Sanctions Laws.

12.3. Supplier shall ensure that any sub-contractor, sub-distributor, or other representative engaged by the Supplier to carry out any of the activities under the Agreement shall be bound by the principles set out in the Business Partner Code of Conduct or the equivalent.

12.4. If the Supplier has violated, or if Mölnlycke has reasonable belief that the Supplier intends to violate, this Section 12, such violation shall be deemed to be a material breach of the Agreement and shall entitle Mölnlycke to, in its sole discretion, provide a corrective action plan, immediately terminate the Agreement or pursue any of the other remedies set out in the Agreement. Mölnlycke shall not be liable for any claims, losses, or damages arising from or related to failure by the Supplier to comply with this Section 12 and the Supplier shall indemnify and hold Mölnlycke harmless against any such claims, losses, or damages. In addition, the Supplier agrees that it shall not be entitled to any damages or compensation due to Mölnlycke’s termination of the Agreement in accordance with the above. 

13.1. All data provided or made available by Mölnlycke (“Mölnlycke Data”), remains the property of Mölnlycke. The Supplier may process Mölnlycke Data solely for the purpose of performing its obligations under the Agreement. Mölnlycke Data shall be treated as confidential information in accordance with this Agreement. The Supplier shall not use Mölnlycke Data in connection with any artificial intelligence systems unless expressly approved in writing by Mölnlycke.

13.2. To the extent that the Products or their delivery involve access to, transmission of, storage of, processing of, or other interaction with Mölnlycke information, data, networks or information systems, Supplier shall comply with Mölnlycke's Information Security Requirements, as made available and updated from time to time via Mölnlycke’s ISR Portal: https://www.molnlycke.com/globalassets/corporate/legal/ISR-portal/).

13.3. Where such access, transmission, storage, processing or interaction occurs, Supplier shall ensure that its operations, as well as those of its subcontractors and suppliers engaged in connection with the Agreement, are conducted in accordance with the ISRs, which shall be binding upon such parties.

13.4. Where Mölnlycke reasonably determines that the ISRs do not adequately cover the information security requirements or risks associated with the Products or their delivery, the Parties shall cooperate in good faith to agree and formalise additional or more stringent requirements in a separate information security addendum.

13.5. To the extent that no access, transmission, storage, processing or interaction with Mölnlycke information, data, networks or information systems occurs, the ISRs shall not apply.

13.6. Each Party shall comply with applicable Privacy Laws in connection with its processing of personal data under the Agreement.

13.7. To the extent that the Products or their delivery involves the processing of personal data on behalf of Mölnlycke, the Supplier shall act as a processor and Mölnlycke shall act as controller (as defined under Privacy Laws).

13.8. To the extent no such processing on behalf of Mölnlycke occurs, each Party shall act as an independent controller in respect of its own processing.

13.9. Where the Supplier acts as a processor, the processing shall be governed by Mölnlycke’s Data Processing Addendum (“DPA”) in Schedule 1, which is incorporated into and forms an integral part of the Agreement.

13.10. The Supplier shall promptly notify Mölnlycke in writing via privacy@molnlycke.com if, in its reasonable opinion, the DPA does not adequately reflect or cover the processing activities carried out on Mölnlycke’s behalf and shall cooperate in good faith to address such gaps.

13.11. Where required, the Supplier shall ensure that relevant individuals (i) are aware that personal data relating to them may be processed by Mölnlycke; and (ii) is referred to or provided with a copy of Mölnlycke’s applicable privacy notices available at: Privacy Centre - Mölnlycke Health Care. 

The Agreement, Products, prices, Mölnlycke Data, and all information disclosed between the Parties that is marked as confidential or is confidential by nature shall be kept confidential and used only for the purpose of performing obligations under the Agreement. These obligations do not apply to information that: (i) is or becomes publicly available through no breach of this section; (ii) was rightfully known to the receiving Party prior to disclosure without restriction; (iii) is rightfully obtained from a third party without restriction; or (iv) is required to be disclosed by applicable law or court order, provided the disclosing Party gives prompt prior written notice to the other Party (to the extent permitted by law) and cooperates with any request to seek a protective order.

These GTC apply on a per-order basis. Each order placed by Mölnlycke in respect of which an Agreement is formed in accordance with clause 3.5, constitutes a separate Agreement. Each such Agreement commences on the date the Agreement is formed in accordance with clause 3.5 and continues until the Products have been fully delivered and accepted by Mölnlycke and all payment obligations in respect of that order have been fulfilled, unless terminated earlier in accordance with these GTC. These GTC do not create any commitment by Mölnlycke to place any minimum volume of orders.

Supplier shall not subcontract or otherwise delegate the performance of any of its obligations under the Agreement to any third party without the prior written consent of Mölnlycke. Mölnlycke's consent to any subcontracting shall not relieve Supplier of any of its obligations or liabilities under the Agreement, and Supplier shall remain fully responsible for all acts and omissions of its subcontractors as if they were its own.

Supplier shall promptly notify Mölnlycke in writing upon becoming aware of any change of control of Supplier (meaning a change in the person or entity that, directly or indirectly, holds fifty per cent (50%) or more of the voting rights or is otherwise able to direct the affairs of Supplier). Mölnlycke shall have the right to terminate the Agreement with immediate effect by giving written notice to Supplier within thirty (30) days of receiving notification of such change of control.

Any notice or other formal communication required or permitted under these GTC shall be made in writing and delivered by: (i) email, with read receipt or written confirmation of receipt by the recipient; (ii) courier; or (iii) registered post. Notices shall be addressed to the contact details set out in the relevant order, or to such other address or email address as a Party may notify the other in writing from time to time. A notice shall be deemed received: (a) if sent by email, at the time the sender receives confirmation of receipt; (b) if sent by courier, upon delivery; and (c) if sent by registered post, three (3) working days after posting (or seven (7) working days if sent internationally).

If a dispute arises between the Parties in connection with the Agreement, the Parties shall first attempt to resolve it through good faith negotiations between senior representatives of each Party for a period of thirty (30) days from the date one Party notifies the other of the dispute in writing, before either Party commences formal legal proceedings (except where a Party seeks urgent interim relief).

20.1. The Agreement is exclusively governed by the laws of Sweden, excluding its provisions on conflicts of law. The application of the UN Convention on the International Sales of Goods ("CISG") is hereby expressly excluded. 

20.2. For all disputes arising out of or in connection with the Agreement, the competent courts in Sweden shall have exclusive local jurisdiction. Mölnlycke may bring proceedings against Supplier in any jurisdiction where Supplier has assets or is domiciled.

20.3. Neither Party may assign or transfer any rights or obligations under this Agreement without the prior written consent of the other Party, except that Mölnlycke may, at any time and without the Supplier's consent or notice, assign, novate or otherwise transfer this Agreement, in whole or in part, to (i) any of its Affiliates (whether now existing or established in the future), or (ii) any successor in interest (whether by merger, acquisition, asset purchase or otherwise) to all or substantially all of the business to which this Agreement relates. This Agreement shall be binding on the permitted assignees of the Parties.

20.4. If any provision of the Agreement is or becomes invalid, that provision shall be replaced by one that most closely reflects its economic purpose, without affecting the validity of the remaining provisions. The following provisions survive expiry or termination of any Agreement: section 5 (Intellectual Rights), section 8 (Title), section 9 (Liability), section 12 (Compliance and Business Ethics), section 13 (Data Protection), section 14 (Confidentiality), section 21 (Audit Rights, insofar as they relate to obligations arising prior to expiry or termination), and section 23 (Publicity), together with any provision which by its nature is intended to have continuing effect.

Mölnlycke may, upon reasonable prior written notice, audit, or appoint an independent third-party auditor (subject to customary confidentiality undertakings) to audit, Supplier's compliance with the Agreement. Supplier shall provide reasonable access and cooperation. Each Party bears its own audit costs, unless the audit reveals a material breach by Supplier, in which case Supplier shall reimburse Mölnlycke's reasonable and documented audit costs.

Supplier shall immediately notify Mölnlycke in writing of any defect, safety issue, regulatory issue, recall, field action, or compliance concern affecting Products supplied under the Agreement. Supplier shall cooperate with and assist Mölnlycke in connection with any recall, field correction, or safety-related action, and shall bear all costs attributable to a defect or non-compliance originating from Supplier.

Supplier may not use Mölnlycke's name, logo, trademarks, or any reference to its relationship with Mölnlycke in any marketing, advertising, press release, or other public communication without Mölnlycke's prior written approval.

1.1. This DPA constitutes a written Data Processing Agreement pursuant to applicable Privacy Laws and applies to processing of personal data performed by Supplier on behalf of Mölnlycke. This DPA does not apply to any processing performed by the Parties as independent controllers. 

1.2. Mölnlycke instructs the Supplier to process personal data solely as necessary to perform the Agreement and provide the Products to Mölnlycke according to the applicable product description(s). Details of the processing, including its subject matter, nature, duration, purpose, and the categories of personal data and data subjects, are set out in this DPA and in Appendix A (Details of processing).

1.3. Unless otherwise agreed in writing, this DPA shall constitute all of Mölnlycke’s documented instructions to Supplier. If Supplier considers that a Mölnlycke instruction would breach applicable Privacy Laws, Supplier shall inform Mölnlycke thereof. Any entitlement to remuneration regulated in the Agreement includes remuneration for the obligations under this DPA.

2.1. When processing personal data under the Agreement, Supplier is responsible for:

a) ensuring sufficient data security by means of appropriate technical and organisational measures in compliance with the requirements of applicable Privacy Laws, and as modified, adapted, and updated by Mölnlycke from time to time, 
b) providing assistance as may be requested by Mölnlycke with respect to any data protection impact assessments, and prior consultations with relevant regulatory or supervisory authorities which Mölnlycke considers to be required by applicable Privacy Laws (including Article 35 or 36 of the GDPR),
c) notifying Mölnlycke without undue delay of any requests from data subjects exercising their rights under Privacy Laws, and not respond to such requests, unless instructed by Mölnlycke to do so,
d) providing timely assistance to Mölnlycke to enable Mölnlycke to respond to any request from a data subject to exercise any of its rights under Privacy Laws and any other correspondence, enquiry or complaint received from a data subject,
e) notifying Mölnlycke without undue delay after becoming aware of a personal data breach, delivering such notification to privacy@molnlycke.com, and include the details of the personal data breach, the measures taken or to be taken to address it, and a Supplier contact point,
f) cooperating as instructed by Mölnlycke to assist in the investigation, mitigation, and remediation of a personal data breach, including with respect to any notification to a relevant supervisory authority/regulator, or data subjects, 
g) ensuring that only authorized persons may access personal data and that such persons are bound by appropriate confidentiality undertakings, 
h) not disclosing or otherwise revealing any personal data to a data subject or third party, unless otherwise stated in the Agreement or required by law or a court or official authority’s decision, and,
i) notifying Mölnlycke if it becomes aware of any notice, inquiry or investigation by a supervisory authority that refer specifically to the processing of personal data under the Agreement and also refer such supervisory authority to Mölnlycke. 

3.1. Mölnlycke provides general authorization to Supplier to engage third parties (including other Supplier companies) to process personal data (“Sub-Processors”).

3.2. For all its sub-processors, Supplier is responsible for imposing, by way of a written contract, data protection obligations equivalent to those set out in this DPA. Supplier shall remain responsible for all obligations, acts and omissions of any Sub-Processor to the same extent as if performed or not performed by Supplier itself. 

3.3. Supplier shall provide Mölnlycke with a current list of Sub‑Processors at the time of entering into the Agreement and keep such information up to date at all times. Supplier shall notify Mölnlycke in writing in advance of any addition, replacement or other change of Sub‑Processor, allowing Mölnlycke a reasonable opportunity to object. Upon request, Supplier shall promptly provide all relevant information regarding its Sub‑Processors, including their identity, role, and location of processing.

4.1. Supplier shall not transfer, access, or otherwise make available Personal Data to any recipient (including Sub‑Processors) in or from any jurisdiction where such transfer would constitute a restricted or regulated transfer under applicable data protection laws, without Mölnlycke’s prior written authorization.

4.2. Where Mölnlycke has provided its explicit written authorization and Supplier’s processing under this DPA requires a transfer of personal data to a country outside of the European Economic Area (“EEA”), and such a country does not enjoy an adequacy decision by the EU Commission pursuant to article 45 of the GDPR, the EU Commission’s standard contractual clauses for the transfer of personal data to third countries, (as annexed to the EU Commission’s implementing decision (EU) 2021/914) (“SCCs”) shall hereby apply and be incorporated into this DPA by reference to their official publication page on the EU Commission’s website.

4.3. As applicable under this DPA, the SCCs shall utilise the version accommodating Controller‑to‑Processor transfers (Module 2) with the following adjustments: (i) Clause 7 (docking clause) shall not apply, (ii) Clause 17 (governing law) shall be the laws of Sweden, (iii) Clause 18 (choice of forum and jurisdiction) shall designate the courts of Sweden, (iv) Annex I.A (list of parties) shall, unless otherwise specified in an applicable order form, be the parties to the Agreement, whereby Mölnlycke is the Data Exporter (Controller) and Supplier is the Data Importer (Processor), and (v) Annex I.B (description of transfer) shall follow the specifications set out in Appendix A (Details of processing).

5.1. Supplier shall, upon prior written request from Mölnlycke provide to Mölnlycke such information as may be reasonably necessary to demonstrate Supplier’s compliance with its obligations under this DPA and applicable Privacy Laws.

5.2. Mölnlycke may conduct audits to assess Supplier’s compliance under this DPA and applicable Privacy Laws. Such audit may be conducted by an independent third-party auditor, provided such auditor is made subject to confidentiality undertakings. Any audit must be preceded by at least thirty (30) day’s prior notice by Mölnlycke.

5.3. Each Party shall bear its own costs in connection with any audit. However, if an audit identifies a material breach of this DPA by Supplier, Supplier shall reimburse Mölnlycke for reasonable and documented costs of the audit.

6.1. When the Agreement expires, the Supplier shall either delete or return (in accordance with Mölnlycke’s instructions) all personal data that has been processed on Mölnlycke’s behalf and ensure that no such personal data remains with the Supplier or any Sub-Processor, except as required by applicable law, provided Mölnlycke is notified in advance of such requirement in writing.

7.1. Supplier shall indemnify and hold Mölnlycke harmless from and against any claims, damages, or liabilities arising out of or in connection with Supplier’s (or a Sub-Processor’s) unlawful processing or breach of this DPA. 

7.2. Mölnlycke shall indemnify Supplier to the extent Supplier is held liable by a third party due to Mölnlycke’s documented instructions that infringe Privacy Laws, provided that Supplier has informed Mölnlycke in advance of the unlawful nature of such instructions.