Data Processing Agreement

This agreement sets out the rights and obligations that apply when the data processor carries out processing of personal data on behalf of the data controller.

The agreement is designed to ensure the parties’ compliance with Article 28(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation), which sets specific requirements for the content of a data processing agreement.

The data processor’s processing of personal data is carried out for the purpose of fulfilling the parties’ "main agreement".

The data processing agreement and the "main agreement" are interdependent and cannot be terminated separately. The data processing agreement may, however, without terminating the "main agreement", be replaced by another valid data processing agreement.

This data processing agreement takes precedence over any corresponding provisions in other agreements between the parties, including in the "main agreement".

Four appendices are attached to this agreement. The appendices form an integral part of the data processing agreement.

Appendix A to the data processing agreement contains further information about the processing, including the purpose and nature of the processing, the type of personal data, the categories of data subjects and the duration of the processing.

Appendix B to the data processing agreement contains the data controller’s conditions for the data processor’s use of any sub-processors, as well as a list of the sub-processors, if any, that the data controller has approved.

Appendix C to the data processing agreement contains detailed instructions on the processing the data processor is to carry out on behalf of the data controller (the subject of the processing), the security measures that must be observed as a minimum, and how the data processor and any sub-processors are supervised.

The data processing agreement, together with its appendices, is retained in writing, including electronically, by both parties.

This data processing agreement does not release the data processor from obligations imposed directly on the data processor under the General Data Protection Regulation or any other legislation.

As a general rule, the data controller is responsible towards the outside world (including the data subject) for ensuring that the processing of personal data is carried out within the framework of the General Data Protection Regulation and the Data Protection Act.

The data controller therefore has both the rights and the obligations to make decisions about the purposes for which, and the means by which, processing may be carried out.

The data controller is responsible, among other things, for ensuring that there is a legal basis for the processing that the data processor is instructed to carry out.

The data processor may only process personal data on documented instructions from the data controller, unless required to do so under EU law or the national law of a Member State to which the data processor is subject; in that case, the data processor shall inform the data controller of that legal requirement before processing, unless that law prohibits such notification on important grounds of public interest, cf. Article 28(3)(a).

The data processor shall immediately inform the data controller if, in the data processor’s opinion, an instruction infringes the General Data Protection Regulation or data protection provisions in other EU law or the national law of a Member State.

The data processor ensures that only those persons currently authorised to do so have access to the personal data being processed on behalf of the data controller. Access to the data must therefore be closed down immediately if the authorisation is withdrawn or expires.

Only persons for whom it is necessary to have access to the personal data in order to fulfil the data processor’s obligations towards the data controller may be authorised.

At the request of the data controller, the data processor shall be able to demonstrate that the relevant employees are subject to the above-mentioned duty of confidentiality.

The data processor shall implement all measures required under Article 32 of the General Data Protection Regulation, which states, among other things, that, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing in question, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, appropriate technical and organisational measures shall be implemented to ensure a level of security appropriate to those risks.

The above obligation means that the data processor shall carry out a risk assessment and then implement measures to address the identified risks. Depending on what is relevant, these may include, among others, the following measures:

In connection with the above, the data processor shall in all cases, as a minimum, implement the level of security and the measures specified in more detail in Appendix C to this agreement.

Any arrangement or agreement between the parties concerning remuneration or the like in connection with the data controller’s or the data processor’s subsequent request for the establishment of additional security measures will appear in the parties’ "main agreement".

The data processor shall meet the conditions referred to in Article 28(2) and (4) of the General Data Protection Regulation in order to make use of another processor (sub-processor).

The data processor may therefore not make use of another processor (sub-processor) to fulfil the data processing agreement without prior specific or general written approval from the data controller.

In the case of general written approval, the data processor shall inform the data controller of any planned changes concerning the addition or replacement of other processors, thereby giving the data controller the opportunity to object to such changes.

The data controller’s detailed conditions for the data processor’s use of any sub-processors appear in Appendix B to this agreement.

The data controller’s approval, if any, of specific sub-processors is stated in Appendix B to this agreement.

When the data processor has the data controller’s approval to make use of a sub-processor, the data processor shall ensure that the sub-processor is subject to the same data protection obligations as those set out in this data processing agreement, by way of a contract or other legal instrument under EU law or the national law of a Member State, whereby in particular the necessary guarantees are provided that the sub-processor will implement the appropriate technical and organisational measures in such a way that the processing meets the requirements of the General Data Protection Regulation. The data processor is thus responsible, through the conclusion of a sub-processor agreement, for imposing on any sub-processor at least the obligations to which the data processor is itself subject under the data protection rules and this data processing agreement, together with its appendices.

A copy of the sub-processor agreement and of any subsequent amendments thereto shall, at the data controller’s request, be sent to the data controller, who is thereby able to satisfy itself that a valid agreement has been concluded between the data processor and the sub-processor. Any commercial terms, such as prices, that do not affect the data protection content of the sub-processor agreement need not be sent to the data controller.

In its agreement with the sub-processor, the data processor shall include the data controller as an intended third-party beneficiary in the event of the data processor’s bankruptcy, so that the data controller can step into the data processor’s rights and enforce them against the sub-processor, for example so that the data controller can instruct the sub-processor to delete or return data.

The data processor may only process personal data on documented instructions from the data controller, including with regard to the transfer (assignment, disclosure and internal use) of personal data to third countries or international organisations, unless required to do so under EU law or the national law of a Member State to which the data processor is subject; in that case, the data processor shall inform the data controller of that legal requirement before processing, unless that law prohibits such notification on important grounds of public interest, cf. Article 28(3)(a).

Without the data controller’s instructions or approval, the data processor may therefore not, within the framework of the data processing agreement, among other things:

The data controller’s instructions or approval, if any, for personal data to be transferred to a third country will appear in Appendix C to this agreement.

This means that the data processor shall, as far as possible, assist the data controller in ensuring compliance with:

The data processor assists the data controller in ensuring compliance with the data controller’s obligations pursuant to Articles 32-36 of the General Data Protection Regulation, taking into account the nature of the processing and the information available to the data processor, cf. Article 28(3)(f).

Any arrangement or agreement between the parties concerning remuneration or the like in connection with the data processor’s assistance to the data controller will appear in the parties’ "main agreement".

The data processor shall notify the data controller without undue delay after becoming aware that a personal data breach has occurred at the data processor or a possible sub-processor.

In accordance with section 10.2(b) of this agreement, the data processor shall, taking into account the nature of the processing and the information available to it, assist the data controller in reporting the breach to the supervisory authority.

On termination of the processing services, the data processor is obliged, at the data controller’s choice, to delete or return all personal data to the data controller, and to delete existing copies, unless EU law or national law requires the storage of the personal data.

The data processor makes available to the data controller all information necessary to demonstrate the data processor’s compliance with Article 28 of the General Data Protection Regulation and this agreement, and allows for and contributes to audits, including inspections, carried out by the data controller or another auditor mandated by the data controller.

The detailed procedure for the data controller’s supervision of the data processor appears in Appendix C to this agreement.

As a general rule, the data controller’s supervision of any sub-processors takes place through the data processor. The detailed procedure for this appears in Appendix C to this agreement.

The data processor is obliged to grant authorities that, under the legislation in force at any given time, have access to the data controller’s and the data processor’s facilities, or representatives acting on behalf of such an authority, access to the data processor’s physical facilities upon due identification.

This agreement enters into force upon both parties’ signature of it.

Either party may require the agreement to be renegotiated if changes in the law or inexpediencies in the agreement give rise to this.

Termination of the data processing agreement may take place in accordance with the termination terms, including notice period, set out in the "main agreement".

The agreement applies for as long as the processing continues. Regardless of the termination of the "main agreement" and/or the data processing agreement, the data processing agreement will remain in force until the processing ceases and the data is deleted at the data processor and any sub-processors.

Signature.

The purpose of the data processor’s processing of personal data on behalf of the data controller is:

The data processor’s processing of personal data on behalf of the data controller primarily concerns (the nature of the processing):

The processing includes the following types of personal data about the data subjects:

The processing includes the following categories of data subjects:

The data processor’s processing of personal data on behalf of the data controller may commence after this agreement enters into force. The processing has the following duration:

Conditions for the data processor’s use of any sub-processors.

Approved sub-processors.

Subject of the processing/instructions. The data processor’s processing of personal data on behalf of the data controller takes place through the data processor carrying out the following:

Security of processing. As this concerns the processing of ordinary, non-sensitive personal data, a "low" level of security is to be established. The data processor is thereafter entitled and obliged to make decisions about which technical and organisational security measures are to be used to create the necessary (and agreed) level of security around the data. However, the data processor shall in all cases, and as a minimum, implement the following measures, which have been agreed with the data controller:

Storage period/erasure routine. The personal data is stored at the data processor until the main agreement terminates or the data controller requests that the data be deleted or returned.

Location of processing. Processing of the personal data covered by the agreement may not, without the data controller’s prior written approval, take place at locations other than the following:

Instructions or approval regarding the transfer of personal data to third countries. If the data controller has not, in this section or by a subsequent written notice, given instructions or approval regarding the transfer of personal data to a third country, the data processor may not, within the framework of the data processing agreement, carry out such a transfer.

Detailed procedures for the data controller’s supervision of the processing carried out at the data processor. The personal data at the data processor may be supervised when the data controller believes that a need for this arises.