Data Processing Agreement

This data processing agreement governs Digiserv's processing of personal data on behalf of the Customer, and is entered into pursuant to the Norwegian Personal Data Act (personopplysningsloven) and the EU General Data Protection Regulation (GDPR), Regulation (EU) 2016/679. The agreement is an appendix to the General Terms and Conditions.

1. Subject matter of the agreement, nature, purpose and duration of the processing

1.1 The processing consists of Digiserv making its infrastructure (storage space, processing power and transmission capacity) available for the controller's data, including personal data. The purpose is to meet the controller's need for infrastructure for the storage, processing and transmission of such data.

1.2 The processing is not limited in time and continues until the agreement is terminated by either party.

2. Categories of data subjects and personal data

2.1 Categories of data subjects may be employees, suppliers, customers, clients, members, users, visitors or other groups of natural persons, as defined by the controller.

2.2 The personal data processed may include names, dates of birth, contact details, IP addresses, usernames, passwords, cookies, customer numbers, information relating to employment or customer relationships, log data, user behavior and preferences, location data and other information as defined by the controller which, alone or together with other information, can identify a natural person.

3. The controller's obligations and rights

3.1 The controller is responsible for ensuring that personal data is processed in accordance with the Norwegian Personal Data Act and the GDPR (cf. GDPR Article 24), and determines the purposes and means of the processing (cf. GDPR Article 4(7)).

3.2 The controller hereby gives Digiserv documented instructions to process personal data stored in Digiserv's infrastructure in a manner that fulfills the purpose set out in section 1. The controller may give further written instructions.

3.3 The controller is responsible for forwarding notifications of security breaches from Digiserv to the Norwegian Data Protection Authority (Datatilsynet), and has the right to terminate the agreement if Digiserv no longer meets the requirements of GDPR Article 28(1).

4. Digiserv's obligations

4.1 Processing only on instructions. Digiserv processes personal data only on documented instructions from the controller, unless Norwegian law requires otherwise. In that case, Digiserv informs the controller of this before the processing, unless the law prohibits it. Digiserv also informs the controller if an instruction infringes data protection legislation.

4.2 Confidentiality. Digiserv ensures that persons authorized to process the personal data have committed themselves to confidentiality. This obligation also applies after the assignment or employment has ended. Access is granted only to employees who need it for necessary reasons.

4.3 Security measures. Digiserv takes all measures required under GDPR Article 32, and stores data in an appropriately secured manner with the necessary backups to restore availability and access in the event of a physical or technical incident. Digiserv works continuously to maintain an appropriate level of security.

4.4 Use of subprocessors. The controller gives Digiserv general authorization to engage other processors (subprocessors). An up-to-date overview is available in the list of subprocessors. New subprocessors are added to the list at least 14 days before they are engaged. If the controller objects to a new subprocessor, Digiserv must be notified immediately; Digiserv will then either refrain from using the subprocessor for the controller's personal data, or give the controller the right to terminate the affected service. Digiserv imposes on its subprocessors the same data protection obligations as follow from this agreement, and is liable to the controller for the subprocessor's performance of those obligations (cf. GDPR Article 28(4)). Digiserv's financial liability under this agreement is subject to the limitations of liability in the General Terms and Conditions, to the extent permitted by mandatory law.

4.5 Assistance with data subjects' rights. Digiserv assists the controller by appropriate technical and organizational measures, insofar as this is possible, in fulfilling the obligation to respond to requests from data subjects to exercise their rights.

4.6 Assistance and breach notification. Digiserv assists the controller in ensuring compliance with the obligations under GDPR Articles 32–34. Digiserv notifies the controller without undue delay after becoming aware of a personal data breach, and provides the information the controller needs to fulfill its obligations under Articles 33 and 34.

4.7 End of processing. Upon termination of the contractual relationship, Digiserv shall, at the choice of the controller, either delete or return all personal data processed on behalf of the controller, and then delete its own copies. This takes place within 60 days of termination, unless storage is required by law. If the controller does not make a choice within the deadline, the data is deleted.

4.8 Provision of information and audits. Digiserv makes available to the controller all information necessary to demonstrate compliance with the obligations in GDPR Article 28, and carries out an annual internal review of compliance, which is confirmed on request. The controller may conduct audits, including inspections, of Digiserv's compliance. Unless otherwise required by mandatory law or an order from a supervisory authority, such audits are normally carried out by reviewing documentation. Physical inspections may be carried out up to once per year, and otherwise in the event of a reasonable suspicion of a breach, with at least 30 days' notice, during normal working hours, without undue disruption to operations, subject to a duty of confidentiality and at the controller's expense.

5. Amendments to the agreement

5.1 Digiserv may amend this agreement with at least 1 month's written notice where the amendment results from changed legal requirements, orders from a supervisory authority or changes in the use of subprocessors. Other amendments require agreement between the parties. If an amendment entails a material reduction of the controller's protection, the controller may terminate the agreement free of charge with effect from the date the amendment takes effect.

6. Information and notices

6.1 Notices under this agreement shall be given in writing. To Digiserv: databehandler@digiserv.no. To the controller: the contact person stated in the Agreement on Services/Products.

7. Governing law and jurisdiction

7.1 The parties shall seek to resolve disputes through negotiation. The agreement is governed by Norwegian law, and the parties accept Agder District Court (Agder tingrett), sitting in Kristiansand, as the legal venue. This also applies after the termination of the agreement.

Back to agreements and documents