Aimz AS is referred to herein as the “Processor” and the Customer (as defined in the Contract) is referred to as the “Controller”.

The purpose of this Data Processing Agreement (the “Agreement”) is to regulate the parties’ rights and obligations under applicable data protection legislation, including the Norwegian Personal Data Act of 2018, which incorporates the EU General Data Protection Regulation 2016/679 (GDPR) (hereinafter jointly referred to as the “data protection legislation”).

The purpose of this Agreement is to regulate the Processor’s use of personal data on behalf of the Controller to which the Processor gains access in connection with the delivery of services under the License Agreement for the use of AIMZ (the “Contract”), in accordance with GDPR Article 28.

Annexes A and B to this Data Processing Agreement form an integral part of the agreement and contain, respectively, further details on the processing of personal data and the list of approved sub-processors.

The Agreement takes precedence over any corresponding data protection provisions in other agreements between the parties, including the Contract.

This Agreement does not release the Processor from obligations imposed on the Processor by the data protection legislation or other legislation. This Agreement only regulates the Processor’s processing on behalf of the Controller in connection with the Solution. For personal data that the Processor processes as an independent controller (e.g. CRM, invoicing, supplier and support channels outside the Solution), the Processor’s own privacy documents apply and not this Agreement.

The Controller is responsible for ensuring that the processing of personal data takes place in accordance with the data protection legislation.

The Controller has the right and the obligation to determine the purpose of the processing of personal data and the means to be used. The Controller is further responsible for ensuring that there is a legal basis for the processing of personal data that the Processor is instructed to carry out.

Instructions: The Processor shall only process personal data on documented instructions from the Controller, unless otherwise required by national or European law. The Processor shall immediately notify the Controller if the Processor is of the opinion that an instruction infringes the data protection legislation.

Confidentiality: The Processor may only grant access to personal data processed on behalf of the Controller to persons who are subject to the Processor’s authority of instruction and who have committed themselves to confidentiality or are subject to an appropriate statutory obligation of confidentiality, and only to the extent necessary.

At the request of the Controller, the Processor shall be able to demonstrate that the persons concerned who are subject to the Processor’s authority of instruction are bound by the above obligation of confidentiality.

Security: The Processor shall implement appropriate technical and organisational measures to achieve a level of security appropriate to the risk, cf. GDPR Article 32. The Processor shall also assist the Controller in complying with the Controller’s obligations under GDPR Article 32, including by making the necessary information available to the Controller.

The Controller shall likewise make available to the Processor the information necessary to enable the Processor to identify and assess risks in accordance with GDPR Article 32.

The Processor shall meet the requirements of GDPR Article 28(2) and (4) where the Processor engages another processor (a “sub-processor”).

The Controller gives a general authorisation for the Processor to engage sub-processors. The Processor shall maintain an up-to-date list of current sub-processors on its website. Changes to the list (addition or replacement of sub-processors) will be published on the Processor’s website. The Processor may additionally notify the Controller by e-mail, but this is not a requirement for the change to be valid. The Controller may, within thirty (30) days of a published change, raise objectively justified objections to a new sub-processor. If the parties fail to reach agreement, the Controller may terminate the Contract with effect from the date on which the new sub-processor was to be taken into use. Continued use of the Service after the expiry of the objection period is deemed acceptance of the new sub-processor. The list of sub-processors already approved by the Controller is set out in Annex B.

When engaging sub-processors, the sub-processor shall as a minimum be subject to the same data protection obligations as set out in this Agreement. A copy of the sub-processor agreement and any subsequent amendments shall – at the Controller’s request – be sent to the Controller, who thereby has the opportunity to ensure that the sub-processor is subject to the same data protection obligations as set out in this Agreement. Commercial terms that do not affect the data protection content of the sub-processor agreement are not subject to the requirement of a copy to the Controller.

The Processor shall remain fully liable for any failure by the sub-processor to fulfil its data protection obligations.

The Processor may only transfer personal data to third countries or international organisations on documented instructions from the Controller, unless the transfer is required by national or European law. In that case the Controller shall be informed of that legal requirement unless public interest prevents this. For the avoidance of doubt, a transfer to a third country in connection with the use of approved sub-processors pursuant to clause 5 above shall always be regarded as a transfer on documented instruction from the Controller. Any transfer shall always take place in accordance with GDPR Chapter V, including being subject to a lawful transfer mechanism.

Transfer mechanism for third countries: For transfers of personal data to third countries (including the USA), the Processor shall ensure that the transfer takes place in accordance with GDPR Chapter V, including by using the EU Standard Contractual Clauses (EU SCC 2021/914) and carrying out a Transfer Impact Assessment (TIA) with the necessary supplementary measures. At the Controller’s request, the Processor shall make available high-level documentation confirming a valid transfer mechanism.

This Agreement shall not be confused with standard data protection clauses as referred to in GDPR Article 46(2)(c) and (d), and this Agreement cannot constitute a basis for the transfer of personal data under GDPR Chapter V.

To the extent possible, the Processor shall assist the Controller in responding to requests from data subjects for the exercise of their rights, assist with information and notification in the event of qualifying personal data breaches, assist with data protection impact assessments and assist in connection with prior consultations with the Norwegian Data Protection Authority (Datatilsynet).

In the event of a personal data breach, the Processor shall notify the Controller of the breach without undue delay after becoming aware of it, so that the Controller can comply with its obligation to notify the breach to the competent supervisory authority (in Norway: Datatilsynet), cf. GDPR Article 33.

Each party is liable for any financial loss it causes the other party through breach of this Agreement. The limitations of liability in the Contract also apply here.

Each party is liable to a data subject who has suffered material or non-material damage where the damage is caused by the party having acted outside or contrary to this Agreement or the data protection legislation, cf. GDPR Article 82(1).

Upon termination of the data processing services, the Processor shall, at the Controller’s choice, delete all personal data processed on behalf of the Controller or return all personal data and delete existing copies, unless national or European law prevents this or otherwise agreed in the Contract. The Processor undertakes to process the personal data exclusively for the purpose(s), for the duration and under the conditions laid down in these rules.

Deletion at sub-processors: Upon termination, the Processor shall instruct relevant sub-processors to delete or return personal data processed on behalf of the Controller. The Processor shall confirm completed deletion/return within a reasonable time (normally within 30–90 days) after termination, unless another deadline follows from law.

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations under the data protection legislation and this Agreement. Furthermore, the Processor shall allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.

The Agreement enters into force on the same date as the Contract.

The Agreement applies for as long as the data processing services last and cannot be terminated during that period, unless the parties agree other terms governing the delivery of the data processing services in accordance with applicable data protection legislation.

If the Contract or the delivery of the data processing services ends, and the personal data has been deleted or returned to the Controller in accordance with clause 9.1 above, this Agreement terminates.