DATA PROCESSING AGREEMENT

1. Background and purpose of the processing

The Processor shall process the personal data on behalf of the Controller concerning the above-said. The subject and purpose of the processing of personal data, the duration of the processing of personal data, the subject matter of the processing of personal data, the types of personal data to be processed, the categories of data subjects to whom the personal data relates and other obligations and rights of the Controller are included in Appendix to this Agreement.

This Agreement shall provide for the processing of personal data in accordance with the regulation the EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data, and repealing Directive 95/46/EC (“General Data Protection Regulation” or “GDPR”) as implemented into Norwegian legislation in the Personal Data Act (LOV-2018-06-15-38), and in accordance with other relevant legislation which concerns the processingsof personal data under the Agreement (“Personal Data Regulation”). The Processor shall process the personal data only in the way described in the Agreement, as agreed in writing with the Controller, or as instructed by the Controller.

Terms and definitions used in the Agreement shall be construed in the same way as in the Personal Data Regulation.

2. The Processor’s duties

The Processor confirms that it will implement appropriate technical and organizational measures in such a manner that processing will meet the requirements of the Personal Data Regulation and ensure the protection of the rights of the data subject, inclusive comply with the requirements in GDPR Article 32. Other duties are set forth under Section 5. The Controller shall at any time have the legal rights to the personal data.

The Processor shall only process the personal data under the instructions given by the Controller. The Processor shall be able to document such instructions if requested. The Processor shall not process the personal data in any other way than instructed or necessary to provide the services or undertake the obligations requested by the Controller.

The Processor can use de-identified data for its own purposes, including for statistical and analytical purposes, provided that the data cannot be traced back to an individual.

The Processor shall, considering the nature of the processing, assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Controller’s obligation to respond to requests for exercising the data subject’s rights laid down in GDPR Chapter III. In addition, the Processor shall assist the Controller in ensuring compliance with the obligations pursuant to GDPR Articles 32 to 36 taking into account the nature of processing and the information available to the Processor. If there are an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42, which the Processor has undertaken to comply with, the Processor shall comply with such code of conduct or certification mechanism at any time during the term of this Agreement.

The Processor shall maintain a record of processing activities which the Processor performs for the Controller. The record shall contain at a minimum the information required under GDPR Article 30 no. 2.

The Processor shall maintain a record of processing activities which the Processor performs for the Controller. The record shall contain at a minimum the information required under GDPR Article 30 no. 2. The Processor shall make available to the Controller all information reasonable and necessary to demonstrate compliance with the obligations laid down in this Section 2 and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller, which is reasonable and necessary under the legal obligations. The Controller is however solely responsible for the contact and communication with the supervisory authorities, such as Datatilsynet in Norway, and the Processor shall not contact the supervisory authorities about the processing unless this has been cleared with the Controller. The Processor has a duty of confidentiality regarding the personal data and other information the Processor receives as part of the Agreement and the processing of personal data, and shall ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. The obligation of confidentiality shall survive any termination of the Agreement.

The Processor shall not transfer or give access to the personal data or information which the Processor processes or handles on behalf of the Controller to a third party without the explicit instruction from the Controller. Any requests regarding the personal data or the processing from others or the data subject shall be forwarded to the Controller without undue delay if not otherwise agreed in this Agreement or by instruction by the Controller.

If the Processor is in the opinion that an instruction by the Controller infringes the Personal Data Regulation, the Processor shall immediately inform the Controller.

3. Duties and rights of the Controller

The Controller is responsible for ensuring that personal data is processed in accordance with the Personal Data Regulation, and has both a right and an obligation to decide which purposes and which aids can be used in the processing carried out by the data processor. Therefore, the Controller must provide the data processor with documented instructions for how personal data is to be processed, where the instructions can either be part of this Agreement or attached to the Agreement. The instructions may also be given after entering into the Agreement.

4. Use of subcontractor/sub-processor

The Controller acknowledges and consents to The Processor utilization of sub-processors as listed at https://sokkel.com/terms/sub-processor. The Processor can modify this list as needed. To stay informed about such changes, the Controller can opt-in for email notifications by contracting dpo@sokkel.io.

Should the Controller wish to contest the addition of a new sub-processor, they must submit a written objection to the Processor within a 30-day window following the notification. Upon receiving an objection, both parties commit to collaboratively seeking a resolution. This may involve making reasonable adjustments to the Controller’s service configuration or agreement to circumvent personal data processing by the new sub-processor.

If the Controller objects to changes to Sub-processors, the parties must work together in good faith to resolve the objection, including potential changes to the deals, configuration or use of the services provided by the Processor. Objections can only be raised on the grounds that the new sub-processor’s inclusion would result in the Controller violating their data protection obligations or other relevant legal requirements. If no objection is raised within the specified timeframe, the new sub-processor will be deemed accepted by the Controller.

Sokkel will maintain an up-to-date list of sub-processors on their website, and any additions to this list will serve as official notice to Controller.

Any sub-processor shall be imposed the same obligations as the Processor set forth in the Agreement in a written, binding agreement wherein the sub-processor is providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the Personal Data Regulation. Where that sub-processor fails to fulfill its data protection obligations, the Processor shall remain fully liable to the Controller for performing the subprocessor’s obligations.

5. Security of processing and notification of breach

The Processor shall comply with the requirements for security given in the Personal Data Regulation and such best practice/branch standards the Processor deems relevant for the processing. The Processor shall provide documentation of technical and organizational measures implemented to ensure the security of the personal data upon the request of the Controller.

In case of a personal data breach, the Processor shall without undue delay notify the Controller. Such notification shall at least:

1. describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
2. communicate the name and contact details of the contact point where more information can be obtained;
3. describe the likely consequences of the personal data breach;
4. describe the measures taken or proposed to be taken to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

If not all information above may be given in the first notice, the information shall be provided as soon as possible. The Controller is responsible for notifying the supervisory authorities, such as Datatilsynet in Norway, and the Processor is not to contact or notify the supervisory authorities without the explicit instruction by the Controller.

6. Transfer to countries outside the EEA (third countries)

Personal data shall only be transferred to third countries, i.e. countries outside EU/EEA, which ensure an adequate level of protection upon explicit agreement or instructions by the Controller. The Processor shall not transfer or give access to the personal data to persons in third countries without the explicit approval of the Controller. The consent or instruction given by the Controller must cover the country which the personal data shall be transferred to or accessed.

For the transfer to or access from third countries for personal data, it is required that the appropriate safeguards, including with regard to the rights of data subjects, be complied with.

7. Term. Instruction to stop the processing. Effect on termination

This Agreement shall be effective and stay in force as long as the Processor (and its permitted sub-processors) processes personal data on behalf of the Controller in the context of the Main Agreement.

Upon breach of this Agreement, of instructions given by the Controller or on the Personal Data Regulation, the Controller may instruct the Processor to stop the processing of the personal data with immediate effect.

Upon termination of this Agreement, regardless of reason, the Processor (and its permitted sub-processors) shall within 60 days delete or return any or all personal data to the Controller, subject to the Controllers instructions, in a standardized format and medium along with necessary instructions to facilitate the Controller’s further use of such data, and delete all copies of those personal data.

The Controller shall upon request receive a written confirmation from the Processor that all personal data has been returned or deleted according to the Controller’s instructions and that the Processor has not kept any copy, printout or any other representation of such data on any medium.

8. Other duties and rights

Other obligations and rights are governed by the Main Agreement between the Controller and the Processor regarding the services that necessitate the processing of personal data and this Agreement. The same contact persons apply for the Agreement as under the Main Agreement.

If the Main Agreement is transferred, this Agreement shall be transferred accordingly.

Details on Processing

For the Data Exporter, identified as the Controller, contact information is to be provided by the Controller through an online purchase system or specified in relevant order documents, the Main Agreement.

Sokkel AS serves as the Processor. Contact details for Sokkel AS are as follows:

• Address: Gaustadalléen 21, 0349 Oslo, Norway
• Email: dpo@sokkel.io

The transfer of Personal Data between the Controller and Processor is designed to be an ongoing process that aligns with the operational needs of the service. This continuous data flow will persist throughout the entire duration of the Controller’s subscription period, as defined in the Subscription Agreement and this Data Processing Agreement (DPA).

The timeframe for these data transfers is not fixed to specific intervals or one-time events. Instead, it is structured to support the ongoing nature of the service provision, allowing for real-time data processing and service delivery as required by the Controller’s usage patterns and needs.

This approach ensures that the necessary Personal Data is available to the Processor for as long as the Controller maintains an active subscription, facilitating uninterrupted service delivery and support.

Data subjects whose Personal Data are transferred:

• The Controller’s business contacts, including prospective and current customers, partners, and individual vendors.
• People working on behalf of the Controller, such as staff members, representatives, advisors, and freelance professionals.
• End-users of the Controller
• Any natural person who becomes identifiable through information provided by the Controller while using the service. Types of Personal Data Involved in Transfers The agreement covers various categories of personal information that may be processed:
• Identity and access details, including individual names, chosen usernames, email addresses, and security credentials.
• Public-facing profile data, which might encompass names, visual representations like avatars or photographs, workplace information, professional titles, postal addresses, links to social media profiles, and personal or professional biographies.
• Contact details necessary for communication, such as names, physical addresses, email addresses, and phone numbers.
• Information shared during customer support interactions, detailing service requests and assistance provided.
• Usage analytics data that allows the Controller to assess engagement levels of their authorized users, including metrics and statistical information related to service utilization.

Sensitive categories of Personal Data

Sokkel maintains a policy against deliberately collecting or processing sensitive or special categories of Personal Data. This includes, but is not limited to, genetic information, health-related data, or details about religious affiliations.

The Controller is advised not to submit such sensitive data to the Processor’s services without prior explicit agreement, as outlined in the relevant section of the Subscription Agreement.

However, in the event that the Controller does transmit sensitive or special categories of Personal Data to the Processor’s services without obtaining prior consent, such information will still be protected. In these instances, the data will fall under the scope of the technical and organizational security measures that the Processor has implemented, as detailed in the security appendix to this agreement. The nature and purpose of processing.

The processing activities are directly tied to the Controller’s utilization of the Processor’s services. The specific purposes and parameters of this processing are determined and managed exclusively by the Controller, according to their own requirements and objectives. The primary reason for transferring data is to enable Sokkel to deliver its services effectively. These services are hosted and managed on computing infrastructure located within Europe.

Retention

The retention period for Personal Data is primarily governed by the Controller’s decisions and requirements. This arrangement allows the Controller to determine how long their data should be kept within the Processor’s systems.

Generally, the Processor will maintain the Personal Data for the duration of the Controller’s active subscription. Once the subscription term concludes, the data retention period typically ends, unless otherwise specified by the Controller.Generally, the Processor will maintain the Personal Data for the duration of the Controller’s active subscription. Once the subscription term concludes, the data retention period typically ends, unless otherwise specified by the Controller.

However, there are two key exceptions to this general rule:

• Certain laws or regulations may necessitate the retention of specific data beyond the subscription term.
• The Subscription Agreement between the Controller and Processor may include clauses that allow for extended data retention under particular circumstances.

These exceptions ensure compliance with legal obligations and agreed-upon terms, while still prioritizing the Controller’s authority over their data. The Processor will adhere to these retention guidelines, balancing the Controller’s preferences with any applicable legal or contractual requirements.

Security Measures in the Processing

Sokkel commits to implementing and maintaining a comprehensive set of security measures to protect Personal Data. These measures are designed to ensure the confidentiality, integrity, and availability of data processed on behalf of the Controller. The security framework includes technical and organizational safeguards specifically tailored for Sokkel’s services.

These measures are documented and regularly updated to address evolving security challenges and best practices in data protection, found at https://sokkel.io/terms/security.

Sokkel operationalizes security through a set of policies and continuous training. Extending this security commitment, Sokkel requires its sub-processors to implement and maintain security measures that are substantially equivalent to its own standards. This approach ensures a consistent level of protection throughout the data processing ecosystem.