Aimz AS is referred to herein as the “Processor” and the Customer (as defined in the Contract) is referred to as the “Controller”.

The purpose of this Data Processing Agreement (the “Agreement”) is to regulate the parties’ rights and obligations under applicable data protection legislation, including the Norwegian Personal Data Act of 2018, which incorporates the EU General Data Protection Regulation 2016/679 (GDPR) (hereinafter jointly referred to as the “data protection legislation”).

The purpose of this Agreement is to regulate the Processor’s use of personal data on behalf of the Controller to which the Processor gains access in connection with the delivery of services under the License Agreement for the use of AIMZ (the “Contract”), including use of AIMZ (the “Solution”), in accordance with GDPR Article 28.

Annexes A, B and C to this Data Processing Agreement form an integral part of the agreement and contain, respectively, further details on the processing of personal data, the list of approved sub-processors and a description of the security measures.

The Agreement takes precedence over any corresponding data protection provisions in other agreements between the parties, including the Contract.

This Agreement does not release the Processor from obligations imposed on the Processor by the data protection legislation or other legislation. This Agreement only regulates the Processor’s processing on behalf of the Controller in connection with the Solution. For personal data that the Processor processes as an independent controller (e.g. CRM, invoicing, supplier and support channels outside the Solution), the Processor’s own privacy documents apply and not this Agreement.

The Controller is responsible for ensuring that the processing of personal data takes place in accordance with the data protection legislation.

The Controller has the right and the obligation to determine the purpose of the processing of personal data and the means to be used. The Controller is further responsible for ensuring that there is a legal basis for the processing of personal data that the Processor is instructed to carry out.

Instructions: The Processor shall only process personal data on documented instructions from the Controller, unless otherwise required by national or European law. The Processor shall immediately notify the Controller if the Processor is of the opinion that an instruction infringes the data protection legislation. If the Processor is required by law to process the personal data otherwise, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. This Agreement with its annexes, the Contract, and the Controller’s configuration and use of the Solution constitute the Controller’s documented instructions. The Processor shall process the personal data exclusively for the purposes, for the duration and under the conditions set out in these instructions.

Confidentiality: The Processor may only grant access to personal data processed on behalf of the Controller to persons who are subject to the Processor’s authority of instruction and who have committed themselves to confidentiality or are subject to an appropriate statutory obligation of confidentiality, and only to the extent necessary.

At the request of the Controller, the Processor shall be able to demonstrate that the persons concerned who are subject to the Processor’s authority of instruction are bound by the above obligation of confidentiality.

Security: The Processor shall implement appropriate technical and organisational measures to achieve a level of security appropriate to the risk, cf. GDPR Article 32. The Processor shall also assist the Controller in complying with the Controller’s obligations under GDPR Article 32, including by making the necessary information available to the Controller. An overview of the measures is set out in Annex C.

The Controller shall likewise make available to the Processor the information necessary to enable the Processor to identify and assess risks in accordance with GDPR Article 32.

The Processor shall meet the requirements of GDPR Article 28(2) and (4) where the Processor engages another processor (a “sub-processor”).

The Controller gives a general authorisation for the Processor to engage sub-processors. The Processor shall maintain an up-to-date list of current sub-processors on its website. Changes to the list (addition or replacement of sub-processors) will be published on the Processor’s website. The Processor shall additionally notify by e-mail any Controller that has asked to receive such notices. The Controller may, within thirty (30) days of a published change, raise objectively justified objections to a new sub-processor. If the parties fail to reach agreement, the Controller may terminate the Contract with effect from the date on which the new sub-processor was to be taken into use. Continued use of the Solution after the expiry of the objection period is deemed acceptance of the new sub-processor. The list of sub-processors already approved by the Controller is set out in Annex B.

When engaging sub-processors, the sub-processor shall as a minimum be subject to the same data protection obligations as set out in this Agreement. At the Controller’s request, the Processor shall document the sub-processor’s data protection obligations, so that the Controller has the opportunity to satisfy itself that they correspond to the obligations in this Agreement. This may be done by referring to the sub-processor’s published data processing terms. Commercial terms of the sub-processor agreement are not covered by this documentation requirement.

The Processor shall remain fully liable for any failure by the sub-processor to fulfil its data protection obligations.

The Processor may only transfer personal data to third countries or international organisations on documented instructions from the Controller, unless the transfer is required by national or European law. In that case the Controller shall be informed of that legal requirement unless public interest prevents this. For the avoidance of doubt, a transfer to a third country in connection with the use of approved sub-processors pursuant to clause 5 above shall always be regarded as a transfer on documented instruction from the Controller. Any transfer shall always take place in accordance with GDPR Chapter V, including being subject to a lawful transfer mechanism.

Transfer mechanism for third countries: For transfers of personal data to third countries (including the USA), the Processor shall ensure that the transfer takes place in accordance with GDPR Chapter V, including by using the EU Standard Contractual Clauses (EU SCC 2021/914) and carrying out a Transfer Impact Assessment (TIA) with the necessary supplementary measures. At the Controller’s request, the Processor shall make available high-level documentation confirming a valid transfer mechanism.

This Agreement shall not be confused with standard data protection clauses as referred to in GDPR Article 46(2)(c) and (d), and this Agreement cannot constitute a basis for the transfer of personal data under GDPR Chapter V.

To the extent possible, the Processor shall assist the Controller in responding to requests from data subjects for the exercise of their rights, assist with information and notification in the event of qualifying personal data breaches, assist with data protection impact assessments and assist in connection with prior consultations with the Norwegian Data Protection Authority (Datatilsynet). Assistance under this clause that goes beyond ordinary user support may be invoiced at the Processor’s hourly rates applicable at any time, cf. the Contract, unless the assistance results from the Processor’s own breach of this Agreement or the data protection legislation. Notification under clause 7.2 is always free of charge for the Controller.

In the event of a personal data breach, the Processor shall notify the Controller of the breach without undue delay after becoming aware of it, so that the Controller can comply with its obligation to notify the breach to the competent supervisory authority (in Norway: Datatilsynet), cf. GDPR Article 33. The notification shall, as far as known, describe the nature of the breach, the categories and approximate number of data subjects and personal data records concerned, the likely consequences, and the measures taken or proposed. Information not available at the time of the first notification shall be provided without undue delay as it becomes available.

Enquiries about data protection and this Agreement shall be sent to contact@aimz.no.

Each party is liable for any financial loss it causes the other party through breach of this Agreement. The limitations of liability in the Contract also apply here.

Each party is liable to a data subject who has suffered material or non-material damage where the damage is caused by the party having acted outside or contrary to this Agreement or the data protection legislation, cf. GDPR Article 82(1).

Upon termination of the data processing services, the Processor shall, at the Controller’s choice, delete all personal data processed on behalf of the Controller or return all personal data and delete existing copies, unless national or European law requires storage of the personal data. Return takes place in the Processor’s standard format, cf. the Contract. Personal data in backups is deleted as the backups expire in the ordinary backup cycle, and shall not be restored or used until then.

Deletion at sub-processors: Upon termination, the Processor shall instruct relevant sub-processors to delete or return personal data processed on behalf of the Controller. The Processor shall confirm completed deletion/return within a reasonable time (normally within 30–90 days) after termination, unless another deadline follows from law.

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations under the data protection legislation and this Agreement. Furthermore, the Processor shall allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.

Audits shall be notified in writing at least thirty (30) days in advance, unless Datatilsynet requires otherwise or there is a specific suspicion of breach of this Agreement. Audits are carried out by the Processor providing documentation and answering written questions, as a general rule not more often than once a year. On-site inspections only take place if the documentation is not sufficient to demonstrate compliance, if Datatilsynet requires it, or if there is a specific suspicion of breach of this Agreement. Inspections take place during normal working hours and without unreasonable disruption to the Processor’s operations. The auditor shall be bound by confidentiality. The Controller covers its own costs and the Processor’s reasonable costs of the audit, unless the audit reveals material breaches of this Agreement.

The Agreement enters into force on the same date as the Contract.

The Agreement applies for as long as the data processing services last and cannot be terminated during that period, unless the parties agree other terms governing the delivery of the data processing services in accordance with applicable data protection legislation.

If the Contract or the delivery of the data processing services ends, and the personal data has been deleted or returned to the Controller in accordance with clause 9.1 above, this Agreement terminates. The Agreement nevertheless continues to apply to personal data in backups until it has been deleted.