Data processing agreement

1. Parties and duration

The customer is the controller, or a processor with the necessary authorisation from its controller. Pelle Lindal, who operates Svarlane from Kvernsteinkroken 27, 4320 Sandnes, Norway, is the processor or subprocessor for customer data. The contact point is info@svarlane.no. The customer’s organisation and contact person are stated in the order.

The agreement governs processing of customer data for the service from its lawful commencement until the data has been returned or deleted under agreed instructions. The data processing agreement takes precedence in the event of a conflict concerning personal data processing. Standard contractual clauses lawfully entered into for transfers take precedence within their scope.

2. Documented instructions

Svarlane must process customer data in accordance with the customer’s documented, lawful instructions, including those concerning international transfers. The order, selected features, authorised settings and documented support requests may constitute instructions within the purpose of the agreement.

Svarlane must immediately inform the customer if, in the provider’s opinion, an instruction infringes data protection law. The affected processing may be suspended while the matter is clarified. Processing beyond the instructions may only be justified by a legal obligation under Norwegian or EU/EEA law applicable to Svarlane. The customer must be informed before such processing unless that law prohibits this on important grounds of public interest. Demands from authorities in other countries must be assessed separately under the GDPR, including Chapter V. The provider’s own purposes require a separate legal basis and cannot be concealed as customer instructions.

3. The customer’s rights and obligations

Where the customer is the controller, it determines the purposes and necessary means, ensures a legal basis, informs data subjects, keeps data accurate and restricts access. Where the customer is itself a processor, it must have the necessary authorisation and convey the controller’s documented instructions. Within its role, the customer must assess risk, the need for a data protection impact assessment and the suitability of the service for the data concerned.

The customer may issue and amend lawful instructions, obtain necessary documentation, object to new subprocessors and conduct audits under the agreement. The customer may terminate the affected processing and the agreement if Svarlane no longer provides sufficient guarantees under Article 28(1), with appropriate return or deletion. Instructions requiring new functionality or substantial additional work must be clarified separately. Statutory obligations remain in force during that clarification.

4. Confidentiality and personnel

Access must be limited to authorised persons with a documented work-related need. Those persons must be bound by contractual or statutory confidentiality obligations and receive relevant training and instructions. The obligation continues after access ends.

Support access must be justified, limited and traceable. The actual administrator must be identifiable through the platform’s audit data, including where the customer’s log shows a system administrator as the actor.

5. Security and changes to measures

Svarlane must implement appropriate technical and organisational measures under Article 32, assessed against risk, the nature and scope of processing, available technology and costs. The measures must protect confidentiality, integrity, availability and the ability to restore data and services.

The security overview forms Annex B. Svarlane must maintain documentation of the measures, relevant operational controls and incident handling. Quantified operational and recovery guarantees require a separate agreement. Measures may be improved and replaced with equivalent or better protection. A material reduction requires a lawful and agreed basis.

6. Subprocessors

By entering into this data processing agreement, the customer grants general written authorisation for documented subprocessors in provider Annex C within the scope of the activated processing and the customer’s lawful instructions. Svarlane must provide the customer with information about the actual legal recipient, tasks, processing countries and relevant transfer basis before access is granted. The authorisation covers only processing that is sufficiently documented. Svarlane must enter into written agreements imposing at least equivalent data protection obligations and remains responsible to the customer for their agreed tasks under Article 28(4).

Planned additions or replacements are notified in writing at least 30 days before new providers gain access. The customer may raise a reasoned data protection objection within the notice period. The parties must seek an appropriate alternative solution. If this is not possible, the customer may terminate the affected service before the transfer and receive a refund of unused prepayments for that part.

A time-critical replacement to address an urgent risk must still meet the legal requirements for information and an opportunity to object. An updated website list alone does not replace the agreed notice. On request, Svarlane must provide necessary documentation of the subprocessors’ tasks and agreed protection.

7. International transfers

Customer data may only be transferred or made available outside the EEA on documented instructions and a valid basis under Chapter V GDPR. Svarlane must identify the recipient, country, purpose and relevant onward transfers, and assess the need for supplementary measures.

The relevant adequacy decision or standard contractual clauses, the correct module, completed annexes and any transfer assessment must be documented. The agreement does not override the standard clauses or data subjects’ rights. Statutory disclosure demands are assessed, limited and notified where permitted by law.

8. Assistance with rights and assessments

Svarlane must, insofar as possible and taking into account the nature of processing, assist the customer with data subjects’ rights through appropriate measures. Requests concerning customer data are forwarded to the customer without undue delay. Responding independently on the customer’s behalf requires instructions or legal authority.

Svarlane must also assist with Articles 32 to 36, including risk assessments, data protection impact assessments, prior consultation and incident documentation, based on the information available. Reasonable fees for additional work may be agreed in advance. Pricing or disagreement must not prevent necessary or time-critical statutory assistance.

9. Personal data breaches

When Svarlane becomes aware of a breach affecting customer data, it must notify the customer without undue delay. Initial notice must be given even while the investigation is ongoing. Further information may be supplied in stages.

To the extent that information is available, notification must describe the incident, categories and approximate numbers of affected individuals and records, likely consequences, measures taken and proposed, and a contact for follow-up. Svarlane must mitigate harm, preserve relevant evidence and assist the customer.

The customer assesses notification to the supervisory authority within the statutory deadline, normally 72 hours after becoming aware where notification is required, and communication to data subjects where Article 34 requires it. This deadline for notifying the authority does not entitle the processor to wait as long before notifying the customer.

10. Documentation and audits

Svarlane must make available the information necessary to demonstrate compliance and allow and contribute to audits and inspections carried out by the customer or an authorised independent auditor.

Audits are planned with reasonable notice, confidentiality and protection for other customers. Existing documentation and remote reviews may be used where they provide a sufficient basis. The need for incident-triggered reviews and authorities’ powers must be accommodated. No general annual limit, unreasonable fee or certification requirement may override the statutory audit right.

11. Return, deletion and termination

On termination, Svarlane must, at the customer’s choice, return or delete the personal data and delete existing copies, unless Norwegian or EU/EEA law applicable to the processing requires further retention. Data retained further must be isolated for that purpose with restricted access.

Return or deletion must be carried out without undue delay following a verified instruction. Svarlane must clarify and document the scope, suitable export format, practical implementation and any lawful retention exceptions with the customer. Follow-up must cover R2 objects, derived data, subprocessors and relevant copies. Svarlane must confirm the measures carried out and disclose any remaining copies, the basis for their retention and their expiry.

Moving a case to trash or marking a privacy request as completed does not in itself document deletion across all stores. Svarlane must provide factual documentation of the measures carried out.

12. Liability, payment and governing law

The exclusion of liability in the terms of service applies between the parties only to the extent that it is lawful. Data subjects’ compensation rights, supervisory authorities’ powers, responsibility for subprocessors under Article 28 and statutory rights of recourse remain in force. This provision does not limit rights or obligations under any standard contractual clauses.

Norwegian law is the basis for the parties’ B2B agreement. The statutory rights of the relevant data protection authority and data subjects remain in force. The agreement continues to govern retained customer data after the service ends.

13. Annex A — processing

The subject matter is the operation of the customer’s shared support inboxes. Processing includes receipt, structuring, storage, search, access, case assignment, collaboration, sending, reporting and the customer’s lawful export and deletion instructions. The duration follows the service relationship and necessary termination activities.

Data subjects may include the customer’s employees, contractors, customers, prospective customers, suppliers, contact persons, message senders and recipients. Data may include names, contact details, organisational affiliation, email headers, content, attachments, case data, notes, tasks, audit data and associated identifiers.

Special categories of data and data under Article 10 are not a specifically intended processing purpose in the standard configuration. The customer must assess any occurrence and agree appropriate safeguards before such use. AI and external integrations are included only to the extent lawfully instructed by the customer and where provider terms have been clarified.

14. Annexes B, C and D

The security overview forms Annex B. The subprocessor list forms Annex C. The retention and deletion overview forms Annex D. The accepted document versions and any individually agreed processing locations, instructions and deadlines must be retained with the agreement. Material changes are handled under the agreement’s notice and amendment provisions.