This data processing agreement (the "DPA") forms part of the terms of service between Nordic USV AS ("Nordic USV", the processor) and the customer (the controller). It applies where Nordic USV processes personal data on the customer's behalf in Kystdata.io. The customer enters into it on behalf of its organization by using the platform. If the customer has a signed data processing agreement with Nordic USV, the signed agreement prevails.
1. What the processing covers
Subject and purpose. Providing Kystdata.io to the customer: storing, displaying, analyzing and exporting the customer's data, and the AI features when the customer has turned them on.
Categories of data subjects. The customer's users and contact persons, and other people the customer's users mention in free text or uploaded files.
Categories of personal data. Names, email addresses, phone numbers and roles of users and contact persons; activity in the platform connected to user accounts; and personal data the customer's users include in free text, figure text, comments, uploaded files and messages to the AI assistant. The platform is not intended for special categories of personal data (GDPR article 9), and the customer must not put such data into it.
Duration. For as long as the customer relationship lasts, plus the deletion period in section 8.
Personal data Nordic USV processes for its own purposes (user account administration, support, invoicing, security, product analytics) is covered by the privacy policy, where Nordic USV is the controller.
2. Instructions
Nordic USV processes personal data only on the customer's documented instructions, unless the law requires otherwise. In that case Nordic USV informs the customer before processing, unless the law prohibits it. The terms of service, this DPA, and the settings the customer's organization administrators choose in the platform, including turning the AI features on or off, are the customer's instructions. Nordic USV tells the customer if it believes an instruction breaks the law.
3. Confidentiality
Only people who need access to operate the platform have access to the customer's personal data. They are bound by confidentiality.
4. Security
Nordic USV applies technical and organizational measures suited to the risk, as described in section 7 of the privacy policy: encryption in transit, access control at the database level, activity logging, secure handling of system credentials, and restricted access to production data.
5. Sub-processors
The customer gives Nordic USV general authorization to use the sub-processors in the sub-processor list. Nordic USV notifies the customer's organization administrators at least 30 days before a new sub-processor starts processing personal data. The customer can object within that period on reasonable grounds related to data protection. If the parties cannot resolve the objection, the customer can terminate the affected service with effect from the day the new sub-processor is taken into use. Nordic USV imposes the same data protection obligations on its sub-processors as in this DPA, and remains responsible to the customer for their performance.
6. Assistance
Nordic USV assists the customer, as far as reasonably possible, in responding to requests from data subjects and in meeting the customer's obligations on security, breach notification, data protection impact assessments and consultations with the supervisory authority. Nordic USV may charge for assistance that goes beyond what the platform offers as standard.
7. Personal data breaches
Nordic USV notifies the customer's organization administrators without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach affecting the customer's personal data. The notice describes the nature of the breach, the likely consequences, the measures taken, and a contact point.
8. Deletion and return
During the customer relationship, the customer can export its data from the platform at any time. When the relationship ends, Nordic USV assists with export on request for up to 30 days, then deletes the customer's personal data within 90 days, unless the law requires it to be kept. Backups are deleted on their normal rotation, at the latest 12 months later.
9. Documentation and audits
Nordic USV makes available the information needed to demonstrate compliance with this DPA, and allows audits by the customer or an auditor the customer appoints, at most once a year unless a supervisory authority requires otherwise or a breach has occurred. Audits are agreed in advance, take place during normal working hours, and must not disturb the operation of the platform. Each party covers its own costs.
10. Transfers out of the EU/EEA
Nordic USV transfers personal data out of the EU/EEA only under a legal basis in GDPR chapter V, as stated in the sub-processor list.
11. Liability and term
The liability provisions in the terms of service apply to this DPA. The DPA lasts as long as Nordic USV processes personal data on the customer's behalf.
This DPA is available in Norwegian and English. In case of conflict, the Norwegian version prevails.