Data Processing Agreement

Data Processing Agreement

Effective date: 22.11.2020

Agreement dated on the date when you agree to this agreement, Terms and Conditions and Privacy Policy

BETWEEN:

(1) You (the “Controller” or “you”); and

(2) DealBuilder AS, a company established in Norway, registration number 926 077 139, with its business address at Voksenkollveien 126a 0790 Oslo, Norway (the «Processor»).

BACKGROUND

(A) This Agreement is to ensure there is in place proper arrangements relating to personal data passed from you to the Processor.

(B) This Agreement is compliant with the requirements of the General Data Protection Regulation.

(C) The parties wish to record their commitments under this Agreement.

IT IS AGREED AS FOLLOWS:

1. Definitions

‍In this Agreement:

‍»Data Protection Laws» means the any EU national data protection act, together with successor legislation incorporating GDPR;

«Data» means personal data passed under this Agreement;

“GDPR” means the General Data Protection Regulation;

«Services» means our website and esignature services software.

2. Data  processing

‍Processor is the data processor for the Data. The Data Processor agrees to process the Data only in accordance with Data Protection Laws and in particular on the following conditions:

1. the Processor shall only process the Data (i) on the written instructions from you (ii) only process the Data for completing obligations related to the Services;
2. ensure that all employees and other representatives accessing the Data are (i) aware of the terms of this Agreement and (ii) have received comprehensive training on Data Protection Laws and related good practice, and (iii) are bound by a commitment of confidentiality;
3. the Processor have implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk;
4. the Processor shall not involve any third party in the processing of the Data without your consent. Such consent may be withheld without reason. If consent is given a further processing agreement will be required;
5. respond to requests from individuals exercising their rights to erasure, rectification, access, restriction, portability, object and right not to be subject to automated decision making;
6. the Processor shall ensure compliance with the obligations pursuant to security, notification of data breaches, communication of data breaches to individuals, data protection impact assessments and when necessary consultation with the national regulator, taking into account the nature of processing and the information available to the Processor;
7. at your choice safely delete or return the Data at any time. Where the Processor is to delete the Data, deletion shall include destruction of all existing copies unless otherwise a legal requirement to retain the Data. Where there is a legal requirement the Processor will prior to entering into this Agreement confirm such an obligation in writing to you. Upon your request the Processor shall provide certification of destruction of all Data;
8. make immediately available to you all information necessary to demonstrate compliance with the obligations laid down under this Agreement and allow for and contribute to any audits, inspections or other verification exercises required from time to time;
9. arrangements relating to the secure transfer of the Data from you to the Processor and the safe keeping of the Data by the Processor;
10. maintain the integrity of the Data, without alteration, ensuring that the Data can be separated from any other information created;
11. immediately contact you if there is any personal data breach or incident where the Data may have been compromised.

‍

3. Scope of Processing

   1. Data is processed and stored in the European Union or United Stated at selected data centers depending on where the user is located to guarantee a fast system regardless of geography.
   2. The scope of processed Data includes the following types of personal data;
   
   – first name and last name of the sender/seller,
   – email address of the sender/seller,
   – phone number of the sender/seller,
   – company street address of the seller,
   – IP address of the sender/seller,
   – signing environment of the signer/seller (such as device type and type of – operating system on that device),
   
   – first and last name of the signing counterparts,
   – email address of the signing counterparts,
   – phone number of the signing counterparts,
   – street address of the signing counterparts, 
   – IP address of the signing counterparts, 
   – signing environment of the signing counterparts (such as device type and type of operating system on that device), 
   
   together with personal data contained in the individual documents.
   
   This personal data is processed for the purpose of signing contracts and other documents of the Controller.
   
   3. All Data and its copy shall remain the property of the Controller. The Processor will not grant access to Data to third parties without direct authorization of the Controller.
   
   

4. Subprocessors
   
   1. The Processor ensures that Personal Data is processed within EU/EEA and not transferred to a third country or international organization if the Controller does not consent in writing to such transfer.
   
   2. The Controller hereby specifically authorizes the Processor to engage the following: 

• Microsoft Azure, Ireland, Storage/servers (Standard Contractual Clauses);
  
• PowerOffice, Norway , Invoicing and accounting solutions provider (Standard Contractual Clauses);
  
• DNB ASA, Norway, payment service provider, (Standard Contractual Clauses).
  
• Puzzel, Norway, SMS gateway provider, (Standard Contractual Clauses). 
• Twilio, USA, email system provider, (Standard Contractual Clauses). 

3. The Processor is authorized to replace Subprocessors. The Processor will notify you of any intended replacement of any Subprocessor and you are entitled to object to such changes within 10 days of receiving notification.
   
   

5. Termination
   
   1. You may immediately terminate this Agreement on written notice to the Processor.  The Processor may not terminate this Agreement without your written consent.
   2. Upon termination of this Agreement for whatsoever reason, the Processor shall return all Data in its possession to the Controller and shall thereafter delete any Data stored.

6. General

   1. This Agreement represents the entire understanding of the parties relating to necessary legal protections arising out of their relationship under Data Protection Laws.
   2. This Agreement is subject to the law of Norway and the exclusive jurisdiction of  courts of Norway.

7. Contacts

Please send your questions about this Data Processing Agreement and our Privacy Policy to the following email: post@dealbuilder.io