# Data Processor Agreement between Signicat and Customer
# 1 Definitions
| Agreement | This Data Processing Agreement |
|---|---|
| Applicable Data Protection Law | All privacy laws and regulations in the country where Controller or Processor is registered, hereunder but not limited to national laws based on the European Union Regulation (EU) 2016/679 (the "GDPR"). |
| SaaS Agreement | The agreement between the Controller and the Processor under which the Processor provide the services the processing forms a part of. |
| Controller | The legal entity determining, alone or jointly with others, the purpose for and the means of the processing of Personal Data pursuant to this Agreement: The Customer pursuant to the SaaS Agreement. |
| Personal Data | Any information relating to an identified or identifiable natural person processed by the Processor on behalf of the Controller. |
| Processor | The legal entity processing data on behalf of the Controller pursuant to this Agreement: Signicat AS. |
| Party | Each of the entity “Controller” or “Processor” by themselves. Collectively knows as “Parties”. |
# 2 Purpose
This Agreement shall reflect the Parties agreement with respect to their rights and obligations pursuant to the Applicable Data Protection Law and concerns the Processor’s use of Personal Data on behalf of the Controller, including collection, recording, alignment, storage and disclosure or a combination of such uses. This Agreement is enclosed as an exhibit to and forms a part of the SaaS Agreement.
This Agreement shall ensure that Personal Data is protected from accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access when transmitted, stored or otherwise processed.
# 3 Scope and purpose of the data processing
The Processor shall process Personal Data on behalf of the Controller solely for the purpose of performing the tasks imposed on the Processor by the Controller pursuant to the SaaS Agreement, as part of the agreed delivery of services under the SaaS Agreement. The Parties further agree that any processing of Personal Data contemplated by this Agreement shall be conducted in accordance with the requirements set forth in the Applicable Data Protection Law, this Agreement, and the SaaS Agreement.
This Agreement covers any category of Personal Data. A specification on which Personal Data the Processor will process is set out in the Personal Data Checklist as part of the Agreement.
# 4 The Processor’s obligations
# 4.1 General
When processing Personal Data on behalf of the Controller, the Processor shall comply with any documented routines and instructions stipulated by the Controller at any given time, and the Processor shall process Personal Data in compliance with Applicable Data Protection Law and the Agreement including the Security Requirements Appendix.
Nothing in this Agreement shall be interpreted as preventing the Controller from taking the necessary steps to comply with the Applicable Data Protection Law.
The Processor shall specify to the Controller where the Personal Data is stored at any time and shall ensure that the Personal Data is stored and processed within the EU/EEA.
Notwithstanding the foregoing, the Processor may disclose Personal Data, and therefore process and / or transfer Personal Data to a third country or an international organisation, in the event that such processing / transfer is required by Applicable Data Protection Law, in which case the Processor shall notify the Controller of the legal requirement in question before processing unless the law in question prohibits such notification due to important grounds of public interests.
# 4.2 Assistance to the Controller
The Processor shall provide assistance to the Controller in fulfilling its duties under the Applicable Data Protection Law, including without limitation the Controllers obligations towards data subjects to ensure their right to information, access, rectification, erasure, restriction of processing, and data portability, to the extent such assistance is necessary for the Controller to be compliant with Applicable Data Protection Law.
# 5 Use of Sub-Processors
Processor shall ensure that any Sub-Processor (a "Sub-Processor"), and its sub-contractor, is bound by terms in accordance with the Applicable Data Protection Law.
Anyone who performs assignments on behalf of the Processor including processing of Personal Data shall be made familiar with the Processor’s contractual and legal obligations and fulfill the applicable requirements. Thus, the Processor is obliged to enter into a Data Processor Agreement with any Sub-Processor.
As of the effective date of this Agreement, the Controller acknowledges and agrees that the Processor has entered into an agreement with Sub-Processor(s) listed in the SaaS Agreement, and hereby consents to the use of such Sub-Processors.
The Processor may not use a subcontractor to process Personal Data without notifying the Controller in writing at least 30 days before the new Sub-Processor starts processing any Personal Data. The Controller may, within 90 days after being notified of the engagement of a new Sub-Processor, object to the engagement by terminating both the Agreement and the SaaS Agreement if it can demonstrate that the new Sub-Processor will not meet the requirements set out in GDPR. This termination right is Controller's sole and exclusive remedy if Controller objects to any new Sub-Processor.
# 6 Security
The Processor shall fulfill the requirements for technical and organisation security measures stipulated in the Applicable Data Protection Law, and shall comply with the Security Requirements Appendix to the SaaS Agreement. The documentation shall be made available upon the Controller’s request.
The Processor shall report to the Controller any discrepancies between this Agreement and the requirements set out in the Applicable Data Protection Law.
The Processor shall, if reasonably requested the Controller and to the extent necessary, assist the Controller in (i) complying with the Applicable Data Protection Law; (ii) conducting the necessary data protection impact assessments pursuant to the Applicable Data Protection Law, and (iii) consulting the relevant supervisory authority prior to processing where the data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the Controller to mitigate such risks.
# 7 Audits
The Processor shall regularly conduct audits for systems and services covered by this Agreement to assess the Processors compliance with the Applicable Data Protection Law. The same applies to Sub-Processors.
The Processor shall provide the Controller with its audit reports upon request. The same applies to audit reports of Sub-Processors. Such audit reports are subject to confidentiality obligations.
In addition to the provision of the audit reports, the Processor shall on Controller's reasonable request provide access to the Processors relevant processing systems, facilities and supporting documentation to conduct audits and inspections in accordance with Applicable Data Protection Laws. Such an audit will be conducted by an independent recognised third-party audit firm during regular business hours, with reasonable notice and reasonable confidentiality reports. The audit reports are subject to confidentiality obligations. These provisions regarding access to relevant processing systems, facilities and supporting documentation does also apply to Sub-Processor(s). In the event of any such inspection or audit, each Party shall provide all reasonable assistance to the other Party on a time and material basis.
If an audit reveals or confirms that the processing pursuant to this Agreement is unlawful or otherwise conducted in a manner not compliant with the Applicable Data Protection Law, the Parties shall take immediate action to ensure future compliance with the Applicable Data Protection Law.
# 8 Confidentiality
The Processor and the Processor's personnel shall observe unconditional confidentiality as regards the processing of Personal Data pursuant to this Agreement and any documentation accessed under this Agreement. The Processor shall not disclose Personal Data in any way to any employee or third party without the prior written approval of the Controller, except where (i) the disclosure is in accordance with the instructions from the Controller, or where (ii) Personal Data need to be disclosed to a competent public authority to comply with a legal obligation.
The Processor shall take reasonable steps to ensure the reliability of any personnel, sub-contractor or personnel of such sub-contractor who may have access to Personal Data processed pursuant to this Agreement, ensuring in each case that access is strictly on a need-to-know basis.
This provision shall survive expiration or termination of this Agreement.
# 9 Notification of non-compliance and data breaches
Processor shall give an initial notification to the Controller without undue delay, and at the latest within twentyfour (24) hours, if the Processor:
a) cannot, for any reason, comply with its obligations in this Agreement; or
b) becomes aware of any circumstance or change that is likely to have a substantial adverse effect on the Processor’s or its Sub-Processors’ ability to meet its obligations in this Agreement.
The Processor shall, as soon as possible or at the latest within twentyfour (24) hours after becoming aware of it, notify the Controller of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed or similar Personal Data breaches. Thereafter, the Processor shall contribute to and reasonably cooperate with the Controller to obtain the following information:
a) describe the nature of the personal data breach including the categories and approximate number of data subjects and personal data records concerned; b) communicate the name and contact details of the Processor’s data protection officer or other contacts where further information can be obtained; c) describe the likely consequences of the personal data breach; and d) describe the measures taken or proposed to be taken by the Processor to address the personal data breach, including, measures to mitigate its possible adverse effects.
The Processor shall co-operate with the Controller and take such reasonable steps as are directed by the Controller to assist in the investigation, mitigation and remediation of personal data breaches involving the Processor.
# 10 Liability
Subject to the limitations of liability of the SaaS Agreement, the Processor is liable for claims, costs (including reasonable expenses for legal services), loss, fines, expenses or damages incurred by the Controller as a result of the Processor's breach of this Agreement, including non-compliance with the Applicable Data Protection Law.
# 11 Term
This Agreement remains valid for as long as the SaaS Agreement is in force and terminates automatically upon the termination or expiration of the SaaS Agreement. The Processor may not process Personal Data on behalf of the Controller following the termination or expiration of this Agreement.
In the event of a material breach of this Agreement or the Applicable Data Protection Law, the Controller is entitled to terminate this Agreement with immediate effect and may instruct the Processor to cease further processing of the Personal Data in question with immediate effect.
# 12 Termination
Upon notification of termination of the SaaS Agreement, the Processor shall have all Personal Data processed on behalf of the Controller available for downloading pursuant to this Agreement in a format agreed on between the Parties, and in accordance with reasonable industry standards.
The Processor shall further delete or destroy in a secure and definite/irreversible manner all physical mediums that contain Personal Data processed under this Agreement, at the latest on the date that the termination of the SaaS Agreement takes effect.
# 13 Notifications
The Parties shall ensure that the Parties have up to date notification and contact information.
# 14 Entire agreement
This Agreement, as well as the SaaS Agreement with appendices, constitutes the entire agreement between the Parties with respect to the subject matter hereof (the Processor’s processing of Personal Data on behalf of the Controller) and, upon its effectiveness, shall supersede all prior agreements, understandings and arrangements, both oral and written, between the Parties with respect to such subject matter.
# 15 Governing law and legal venue
Unless otherwise agreed through the SaaS Agreement, this Agreement is governed by Norwegian law, and any disputes arising from or relating to this Agreement shall be subject to the exclusive jurisdiction of Norwegian courts.