Data Processing Agreement

The Controller determines the purposes and means of processing. The Processor processes Customer Personal Data only on documented instructions from the Controller — including the Services Agreement itself as the primary written instruction — and as further specified in Annex I.

This DPA is effective from the earlier of (a) the effective date of the Services Agreement and (b) the first access by the Processor to Customer Personal Data, and continues for the duration of the Services plus any post-termination period required to return or delete data under Clause 10.

The Processor shall:

• process Customer Personal Data only on the Controller’s documented instructions, including with regard to transfers to third countries;
• ensure that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
• implement the technical and organisational measures set out in Annex II;
• respect the conditions for engaging sub-processors set out in Clause 5;
• assist the Controller in fulfilling data-subject rights and in meeting obligations under GDPR Art. 32–36;
• at the Controller’s election, delete or return all Customer Personal Data at the end of the Services, as described in Clause 10;
• make available to the Controller information necessary to demonstrate compliance with this DPA and allow for audits under Clause 9.

Taking into account the state of the art and the risks to data subjects, the Processor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the measures described in Annex II. The Processor reviews and updates these measures at least annually and whenever a material change warrants it.

The Controller provides general written authorisation for the Processor to engage sub-processors, subject to:

• the sub-processors listed in Annex III and at /subprocessors/ are approved as of the Effective Date;
• the Processor notifies the Controller at least 30 days before adding or replacing a sub-processor processing Customer Personal Data;
• the Controller may object for documented reasons within the notice period; if the objection cannot be resolved, the Controller may terminate the affected Service with written notice;
• the Processor imposes on each sub-processor the same data-protection obligations as in this DPA by written contract.

Where Customer Personal Data is transferred to a jurisdiction outside the EEA without an adequacy decision, such transfer is performed under the EU Commission Standard Contractual Clauses (Decision 2021/914), Module Three (processor to processor), and/or the EU-US Data Privacy Framework where the recipient is certified. The SCCs are incorporated by reference into this DPA; Annex III identifies the transfer mechanism per sub-processor.

The Processor shall, taking into account the nature of the processing, assist the Controller with appropriate technical and organisational measures, insofar as possible, in responding to requests to exercise data-subject rights under GDPR Chapter III. Where a data subject contacts the Processor directly, the Processor forwards the request to the Controller without undue delay.

The Processor notifies the Controller without undue delay and in any event within 48 hours of becoming aware of a personal-data breach affecting Customer Personal Data. The notification describes the nature of the breach, likely consequences, the categories and approximate number of data subjects and records concerned, and measures taken or proposed.

The Processor provides the Controller with audit evidence sufficient to demonstrate compliance with this DPA, including current third-party certifications held by the Processor and its sub-processors (e.g. ISO 27001, SOC 2), summary reports, and, on reasonable notice and subject to confidentiality, a remote audit session. On-site audits are available on written request at the Controller’s expense, limited to once per calendar year unless a material breach or regulatory investigation warrants more.

On termination of the Services, the Processor shall, at the Controller’s election: (a) provide a full export of Customer Personal Data in a durable format within 30 days, or (b) delete Customer Personal Data from active systems within 30 days and from backups within 90 days. Records retained under EU or Member State law (e.g. Bogføringsloven accounting obligations) are preserved for the statutory minimum and no longer.

This DPA is governed by Danish law. Disputes are resolved by the courts of Copenhagen. Nothing in this DPA limits the rights of data subjects or the supervisory authority under GDPR or applicable national law.