Legal

Data Processing Agreement

Jelpify AS, Vossegtata 22, 0475 Oslo, Norway

This Data Processing Agreement ("DPA") forms part of the agreement between Jelpify AS ("Jelpify", "Processor") and the customer identified in the applicable Customer Contract ("Controller"). It supplements the Master Service Agreement ("MSA") and governs the processing of Personal Data in connection with the provision of Jelpify's SaaS platform. If you have any questions, you can reach us at post@jelpify.no.

1. Purpose and Scope

1.1 This Agreement sets out the terms under which the Processor processes Personal Data on behalf of the Controller.

1.2 The Processor shall process Personal Data only:

  • On documented instructions from the Controller
  • In accordance with GDPR
  • In accordance with applicable Norwegian data protection laws

1.3 This Agreement satisfies the requirements of Article 28(3) GDPR.

2. Definitions

For the purposes of this Agreement:

  • "Personal Data" means any information relating to an identified or identifiable natural person as defined in GDPR Art. 4(1).
  • "Processing" has the meaning set out in GDPR Art. 4(2).
  • "Data Subject" means the individual to whom Personal Data relates.
  • "Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.
  • "Security Incident" means any confirmed or reasonably suspected breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

3. Nature and Purpose of Processing

3.1 The Processor provides a SaaS platform enabling the Controller to manage business operations.

3.2 Processing activities may include:

  • Hosting and storage of Personal Data
  • Transmission of data
  • Access control and authentication
  • Backup and disaster recovery
  • Technical support
  • System maintenance

3.3 The duration of processing corresponds to the duration of the MSA unless otherwise agreed.

4. Categories of Data Subjects and Personal Data

4.1 Data Subjects may include:

  • Employees of the Controller
  • Customers of the Controller
  • Contractors
  • Business partners

4.2 Categories of Personal Data may include:

  • Name
  • Email address
  • Contact details
  • Job title
  • Account credentials
  • Usage data
  • Financial or billing information (where applicable)

The Controller determines the categories of data processed.

5. Controller Obligations

The Controller shall:

5.1 Ensure that it has a lawful basis for processing Personal Data.

5.2 Provide Data Subjects with required privacy notices.

5.3 Ensure that instructions to the Processor comply with applicable laws.

5.4 Remain solely responsible for determining the purposes and means of processing.

6. Processor Obligations

The Processor shall:

6.1 Process Personal Data only on documented instructions from the Controller.

6.2 Ensure that persons authorized to process Personal Data:

  • Are bound by confidentiality obligations
  • Receive appropriate data protection training

6.3 Implement appropriate technical and organizational measures as required under GDPR Art. 32.

6.4 Assist the Controller in complying with obligations under GDPR Articles 32–36, including:

  • Security
  • Data breach notification
  • Data Protection Impact Assessments
  • Prior consultation with supervisory authorities

7. Information Security Measures

The Processor maintains an information security framework aligned with ISO/IEC 27001 principles and risk-based controls.

Security measures include:

7.1 Organizational Controls

  • Documented security policies
  • Risk assessments
  • Role-based access control
  • Confidentiality agreements
  • Security awareness training
  • Vendor risk management
  • Change management procedures

7.2 Technical Controls

  • Encryption in transit (TLS)
  • Encryption at rest (where applicable)
  • Access control mechanisms
  • Multi-factor authentication (where applicable)
  • Logging and monitoring
  • Vulnerability management
  • Secure development lifecycle
  • Backup and disaster recovery procedures

7.3 Physical Controls

  • Secure data center facilities
  • Access controls
  • Environmental safeguards

Security controls are reviewed periodically.

8. Sub-processors

8.1 The Processor may engage Sub-processors.

8.2 The Processor shall:

  • Enter into written agreements with Sub-processors
  • Impose equivalent data protection obligations
  • Remain fully liable for Sub-processor performance

8.3 The Processor shall provide the Controller with a list of Sub-processors upon request.

8.4 The Controller may object to new Sub-processors on reasonable grounds relating to data protection.

9. International Transfers

9.1 Personal Data shall be processed within the EEA unless otherwise agreed.

9.2 If transfers outside the EEA occur, the Processor shall ensure appropriate safeguards, including:

  • EU Standard Contractual Clauses (SCCs)
  • Adequacy decisions
  • Additional technical safeguards

10. Data Subject Rights

The Processor shall:

10.1 Assist the Controller in responding to Data Subject requests, including:

  • Access
  • Rectification
  • Erasure
  • Restriction
  • Portability
  • Objection

10.2 Notify the Controller promptly if it receives a request directly from a Data Subject.

11. Personal Data Breach

11.1 The Processor shall notify the Controller without undue delay after becoming aware of a Security Incident.

11.2 The notification shall include:

  • Nature of the breach
  • Categories of affected data
  • Likely consequences
  • Measures taken or proposed

11.3 The Processor shall cooperate in remediation and investigation.

12. Audit and Compliance

12.1 The Processor shall make available information necessary to demonstrate compliance with this Agreement.

12.2 The Controller may conduct audits:

  • No more than once per year (unless required by law)
  • During normal business hours
  • With reasonable notice

12.3 The Processor may provide third-party audit reports (e.g., ISO, SOC 2) in lieu of direct audits where appropriate.

13. Data Retention and Deletion

13.1 Upon termination of services, the Processor shall:

  • Delete or return Personal Data
  • Unless retention is required by law

13.2 Deletion shall be performed securely.

Backup retention may apply for a limited period under standard recovery procedures.

14. Confidentiality

The Processor shall treat all Personal Data as confidential and shall not disclose it except as required by law.

15. Liability

Liability shall be governed by the MSA.

Nothing in this Agreement limits liability under applicable data protection law.

16. Governing Law

This Agreement shall be governed by Norwegian law unless otherwise agreed in the MSA.

17. Execution

This Agreement is executed by authorized representatives of Jelpify AS ("Processor") and the customer identified in the applicable Customer Contract ("Controller"), as part of that Customer Contract.