Data Processing Agreement

If the Data Processor changes or includes new subcontractors, the Data Controller shall be notified of these 90 calendar days before the new subcontractor starts processing personal data and the Data Controller may within 30 calendar days oppose the change. If the Data Controller opposes the change, the Data Controller may terminate the Terms-of-Use Agreement with 60 calendar days' notice. Notification of termination must be given at the same date as the Data Controller opposes the change. If the Data Controller does not terminate the Terms-of-Use Agreement, the new subcontractor is deemed to be accepted.

In case of change of a subcontractor, the former subcontractor must confirm in writing to the Data Processor that all personal data has been permanently deleted from its systems.

If the Data Processor is to enter into an agreement with Subcontractors in countries outside the EU/EEA, this should only be done according to valid mechanisms for such transfers such as EUs model clauses for the transfer of personal data to third countries or other applicable basis for transfer to third countries in accordance with GDPR Chapter 5. The same applies even if Personal Data is retained or stored in the EU/EEA when personnel with access to the data are located outside the EU/EEA.

5. Personal data security

The Data Processor shall ensure, through appropriate planned, systematic, organizational and technical measures, adequate information security in terms of confidentiality, integrity and availability in connection with the processing of personal data in accordance with GDPR Article 32.

The Data Processor should be able to document security measures. The documentation must be made available at the Data Controller's request.

The Data Processor shall ensure satisfactory personal data security regarding:

• confidentiality, i.e., the data is not available to persons who do not have legal access to the data,
• integrity, i.e. the data is not changed in an unauthorized or unintended manner and
• availability, i.e. the data is available and operative for legitimate and authorized use.

The Data Processor shall have routines and systematic processes to follow up on violations of personal data security ("Deviation"). If the Deviation is caused by the Data Controller, or circumstances within the control of the Data Controller, the Data Processor may invoice the Data Controller for work related to follow-up of the Deviation in accordance with the rates stated in the Terms-of-Use Agreement and/or the Service Level Agreement.

The Data Processor shall, without undue delay, notify the Data Controller of the Deviation.

The Data Processor shall provide the Data Controller with the necessary information to enable the Data Controller to comply with applicable laws regarding the processing of Personal Data and to enable the Data Controller to respond to requests from data supervisory authorities in the event of Deviations. It is the responsibility of the Data Controller to report nonconformities to the Norwegian Data Protection Authority in accordance with applicable legislation.

The Data Processor will not disclose passwords to the Data Controller's users without the Data Controller requesting this in writing. All passwords to Data Controller's users are stored with irreversible encryption, and it is physically impossible for the Data Processor to disclose passwords in plain text.

The Data Processor provides system backups and data according to current Service Level Agreement (SLA).

If personal data is to be transmitted electronically internally at the Data Controller or from the Data Controller to the Data Processor, the Data Processor recommends that transmission is done in encrypted form or otherwise secured by further agreement with the Data Processor.

6. Security audits

The Data Controller acknowledges that the Data Controller's right to conduct audits under GDPR is fulfilled through the fact that the Data Processor ensures that an independent third party, appointed by the Data Processor, performs a systemic audit of the system on a regular basis. The main results of the audit are made available to the Data Controller on request.

7. Liability and limitation of liability

Claims from a party as a result of the other party's failure to comply with the Data Processing Agreement shall be subject to the same liability regulations and limitations of liability as provided by the Terms-of-Use Agreement.

8. Duration of the Data Processing Agreement

This Data Processing Agreement shall apply from the date it has been signed by both parties until the Terms-of-Use Agreement expires or until the Data Processor's obligation to perform services under the Terms-of-Use Agreement terminates for any reason, except for the provisions of the Terms-of-Use Agreement and the Data Processing Agreement that continue to run after termination.

In the event of a material breach of the Data Processing Agreement, the Data Controller may impose on the Data Processor to stop further processing of personal data with immediate effect. The Data processor can, for the same reasons, stop all processing on behalf of the Data Controller with immediate effect. Deletion of data covered by this Data Processing Agreement will however not be implemented until the Terms-of-Use Agreement expires in accordance with paragraph 9 below.

9. Upon termination

After the expiry of the Terms-of-Use Agreement, the Data Processor is obligated to anonymize all personal data covered by this Data Processing Agreement, and subsequently delete all the customers data. Anonymization means that the data is no longer personal data and therefore not covered by the privacy policy. The Data Processor shall provide the Data Controller with a written statement, after which the Data Processor guarantees that all personal data or data mentioned above has been anonymized and that the Data Processor has not retained any copy, print or retained personal data in any other medium.

The Controller is upon termination of the Terms-of-Use Agreement entitled to receive Customer data in return. The way return of Customer data should be handled is governed by the Service Level Agreement (SLA).

10. Notices

Notices pursuant to this Data Processing Agreement shall be sent in writing to the Data Controller's contact person as specified in the Terms-of-Use Agreement.

11. Amendment of the Data Processing Agreement

The Data Processor may amend the content of the Data Processing Agreement if the Data Controller is notified about these 90 calendar days before the amendment enters into force. The Data Controller can oppose the amendment within 30 calendar days. If the Data Controller opposes the amendment, the Data Controller may terminate the Terms-of-Use Agreement with 60 calendar days' notice. Notice of termination must be given at the same date as the Data Controller opposes the amendment. If the Data Controller does not notify termination of the Terms-of-Use Agreement, the amendment is deemed to be accepted.

 

Appendix A to Data Processing Agreement – Insights / Integration Interface ("API")

Appendix A only applies if the Customer has purchased access to Insights (an integration Interface), hereinafter referred to as the "API". Simployer APIs expose integration interfaces that selected users at the customer’s side can access, which enables the customer to transfer information, including personal data, from the customer's data generated in Simployer, for further processing and analysis in third-party software.

The API is protected by an API key that is used to authenticate the individual service(s) that will interact with the interface. The customer is provided with this key and is solely responsible for using it and to only authenticate the systems, and those users, who shall have access to the service.

The interface allows for access to the customer's data, including personal data registered or generated in the system and the Customer's database, and does not have the same access control and mechanisms to ensure privacy that is built into Simployer by default. It is therefore very important that the Customer only uses the service for purposes, and only authenticates systems and users against the interface, which the Customer has made necessary assessments of (legal and technical assessments).

Simployer is responsible for the availability and confidentiality of data up and until the endpoints. After data has left the endpoint, it is the Customer who is responsible for all use of the service and all use of data made available via the endpoint. Simployer, including subcontractors, do not have any responsibility for customer's use of the endpoints or Customer's processing of data obtained from the endpoints, or the integrity of data submitted to the endpoints (from the Customer's systems or other third parties the Customer is responsible for).

Where integrations do not use endpoints for transferring data but instead use file-based transfer of data, the same principles apply as mentioned above.

Appendix B to Data Processing Agreement – Engagement

Appendix B only applies if the Customer has purchased the Engagement module. Regarding the disclosure of data from this module, the Data Processor cannot provide the Controller (the Customer) with response information in any other way than in anonymized and de-identified form.  Response information means the answers employees have given to employee surveys collected using the Engagement module.

If the Controller intends to use the service also for employees of companies other than their own, they shall on their own obtain the companies' permission to process personal data about the affected employees. In the case of companies and employees residing outside the EU/EEA, the Controller shall independently supervise and be responsible for compliance with legal requirements in accordance with applicable foreign law.

The data controller is also responsible for ensuring that their use of-, and the content of the questions and answers stored in the Engagement module. The data controller should avoid and or exercise caution in asking questions that involves, or results in, response information that contains personal data and that they do not need, or have legal grounds to process. This may i.e. be categories of sensitive information such as health information, or information that is regulated distinctly, such as trade secrets, etc.

When using the Engagement module, the Controller accepts the sub-processors as described here: List of additional subprocessors when using Engagement. This list is kept up to date on the website mentioned above and any changes will be communicated as described in section 4 of this DPA. Please note the possibility of “Reduced Processing Mode” which ensures data-processing only within the EU/EEA.

Appendix C to Data Processing Agreement – Whistleblowing

Appendix C only applies if the Customer has purchased the Whistleblowing-module and activated it for use.

In support of the EU Directive 2019/1937 on Whistleblowing, Simployer offers a digital service to facilitate and support the process of whisteblowing.

The service enables all individuals who know the address of the whistleblowing functionality at the customer, to submit whisteblowing. The whistleblower can choose to submit the message with their name and contact details, or to remain anonymous. The message may therefore contain personal data about the whistleblower. The message itself is a text field, and this may include registration, and storage of, personal data, also about other than the whistleblower, i.e. an affected third party to the matter.

The customer is responsible for ensuring that the messages are processed and stored in accordance with applicable regulations, i.e. both the national whistleblower-regulation and the rules of the General Data Protection Regulation ("GDPR"). This involves, among other things, the responsibility for deleting personal data that is not relevant to the messages/whistleblowing-cases. The system automatically deletes data in messages two years after it was created, but deletion should otherwise be done by the administrator of the module,and should be done continuously and without undue delay. The storage of messages and reports containing personal data shall not be done longer than what is necessary and proportionate to the provisions of Article 17 of the EU Directive 2019/1937 and the relevant national implementation of these regulations. 

The service does not change the list of relevant subcontractors, see section 4 above.

 

V.2.1.8 - updated 2024-11-25