Data Processing Agreement

1. Background, purpose and scope

1.1 As part of the Data Processor's delivery of services, the Data Processor processes personal data for which the Data Controller is responsible.

1.2 The Data Processor shall comply with the Danish Act on Processing of Personal Data (Act No. 421 of 31 May 2000, as amended) and the executive orders issued thereunder.

1.3 The Data Processor shall comply with the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data), together with the associated legal acts and the national legislation derived therefrom.

1.4 Both the Danish Act on Processing of Personal Data and the General Data Protection Regulation require that a written agreement on the processing to be carried out — a so-called "data processing agreement" — is entered into between the data controller and the data processor. This Data Processing Agreement constitutes such a data processing agreement.

2. Personal data covered by the agreement

2.1 The Data Processing Agreement and the associated instructions cover all types of personal data processed by the Data Controller under the agreement entered into between the Parties.

3. Geographical requirements

3.1 The processing of personal data carried out by the Data Processor under agreement with the Data Controller may only be carried out by the Data Processor or by sub-processors, cf. clause 5, within the European Economic Area (EEA). The Data Processor is in no way entitled to allow data processing to take place outside the EEA without the Data Controller's written consent.

4. Instructions

4.1 The primary data processing carried out by the Data Processor is the storage of the data that the Data Controller entrusts to the Data Processor. If the Data Controller wishes other forms of data processing that are not related to the standard services delivered by the Data Processor, the Data Controller shall give the Data Processor clear, documented instructions to this effect.

4.2 The Data Processor acts solely on documented instructions from the Data Controller. The Data Processor shall ensure that the personal data entrusted to it is not used for other purposes or processed in any way other than as set out in the Data Controller's instructions.

4.3 If, in the Data Processor's opinion, an instruction infringes the Danish Act on Processing of Personal Data or the General Data Protection Regulation, the Data Processor shall inform the Data Controller thereof.

4.4 If the processing of personal data by the Data Processor takes place wholly or partly by means of remote access, including home workplaces, the Data Processor shall lay down guidelines for employees' processing of personal data via remote access, which shall otherwise meet the requirements set out in the Agreement.

4.5 The Data Processor shall, as far as possible, assist the Data Controller in fulfilling the Data Controller's obligation to respond to requests for the exercise of data subjects' rights, including access, rectification, restriction or erasure, where the relevant personal data is processed by the Data Processor. If the Data Processor receives such a request from a data subject, the Data Processor shall inform the Data Controller thereof.

4.6 The Data Controller is liable for all of the Data Processor's costs in connection with such assistance, cf. clause 4.5, including costs payable to the sub-processor. The Data Processor's assistance is invoiced at the Data Processor's hourly rate applicable from time to time for such work.

5. Use of sub-processors

5.1 The Data Controller consents to the Data Processor's use of sub-processors, provided that the conditions for this set out in the Agreement are met.

The Data Processor's current list of sub-processors can be viewed at any time at teknisksupport.dk/compliance

5.2 The sub-processor is subject to the Data Processor's instructions. The Data Processor has entered into a written data processing agreement with the sub-processor, which ensures that the sub-processor meets requirements corresponding to those imposed on the Data Processor by the Data Controller under the Agreement.

5.3 Costs associated with establishing the contractual relationship with a sub-processor, including the costs of drawing up a data processing agreement and any establishment of a basis for transfers to third countries, are borne by the Data Processor and are thus of no concern to the Data Controller.

5.4 Should the Data Controller wish to instruct sub-processors directly, this should only be done after consultation with, and via, the Data Processor. If the Data Controller issues instructions directly to sub-processors, the Data Controller shall, at the latest at the same time, notify the Data Processor of the instruction and the background for it. Where the Data Controller instructs sub-processors directly:

a) the Data Processor is released from any liability, and any consequence of such instruction is solely the responsibility of the Data Controller,
b) the Data Controller is liable for any cost that the instruction may cause the Data Processor, including that the Data Processor is entitled to invoice the Data Controller at its usual hourly rate for all working time that such direct instruction may cause the Data Processor, and
c) the Data Controller is itself responsible towards the sub-processors for any cost, fee or other payment to the sub-processor that the direct instruction may entail.

5.5 By entering into this Agreement, the Data Controller accepts that the Data Processor is entitled to change sub-processor, provided that a) any new sub-processor complies with conditions corresponding to those imposed in this clause 5 on the current sub-processor, and that b) any such other sub-processor appears on the Data Processor's website no later than at the commencement of its processing of personal data for which the Data Controller is the data controller.

6. Processing and disclosure of personal data

6.1 The Data Controller warrants that it has the necessary legal basis for processing the personal data covered by this Data Processing Agreement.

6.2 The Data Processor may not, without the written consent of the Data Controller, disclose data to third parties unless such disclosure follows from legislation or from a binding request from a court or a data protection authority, or is provided for in this Agreement.

7. Security

7.1 The Data Processor shall implement appropriate technical and organisational security measures to protect personal data against accidental or unlawful destruction, loss or deterioration, and against unauthorised disclosure, misuse or other processing in violation of the legislation, cf. clauses 1.2 and 1.3 above.

7.2 The Danish Security Order (Executive Order No. 528 of 15 June 2000 on security measures for the protection of personal data processed on behalf of public administration) shall also be complied with where personal data is processed on behalf of public administration.

7.3 The Data Processor is at all times entitled to implement alternative security measures, provided that such security measures as a minimum meet or provide greater security than the security measures described in Appendix 1. The Data Processor may not reduce the level of security without the prior written approval of the Data Controller.

7.4 If the Data Processor is established in another EU Member State, the provisions on security measures laid down in the legislation of the EU Member State in which the Data Processor is established shall additionally apply to the Data Processor.

7.5 The Data Processor shall, by further agreement with the Data Controller and as far as possible, assist the Data Controller in ensuring compliance with the obligations under Article 32 of the Regulation (appropriate technical and organisational measures), Article 35 (data protection impact assessment) and Article 36 (prior consultation). The Data Processor is entitled to invoice the Data Controller at its usual hourly rate for all working time that such assistance may entail.

7.6 If the matters set out in clause 7.5 lead to stricter security measures than those already agreed between the Parties, the Data Processor shall, as far as possible, implement such measures, provided that the Data Processor receives payment for this, cf. clause 7.7 below.

7.7 Costs associated with implementing measures under clause 7.6 are borne by the Data Controller. The Data Processor is furthermore entitled to invoice the Data Controller at its usual hourly rate for all working time that such implementation may entail, and the Data Controller is likewise liable for any payment to the sub-processor.

8. Right of audit

8.1 At the Data Controller's request, the Data Processor shall provide the Data Controller with sufficient information to enable the Data Controller to verify that the Data Processor has implemented the necessary technical and organisational security measures.

8.2 To the extent that the Data Controller also wishes this to cover the processing carried out by sub-processors, the Data Processor shall be informed accordingly. The Data Processor will then obtain sufficient information from the sub-processor.

8.3 If the Data Controller wishes to carry out an audit, the Data Controller shall always give the Data Processor at least 30 days' notice.

8.4 Once a year, at the request of the Data Controller, the Data Processor shall arrange for a generally recognised and independent third party to issue a security audit report prepared in accordance with a recognised auditing standard.

8.5 If the Data Processor has a security audit report prepared that describes the security arrangements at the sub-processor in accordance with clause 8.4, the Data Controller is entitled to receive a copy thereof.

8.6 If the Data Controller wishes to have another or additional security audit report prepared beyond those referred to in clauses 8.4 and 8.5, or otherwise wishes an audit of the Data Processor's or the sub-processor's processing of personal data to be carried out, this shall be agreed in more detail with the Data Processor. The Data Processor or the sub-processor may at any time require that such a security audit report be prepared in accordance with a recognised auditing standard (e.g. ISAE 3402 with reference to ISO 27002 or similar) by a generally recognised and independent third party.

8.7 The Data Controller bears all costs in connection with audits of security arrangements at the Data Processor and in relation to the sub-processor, including that the Data Processor is entitled to invoice the Data Controller at its usual hourly rate for all working time that such audits may entail.

9. Personal data breaches

9.1 If the Data Processor becomes aware of a personal data breach, meaning a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed, the Data Processor is obliged, without undue delay, to seek to locate such breach and to seek to limit the resulting damage to the greatest extent possible, and, to the extent possible, to restore any lost data.

9.2 The Data Processor is furthermore obliged to notify the Data Controller without undue delay after becoming aware that a personal data breach has occurred. The Data Processor shall thereafter, without undue delay and to the extent possible, give written notice to the Data Controller, which shall as far as possible include:

a) A description of the nature of the breach, including the categories and approximate number of data subjects and personal data records concerned.
b) The name and contact details of the data protection officer.
c) A description of the likely consequences of the breach.
d) A description of the measures taken or proposed by the Data Processor or the sub-processor to address the breach, including measures to mitigate its possible adverse effects.

9.3 Where it is not possible to provide the information set out in clause 9.2 at the same time, the information may be provided in phases without undue further delay.

9.4 Sub-processors are likewise required to notify the Data Processor without undue delay in accordance with clauses 9.2 and 9.3.

10. Confidentiality

10.1 The Data Processor shall keep the personal data confidential and is thus only entitled to use the personal data as part of fulfilling its obligations and rights under the Agreement.

10.2 The Data Processor shall ensure that the employees and any others, including sub-processors, who are authorised to process the personal data covered by the Agreement are bound by confidentiality.

11. Term and termination of the data processing agreement

11.1 The Agreement enters into force upon the Parties' signature of the Data Processing Agreement.

11.2 The Data Processor is bound by this Agreement for as long as the Data Processor processes personal data on behalf of the Data Controller. If the Data Processor ceases to deliver services to the Data Controller, the Data Controller shall, as soon as possible and no later than 14 days after termination, inform the Data Processor in writing how the Data Processor is to deal with the personal data processed. 30 days after termination of the Data Processing Agreement, the Data Processor is entitled to delete all personal data processed on behalf of the Data Controller.

Appendix

Appendices are based on hosted solutions via our hosting partners. The latest versions of the compliance documentation can always be found here:

zitcom.dk/vores-forretning/compliance
Zitcom / team.blue — our primary hosting and infrastructure partner

Last updated: 2024