Appendix 5 –
data processing agreement

1Background and Purpose

1.1Applicable Data Protection Law requires that a data processing agreement is entered into between a controller and a processor for the Processing of Personal Data.

1.2For the purposes of fulfilling the Main Agreement, certain Personal Data for which the Controller is data controller will be processed by the Processor.

1.3The parties have agreed to enter into this DPA with regard to the Processing of Personal Data, as required by the Applicable Data Protection Law

2Definitions

The following terms used in this DPA shall have the meanings set forth below:

3Processing of Personal Data

3.1Warranty. The Processor warrants and represents, during the term of this DPA, that it has implemented appropriate technical and organizational measures in such a manner that its processing of Personal Data under this DPA will meet the requirements of Applicable Data Protection Law and ensure the protection of the rights and freedoms of the Data Subject.

3.2Instructions. The Processor undertakes to only Process Personal Data in accordance with documented instructions communicated by the Controller from time to time, unless required to do so pursuant to Applicable Data Protection Law. The Processor shall at any time be able to demonstrate it keeps records of the specific and current instructions from the Controller and how such instructions are implemented. The Controller’s Initial Instructions (see clause 10) to the Processor regarding the subject-matter and duration of the Processing, the nature and purpose of the Processing, the type of Personal Data and categories of data subjects are set forth in this DPA and in Attachment 1. Any instructions to Processor exceeding the scope of the Initial Instructions shall entitle Processor to receive renumeration in accordance with clause 10.

3.3Continuous compliance.The Processor shall, when processing Personal Data under this DPA, comply with Applicable Data Protection Law and applicable recommendations by the Supervisory Authority or other competent authorities. The Processor shall accept to make any changes and amendments to this DPA and the Processing that are required under Applicable Data Protection Law, however subject to clauses 3.2 and 10 .

3.4Data protection officer.The Processor shall designate a person responsible for data protection and compliance with Applicable Data Protection law at the Processor.

3.5Privacy by design. To the extent the Processor designs the systems, procedures or processes under which the Processing take place, the Processor shall design such systems as to comply with the GDPR art. 25.

3.6Data portability.To the extent the Processor designs the systems, procedures or processes under which the Processing takes place, the Processor shall ensure that data portability in compliance with the GDPR art. 20 may take place.

3.7Assistance.The Processor shall assist the Controller in fulfilling its legal obligations under Applicable Data Protection Law, including but not limited to the Controller’s obligation to respond to requests for exercising the Data Subject's rights to request information (register extracts) and for Personal Data to be corrected, blocked or erased at the Controller’s request.

3.8Information.The Processor shall immediately inform the Controller if the Processor does not have sufficient instructions on how to process Personal Data in a particular situation or if any instruction provided under this DPA or otherwise infringes Applicable Data Protection Law.

3.9Third party requests. If Data Subjects, competent authorities or any other third parties request information from Processor regarding the processing of Personal Data covered by this DPA, the Processor shall refer such request to the Controller.

The Processor may not, without prior written consent from the Controller, transfer or in any other way disclose Personal Data or any other information relating to the processing of Personal Data to any third party. In the event the Processor, according to Applicable Data Protection Law, is required to disclose Personal Data that the Processor processes on behalf of the Controller, Processor shall be obliged to inform the Controller thereof immediately in writing. If the Controller does not give its written consent to disclosure, the Controller shall to the fullest possible extent under the law contest any such request and assist the Controller in same.

If a transfer of Personal Data is to take place, the Processor shall ensure that it takes place subject to confidentiality and Processing obligations similar to those stipulated in the DPA.

3.10No representative.The Processor may not in any legal capacity act on behalf of or as a representative of the Controller.

3.11Additional measures.Upon the Controller’s reasonable request the Processor shall implement additional reasonable technical and organizational security measures and adjustments to the Processing activities. The Controller shall notify the Processor of any adjustments to the Controller’s instructions concerning security and the Processing of Personal Data in reasonable time in order to enable the necessary amendments to procedures to be implemented.

3.12Demonstration of compliance. The Processor shall at all times be able to demonstrate that is complies with the DPA and Applicable Data Protection Law.

3.13Transparency.The Processor undertakes to make available to the Controller all information and provide all assistance necessary to demonstrate compliance with the obligations laid down in this DPA and allow for and contribute to audits, including on-site inspections, conducted by the Controller or another auditor mandated by the Controller.

3.14Auditor’s statement.The Processor undertakes to provide the Controller with a yearly auditor's Statement regarding the extent to which the Processors technical and organizational measures are compliance with the Applicable Data Protection Law.

3.15Deletion.The Processor shall upon the Controller’s request and further instructions return or delete all Personal Data that the Processor has been Processing on behalf of the Controller under this DPA, unless Applicable Data Protection Law requires further storage of the relevant Personal Data.

3.16Creation.When you signup to Crystallize with a social networking credential, such as with your Facebook or Google account, we will ask permission to access basic information from that account, such as your name and email address. We use this information strictly for identification purposes. You can stop sharing that information with us at any time by removing Crystallizes access to that account.

4Sub-processors

4.1Consent. The Processor may not engage Sub-processors without prior specific or general written consent of the Controller. The Controller’s initial consents are set out in Attachment 1. If the Controller acts under a general written consent given by the Controller, the Processor shall inform the Controller of any intended changes concerning the addition or replacement of Sub-processors. Controller may to object to such changes.

4.2Down-stream obligations.The Processor shall ensure that any Sub-processors (and any Sup-processors of such) are bound by written agreements that require them to comply with data processing obligations corresponding to those contained in this DPA. The Processor shall remain fully liable to the Controller for the performance of the Sub-processor's obligations.

4.3Proof of audit. The Controller may request that the Processor audit the Sub-processor or provide confirmation that such an audit has occurred, or, where available, obtain or assist the Controller in obtaining a third-party audit report concerning Sub-processor’s operations to ensure compliance with Applicable Data Protection Laws. The Controller will also be entitled, upon written request, to receive copies of the relevant terms of the Processor’s agreement with Sub-processors that may Process Personal Data and a precise description of the Processing performed by the Sub-processor.

5Transfer to third countries

5.1Legal basis. Any transfer of Personal Data to a state which is not a member state of either the EU or the European Economic Area (EEA) requires the prior written consent of the Controller and shall only occur if the conditions for transfer to third countries or international organisations laid down in the Applicable Data Protection Laws, hereunder Chapter V of the GDPR have been fulfilled.

5.2Withdrawal of consent.The Controller may at any time withdraw its consent to third country transfers provided under clause 5.1. In such case, the Processor shall immediately cease any further transfer and shall, upon the Controller’s request, provide written confirmation of this.

6Information security and confidentiality

6.1General.The Processor shall, in order to assist the Controller in fulfilling its legal obligations, including but not limited to security measures and privacy impact assessments, be obliged to take appropriate technical and organizational measures to protect the Personal Data which is Processed. The Processor shall comply with any written information security requirements or policies communicated by the Controller from time to time.

6.2Adequate security.The Processor shall maintain adequate security for the Personal Data appropriate to the risk of Processing. The Processor shall protect the Personal Data against destruction, modification, unlawful dissemination, or unlawful access. Having regard to the state of the art and the costs of implementation and taking into account the nature, scope, context and purposes of the processing as well as the risk of varying likelihood and severity for the rights and freedoms of individuals, the technical and organizational measures to be implemented by the Processor shall include, inter alia, as appropriate:

1. the Pseudonymisation and encryption of Personal Data;
2. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of systems and services Processing Personal Data;
3. the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident;
4. a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the Processing, and;
5. compliance with best industry practices.

6.3Additional measures.In addition to the technical and organizational measures mentioned in clause 6.1 and 6.2, the Processor shall implement the following measures:

1. Access control whereby access to the Personal Data is managed through a technical system for authorization control. There shall be procedures for allocating and removing authorizations.
2. User IDs and passwords used to access Personal Data shall be personal and shall not be shared.
3. Secure communications whereby external data communication connections shall be protected using technical functions ensuring that the connection is authorized and encrypted for Personal Data in transit in communication channels outside systems controlled by the Processor.
4. It shall be possible to follow up access to the Personal Data retrospectively through a log or similar information base. The logs shall be protected and accessed only through authorized personnel. It shall be possible for the Processor to check the information base and report back to the Controller.
5. A process to ensure secure data destruction when fixed or removable storage media no longer are used for their purpose.
6. Computer equipment and removable storage media containing Personal Data at the Processor’s premises shall be locked up when not under supervision in order to protect against unauthorized use, impact and theft.
7. Routines for entering into confidentiality agreements with suppliers providing repair and service of equipment used to store Personal Data.
8. Routines for supervising the service performed by suppliers at the premises of the Processor. Storage media containing the Personal Data shall be locked up if supervision is not possible.

6.4Records. The Processor shall maintain a record of all categories of Processing activities carried out on behalf of the Controller. The Processor shall prepare and keep updated a description of its technical, organisational and physical measures to be and maintain compliant with the Applicable Data Protection Law.

6.5Data access. The Processor shall be obliged to ensure that only persons that directly require access to Personal Data in order to fulfil the Processor’s obligations in accordance with the Main Agreement have access to such information. The Processor shall ensure that any persons involved in the processing of Personal Data have committed themselves to confidentiality or are under proper statutory obligation of confidentiality.

6.6The duties of confidentiality set forth in clause 6.4. and 6.5. of the DPA shall survive the expiry or termination of the DPA.

7Personal data breach

7.1Assistance. In case of a Personal Data Breach involving Personal Data Processed on behalf of the Controller, the Processor shall, taking into account the nature of Processing and the information available to the Processor, assist the Controller in ensuring compliance with the Controller’s obligations pursuant to Applicable Data Protection Law, including article 33 in the GDPR. The Processor shall notify the Controller without undue delay, but not later than 24 hours after becoming aware of such a Personal Data Breach. The notification shall at least:

1. describe the nature of the Personal Data breach including where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned;
2. communicate the name and contact details of the data protection officer or other contact point where more information can be obtained;
3. describe the likely consequences of the Personal Data breach;
4. describe the measures taken or proposed to be taken by the Controller to address the Personal Data breach, including, where appropriate, measures to mitigate its possible adverse effects.

8Term and termination

8.1Duration.The DPA applies for the duration of the Main Agreement, however subject to any obligations which according to their nature require additional duration.

8.2Termination.If a party materially breaches its obligations under the DPA, the non-breaching party may terminate the DPA and the Main Agreement. The party seeking termination shall provide the other party with a prior written notice of 10 days in reasonable detail of such material breach and the opportunity to resolve the breach. The Controller may choose to partially terminate the DPA and the Main Agreement.

If the party in breach does not resolve the breach within 10 days of receipt of written notice of a breach, then the party that is not in default may terminate this DPA and the Main Agreement on the Date specified in the written notice of termination.

8.3The Processor’s non-fulfilment of Applicable Data Protection Law and the Processors non-fulfilment of the warranties in clause 3.1 shall always be deemed material breach.

8.4A material breach of this DPA by the Processor is also deemed a material breach of the Main Agreement.

9EFFECT Of TERMINATION

9.1Upon termination or expiry of this DPA, the Processor shall cease its Processing activities. Upon written instructions from the Controller, the Processor shall delete and/or return all Personal Data to the Controller and delete existing copies of such data unless Applicable Data Protection Law requires the continued storage of the Personal Data. The Processor shall ensure that any Sub-processor does the same.

9.2Regardless of the reason for termination or expiry of the DPA the Processor shall upon the Controllers written request accept to postpone the effective termination of this DPA with up to 90 days to allow the Controller to secure its data before return or deletion. Current prices under the Main Agreement shall apply.

9.3Upon request by the Controller, the Processor shall provide a written notice of the measures taken regarding the Personal Data upon the completion of the Processing.

10RENUMERATION

10.1The Processor's renumeration for carrying out the Initial Instructions under this DPA is agreed to under the Main Agreement. Any additional renumeration for scope exceeding the scope agreed to under the Main Agreement (“Initial Instructions”), will be in accordance to the unit prices stipulated in the Main Agreement. If no unit prices are agreed to, Controllers standard unit prices will apply.

11LIABILITY

No additional liability to what follows from the Main Agreement is assumed by entering into the DPA. Any limitations of liability stipulated in the Main Agreement or otherwise shall apply equally to this DPA.

12Miscellanous

12.1Assignment. The Processor may not assign this DPA, in whole or in part, or delegate any of its duties hereunder to a third party by change in control, or otherwise, without the Controller’s prior written approval.

12.2No-waiver. No delay or failure of either party to enforce any provision of this DPA will operate as a waiver of the right to enforce that or any other provision of this DPA, nor will any single or partial exercise of any such rights preclude any other or further exercise thereof. To be effective, any waiver must be in writing, signed by the party providing the waiver.

12.3Severability.In the event that any provision of this DPA is held by a court of competent jurisdiction to be invalid, illegal or unenforceable, the remaining provisions of the DPA will remain in full force and effect, and shall be construed so as to best effectuate the intention of the parties executing it.

12.4Survival. Without prejudice to other provisions of this DPA, any obligations which either expressly or by their nature are to continue after the termination or expiration of this DPA shall survive and remain in effect.

12.5Counterparts.This DPA may be executed in one or more counterparts, each of which shall be deemed an original. The parties may rely on a scanned signature to bind the other party and may deliver such signatures electronically.

13NOTICES

13.1All notices, requests, claims, demands and other communications under this DPA from one party to the other shall be in writing, in English.

14Governing law and dispute resolution

14.1This DPA shall be governed by and construed in accordance with the laws of Norway without reference to any conflict of laws principles under which different law might otherwise be applicable.

14.2The parties agree that the courts of Norway shall have sole and exclusive jurisdiction and be legal venue for any matter arising out of this DPA.