eloomi data
processing agreement

1.1 The customer (data controller) and eloomi (data processor) have entered into an agreement regarding the data controllers’ access to the eloomi services delivered as a software as a service application. The data controller will use the data processor’s services according to the eloomi agreement (Agreement) and eloomi terms and conditions (Terms), from now on unified called the Master Agreement. This Data Processing Agreement (DPA) is enclosed as an addendum to the master agreement and does not entail any changes in the commercial terms and conditions agreed upon by the parties in the master agreement.

1.2 As part of the fulfilment of the duties under the master agreement, the data processor may process certain personal data on behalf of the data controller. The purpose of this DPA is therefore to govern the parties’ rights and obligations under the Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereafter the “General Data Protection Regulation” or “GDPR”), including the framework for the data processor’s processing of personal data, to ensure that the personal data processing is performed in accordance with GDPR, and not processed unlawfully or exposed to any unauthorized persons.

1.3 By agreeing to this DPA the parties acknowledge that the data processor has met sufficient guarantees for them to implement appropriate technical and organizational measures that ensures that the control of personal data always meets the applicable data processor requirements listed in GDPR, including protecting the rights of the data subjects, and the data controller also acknowledges that it complies with all data controller obligations under GDPR.

2.1 The data processor shall according to the master agreement provide the services agreed upon as governed by the master agreement.

2.2 In order for the data processor to deliver products and services to the data controller and meet the requirements pursuant to the master agreement, the data processor will, from time to time, receive access to and process personal data on behalf of the data controller. The data processor’s processing and storing of personal data shall only be performed in accordance with the Instructions and should not occur to a greater extent or last longer than what is necessary to meet the purpose for which the personal data was made available to the data processor.

3.1 At all times, the data controller must comply with its obligations under GDPR and is responsible for processing the personal data in accordance with GDPR, including that the basic principles for the handling of personal data are met. Additionally, the data controller is responsible for any actions required to meet a request from a data subject.

3.2 The data controller has performed an evaluation of the risk related to the use of the data processor, before entering this DPA and master agreement, and found it safe and in accordance with GDPR.

3.3. Considering the principles of GDPR, including the risk of varying likelihood and severity for the rights and freedoms of natural persons, the data controller will only supply personal data when it is not reasonably practical to supply Redacted Materials for the data processor to comply with the Instructions.

4.1 The data processor does not have a general right of use to the personal data that is being processed according to this DPA and cannot process these for its own purposes. The data processor can only process personal data in accordance with this DPA and the instructions given by the data controller (the “Instructions”), and other written routines and instructions for processing that may be agreed in writing between the parties from time to time. Exceptions can be made if otherwise provided by law. In such case, the data processor shall inform the data controller of the legal obligation before the process begins, unless the law prohibits such notification to the data controller. The data processor shall in all cases process the personal data in accordance with the applicable processor obligations in GDPR. If the data controller unnecessarily makes personal data available to the data processor, the data processor shall promptly delete such personal data.

4.2 Processing activities may be carried out at the data processor’s locations and at the sub-data processor’s locations. The data controller acknowledges that the data processor and/or its sub data processors may process customer data in countries that are outside of the EEA, United Kingdom, and Switzerland (“European Countries”). This will apply even where the data controller has agreed with the data processor to host customer data within EEA in accordance with the data processor’s Regional Data Hosting Features if such non-European Countries processing is necessary to provide support or services requested by the data controller. Such transfer will rely on (a) the country ensures an adequate level of data protection (b) and/or one of the conditions
listed in Article 46 GDPR (or its equivalent) is satisfied.

4.3 The data processor is obliged to give the data controller access to its security policy documentation and other relevant security documents upon the data controller’s request. The data processor shall provide such assistance within the data processor’s obligations pursuant to GDPR as requested in writing by the data controller from time to time as the data controller reasonably considers is necessary to comply with the data controller’s own obligations under GDPR.

4.4 The data processor shall assist the data controller in fulfilling the data controller’s duty to respond to requests that the data subject provides in order to exercise his rights in accordance with GDPR. Such assistance must first be agreed in writing between the parties, which may incur additional fees. If the Data Subject makes his/her rights applicable by contacting the data processor directly, the data processor shall promptly inform the data controller. The data processors are obliged to delete and/or destroy after returning all personal information provided for the data processor if the data subject has submitted such a request to the data controller.

4.5 The data processor shall hold confidential all documentation and personal data that he or she may process under this DPA. This also applies after termination of the master agreement. Access to personal data shall be limited to those of the data processor’s employees who need access to the personal data to perform their duties and the implementation of the data processor’s obligations under this DPA, and in accordance with the instructions. The data processor shall ensure that persons authorized to process personal data have undertaken to treat the information as confidential or are subject to an appropriate duty of confidentiality.

4.6 The data processor shall provide the data controller with the contact details of the data processor’s data protection advisor, if the data processor has designated this.

4.7 The data processor is obliged to keep itself updated with regards to any changes to GDPR that may affect this DPA, and both parties to this DPA are obligated to notify the other party if they reasonably believe that this DPA is required to be varied due to such changes to the law.

4.8 In the event that the data processor becomes aware that in following the data controller’s instructions it shall be breaching the terms of this DPA or GDPR, the data processor will agree with the data controller in good faith on how to vary the Instructions if necessary.

5.1 The data controller hereby confirms its general written authorization for the data processor’s use of sub-data processors listed at: https://eloomi.com/legal/subprocessors/. The data processor shall update the sub-data processer list on its Website of any change to sub-data processor to be appointed at least thirty (30) days prior to such change. The data controller is responsible to frequently review the Website to ensure notification. The data controller can object to any change in accordance with the procedure stated at the Website.

5.2 The data processor is responsible for own use of subcontractors, and that such use is in accordance with GDPR, including an obligation to secure that a similar data processing agreement has been entered. The data processor shall ensure that the subcontractors are familiar with the data processor’s contractual and legal obligations, and the subcontractors are required to fulfil the terms thereof in the same way as the data processor.

5.3 The data processor is fully responsible for the subcontractor fulfilling its obligations to the data controller. The data processor shall remain liable to the data controller for the performance of the data processor’s subcontractor’s obligations.

5.4 The data processor is required to provide the data controller with a copy of the data processing agreement between the data processor and the subcontractor upon request.

5.5 The data controller can through the eloomi services gain access to link and play content and data in the solution from other third-party solutions. In such case the data controller decides to make use of this and do so, the data processer cannot be the responsible data processor. (Examples, but not limited to e.g., link to a document in a third-party solution, link to a YouTube video hosted on a third-party solution and similar).

6.1 Considering the nature of the processing, the data processor shall comply with the requirements for security measures provided for in GDPR that are applicable to the data processor at any time. This means, inter alia, that appropriate technical and organizational measures are taken to ensure an appropriate level of security of personal data that may be processed by the data processor in accordance with the instructions. A description of the technical and organizational measures implemented by the data processor is described in detail in Appendix C to this DPA.

6.2 The data processor shall carry out regular internal controls for the purpose of giving the data controller a sufficient guarantee that the data processor is continuously making the necessary steps, as mentioned above, to ensure appropriate information security, considering the nature of the processing, in compliance with the data processor’s obligations under GDPR. In this regard, the data processor shall document the procedures and other measures to ensure that the requirements for the information security is met. Such documentation shall be made available upon written request from the data controller.

6.3 The data processor is obliged to notify the data controller in writing of any personal data breach (as defined in GDPR) of security regarding personal data security without undue delay after having become aware of the breach.

6.4 The data controller is responsible for sending a discrepancy report to the relevant data protection authority. The data processor is obliged to assist the data controller with information to ensure that the notification requirements for the data inspectorate are met. If the data controller requests, the parties will agree in writing on any additional services that the data processor may provide with respect to notifying the affected data subjects.

6.5 In connection with the data processor’s processing of the data controller’s personal data, the data processor may be jointly liable with the data controller for the financial loss suffered by the data subject because of a direct breach of GDPR, where such liability is imposed on the data processor under GDPR by a regulatory body authorized to do so, or by a third-party. For all other matters, the data processor’s liability for all claims for a breach of any term of this DPA is as set out in the master agreement ref. clause 6 in the terms.

7.1 From time to time, the data controller can agree with the data processor to a security audit of information systems and the like to confirm compliance with this DPA. This audit can be an acceptance of the external audit done by a third-party for eloomi’s compliance audit. Each party shall bear its own costs in connection with such audit.

7.2 The data processor shall cooperate with the data controller’s implementation of security audits, by making available to the data controller the necessary documentation as reasonably required, and physical premises for inspection, during normal business hours at data processor.

7.3 The data controller may use an external auditor for the implementation of a security audit, provided that such external auditor has signed a confidentiality agreement and NDA acceptable to data processor. Audits can be carried out annually by agreement.

7.4 Nothing in this section 7 will apply to audits conducted by an authority or body who may perform such audit under GDPR, where in accordance with GDPR the data processor must bear its own costs, and perform such obligations as reasonably requested.

8.1 This DPA applies as long as the data processor processes personal data on behalf of the data controller.

9.1 Upon termination of this DPA, the data processor is obliged to delete or return at request all personal data received on behalf of the data controller, as agreed in writing with the data controller. If personal data is to be returned on request by the data controller, and to the extent that the data processor possess such items, the following is agreed to be possible to return and shall be returned upon termination of this DPA: Copy of all personal data in databases and data files in recognized readable formats that is in data processor’s possession. Reasonable costs related to
return are covered by the data processor. The exception is a material breach of this DPA caused solely by the data processor, where such breach results in a termination of this DPA.

9.2 If deleting personal data, the data processor shall delete and/or properly destroy all personal data as well as copies of such that it may possess. The data processor shall on request document
in writing and verify that deletion and/or destruction has happened in accordance with this DPA within a reasonable time after the termination of this DPA, and at the latest within 3 months after
the termination of this DPA.

10.1 Each of the parties shall name persons or responsible unit responsible for giving instructions on behalf of the data controller and receive instructions on behalf of the data processor. In relation to this DPA, the parties agree that the name stated in this DPA shall give and receive instructions relating to the processing of personal data. Each of the parties shall in writing inform the other part if the named responsible changes or is temporarily prevented from giving and/or receiving Instructions and appoint a substitute.

10.2 The data processor shall promptly inform the data controller if the data processor thinks that any instructions are in breach of the law, and certain processing may accordingly be suspended, or varied in accordance with section 4 of this DPA.

11.1 The DPA is subject to Danish law and the parties agree on Copenhagen City court as legal venue. This also applies after termination. The legal basis for processing is as described in the
applicable instructions.