Data processing agreement

Draft. This document has not yet been reviewed by a lawyer and may change before it takes effect.

1. Parties and scope

This data processing agreement ("DPA") is between the customer who has accepted the terms of service of Hordio (the "Controller") and [Company name ehf.], kennitala [000000-0000], [Street address], [000] Reykjavík, Iceland (the "Processor"). It forms part of the terms of service and applies to personal data the Processor processes on behalf of the Controller when providing Hordio, in accordance with article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Icelandic Act no. 90/2018.

2. Nature and purpose

The Processor stores and processes data to provide the asset management service: registering assets and their history, maintenance, check-outs, inspections and related functions, and sending emails the Controller has turned on.

3. Data subjects and data

• Data subjects: the Controller's users and employees, contact people at suppliers, and other people the Controller registers.
• Types of data: names, email addresses, phone numbers, job titles, employee numbers, departments, the assets a person has or has borrowed, notes, documents and the audit log of changes.
• The service is not designed for special categories of personal data (GDPR art. 9), and the Controller should not register such data.

4. Duration

The DPA applies while the Processor processes personal data for the Controller, and ends when the data has been deleted in accordance with section 11.

5. The Processor's obligations

• Process personal data only on documented instructions from the Controller. The terms of service, the DPA and the Controller's use of the service are the Controller's instructions.
• Inform the Controller if an instruction, in the Processor's opinion, infringes data protection law.
• Ensure that persons authorized to process the data have committed to confidentiality.
• Not use the data for its own purposes.

6. Security

The Processor implements appropriate technical and organizational measures under GDPR art. 32, including: encryption in transit and at rest; separation of each customer's data; role-based access within the service; secure password storage; logging of all changes; limited and logged administrative access; daily backups; and regular updates of software.

7. Sub-processors

The Controller gives general authorization to the use of the following sub-processors:

The Processor will notify the Controller by email at least 30 days before adding or replacing a sub-processor. The Controller may object on reasonable grounds; if no solution is found, the Controller may terminate the agreement. The Processor imposes the same data protection obligations on sub-processors and remains responsible for them.

8. Transfers outside the EEA

Personal data is stored in the EU. Where a sub-processor processes data outside the EEA, the transfer is based on an adequacy decision or the EU standard contractual clauses.

9. Assistance

Taking into account the nature of the processing, the Processor assists the Controller with requests from data subjects, with security, with notification of breaches, and with data protection impact assessments and prior consultations. Most requests can be handled by the Controller directly in the service (look up, correct, export and delete).

10. Personal data breaches

The Processor notifies the Controller without undue delay, and no later than 48 hours, after becoming aware of a personal data breach, with the information the Controller needs to meet its obligations.

11. Deletion and return

The Controller can export its data at any time. When the agreement ends, the Processor deletes the Controller's personal data as described in the terms of service, unless the law requires it to be kept. Backups are deleted on a rolling basis within 35 days.

12. Audits

The Processor makes available the information necessary to demonstrate compliance with this DPA, and allows for and contributes to audits by the Controller or an auditor it appoints, with reasonable notice, at the Controller's cost and no more than once a year unless there has been a breach.

13. Law

This DPA is governed by Icelandic law, and disputes go to the District Court of Reykjavík.