Data processing agreement

The Customer is the controller.

The processor is Easypeasy Regnskap AS, company no. 935 427 738.

The data processing agreement applies only to processing where Easypeasy acts as processor. Processing where Easypeasy acts as an independent controller is governed by the privacy policy.

The purpose of processing is to make the System available to the Customer and carry out the operations, hosting, maintenance, security, support, troubleshooting, backup, export and other actions necessary to provide the ordered service.

Processing includes storage, organisation, structuring, making data available, transfer on the Customer's instructions, backup, troubleshooting and other necessary technical processing of personal data in the System.

Processing continues for as long as Easypeasy provides services to the Customer and thereafter for as long as data is retained in accordance with the agreement, documented instructions or statutory requirements.

Data subjects may include the Customer's contact persons, users, employees, contractors, customers, suppliers, private customers, debtors, creditors and other individuals included in the Customer's accounting records.

Personal data may include names, addresses, email addresses, telephone numbers, job titles, dates of birth, national identity numbers where necessary and lawful, organisational affiliation, account numbers, payment details, invoice details, transaction details, attachments, accounting documents, message history, login data and other information the Customer records or makes available in the System.

Easypeasy shall process personal data only on documented instructions from the Customer, unless otherwise required by law.

The Customer's use of the System, activation of features, configuration of integrations and written support requests constitute documented instructions within the scope of the agreement.

If Easypeasy considers an instruction to breach data protection law, the Customer shall be notified without undue delay.

Easypeasy shall ensure that persons authorised to process personal data are subject to a duty of confidentiality or an equivalent contractual obligation.

Access to personal data shall be restricted according to need, role and duties.

Easypeasy may grant access to relevant employees and its internal accountant where necessary for support, internal quality control, troubleshooting, security, compliance with legal requirements or other performance of the agreement.

Easypeasy shall implement appropriate technical and organisational measures to protect personal data, including access control, logging, secure transfer, secure storage, backup, recovery, vulnerability management and internal security follow-up.

The level of security is assessed against the risks of processing and the types of data processed.

No digital system can be guaranteed entirely risk-free, but Easypeasy shall work systematically to reduce risk and manage incidents responsibly.

Easypeasy may use subprocessors for hosting, infrastructure, communication, customer support, analytics, authentication, backup and other supporting services necessary to provide the System.

Easypeasy shall ensure that subprocessors are bound by agreements imposing data protection and security obligations substantially equivalent to this data processing agreement.

An up-to-date overview of key subprocessors is available on separate page .

Taking into account the nature of processing and the information available, Easypeasy shall assist the Customer in fulfilling obligations under data protection law.

This includes requests for access, rectification, erasure, restriction and data portability, as well as security breaches, impact assessments and dialogue with supervisory authorities.

Easypeasy may charge a reasonable fee for assistance that substantially exceeds ordinary support and what can reasonably be considered included in the service.

Easypeasy shall notify the Customer without undue delay after becoming aware of a personal data breach affecting personal data processed on behalf of the Customer.

Where possible, the notification shall include information about the nature of the incident, likely consequences, measures taken and a contact point for further follow-up.

Easypeasy shall not transfer personal data to countries outside the EU/EEA without a valid transfer basis under applicable data protection law.

If a transfer takes place, Easypeasy shall provide the necessary safeguards, such as standard contractual clauses or another valid basis.

The Customer may request reasonable documentation showing that Easypeasy fulfils its obligations under this appendix.

If the documentation is insufficient and the Customer has an objective need, the Customer may request an audit or inspection with reasonable advance notice and in a manner that does not unnecessarily disrupt Easypeasy's business or other customers' security.

Easypeasy may offer third-party audits, statements or standardised security descriptions as an alternative to an on-site audit.

When the agreement ends, the Customer shall have the opportunity to retrieve data through available export functions for a reasonable period, unless access must be closed earlier for security or legal reasons.

Due to requirements for traceability, consistency and accounting integrity, not all data can be deleted immediately.

As a general rule, businesses or users may first be logically deleted and then physically deleted up to twelve months later. Backups may be retained for up to three months after logical deletion, and security logs for up to three years where necessary for security, incident handling and traceability.

The Customer is responsible for determining which accounting information and records must be retained under bookkeeping regulations and other relevant legislation.

No provision in this appendix shall be interpreted as Easypeasy assuming the Customer's independent obligations under the Norwegian Bookkeeping Act or other mandatory legislation.