Data processing agreement

The customer is the controller and Itema AS (org. no. 882 067 122, Brøsetvegen 164B, 7069 Trondheim, Norway), which provides Licens, is the processor. The processor processes personal data only to provide the service as described in the terms of service, and only on documented instructions from the customer. The terms of service and the customer's use of the service constitute those instructions.

Categories of data subjects: the customer's users, agreement owners and deputies, vendor contacts and other people mentioned in documents the customer uploads.

Types of data: name, e-mail address, phone number, role, activity log and any personal data in notes, custom fields and documents. The service is not intended for special categories of personal data.

The processor shall ensure that people with access are bound by confidentiality, implement appropriate technical and organisational security measures (see the security page), help the customer respond to data subjects' requests, and assist with data protection impact assessments where relevant.

Personal data breaches shall be reported to the customer without undue delay after the processor becomes aware of them, with the information available at the time.

The customer gives general authorisation to use the sub-processors listed on the sub-processors page. We give reasonable notice of new or changed sub-processors, and the customer may object. Personal data is stored in the EU/EEA. Should a sub-processor transfer data outside the EEA, this must be done on a valid transfer basis.

The processor shall make available the information needed to demonstrate compliance with this agreement, and allow for reasonable audits by prior arrangement.

This agreement applies for as long as the processor processes personal data for the customer. On termination, the customer can export all data. Data and documents are then deleted, and backups are deleted according to the established rotation, unless the law requires retention.