Data Processing Agreement
1. BACKGROUND AND PURPOSE
1.1 This data processing agreement (the "DPA") forms an integral part of the Subscription Order Form and is entered into between the customer identified in and signing that Subscription Order Form (the "Controller") and Reope AS (the "Processor"), each a "Party" and together the "Parties". By signing the Subscription Order Form, the Parties also enter into this DPA. The individual signing the Subscription Order Form on behalf of the Controller confirms that he or she is authorised to bind the Controller to the Subscription Order Form and this DPA.
1.2 The purpose of this DPA is to set out the rights and obligations of the Parties concerning the Processor's processing of personal data on behalf of the Controller in connection with the services subscribed to under the Subscription Order Form (the "Services"). The Subscription Order Form, the General Terms and Conditions, the applicable Special Terms and Conditions and this DPA together constitute the subscription agreement (the "Agreement"). This DPA applies to the processing described in Appendix 1.
1.3 This DPA does not govern personal data that the Processor processes on its own behalf (as a controller), such as for bookkeeping purposes and customer relation purposes. Such processing is described in the Processor's privacy notice.
1.4 In the event of inconsistency between this DPA and any other part of the Agreement, including the Subscription Order Form, this DPA shall prevail on matters specifically concerning processing of personal data on behalf of the Controller. Processing details expressly agreed in the Subscription Order Form supplement the appendices to this DPA.
2. DEFINITIONS
2.1.1 In this DPA, the following terms shall have the meanings set out below:
2.1.2 "Applicable Data Protection Law": Any applicable data protection and privacy law, including but not limited to the GDPR, or any law replacing or supplementing the GDPR, and local law implementing the GDPR.
2.1.3 "EEA": The European Economic Area.
2.1.4 "GDPR": The EU General Data Protection Regulation 2016/679.
2.1.5 "Standard Contractual Clauses": The standard contractual clauses for the transfer of personal data to third countries pursuant to the GDPR, issued by the European Commission on 4 June 2021 and/or laid down by the European Commission or a relevant supervisory authority in accordance with Article 46(2)(c) or 46(2)(d) of the GDPR.
2.1.6 "Sub-processor": Another processor engaged by the Processor for the processing of personal data on behalf of the Controller.
2.1.7 "Third Country": A non-EEA country or an international organisation that is not approved by the EU Commission as having an adequate level of data protection (adequacy decision).
2.1.8 Other terms shall have the meaning as given to them in the GDPR.
3. GENERAL OBLIGATIONS
3.1 Each Party shall comply with its obligations under Applicable Data Protection Law.
3.2 The Controller warrants and will ensure that the personal data is processed for specified, explicit and legitimate purposes and that the Processor does not process more personal data than required for fulfilling such purposes. The Controller is responsible for ensuring that a valid legal basis for processing exists and that the data subjects are informed about the processing covered by this DPA in accordance with Applicable Data Protection Law.
3.3 The Controller hereby instructs the Processor to process personal data for the purposes and within the scope as set out in APPENDIX 1 and otherwise in accordance with this DPA. The Processor will only process the personal data on documented instructions from the Controller, unless required to do so by EEA law to which the Processor is subject.
3.4 The Processor shall immediately inform the Controller in writing if, in its reasonable opinion, (i) an instruction from the Controller infringes Applicable Data Protection Law, or (ii) a legal requirement laid down by EEA law to which the Processor is subject requires the Processor to process personal data beyond the scope of the Controller's documented instructions, unless that law prohibits such information on important grounds of public interest (if so, the Processor shall inform the Controller as soon as permitted by law).
4. ASSISTANCE TO THE CONTROLLER
4.1 The Processor shall assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to and comply with requests for exercising the data subject's rights laid down in chapter III of the GDPR.
4.2 Taking into account the nature of processing and the information available to the Processor, the Processor shall assist the Controller in ensuring compliance with Articles 32 to 36 of the GDPR, including the obligations of data security, personal data breach notification, data protection impact assessments and prior consultation with supervisory authorities.
4.3 The Processor shall not engage in any direct communication with data subjects or supervisory authorities, unless approved in advance by the Controller or required by applicable law. The Processor shall forward to the Controller any request or complaint received from a data subject or a supervisory authority concerning the processing of personal data under this DPA, unless prohibited by applicable law (if so, the Processor shall inform the Controller as soon as permitted by such law).
4.4 The Controller shall pay the Processor for any assistance provided under this DPA, including this section 4, at the Processor's hourly rates.
5. TECHNICAL AND ORGANISATIONAL SECURITY MEASURES
5.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Processor shall implement and maintain throughout the term appropriate technical and organisational data security measures to protect the personal data pursuant to Article 32 of the GDPR.
5.2 The Processor shall limit the access to the personal data to its personnel on a need-to-know basis. The Processor shall ensure that the personnel have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that the confidentiality also applies after the termination of the DPA.
6. USE OF SUB-PROCESSORS
6.1 The Processor shall only use Sub-processors upon the Controller's consent. The Controller has consented to the Sub-processors listed in APPENDIX 2.
6.2 If the Processor intends to make changes by adding or replacing Sub-processors (including changes in processing locations of approved Sub-processors), the Processor shall notify the Controller about such intended change. If the Controller does not consent to the change, the Controller must object to such change within two weeks from the Processor's notification. The Controller will be deemed to have consented to the change unless such objection is provided to the Processor within this time limit.
6.3 The Processor must ensure that materially the same data protection obligations as set out in this DPA are imposed upon any Sub-processor by a written agreement.
6.4 The Processor shall not in any way be liable for any processing carried out by the Sub-processor as a result of instructions received by the Sub-processor directly from the Controller.
7. INTERNATIONAL DATA TRANSFERS
7.1 The Processor must only transfer personal data to any Third Country after general consent from the Controller following the procedure set out in clause 6.2 of this DPA. Processor shall at all times keep an updated list of Sub-processors in Third Countries.
7.2 The Processor shall only transfer personal data to Third Countries under a legal basis for such transfer following Applicable Data Protection Law, including Chapter V of the GDPR. Upon the Controller's reasonable request, the Processor shall provide the Controller with evidence that such requirements are complied with (commercial terms may be redacted).
8. PERSONAL DATA BREACHES
8.1 In the event of a personal data breach, the Processor shall without undue delay after becoming aware of it notify the Controller in writing about the breach. The notice shall contain all such information the Controller may reasonably require to enable the Controller to comply with its obligations pursuant to Article 33 and Article 34 of the GDPR, provided that the Processor possesses or may reasonably obtain such information.
9. AUDITS
9.1 The Processor shall maintain necessary records and make available to the Controller information reasonably necessary to demonstrate compliance with this DPA and Applicable Data Protection Law.
9.2 The Processor shall allow for and contribute to audits, including inspections, of the Processor's processing operations. The Controller may perform the audit itself or by use of a third-party auditor, subject to appropriate confidentiality undertakings. The request for audit shall be given in writing with a notice period of at least three weeks, unless otherwise is required under Applicable Data Protection Law. Audits cannot be requested more than once a year, unless the Controller has a particular reason to request additional audits on an ad-hoc basis. To the extent reasonably possible, the audits shall be conducted within ordinary working hours and without obstructing the Processor's activities.
9.3 Authorities who supervise the Controller have a right to request information from and to conduct audits of the Processor to the same extent as the Controller.
9.4 The Controller shall bear any costs related to audits initiated by the Controller or accrued in relation to audits of the Controller, including compensation to Processor for reasonable time spent by it and its employees complying with on premises audits. However, if an audit reveals material deviations from the obligations set out in this DPA caused by the Processor or any Sub-processor, the Processor's costs of the audit shall be borne by the Processor.
10. LIABILITY
10.1 The Parties' liabilities are governed by the Agreement. If the Parties' liabilities are not governed by the Agreement, Sections 10.2 to 10.4 shall apply.
10.2 Neither Party shall be liable to the other Party for any of the following categories of loss or damage, howsoever arising and whether in contract, tort (including negligence), breach of statutory duty, misrepresentation or otherwise, even if such Party has been advised of the possibility of such loss or damage:
(i) indirect, consequential, special, incidental, punitive or exemplary losses or damages of any kind whatsoever; and
(ii) loss of production, loss of revenue, loss of earnings or income of any kind, loss of anticipated cost savings, loss of goodwill or reputation, losses arising from third-party claims, loss or corruption of Customer Data and any consequences thereof, and loss of profit or anticipated profit, in each case whether arising directly or indirectly.
10.3 The aggregate liability of each Party for all claims arising out of or in connection with the Subscription Agreement and the Services, whether in contract, tort, breach of statutory duty or otherwise, shall not exceed the higher of: (a) NOK 50,000; or (b) fifty per cent (50%) of the total fees paid or payable by the Customer for the Services during the six-month period immediately preceding the event giving rise to the claim, exclusive of value added tax. For the avoidance of doubt, this limitation shall apply in the aggregate and not on a per-incident basis.
10.4 The Customer shall indemnify, defend and hold harmless Reope and its Affiliates, and their respective officers, directors, employees and agents, from and against any and all claims, demands, actions, losses, damages, costs and expenses (including reasonable legal fees) arising out of or in connection with: (a) the Customer's use of the Services; (b) the Customer's use, distribution or deployment of AI-generated output; or (e) any breach by the Customer of Applicable Laws in connection with its use of the Services.
11. TERM AND TERMINATION
11.1 This DPA takes effect when the Subscription Order Form becomes binding on the Parties and applies from the commencement of processing on behalf of the Controller. It remains in force for as long as the Processor or any Sub-processor retains personal data processed on behalf of the Controller under the Agreement.
11.2 If the Processor has not implemented appropriate technical and organisational measures in such a manner that processing will meet the requirements of the GDPR, the Controller may terminate the DPA if the Processor has not implemented such measures within two months after the Controller's notification thereof.
11.3 Upon expiry or termination, the Processor shall, at the choice of the Controller, delete or return to the Controller the personal data. If the Controller choses deletion, the Processor shall verify to the Controller that it has done so.
11.4 Notwithstanding the foregoing, the Processor is entitled to continue storing the personal data to the extent required to comply with applicable law, or to the extent it follows from the Processor's general backup routines, provided that clause 5 continues to apply for such data, and provided that the Processor does not actively process such data.
12. GOVERNING LAW AND LEGAL VENUE
12.1 This DPA shall be governed by the laws of Norway and disputes shall be settled in accordance with the Agreement.
APPENDIX 1: Scope of the processing
Purpose of the processing
To enable the Controller to administer its organisation's users and access to the subscribed Services through Dokk (the Processor's sign-in, licence and update service for its desktop tools), including inviting users, assigning packages and roles, withdrawing access and viewing aggregated usage. This includes storing associated user-level log and usage data on the Controller's behalf.
Nature of the processing
Collection, recording, organisation, storage, retrieval, use, aggregation, disclosure to authorised recipients and deletion of personal data in connection with the Controller's administration of users and access through Dokk. Users authenticate through Google, Microsoft or an email link. The Controller determines invitations, memberships, package assignments, removal of members and retention settings. Instructions given by the Controller's authorised administrators through these functions form part of the Controller's documented instructions.
Categories of personal data
Email addresses and user identifiers used for invitations and authentication.
Organisation membership, roles, assigned packages and access status.
User-level log and usage records, including activity and diagnostic information, to the extent processed on the Controller's behalf.
Categories of data subjects
The Controller's employees and other individuals whom the Controller invites or authorises to use the subscribed Services, including organisation administrators.
Duration and retention
Processing takes place during provision of the relevant Services. Log and raw usage data is retained for three (3) years by default. Where Dokk allows the Controller to configure the retention period, the Controller may choose a period between six (6) months and three (3) years.
Processing locations
The default location for server hosting and storage is the EU. Alternative hosting and processing locations may be agreed for the relevant components in the Subscription Order Form at an additional charge, subject to this DPA.
APPENDIX 2: Approved Sub-processors
| Name and address of the subcontractor | Description of the services | Processing locations and transfer safeguards if relevant |
|---|---|---|
| Google (Firebase Authentication): Google LLC or Google Ireland Limited, as applicable under the Firebase Data Processing and Security Terms. | User authentication for Dokk, to the extent involving processing on the Controller's behalf. | Authentication data may be processed in the USA and other countries where Google or its sub-processors maintain facilities. Transfer safeguard: the EU-US Data Privacy Framework or, where needed, the Standard Contractual Clauses under Google's Firebase Data Processing and Security Terms. |
| DigitalOcean, LLC, USA. | Server hosting and storage for Dokk. | EU (Dokk servers are hosted in EU data centres). Transfer safeguard for any transfer outside the EEA by DigitalOcean or its sub-processors: the EU-US Data Privacy Framework or the Standard Contractual Clauses under DigitalOcean's data processing agreement. |
| Slack Technologies Limited, Salesforce Tower, 60 R801, North Dock, Dublin, Ireland. | Notifications concerning errors and critical log entries, to the extent containing personal data processed on the Controller's behalf. | Ireland and other locations where Slack or its sub-processors process data, including the USA. Transfer safeguard: as set out in Slack's data processing addendum. |
| Anthropic, PBC, San Francisco, USA, or the Anthropic entity that is party to Reope's agreement with Anthropic. | AI model provider for the AI Module (ToolMaker). Processes Input and Output to generate responses, to the extent the Controller's users submit personal data despite the restriction in the General Terms. | USA and other regions where Anthropic or its sub-processors operate. Transfer safeguard: the Standard Contractual Clauses (Module Two or Three) under Anthropic's data processing addendum. |
| Render Services, Inc., 525 Brannan St, San Francisco, CA 94131, USA. | Hosting of the ToolMaker and ToolFinder services, including storage of tools, usage records and the provider API credential. | Render states that its primary processing operations take place in the USA. Transfer safeguard: the EU-US Data Privacy Framework or, where needed, the Standard Contractual Clauses under Render's data processing addendum. |
| wyDay, LLC (LimeLM), 380 Lafayette Road Unit 11, PMB 304, Seabrook, NH 03874, USA. | Licence activation and licence management for the Toolbox and tools distributed through it, to the extent involving personal data processed on the Controller's behalf. | USA. [Reope to confirm the transfer safeguard. wyDay's privacy policy refers only to the EU-US Privacy Shield, which is no longer valid.] |
| Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513. | Storage of usage telemetry for ToolFinder, to the extent offered to the Controller. | [Reope to confirm the Supabase project region.] Transfer safeguard: the Standard Contractual Clauses (Module Two or Three) under Supabase's data processing addendum. |
| OpenAI Ireland Limited (for customers in the EEA). | AI model provider for ToolFinder search queries and embeddings, to the extent offered to the Controller. | Processing may occur outside the EEA. Transfer safeguard: the Standard Contractual Clauses or an EU adequacy decision, as set out in OpenAI's data processing addendum. |