Data processing agreement

This agreement is entered into between the customer company (the “data controller”) and Flexibemanning AS, org. no. 931 015 737, Årvollskogen 103, 1529 Moss (the “data processor”). It regulates the data processor’s processing of personal data on behalf of the data controller in the Flexikompetanse service, and is intended to meet the requirements of Article 28 of the General Data Protection Regulation (personvernforordningen), “GDPR”. The agreement forms part of the terms and prevails over them on matters concerning personal data. See also the privacy notice.

1. Purpose and scope

The data processor processes personal data only in order to deliver the service, on documented instructions from the data controller. This agreement and the data controller’s use of the service constitute the instructions. The data, data subjects and purposes concerned are set out in Appendix A.

2. The data controller’s obligations

• Have a legal basis for the processing and inform the employees about it.
• Decide who is to have access in the service, and keep users and roles up to date.
• Decide deletion routines in the service for sick leave and former employees.
• Be responsible for everything that is written in free-text fields and uploaded. The service has no fields for diagnoses, and health information beyond the type of absence, information about criminal offences and national identity numbers (fødselsnummer) must not be entered.
• Respond to enquiries from data subjects. The data processor assists, see section 5.

3. The data processor’s obligations

• Process data only on instructions. If the data processor considers that an instruction infringes data protection legislation, the data controller must be notified immediately.
• Ensure that everyone who has access to the data is subject to a duty of confidentiality, and that access is granted only to those who need it. Access is reviewed at least once a year.
• Implement appropriate technical and organisational security measures under Article 32, see Appendix C.
• Not use the data for its own purposes.

4. Sub-processors

The data controller gives general authorisation for the data processor to use sub-processors. The current sub-processors are set out in Appendix B. The data processor notifies the data controller at least 30 days before a new sub-processor is taken into use or an existing one is replaced. (Proposal, to be confirmed.) The data controller may object within that period. If the objection does not succeed, the data controller may terminate the agreement before the change takes effect.

Sub-processors are bound by the same obligations as in this agreement. The data processor is fully liable to the data controller for the sub-processors’ compliance with them. On request, the data processor provides a copy of the relevant parts of the agreement with a sub-processor.

5. Assistance

The data processor assists the data controller, as far as possible, in fulfilling the data subjects’ rights of access, rectification, erasure, restriction, data portability and objection. Much of this the data controller can do itself in the service, including rectifying and deleting employee data and downloading all data. The data processor also assists with security, notification of breaches, data protection impact assessments and prior consultations with the Norwegian Data Protection Authority (Datatilsynet). Assistance that goes beyond what the service itself makes possible may be invoiced by agreement. (Proposal, to be confirmed.)

6. Transfers to third countries

Personal data is transferred out of the EU/EEA only where there is a valid transfer mechanism under Chapter V of the GDPR. Where the data is processed is set out in Appendix C.

7. Personal data breaches

The data processor notifies the data controller without undue delay, and no later than within 24 hours (Proposal, to be confirmed.), after discovering a breach. This enables the data controller to notify the breach to the Norwegian Data Protection Authority (Datatilsynet) within 72 hours. The notification is sent to the customer’s administrator and contact person, and contains, as far as is known: what has happened, which types of data and approximately how many data subjects are affected, the likely consequences, and which measures have been taken or are proposed. Information that is not yet known is supplied later.

8. Deletion and return

The data controller may at any time download all of the company’s data in the service, also after the subscription has expired. The download is a ZIP file containing the data in JSON format and the uploaded files.

On termination, the data processor deletes all personal data when the data controller asks it to, and no later than 90 days after the agreement has ended (Proposal, to be confirmed.), unless the law requires longer retention. The data processor confirms the deletion in writing. Backups are deleted as described in Appendix C.

9. Audit and supervision

The data processor makes available the information that is needed to demonstrate that the obligations in the agreement are complied with. The data controller, or an independent auditor appointed by it, may carry out audits, including inspections. An audit is notified at least 30 days in advance, is carried out during normal working hours and in such a way that it does not disrupt operations unnecessarily, and the auditor must be bound by a duty of confidentiality. Each party bears its own costs. (Proposal, to be confirmed.) The Norwegian Data Protection Authority (Datatilsynet) and other supervisory authorities are given the access to which they are entitled by law.

10. Liability

The parties’ liability in damages follows Article 82 of the GDPR and the limitation of liability in the terms, to the extent that it can apply. (Proposal, to be confirmed.)

11. Duration and contact

The agreement applies from when the customer takes the service into use, and for as long as the data processor processes personal data on behalf of the data controller. It cannot be terminated on its own while the customer relationship lasts. If the legislation changes so that the agreement must be amended, the parties shall negotiate this in good faith.

The contact point at the data processor is kontakt@flexikompetanse.no and +47 402 80 400. The contact point at the data controller is the customer’s administrator in the service and the contact person stated in the agreement.

Appendix A. The processing

Data subjects: the data controller’s employees, hired-in staff and former employees, their next of kin who are entered, users of the service, and others who are mentioned in content the customer enters, for example participants in safety inspections or persons in deviation reports.

Types of data:

• Employee record: name, email, telephone, job title, department, form of employment and percentage of full-time position, employee number, pay type (salaried or hourly), date of birth, start and end dates.
• Next of kin: name, relationship, telephone and date of birth.
• Absence and holiday: type of absence (including self-certified sick leave, sick leave on a medical certificate and sick child), dates and case handling. Sick leave is data concerning health under Article 9.
• Hours: hours recorded per day and project.
• Courses: enrolment, progress, test results and course certificates.
• HSE: deviation reports, risk assessments and safe job analyses (SJA) with signatures, safety inspections, minutes of working environment committee (AMU) meetings and read receipts for procedures.
• Equipment issued to the employee.
• Documents and images that are uploaded, and free text.
• User account, access log with IP address, and notifications.

Purpose: to deliver the service so that the data controller can carry out personnel administration, record absence, holiday and hours, follow up training, and carry out systematic HSE work and internal control.

The processing consists of: storage, display, amendment, notification, export, backup and deletion.

Duration: for as long as the agreement applies, and until the data has been deleted under section 8.

Appendix B. Sub-processors

• Hostinger (operations): server and database where the service, all data and uploaded files are located. The server is in Lithuania, and Hostinger’s own backups are stored in France.
• Hostinger (email): sends invitations, password reset links and notifications by email. This is an assumed set-up, and it will be confirmed when the service is made available. (Proposal, to be confirmed.)
• Bunny.net (Bunny Stream): stores and shows course videos. Receives the video files and technical information from the viewer, such as IP address. (Proposal, to be confirmed.)
• Google (Firebase Cloud Messaging): delivers notifications to telephone when the service’s app is used. Receives the device’s notification key and the title and text of the notification. Taken into use only when the app is launched. (Proposal, to be confirmed.)

The legal name, organisation number and address of each sub-processor will be entered before the agreement is taken into use.

Appendix C. Security and place of processing

Security measures:

• Role-based access control. Each company sees only its own data.
• Two-factor authentication for administrators.
• Passwords are stored only as a one-way hash (scrypt). Sessions are held in a cookie that cannot be read by scripts, and last for no more than 14 days.
• The two-factor keys are encrypted with AES-256-GCM. Other data in the database is not encrypted field by field.
• Encrypted transmission (HTTPS).
• Access log of logins and important actions, and limitation of repeated login attempts.
• Encrypted backup (AES-256-GCM) of the database every six hours and at start-up. The encryption key is kept separate from the backups.
• Automatic deletion after set periods: access log after 12 months, error log after 90 days, failed login attempts after 30 days, and sick leave and former employees after periods that the data controller sets.

Backups: there are two kinds. The portal itself makes encrypted copies of the database, and they are located on the same server as the database, in Lithuania. The copy is taken every six hours. All copies from the last 48 hours are kept, and after that one copy per day for 14 days. Older copies are deleted automatically. Deleted data is therefore normally gone from these copies after about 16 days. In addition, Hostinger takes its own backups of the server, and they are stored in France. How long Hostinger keeps them follows Hostinger’s own routines. (Proposal, to be confirmed.)

Place of processing: the service is operated by Hostinger with a server in Lithuania. Hostinger’s backups are stored in France. Both countries are in the EU/EEA. This applies to the server, the database and Hostinger’s copies. For Bunny.net and Google Firebase, section 6 on transfer mechanisms applies. Course videos are stored at Bunny.net. (Proposal, to be confirmed.) The data processor’s own employees work from Norway. (Proposal, to be confirmed.)

This website reproduces the standard text. The binding agreement is entered into in writing between the parties.