Cloud Computing Agreement

Between
Dentframe AB (in the following called “the Contractor”)
and
“the User”
(jointly called ”the Parties”) the following Agreement has been entered into today:

1. The type and scope of the cloud computing

According to this Agreement (the Main Agreement), the Contractor undertakes from the day agreed upon to supply the User with a cloud computing (in the following called “the Service”) at a point (the Access Point) comprised of the point or the points where the Contractor connects the service to a general electronic communication network if nothing further has been agreed upon.

The Service is comprised by a technical platform enabling the User of the Contractor’s applications or websites, accessible as part of the Service, to arrange and plan purchases, sales, offers, quotations, accept and/or logistic services with other users of the Service and independent of the Contractor’s external partners, under agreement with the Contractor.

The services enables the User to offer, sell, supply or purchase such services and/or products from other users of the Service, who in the same way as the User, are the Contractor’s partners and independent, external purchasers or contractors of dental services and dental products.

The dental products or dental services are not produced, offered, sold or supplied by the Contractor but are handled by other user of the Service, external legal persons, companies, individual businesses not employed by the Contractor.

The Contractor is not responsible for any, in part or whole, deliveries or quality concerning the dental products and dental services that the User purchases or supplies by using the Service.

The Contractor only takes on the intermediate role and thus is only responsible for the information in which the users of the Service communicate in the Service, in accordance with and to the extent that is stated in this Agreement, including Exhibits.

In case of conflicts between the provisions entered into in the Agreement, the terms and conditions in this Agreement, including exhibits, are applicable.

2. Supply of the Service

The Contractor must supply the Service and thereto belonging supplementary service according to the terms and conditions in this Agreement, and according to the standard applied to by the Contractor regarding the cloud computing in question. By this Agreement, the Contractor provides a non-exclusive right for the User to have access to and use the Service via his/her own unit (stationary computer, laptop, cell phone, etc.).

3. Contractor’s liability

a) The Contractor must perform his assignments in a professional way and is responsible for the Service to be available at the Access Point from the date agreed upon. The Service is considered to be provided when it is available at the Access Point. Further commitments for the Contractor in connection with the start of the Service shall be agreed between the Parties.

b) The Contractor is entitled to undertake a sub-contractor for execution of the Service and the commitment according to the Agreement. The Contractor is responsible for the work of such sub-contractor.

c) Unless otherwise stated in the Agreement, the Contractor can provide all or part of the Agreement from abroad, however, the Contractor shall observe that the Agreement’s provisions on personal data are met, and that the delivery of the Service is done in such a way that all other provisions in the Agreements are met by the Contractor.

d) The Contractor shall cooperate with the User’s other contractors if necessary to perform the Service. However, this does not apply in cases where the Contractor can verify that such cooperation may harm the Contractor.

4. User’s liability

a) The User is liable to take part in any information supplied by the Contractor, as well as on an ongoing basis grant the Contractor access to the necessary information and system at the User. The User is liable for all communication between the User and the Access Point.

b) The User is liable to grant the Contractor information on and access to any software needed to provide the Service, and that the right to such software also covers the Contractor’s use.

c) The User is liable to inform the Contractor without further delay of any circumstances regarding the User’s business and IT environment that might affect the supply of the Service and to ensure that all information supplied is correct.

d) The User is also responsible for errors, virus, maleficent code or any other default in the User’s software or equipment. The User is also liable that any data and other information supplied by the User to the Contractor is given in the agreed upon format and does not harm or affect the Service or the Contractor’s system. In addition, the User shall inform the Contractor, as soon as it has been discovered, of any intrusion or attempt to such intrusion that might affect the Service.

e) The User is liable for the software and equipment that is required to use the Service and that the required rights exist in order for the User to be able to use such software within the frame of the Service.

f) The User is responsible for a continuous back-up of the User’s data is made.

g) The User is liable to ensure that only authorized users have access to the Service, as the Service has been made available for the User, as well as login information and other information from the Contractor is handled according to applicable provisions on confidentiality.

5. Amendments to the Service

The Contractor is entitled without informing the User to make such amendments of the Service that will not influence the main use of the Service.

The Contractor may oppose the User’s request of amendments, if the Contractor can provide evidence that such amendment will influence the Service in a more substantial way than has been stipulated in the Agreement.

The Contractor shall, without further delay, ask the User if any amendment proposals can be accepted and of the effect of amendments for supplying the Service as regards quality, price and time frame.

In the event that the User wishes to terminate the Service, subsequent to amendments as above, the User shall terminate the Agreement three (3) months after such amendments will be in force, at the latest.

6. Use of the Service

This Agreement, provides the User a non-exclusive right to use the Service, however, only within the frames for his/her own business. Only the persons from the User, who have been appointed hereto by the User and registered with the Contractor are allowed to use the Service. The User is liable, without further delay, to inform the Contractor when personal authorisation to the Service shall be amended.

Employees of the User are allowed to use the Service within the frames for his/her own business only after written approval from the Contractor.

At the use of the Service, the User must follow the instructions given by the Contractor. The Contractor is entitled to amend such instructions considering the applicable provisions for such amendments to the Service as stated in the Agreement. The User is liable to purchase and update compatible hardware or equipment necessary to get access to and use the Service and update thereto. The Contractor does not undertake that the Service or any part hereof will work on any specific hardware or unit.

The User is not entitled to copy any part of the software composing the Service or such software that the User is given access to when using the Service. The User is liable that the software is used according to applicable licence agreement at the use of the Service.

7. Interruption of the Service

The Contractor is entitled to in full or in part terminate the Service in the event that the supply of the Service will entail or risk to entail damage for the Contractor or other users, or in the event that there is reason to suspect that continued access might involve spreading of information in violation of applicable law.

In case of such circumstances as mentioned in the above paragraph, the Contractor shall not take further action than is considered tenable regarding the circumstances.

If the Parties have not made specific agreement on service levels, the Contractor is entitled to, in full or in part, interrupt access to the Service for the purpose of maintenance, update of software as well as other technical actions with the purpose of obtaining operation and safety of the Service The Contractor shall perform planned interruption with the anticipated urgency and, if possible, outside normal office hours.

In the event that the Service is interrupted, the Contractor shall, without further delay, inform the User of such interruption, expected duration and any consequences the interruption might give the User in his/her continued use of the Service.

8. The User’s data

The User holds all rights to data belonging to the User, which are transferred using the Service.

The Contractor is entitled to have access to the User’s data within the frame of the provision of the Service.

Transfer of the User’s data during and after the duration of this Agreement, that is not part of the ordinary operation of the Service, shall be regarded as additional service, which is not covered by the provisions of the Service.

The User is liable that the data, transferred by the User by using the Service, does not constitute infringement in relation to third party, and that it does not contravene the applicable legislation. In the event, that the User fails to meet this responsibility, the User shall indemnify the Contractor, including indirect damage and loss.

9. Personal data

The User is the personal data controller, and the Contractor is the personal data processor, and the User is solely responsible for the personal data handled and stored via the use of the Services are handled according to applicable legislation.

The Contractor is only liable to take such action regarding personal data handling that are stated in the Agreement, and that are requested by the User in writing.

The Contractor shall meet decisions according to law and made by authorities to fulfil safety requirements according to legislation regarding the User’s personal data. The Contractor is entitled to compensation for administrative work done in connection with specific action taken regarding personal data handling, which are made on request by the User or due to law or decisions made by authorities.

The Contractor is entitled to hire sub-contractors for personal data handling. Thus, the Contractor is entitled, as an agent for the User, to enter into personal data processor agreements with any sub-contractor. In the event of such agreement, the User shall be notified.

According to the above paragraph, in the event that personal data are transferred to a country outside the EU/EES, the Contractor is also entitled to ensure that the subcontractor has signed EU’s standard agreements for transferring of personal data to third country.

Where the Contractor keeps a log of the User’s use of the Service, such information can only be used by the Contractor for executing the Service.

Information can be used for development of the Service, for investigation of abuse of or illegal trespassing into the Service, for information for authorities or for statistics, provided that the log does not contain personal data. For further handling of personal data, please see the Personal Data Processor Agreement, which is an exhibit to the Main Agreement.

10. Compensation for using the Service

The User shall pay compensation to the Contractor, according to the Contractor’s from time to time applicable price list, for the Contractor providing and the User using the Service.

In addition, the User shall pay compensation to the Contractor for any additional costs that might occur in the event of circumstances that the User is liable for.

The Contractor is entitled to change the licence fee for third party application available to the User via the Service, in the event that the licensee providing the application changes the fee towards the Contractor.

11. Terms of payment for delivery of goods and services via the Service

When the User has received service or goods by using the Service, the Contractor, on commission from another user, is entitled to, on behalf of the payee in the specific assignment, receive payment from the User for a provided service or goods via the Service. In this specific respect, the Contractor will never enter as part in the relation between different users of the Service or between the User and external Contractors, who provide goods or services via the Service.

Furthermore, on behalf of the User of the Service, the Contractor will receive the User’s payment of Credits, where Credit 1 equals EUR 1. Payment of Credits can be done by the User loading to the User’s account at the Contractor, from which account the User can spent Credit to purchase goods and services provided via the Service.

All payment shall be made using credit cards. No payment via cash payment, payment via bank or giro account, Swish or direct transfer to bank account is accepted. Payment shall be considered as direct payment from the User or any other user or external partner. Fees will include any taxes when applicable by law.

All expenses and fees are payable immediately and payment shall be made as assigned by the Contractor. After payment, the Contractor will forward a receipt via email or similar communication.

After receipt of goods or service via the Service, the User can evaluate and rate said goods or service and forward any comment on external contractors.

The Contractor is entitled, from time to time, to grant the User discounts or similar offers, depending on to which extent the User uses the Service and other users’ evaluation of the quality of the goods and services provided via the Service, which evaluation might result in different amounts being charged for the same or similar goods or services provided by using the Service. Such circumstances shall never be considered motivation for revoke, cancel or discontinue in any other way a given and registered order of goods or services from an external contractor.

The payment structure is intended to compensate both the User and other users and external contractor for goods and services provided via the Service.

Variation of the price, from time to time, for the same or similar goods or services provided by using the Service, shall not entitle the User to revoke, cancel or in any other way discontinue a given and registered order of goods or services from an external Contractor.

12. Infringement on third party's right

The Contractor holds all rights including intangible rights, to the Service and associated software to the extent such rights do not belong to any licensor employed by the Contractor.

The User holds the responsibility to, on his/her own, check if the use of any software when using the Service incriminates or infringes third party’s rights. The Contractor, who has not entered into any investigations, has no knowledge of and holds no responsibility for such liability or infringement, but solely holds the responsibility for the User’s use of the Service, which according to this Agreement, does not impose any infringement to third party’s right.

In the event, that the User’s use of the Service, according to the above provisions, imposes infringement to third party’s right, the Contractor shall make such amendment to the Service or acquire rights enabling the continuous use of the Service without any infringement to third party’s right. If this is not possible or obstructs the Contractor’s providing the Service, the Contractor is entitled to terminate the Agreement with one (1) month’s notice.

13. Data protection
The Contractor shall, in a satisfactory way, handle the User’s register of customers, telephone numbers, passwords and equivalent information of importance for the User’s data protection.

14. Privacy

Each Party commits, during the term of agreement and for a period of three (3) years after the termination of the Agreement, to not reveal to third party confidential information obtained from the other Party or is emerged by the provision of the Service.

“Confidential information” always refers to the Contractor’s price information. In addition, “confidential information” in this Agreement refers to each information – technical, commercial or other kind of information – irrespective of whether the information is documented or not, with the exception of:

a) commonly known information or information which are general knowledge in other ways than through violation against the content of this Agreement made by one of the Parties,

b) information that a Party can prove he already had knowledge of before he received it from the other Party,

c) information that a Party has received or will receive from third party without being bound by duty of confidentiality in relation to the third party.

However, in case of provision c) above, the Party is not entitled to reveal to third party that the same information has also been received from the other Party of this Agreement. The Party commits to ensure that employees, consultants, sub-contractors and board members employed by the Party do not pass on confidential information to third party.

The Party undertakes to comply with rules for data protection and instruction for handling personal data notified by the other Party.

Without time constraints, the Party undertakes to without imperative cause to reveal
a) the existence of this Agreement or arbitration regarding this Agreement (however, the Contractor is entitled to refer to the assignment as back sight),
b) the content in this Agreement or arbitration regarding this Agreement,
c) information on negotiations, arbitration or mediation relating to this Agreement.

The Party’s obligation according to this Agreement does not apply to such information that the Contractor, pursuant to administrative decision, has been required to extradite.

15. Error in the Service

In the event of error in the Service, the Contractor shall, if possible, correct the error. If the error influences the User’s use of the Service substantially, and is of such character that no alternative to facilitate the use of the Service exists, the correction shall be made at the required urgency, implying that the Contractor’s investigation shall be initiated 72 hours from the error has come to the Contractor’s attention internally or through the reporting from the User in the formula for error reporting which is included in the Service and which the User must use for reporting of any error.

The User is entitled to reasonable price reduction for a period, in which the Service cannot be used due to error, which the Contractor is liable for, if the User can prove how and at what time the error has been observed. The Contractor is not responsible for errors not reported by the User to the Contractor within reasonable time or is due to the User acting in violation of the instructions for the use of the Service or such circumstance that according to the Agreement falls under the responsibility of the User.

The User has agreed that the use of the Service might be subject to disturbance and delays in connection with the use of the internet, other electronical communication or third party application. For such interruptions of the Service, the Contractor is not liable.

16. The Contractor’s breach of contract
In the event, that the Contractor violates provisions in the Agreement and does not take action to make corrections within two (2) weeks from the written complaint from the User, the Contractor shall compensate the User for any damage. The complaint shall be made without delay after the breach of contract has been established or should have been established and the complaint shall contain further information on how the breach of contract has appeared.

At substantial breach of contract, the Contractor is entitled to terminate the Agreement with the application of ten (10) days of notice.

In the event of incorrect complaint, the User shall pay compensation to the Contractor for performed work and other expenses according to the Contractors normally applied compensation rules.

During this period, the Contractor is not liable for any flaws and/or defects due to circumstances, that the User is liable for according to the Agreement, circumstances outside of the Contractor’s area of responsibility for the Service, security attacks through virus, malicious code or similar attack to security provided that the Contractor in a professional way has taken professional protection measures.

In addition, the Contractor is not liable for flaws and/or defects caused by amendments taken by the User in relation to original specification or circumstances attributable to the grounds and information provided by the User. For damages to be paid according to this provision, it is required, no matter the circumstances that it regards direct damage and that such damage has occurred as a result of intentional or negligent action by the Contractor.

17. The User’s breach of contract

In the event, that the User violates provisions in the Agreement and does not take action to make corrections within two (2) weeks from the written complaint from the Contractor, the User shall compensate the Contractor for any damage. The complaint shall be made without delay after the breach of contract has been established or should have been established and the complaint shall contain further information on how the breach of contract has appeared.

At substantial breach of contract, the User is entitled to terminate the Agreement with the application of ten (10) days of notice. For damages to be paid according to this provision, it is required, no matter the circumstances that it regards direct damage and that such damage has occurred as a result of intentional or negligent action by the Contractor.

18. Insolvency

The Party is entitled to, in writing, terminate the Agreement for immediate cessation if the other Party goes bankrupt, engage into contract negotiation, enters into liquidation or in other ways are in financial difficulties.

Regardless if the Agreement is terminated or not, the Party shall compensate the damage that has occurred as a consequence of the other Party’s financial difficulties.

19. Claims and limitation

The user shall produce a written claim of the Contractor’s breach of contract no later than ten (10) days after the breach of contract has been identified or should have been identified. In the event that the claim is not made in due time and as prescribed in the Agreement, the User shall lose his/her right to invoke breach of contract.

The User’s right to sanction ceases six (6) months after the termination of this Agreement.

20. Act of God – Force Majeure

The Contractor is released from any sanction for negligence to fulfil his/her obligation according to this Agreement, should the negligence stem from circumstances as mentioned below (“liberating circumstance”), and if such circumstance prevents or makes it considerably complicated to fulfil the obligation in due time. Liberating circumstance is considered to be, among others, authority measures or negligence, new or amended legislation, staff retirement, disease or other reduction of working ability, death, labour market conflict, interruption in tele communications, blockade, fire, flooding, loss or destruction of data to a larger extent or property of material importance or any greater accident.

In the event that the Contractor wishes to call upon the Act of God, the User shall be notified without further delay.

Regardless of the above said on release from sanction, in the case of liberating circumstances, the Contractor is entitled to terminate the Agreement when completion of said obligation is delayed with more than four (4) weeks.

In the event that the Contractor has hired a sub-contractor, this provision also includes force majeure incidents affecting the sub-contractor.

21. Limitation of liability

Apart from what is stated in the provision on liberation circumstances, the Contractor’s responsibility is limited to the following:
a) The Contractor is not liable for indirect damages, such as lack of profit, decline in production, expenses regarding hiring of other contractor, expenses for equipment and similar expenses or losses.
b) The Contractor’s liability in connection with breach of contract, if no intent or gross negligence can be held against the Contractor, is limited to 15% of the compensation paid by the User to the Contractor for his/her providing of and the User’s use of the Service during the twelve (12) months previous to the breach of contract. In the event of shorter time of usage than twelve (12) months, the compensation for this shorter period shall be the basis of such calculation
c) The Contractor is not liable for the User’s loss of data.

Regarding infringement of third party legislation, the provision hereon in this Agreement is applicable.

22. Termination of the Service

At the termination of the Service, the information, data and software belonging to the User, requested in writing by the User within three (3) months in advance, shall be returned to the User without further delay.

In addition, the Contractor assists in transferring of the Service to the User or other contractor, given in writing by the User within three (3) months in advance, if so required by the User. For the Contractor’s work in relation to termination, the Contractor shall be entitled to compensation according to the Contractor’s price list from time to time applicable.

23. Term of Agreement

This Agreement enters into force at the date of both Parties’ signatures and is valid until further notice. The Agreement can be terminated by both Parties pursuant to at least three (3) months’ notice. Termination of the Agreement shall be in writing.

24. Transfer of the Agreement

The Parties are not entitled to transfer their obligations according to this Agreement without the other Party having approved such transfer in writing.

The Contractor is, however, entitled to transfer the right to receive payment according to the Agreement.

25. Communication

With the exception of error reporting in the associated formula for such reporting assigned to the Service and which formula the User shall use for error reporting, the Parties’ claims, termination, amendment and other communication pursuant to the Agreement or providing of the Service shall be forwarded via email to the Parties’ given contact person, according to the specific persons in the introduction or recent modified addresses.

The email shall be regarded as received by the recipient as well as being read by the recipient when the email has reached the stated email address. Change of email address shall be notified to the other Party as described in this provision.

26. Headlines

The division of this Agreement in different chapters and assent of headlines shall not have any influence on the interpretation of the Agreement in its whole.

27. Amendments to the Agreement

Amendments of and additions to this Agreement shall be binding, made in writing and duly signed by both Parties.

28. Inertia

In the event that a Party fails to exercise his/her right according to this Agreement or fails to report certain situations according to this Agreement, such failure shall not entail that the Party waives his/her right in such regard.

Should the Party wish to refrain from making use of his/her right or to issue a complaint of a specific situation, this shall be made in writing separately in each case.

29. Complete regulation

This Agreement, including exhibits, constitutes the Parties complete regulation of all issues concerning this Agreement. In the event that an issue has not been expressly regulated in this Agreement, the issues shall be solved according to the principles on which this Agreement has been grounded. All written and verbal commitments and guarantees prior to this Agreement are replaced by the content in this Agreement and exhibits.

30. Invalidity of provisions

In the event that any provisions in this Agreement or parts hereof prove to be invalid, this shall not mean that the Agreement in its entirety is invalid insofar any Party’s commitment without the invalid part of the Agreement appears to be unreasonably burdensome.

31. Applicable law

This Agreement is applicable to Swedish law, without the application of conflict laws.

32. Arbitration

Dispute in connection with this Agreement shall be determined finally by arbitration according to Stockholm Chamber of Commerce Arbitration Institute Rules for simplified arbitration.

Arbitration shall take place in Malmö.

---

Personal Data Processor Agreement

Between
Dentframe AB (in the following called “the Contractor”) and
“the User”
(jointly called ”the Parties”)

the following Personal Data Processor Agreement has been entered into and agreed upon today:

The purpose of this Agreement is to ensure that the Personal Data Processor’s treatment of personal data on behalf of the responsible Personal Data Controller – within the frame of the availability of the Service according to the Main Agreement, Exhibit x, - is handled according to the GDPR General Data Protection Regulation (the European Parliament and Council’s Regulation (EU) 2016/679) and the Personal Data Controller’s instructions as well as according to what is agreed upon in this Agreement.

According to the Service, the Contractor must have access to cloud computing. Furthermore, the Service implies that the Contractor connects to a technical platform via a communications network.

When connecting to the Service, the User is enabled to offer, sell, supply and purchase dental services and dental products to and from other users of the Service.

This Personal Data Processor Agreement represents an Exhibit to the Main Agreement. In the event of contradictory provision, the Main Agreement precedes.

Definitions

All terms below must have a corresponding meaning in the applicable data protection legislation. Terms that cannot be defined in particular in this Personal Data Processor Agreement (the Agreement) shall have the same meaning as in the Main Agreement.

a) “Handling” shall mean every action or series of action taken in connection with personal data, no matter if such action takes place automatically or not, e.g. collecting, registration, organisation, storage, handling or amending, recycling, obtaining, operation, consignment via communication, circulation or supply of information, compilation or joint operation, obstruction, obliteration or destruction.

b) ”Personal data” means all kind of information that, direct or indirect, can be referred to a physical person, who is alive and handled on account of the User.

c) The ”Personal Data Controller” refers to the single person, or in consort with other people, takes a decision on the purpose and means for handling of personal data, which, in this case, is the User.

d) The ”Personal Data Processor” refers to the person, who handles the personal data on behalf of the Personal Data Controller, which in this case is the Contractor.

e) The ”Personal Data Breach” refers to a security breach, which leads to unintentional or illegal destruction, loss or amendment or to unauthorised disclosure of or unauthorised access to the personal data that are transferred, stored or handled in any other way.

f) ”Registered” refers to the physical person to whom, the personal data relates.

g) ”Applicable Personal Data Legislation” refers to the below-mentioned General Data Protection Directive (1998:204), the Personal Data Ordinance (1998:1191) as well as the General Data Protection Regulation (GDPR) (EU) 2016/679, which replaced the last mentioned legal document on 25 May 2018, and any laws, directives, regulations and administrative decisions applicable regarding handling of personal data at the said time.

Objective with personal data handling

The objective with the Agreement is to ensure that the Contractor’s handling of personal data of the User is according to applicable personal data legislation, the User’s instructions, as well as what has been agreed between the Parties in general.

The Personal Data Processor is not entitled to handle the Personal Data Controller’s information for any other purpose than what is stated in the Agreement, unless the Personal Data Controller has approved it in writing in each specific case.

The responsibility of the Personal Data Processor

The Personal Data Processor is only responsible for taking such action regarding personal data handling requested in writing by the Personal Data Controller and according to the task, unless specific handling is required pursuant to applicable law. Within reasonable time, upon receipt of written instructions, the Personal Data Processor shall take adequate action to ensure that the handling of the personal data is adjusted according to instructions.

The Personal Data Processor is not responsible for any obscurity in such instructions and is thus not liable to take any action apart from those specifically requested by the Personal Data Controller.

For such actions regarding personal data handling that are not expressly specified by the Personal Data Controller at the time of entering of the Agreement, the Personal Data Processor is entitled to compensation according to the pricelist use by the Personal Data Processor.

Actions by the Personal Data Controller

The Personal Data Controller undertakes the following applicable legislation regarding personal data handling, as well as facilitate the personal data handling as far as possible within the frames of the Agreement, among others without further delay to provide the Personal Data Processor with the required information and in due time inform the Personal Data Processor of any additional administrative actions.

Certificates

The Personal Data Processor confirms that his/her own activities are handled in a way that secures compliance with the requirements of the General Data Protection Regulation (GDPR) at an adequate security level according to the trade’s prevailing standards and in a way that enables implementation of actions regarding personal data handling in accordance with this Agreement.

Protective measures

For all handling of personal data on behalf of the Personal Data Controller, the Personal Data Processor must take the required technical and organisational protective measures.

The Personal Data Processor decides how such measures shall be implemented to obtain the required protection level.

The Personal Data Processor is not liable to take protective measures that are not specifically mentioned in this Agreement or its exhibits.

The Parties can decide on extended or additional protective measure after written agreement. For such measures, the Personal Data Processor is entitled to separate compensation according to the from time to time applicable price list.

Insight

In order to control how the personal data handling is executed, the Personal Data Controller is entitled to request documentation of the Personal Data Processor’s business and system to the extent that the personal data handling on the Personal Data Controller’s account is affected.

Follow-up

In the event, that at the entering of this Agreement, the Parties decide to implement new security measures for the personal data handling, the Personal Data Controller is entitled to, at one occasion, to request documentation of the personal data Processor’s taken measures for the purpose of an agreed-upon implementation.

Transmission of data

Without approval from the Personal Data Controller, the Personal Data Processor is not entitled to transmit any personal data to third party apart from in such cases when it is required by law.

If the Personal Data Processor is required by authorities to transmit data or take any other action following personal data handling on behalf of the Personal Data Controller, the Personal Data Processor is entitled to fair compensation for work done.

In addition, the Personal Data Processor is entitled to fair compensation for other transmission of personal data to anyone else than the Personal Data Controller as well as actions in connection to such transmission.

Transmission to third country

The Personal Data Processor is only entitled to transmit personal data to countries that are not in the European Union or affiliated with the European Economic Community (EEC) if the Personal Data Controller has approved such transmission.

In the event that transmission of personal data to third country according to legislation requires a specific agreement be entered with the purpose of preserving adequate protection level, the Personal Data Controller is not entitled to refuse such transmission, if the Personal Data Processor can show that such agreement exists.

Sub-contractor
The Personal Data Processor is entitled to hire a sub-contractor, that are mentioned at the entering of this Agreement, to handling personal data on behalf of the Personal Data Controller. In such case, the Personal Data Processor is responsible for the work carried out by such sub-contractor.

The Personal Data Processor is entitled to, on account of the Personal Data Controller, to enter into agreement with such sub-contractor, according to which agreement the sub- contractor undertakes the responsibility towards the Personal Data Controller according to this Agreement.

Compensation

The Personal Data Processor is entitled to compensation for such handling of personal data and associated actions that have not specifically been agreed upon by the Parties at the entering of this Agreement.

Contacts, etc.

For the main responsibility regarding communication between the Parties, a contact person must be appointed by each Party. The Parties must inform each other of their choice of contact person and of any temporary or permanent changes of contact person. If the contact person shall possess specific authorisation, this must be stated clearly in the Agreement.

Without further delay, the contact person must inform the other party’s contact person of any circumstances that might lead to changes of preconditions regarding the personal data handling.

Amendments to the Agreement

In order for amendments and supplements to this Agreement together with exhibits to be binding, they must be in writing and signed by both Parties.

Safeguards of rights of the registered individuals

The Personal Data Processor must carry out any changes, extracts or termination of personal data comprised by this Personal Data Processor Agreement according to instructions from the Personal Data Controller. In addition, the Personal Data Processor must assist the Personal Data Controller in handling of the registered individuals’ rights according to Chapter III in the General Data Protection Regulation (GDPR). For such actions, the Personal Data Processor is entitled to fair compensation.

In case, the Personal Data Controller in writing requests deletion of personal data, the Personal Data Processor must delete such personal data within six (6) months.

Termination of personal data handling

At termination of the Agreement, on request by the Personal Data Controller, personal data belonging to the Personal Data Controller must be returned or deleted without further delay. Such request must be in writing three (3) months before the termination of the Agreement at the latest.

In addition, the Personal Data Processor must, to a reasonable extent, assist in further transmission according to the above, as well as transferring of services to another processor, if the Personal Data Controller has requested so within three (3) months in writing. In such event, compensation for the Personal Data Processor is given according to the from time to time applicable price list.

Compensation

According to this Agreement, compensation for the Personal Data Processor comprises only damage as a consequence of such handling of personal data that evidently has been in direct violation with written instructions from the Personal Data Controller.

For compensation to be reimbursed according to this provision, it is required in all conditions that it regards direct damage and that this has occurred as a consequence of wilful or negligent handling by the Contractor.

Dispute

Dispute arisen from this Agreement is determined according to what has been agreed in the Main Agreement between the Parties.