Data Processing Agreement — Mynder AS and partner | Mynder

Data processing agreement between Mynder AS and the partner for the partner's own use of the Mynder platform.

Data Processing Agreement

Mynder AS and partner

This agreement follows the same structure as the data processing agreement between Mynder AS and the end customer, because both are based on the Norwegian Data Protection Authority's standard template for data processing agreements (GDPR Article 28). The identical structure is therefore intentional — the content is adapted to the relationship between Mynder AS and the partner. The starting point is model A: the partner is the controller for its own use of the Mynder platform, and Mynder AS is the processor.

This agreement applies when we at Mynder AS process personal data on behalf of the partner in connection with the partner's use of the Mynder platform and related partner functionality.

The partner is the controller. We are the processor.

The agreement describes what we may do with the personal data, how we secure it, which suppliers we may use, how we assist the partner, and what happens to the data when the partner relationship or the use of the Service ends.

We have entered into this agreement in accordance with Article 28(3) of the General Data Protection Regulation (GDPR), and it forms part of the contractual basis for the partner's use of the Mynder platform.

Processor: Mynder AS, org. no. 831 377 372, Edvard Griegs vei 3C, 5059 Bergen, Norway.

We refer to the organisation using the Mynder platform as a partner as “the controller” or “the partner”, and to ourselves as “the processor” or “Mynder”.

1. Who the agreement applies to

The agreement applies between Mynder AS and the organisation using the Mynder platform as a partner (“the Service”).

The partner is the controller for the personal data involved in the partner's own use of the platform: partner administration, partner users, partner documentation and other data the partner enters or makes available. We process that personal data on the partner's behalf and act as processor.

The agreement does not govern the partner's processing of personal data on behalf of end customers. If the partner uses the Service to assist or administer an end customer, the partner must ensure that a valid mandate and the necessary contractual basis with the end customer are in place.

If the end customer has a direct agreement with us, the data processing agreement between Mynder and the end customer governs our processing of the end customer's personal data. The partner's access to the end customer's workspace then rests on the end customer's mandate, and partner terms, access terms or another agreement between the parties govern this in more detail.

If we are to act as a sub-processor for the partner in a customer relationship where the partner is the processor for the end customer, we must agree to this expressly.

2. What we use the personal data for

We process personal data only to deliver, operate, secure and improve the Service for the partner.

By improving the Service we mean, among other things, error correction, security, stability, performance and further development of functionality — always within the partner's instructions. We do not use the partner's personal data for our own independent purposes or to train general models.

Annex A describes in more detail what we process, why, which people and categories of data it concerns, and how long the processing lasts.

3. The partner's responsibilities

The partner decides why we process the personal data and how the Service is used within the functionality we offer.

The partner is responsible for ensuring that the processing has a valid legal basis and otherwise complies with the GDPR and other relevant data protection legislation — including a legal basis under GDPR Article 6 and, where relevant, the conditions for processing special categories of personal data under Article 9.

The partner is also responsible for ensuring that the personal data entered into the Service is relevant and necessary for the purpose.

When the partner processes personal data on behalf of an end customer, the partner is itself responsible for having the necessary agreement, instructions and mandate from the end customer, and for ensuring that its use of the Mynder platform is consistent with that mandate.

4. We follow the partner's instructions

We process personal data on the partner's behalf and only within documented instructions.

The instructions consist of this agreement with annexes, the partner's choices and configuration in the Service, and any other written instructions the partner gives within the functionality of the Service.

We do not use the personal data for our own independent purposes unless EEA law or Norwegian law requires us to do so.

If we believe an instruction conflicts with data protection legislation, we notify the partner without undue delay. The parties then clarify together how we should handle the instruction. We may postpone implementation to the extent necessary to avoid unlawful processing.

The partner may only give us instructions concerning end-customer data if the partner is entitled to do so under its own contractual basis with the end customer and under applicable data protection legislation.

5. Who gets access

Only people who need access to deliver, operate, secure or support the Service get access to the personal data.

Everyone who gets access is bound by confidentiality or a statutory duty of secrecy. We review access rights regularly and remove them when they are no longer necessary.

On request, we document that the relevant people are subject to such obligations.

6. How we protect the personal data

We maintain technical and organisational security measures appropriate to the risk of the processing, in line with GDPR Article 32.

Where relevant, the measures include access control, encryption, logging, backup, restoration and procedures for security incidents.

The partner gives us the information we need to understand any particular risks arising from the partner's use of the Service. At the same time, we assess the risk of the processing we carry out ourselves and maintain an appropriate level of security.

Annex C describes the minimum measures and how we assist the partner with its security obligations under the GDPR.

7. Suppliers that process data for us

We use sub-processors to deliver the Service. Annex B — Sub-processors sets out the overview, processing locations and relevant documentation.

8. Where we process data

In normal use and operation of the Mynder platform, we store and process personal data within the EU/EEA.

If processing outside the EU/EEA becomes necessary, we only do so when the conditions in Chapter V of the GDPR are met and the processing is covered by the partner's documented instructions. Annex C.6 sets out the detailed rules.

This agreement does not in itself authorise transfers of personal data outside the EU/EEA.

9. When the partner needs help with its data protection obligations

We assist the partner whenever information or functionality in the Service is necessary for the partner to meet its data protection obligations.

This includes requests for access, rectification, erasure, restriction, data portability and other data subject rights. We also assist with available information in the event of a personal data breach, for data protection impact assessments (DPIA) and for any prior consultation with the Norwegian Data Protection Authority.

We give this assistance based on the nature of the processing, the functionality of the Service and the information we actually have access to. Annex C describes this further.

If the assistance concerns end-customer data, the partner coordinates the request with the end customer, unless we have a direct contractual basis and contact point with that end customer.

10. If a personal data breach occurs

If we discover a breach of personal data security affecting the Service, we notify the partner without undue delay — where possible, within 24 hours of becoming aware of the breach.

We share the information we have available and that the partner needs to assess further follow-up, including any notification to the Norwegian Data Protection Authority or to the individuals affected.

As far as possible, we describe what has happened, which data may be affected, the possible consequences and the measures we have taken or planned. Annex C describes this further.

If the breach concerns end-customer data, the partner is responsible for any further notification to the end customer, unless we have a direct notification obligation towards that end customer under a separate agreement.

11. Deletion and return of data

When the partner relationship or the partner's use of the Service ends, the partner can export its own data before we delete it, where this is technically possible.

We then delete or return the personal data we have processed on the partner's behalf. We do, however, keep certain data if we need it to: meet statutory obligations; document the contractual relationship; handle security incidents; or defend legal claims.

We delete data in the production environment no later than 30 calendar days after termination or an instruction to delete. We do not delete individual backups, but overwrite them in the ordinary backup cycle within 35 days. The data is therefore finally deleted no later than 65 calendar days after termination or an instruction to delete.

If the relationship between the partner and an end customer ends, this does not affect the end customer's right to its own data in the Mynder platform, provided the end customer has a direct agreement or its own workspace with us.

12. Documentation and audit

We make relevant documentation available so the partner can assess whether we meet the requirements of GDPR Article 28 and this agreement.

As a SaaS provider, we normally meet this through security documentation, audit reports, third-party attestations, Trust Profile or equivalent documentation.

If the documentation is not sufficient, the partner may request a further audit. The partner then notifies us within reasonable time, carries out the audit within normal working hours, and limits it so that it does not weaken the security of the Service or give access to information about other customers, trade secrets or security-sensitive information.

Where supervisory authorities have a statutory right of access or control, we contribute in accordance with applicable law. Annexes C.7 and C.8 give further details about audits.

13. Relationship to other terms

This data processing agreement covers the processing of personal data in the Mynder platform where the partner is the controller and we are the processor.

The partner's other contractual terms with us govern commercial terms, prices, payment, liability, partner status, sales model, customer ownership and other matters, provided they do not weaken the rights and protection that follow from the GDPR.

Annex D describes the partner's access to end customers' workspaces and the partner's responsibility for its own end-customer mandate.

14. When the terms apply

These standard terms apply from when the partner starts using the Mynder platform, or from the point at which the terms form part of the partner's contractual basis with us.

The terms apply for as long as we deliver the Service to the partner and process personal data on the partner's behalf. If delivery of the Service ends, the terms continue to apply for as long as we process personal data in connection with deletion, return, documentation or statutory retention.

We may update these standard terms when necessary due to changes in the Service, suppliers, regulations or security. We notify material changes in accordance with the contractual basis for the Service.

If we enter into a specific enterprise agreement or another individually signed agreement with a partner, separate signature and contractual provisions may apply to that partner relationship.

15. Contact

The partner keeps relevant contact details up to date in the Mynder platform or in another agreed contact point.

The partner can contact us through the contact points we publish at any time on our website, in the Service or in the partner's contractual basis with us.

Annexes

Annexes A–D form part of the data processing agreement and apply together with the standard terms.

Annex A — Information about the processing

Annex B — Sub-processors

Annex C — Instructions and security measures

Annex D — The partner's use of Mynder and end-customer mandate