Data Processing Agreement
1. Parties
This Data Processing Agreement ("DPA") is entered into between the customer entity that has agreed to Economic Mind's Terms of Service ("Controller") and Economic Mind AS, a Norwegian company ("Processor"). This DPA forms part of the agreement between the parties governing the use of Economic Mind's services ("Agreement").
2. Subject Matter
This DPA governs the processing of personal data by the Processor on behalf of the Controller in connection with the Controller's use of Economic Mind's services.
3. Processing Details
The Processor processes personal data on behalf of the Controller for the following purposes:
| Purpose | Providing the Economic Mind service as described in the Agreement |
| Duration | For as long as the Processor holds personal data on behalf of the Controller |
| Types of personal data | May include name, email address, user ID, profession, company name, usage data, and other personal data submitted by the Controller or its users through the service |
| Categories of data subjects | The Controller's employees and end users |
4. Processor Obligations
4.1 Instructions. The Processor shall process personal data only on documented instructions from the Controller. Use of the service by the Controller constitutes such instructions.
4.2 Confidentiality. The Processor shall ensure that persons authorised to process personal data are bound by confidentiality obligations.
4.3 Security. The Processor shall implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage.
4.4 Data breaches. The Processor shall notify the Controller without undue delay upon becoming aware of a personal data breach affecting the Controller's personal data.
5. Sub-processors
The Processor may engage sub-processors to assist in providing the service. A current list of sub-processors is maintained at economicmind.com/sub-processors. The Processor will update this list prior to engaging any new sub-processor. Controllers who object to a change may terminate the Agreement with written notice.
6. Deletion of Personal Data
The Processor will delete personal data processed on behalf of the Controller upon written request, unless retention is required by applicable law.
7. Governing Law
This DPA is governed by Norwegian law. Any disputes shall be subject to the exclusive jurisdiction of the Norwegian courts.
