Data Processing Agreement – standard text

1. Parties and entry into force

This data processing agreement (the “Agreement”) is entered into between

The Agreement is concluded electronically in InfoDesk's customer portal and applies from the time it is accepted there. In any event, the Agreement applies from the first time the Customer uses the Services to process personal data, so that processing on the Customer's behalf never takes place without an agreement. If the Customer has not accepted the Agreement in the customer portal, the standard version in force at any time applies, which is available at https://infodesk.no/databehandleravtale-standard.

2. Purpose of the Agreement, precedence and definitions

The Agreement governs the processing of personal data that InfoDesk AS (“InfoDesk” or the “Processor”) carries out on behalf of the Customer (the “Controller”) when the Customer uses services from InfoDesk to store, send or otherwise process personal data. The Agreement is intended to ensure that the processing is carried out in accordance with Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Norwegian Personal Data Act.

In the event of conflict between the Agreement and InfoDesk's general terms and conditions or other agreements between the parties, the Agreement prevails in matters concerning the processing of personal data.

The terms “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “special categories of personal data” have the same meaning as in GDPR Articles 4 and 9. “Sub-processor” means a processor engaged by InfoDesk to deliver the Services. “The Services” means the services listed in Annex A.

3. Scope and delimitation

The Agreement covers personal data that the Customer or the Customer's users store or process in the Services, that is, in web hosting, email accounts, databases, DNS zones and backups, and in InfoDesk's customer portal insofar as the Customer itself registers information about its own users, contact persons or end customers there, to the extent described in Annex A.

The Agreement does not cover processing where InfoDesk itself determines the purposes and means and is therefore an independent controller. This includes:

• registrant and contact details for domain names, which are processed under the rules of the registries (Norid for .no, other registries for other top-level domains);
• the Customer's own account, agreement, invoicing and payment details held by InfoDesk, including card payments via Stripe;
• support and communication history between the Customer and InfoDesk.

Such processing is described in InfoDesk's privacy policy at https://infodesk.no/personvern.

4. Nature, purpose and duration of the processing

The subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex A. InfoDesk processes the personal data solely to deliver, operate, secure and back up the Services for the Customer, and not for its own purposes.

The Agreement applies for as long as InfoDesk processes personal data on behalf of the Customer, and terminates when all personal data have been deleted or returned in accordance with clause 14.

5. The controller's obligations and rights

The Customer is responsible for ensuring that the processing has a valid legal basis, that the data subjects have received the information they are entitled to, and that the Customer's instructions to InfoDesk comply with applicable law. The Customer alone decides which personal data are entered into the Services.

The Customer shall

• use strong, unique passwords and keep login credentials for the control panel, email, FTP/SFTP and databases confidential;
• ensure that its own websites, applications and add-ons are kept up to date and configured with correct access permissions;
• use encrypted transfer (HTTPS/TLS) where personal data are transferred;
• not store special categories of personal data (GDPR Article 9) or data relating to criminal convictions and offences (Article 10) in a shared hosting environment unless agreed in writing with InfoDesk in advance;
• export its data itself before the Services are terminated, see clause 14.

The Customer is entitled to verify that InfoDesk complies with the Agreement, see clause 13, and may terminate the affected Services without charge if InfoDesk can no longer provide sufficient guarantees under GDPR Article 28(1).

6. Instructions

InfoDesk processes the personal data only on documented instructions from the Customer. The Agreement with its annexes, the Customer's choices and settings in the control panel and customer portal, and the Customer's use of the Services constitute the Customer's complete documented instructions. Further instructions shall be given in writing through the customer portal or to [email protected].

This also applies to the transfer of personal data to countries outside the EEA, see clause 10. An exception applies where Norwegian law or EEA law requires InfoDesk to carry out specific processing. In that case InfoDesk shall inform the Customer of the legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

InfoDesk shall immediately inform the Customer if, in InfoDesk's opinion, an instruction infringes the GDPR or other data protection provisions. InfoDesk may suspend the implementation of the instruction until the Customer has confirmed or amended it. InfoDesk shall also notify the Customer without undue delay if InfoDesk, for whatever reason, is no longer able to fulfil the Agreement.

7. Confidentiality and authorisation

InfoDesk shall ensure that only persons with a business need are given access to the personal data, and that these persons have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access shall be removed without undue delay when the need ceases.

The duty of confidentiality continues to apply after the Agreement has terminated.

8. Security

InfoDesk shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with GDPR Article 32. As a minimum, the measures in Annex C shall be implemented. InfoDesk may change and improve the measures as long as the overall level of security is not reduced.

The Services are delivered in a shared hosting environment with logical separation between customers. The Customer is itself responsible for the security of its own content, its own applications and its own login credentials, see clause 5.

9. Sub-processors

The Customer gives InfoDesk a general written authorisation to use the sub-processors listed in Annex B. InfoDesk shall inform the Customer of any intended replacement or addition of sub-processors at least 30 days before the change takes effect, in the customer portal and by email to the Customer's registered email address. The Customer may object to the change in writing within 14 days of the notification. The sub-processor is not used for the Customer's personal data before the objection period has expired. If the parties fail to reach agreement, the Customer may terminate the affected Services without charge with effect from the time the change takes effect.

InfoDesk shall, by way of a written agreement, impose on each sub-processor the same data protection obligations as set out in the Agreement. Where a sub-processor fails to fulfil its obligations, InfoDesk remains fully liable to the Customer for the performance of the sub-processor's obligations. On request, the Customer may obtain a copy of the agreement with a sub-processor, with commercial information redacted where necessary.

10. Transfers to countries outside the EEA

The personal data are stored and processed within the EEA, see Annex A. InfoDesk does not transfer personal data to countries outside the EEA without documented instructions from the Customer or a basis in this Agreement. Where a sub-processor listed in Annex B processes personal data outside the EEA, this takes place only to countries covered by an adequacy decision of the European Commission, to recipients certified under the EU-US Data Privacy Framework, or on the basis of the European Commission's standard contractual clauses (SCCs) with the necessary supplementary measures.

The Customer acknowledges that DNS zone data and traffic via content delivery networks (CDN) or proxies may be processed globally for performance and security reasons, and that visitors' IP addresses may then pass through such services.

11. Assistance to the Customer

InfoDesk shall, insofar as this is possible and taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures so that the Customer can fulfil its obligation to respond to requests from data subjects concerning access, rectification, erasure, restriction, data portability and objection. Requests from data subjects that InfoDesk receives directly are forwarded to the Customer without undue delay and are not answered by InfoDesk without the Customer's written approval.

On the Customer's instruction, InfoDesk shall delete or make available specific personal data within five working days, insofar as the Customer cannot do this itself through the control panel.

InfoDesk shall assist the Customer in ensuring compliance with the obligations under GDPR Articles 32 to 36, that is security, notification of personal data breaches to Datatilsynet (the Norwegian Data Protection Authority) and to the data subjects, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to InfoDesk.

Assistance that goes beyond what is included in the Services may be invoiced on a time-spent basis at InfoDesk's hourly rate in force at any time. InfoDesk shall inform the Customer of this before the work begins.

12. Personal data breaches

InfoDesk shall notify the Customer without undue delay, and at the latest within 24 hours, after becoming aware of a personal data breach concerning personal data processed on the Customer's behalf. The notification is sent to the Customer's registered email address and to the contact point in Annex D.

The notification shall, insofar as possible, describe the nature of the breach, including the categories and approximate number of data subjects and personal data records concerned, a contact point at InfoDesk, the likely consequences of the breach, and the measures InfoDesk has taken or proposes to take to address the breach and mitigate its possible adverse effects. Information that is not available in the initial notification is provided subsequently without undue delay as it becomes known.

InfoDesk shall document the breach and assist the Customer with the information the Customer needs to notify the breach to Datatilsynet within 72 hours and, where applicable, to communicate it to the data subjects.

13. Documentation, audits and inspections

InfoDesk shall, on request, make available the information necessary to demonstrate compliance with the obligations in GDPR Article 28 and this Agreement, including a description of security measures and the list of sub-processors.

The Customer, or an independent auditor mandated by the Customer and bound by a duty of confidentiality, may conduct audits or inspections of InfoDesk's compliance with the Agreement. Audits may be conducted up to once per calendar year with at least four weeks' written notice, during InfoDesk's normal working hours, and without disrupting the operation of the Services or the security of other customers. The Customer bears its own costs and InfoDesk's documented time spent; if the audit reveals material breaches of the Agreement on InfoDesk's part, InfoDesk bears its own time spent. Where there is a reasonable suspicion of a breach of the Agreement, or where Datatilsynet so requires, audits may be conducted at shorter notice and more frequently.

14. Duration, termination, return and deletion

The Customer may at any time export its own content through the control panel (websites, files, databases and email) and obtain its DNS zones on request, and shall do so before the Services are terminated. InfoDesk assists with export on request, see clause 11.

When the affected Services have been terminated, InfoDesk shall, at the Customer's choice, delete or return all personal data processed on the Customer's behalf, and delete existing copies. Return takes place by the Customer exporting the content through the control panel, or by InfoDesk, on request within 30 days after termination, making the content available in a structured, commonly used and machine-readable format, see clause 11. In the absence of other instructions, active data are deleted within 30 days after the Service has been terminated. Backups are overwritten in accordance with InfoDesk's rotation schedule and are deleted at the latest 90 days after termination. Until deletion has taken place, the Agreement continues to apply in full to the remaining data.

InfoDesk may retain personal data that Norwegian law or EEA law requires InfoDesk to store, and only for as long as the requirement applies. InfoDesk sends the Customer written confirmation when deletion has been carried out, and at the latest when the deadlines in the second paragraph have expired.

InfoDesk is not liable for loss caused by the Customer's failure to export its own content before termination.

15. Liability and amendments

The parties' liability towards each other follows from the agreement on the Services and InfoDesk's general terms and conditions, subject to the limitations agreed there. Liability towards data subjects follows from GDPR Article 82. Each party is responsible for administrative fines imposed on that party for its own infringements of the GDPR.

InfoDesk may amend the Agreement where this is necessary due to changes in legislation, guidance from supervisory authorities or changes in the Services. Amendments are notified at least 30 days before they take effect, in the customer portal and by email. Amendments that are not to the Customer's detriment may take effect without notice. The Customer may terminate the affected Services without charge if the Customer does not accept an amendment. Continued use of the Services after the amendment has taken effect is deemed acceptance of the new version, and the new version is recorded against the Customer in the customer portal.

16. Governing law and legal venue

The Agreement is governed by Norwegian law. Disputes that are not resolved amicably may be brought before the ordinary courts with Vestfold tingrett (Vestfold District Court) as the legal venue, unless mandatory law provides otherwise.

17. Acceptance and versioning

The Agreement is accepted electronically in InfoDesk's customer portal by a person authorised to bind the Customer. Electronic acceptance has the same legal effect as a handwritten signature, in accordance with GDPR Article 28(9) and the Norwegian Act on Electronic Trust Services. InfoDesk records who accepted, the time, the IP address, the agreement version and a checksum (SHA-256) of the agreement text as accepted. The accepted version is available as a PDF in the customer portal and is sent to the parties by email.

The current standard text and previous versions are available in the customer portal. This text is version 2026.1.