TOOL Spawn in Essential Links • 9 mo. ago
Terms & Conditions
Below you will find the terms of use for toolspawn.com, which consists of:
terms and conditions agreement
privacy policy
tool compliance: un global compact s 10 principles
appendix a - data processing agreement
terms and conditions agreement
1. Introduction
1.1 toolspawn.com (the site), is operated by The Ocean Opportunity Lab AS (hereby TOOL), registered address is Slemdalsveien 25 a, 0371 Oslo.
1.2 these terms and conditions apply between you, the user of this website (including any sub-domains, unless expressly excluded by their own terms and conditions) and toolspawn.com. Please read these terms and conditions carefully, as they affect your legal rights.
You should read and agree to these terms and conditions in conjunction with our privacy policy, which combined with this terms and conditions agreement is collectively known as the user agreement.
If you do not agree to be bound by these terms and conditions, you should stop using the website immediately.
1.3 in these terms and conditions, user or users means any third party that accesses the website and is not either (i) employed by tool and acting in the course of their employment or (ii) engaged as a consultant or otherwise providing services to tool and accessing the website in connection with the provision of such services.
You must be at least 16 years of age to use this website. By using the website and agreeing to these terms and conditions, you represent and warrant that you are at least 16 years of age. Users between the age of 13 and 16 may use the website if they submit the consent of a legal guardian / parent
1.4 we reserve the right to change any term or condition of the user agreement at any time.
Changes will take effect when posted on the site. We will try to inform users of any major changes, your continued use of the site and/ or services after such changes have taken effect will be deemed acceptance by you of the amended user agreement.
2. Services
2.1 the sites are online gateway for gaining overview of the innovators ecosystems of ocean and renewable energy, featuring virtual event platform, resource exchange and showcasing platforms providing job, resource and opportunity posting and job finding services (the services) where individual users (the user) can create profiles where they showcase their projects, innovation solutions and share needs or resources related to the innovators journey. You can also utilise the event calendar and industry segment insight sections, and read about TOOLs solutions and products.
3. Use of sites
3.1 individual users (the user) can use the site to create their own profile, company or project profiles, upload videos and images which showcase their solutions, concepts, companies and experience and advertise their services
3.2 we reserve the right to improve, amend, or suspend the service provided on the site at any time without notice.
4. Registration
4.1 you may register on the site to use the services as an individual or a company by completing and submitting the form on our "registration" page. Those who register with the site are hereinafter referred to as "the users". When you register with us you will be asked to create a password. You will use your email address and password ("user id") to log in to your profile page and access the services on the site.
4.2 you should make every effort to keep your user id safe and you are responsible for all actions taken with your user id. It should not be disclosed to any other person and other than where access is provided to users within a company by way of access code, no other person should be allowed, either directly or indirectly, to use your user id or password. Unless authorised under the procedures set out on the sites, you must not transfer or sell your user id.
If you lose control of your password, you may lose substantial control over your personal data and may subsequently be subject to legally binding actions taken on your behalf. You shall be responsible for all activities and anything occurring through your account until your account is closed or you prove that your account security was compromised through no fault of your own.
4.3 you may not register on the sites or use the services unless you are 13 (thirteen) years old.
Company users must not authorise anyone below the age of 13 to use the sites or services. We may use your registration details to verify your identity and entitlement to use the sites and the services.
4.4 you are solely responsible and liable for providing accurate and truthful registration details.
TOOL Spawn does not vet and cannot and does not confirm or guarantee the supposed identity of users or the validity or the accuracy of the information which users post to the sites and accepts no liability or responsibility to users in respect thereof.
4.5 registration on the sites is free at the point of account creation. You are solely responsible for paying all expenses you may incur when you access or use the site and services including without limitation, your internet or data service provider charges and any excess charges to that provider if you have a limit on the amount of data you can download together with all costs of the equipment and facilities you need to connect to and use the site. We are not responsible if your own equipment or software is not compatible with the site.
4.7 we reserve the right to refuse any subscription application, to alter the fee structure and/or to commence or cease charging for any of our services at any time at our discretion. In the event that we reject a membership application after we have received the membership fee we shall refund the fee within fourteen (14) days from the rejection date. If any change is made to the membership fee levels, payment structure and/or process, users will be informed by email and any such change will not affect existing memberships paid by users until the completion of the membership period that they have paid for.
4.8 you may cancel your registration at any time by informing us in writing through your profile on the sites, including the reason for cancellation. Cancellation or suspension of your registration does not affect any statutory rights.
5. Company user GDPR compliance commitment
5.1 when registering on our sites as a company you will be acting as a data processor according to the general data protection regulation, and are by agreeing to our user agreement entering a legal contract with us confirming that you will:
only act on the written instructions of the controller (unless required by law to act without such instructions);
ensure that people processing the data are subject to a duty of confidence;
take appropriate measures to ensure the security of processing;
only engage a sub-processor with the prior consent of the data controller and a written contract;
assist the data controller (indyriot as) in providing subject access and allowing data subjects to exercise their rights under the gdpr;
assist the data controller in meeting its gdpr obligations in relation to the security of processing, the notification of personal data breaches and data protection impact assessments;
delete or return all personal data to the controller as requested at the end of the contract; and
submit to audits and inspections, provide the controller with whatever information it needs to ensure that they are both meeting their article 28 obligations, and tell the controller immediately if it is asked to do something infringing the gdpr or other data protection law of the eu or a member state.
Co-operate with supervisory authorities (such as the ico) in accordance with article 31;
ensure the security of its processing in accordance with article 32;
keep records of its processing activities in accordance with article 30.2;
notify any personal data breaches to the controller in accordance with article 33;
employ a data protection officer if required in accordance with article 37; and
appoint (in writing) a representative within the european union if required in accordance with article 27
6. Termination
6.1 without limiting other remedies, we reserve the right to terminate, suspend or restrict your account without notice if: -
(a) you commit any breach of the user agreement or we believe that you may commit a breach of the user agreement;
(b) you are/have engaged in, are about to engage in, or have been in any way involved in or linked to, fraudulent activity in connection with the site;
(c) we are unable to verify or authenticate any information you provide to us; or
(d) we believe that your actions with regard to the site may cause us financial loss or legal liability or damage our goodwill or bring us into disrepute or infringe any third party rights.
7. Intellectual property and acceptable use
7.1 all content included on the website, unless uploaded by users, is the property of TOOL, our affiliates or other relevant third parties. In these terms and conditions, content means any text, graphics, images, audio, video, software, data compilations, page layout, underlying code and software and any other form of information capable of being stored in a computer that appears on or forms part of this website, including any such content uploaded by users. By continuing to use the website you acknowledge that such content is protected by copyright, trademarks, database rights and other intellectual property rights. Nothing on this site shall be construed as granting, by implication, estoppel, or otherwise, any license or right to use any trademark, logo or service mark displayed on the site without the owner's prior written permission.
7.2 you may, for your own personal, non-commercial use only, do the following:
7.2.1 retrieve, display and view the content on a computer screen
7.3 you must not otherwise reproduce, modify, copy, distribute or use for commercial purposes any content without the written permission of tool.
7.4 you acknowledge that you are responsible for any content you may submit via the website, including the legality, reliability, appropriateness, originality and copyright of any such content. You may not upload to, distribute or otherwise publish through the website any content that (i) is confidential, proprietary, false, fraudulent, libellous, defamatory, obscene, threatening, invasive of privacy or publicity rights, infringing on intellectual property rights, abusive, illegal or otherwise objectionable; (ii) may constitute or encourage a criminal offence, violate the rights of any party or otherwise give rise to liability or violate any law; or (iii) may contain software viruses, political campaigning, chain letters, mass mailings, or any form of "spam. " you may not use a false email address or other identifying information, impersonate any person or entity or otherwise mislead as to the origin of any content.
7.5 you represent and warrant that you own or otherwise control all the rights to the content you post; that the content is accurate; that use of the content you supply does not violate any provision of these terms and conditions and will not cause injury to any person; and that you will indemnify tool for all claims resulting from content you supply.
8. Prohibited use
8.1 you may not use the sites for any of the following purposes:
8.1.1 in any way which causes, or may cause, damage to the sites or interferes with any other person's use or enjoyment of the sites;
8.1.2 in any way which is harmful, unlawful, illegal, abusive, harassing, threatening or otherwise objectionable or in breach of any applicable law, regulation, governmental order;
8.1.3 making, transmitting or storing electronic copies of content protected by copyright without the permission of the owner.
9. Links to other websites
9.1 the sites may contain links to other sites. Unless expressly stated, these sites are not under the control of tool or that of our affiliates.
9.2 we assume no responsibility for the content of such websites and disclaim liability for any and all forms of loss or damage arising out of the use of them.
9.3 the inclusion of a link to another site on this website does not imply any endorsement of the sites themselves or of those in control of them.
10. Privacy policy
10.1 use of the sites is also governed by our privacy policy, which is incorporated into these terms and conditions by this reference.
11. Availability of the website and disclaimers
11.1 any online facilities, tools, services or information that TOOL makes available through the website and app (the sites) is provided "as is" and on an "as available" basis. We give no warranty that the sites will be free of defects and/or faults. To the maximum extent permitted by the law, we provide no warranties (express or implied) of fitness for a particular purpose, accuracy of information, compatibility and satisfactory quality. TOOL is under no obligation to update information on the website, but will to the best of our abilities work to keep it updated at all times.
11.2 whilst TOOL uses reasonable endeavours to ensure that the sites are secure and free of errors, viruses and other malware, we give no warranty or guarantee in that regard and all users take responsibility for their own security, that of their personal details and their computers.
11.3 TOOL accepts no liability for any disruption or non-availability of the sites.
11.4 TOOL reserves the right to alter, suspend or discontinue any part (or the whole of) the sites including, but not limited to, any products and/or services available. These terms and conditions shall continue to apply to any modified version of the website unless it is expressly stated otherwise.
12. Limitation of liability
12.1 nothing in these terms and conditions will: (a) limit or exclude our or your liability for death or personal injury resulting from our or your negligence, as applicable; (b) limit or exclude our or your liability for fraud or fraudulent misrepresentation; or (c) limit or exclude any of our or your liabilities in any way that is not permitted under applicable law.
12.2 to the extent that the sites and content are provided free of charge, we will not be liable to you for any loss or damage of any kind.
12.3 we will not be liable to you in respect of any losses arising out of events beyond our reasonable control.
12.4 to the maximum extent permitted by law, tool accepts no liability for any of the following:
12.4.1 any business losses, such as loss of profits, income, revenue, anticipated savings, business, contracts, goodwill or commercial opportunities;
12.4.2 loss or corruption of any data, database or software;
12.4.3 any special, indirect or consequential loss or damage.
13. General
13.1 you may not transfer any of your rights under these terms and conditions to any other person. We may transfer our rights under these terms and conditions where we reasonably believe your rights will not be affected.
13.2 these terms and conditions may be varied by us from time to time. Such revised terms will apply to the sites from the date of publication. Users should check the terms and conditions regularly to ensure familiarity with the then current version.
13.3 these terms and conditions together with the privacy policy contain the whole agreement between the parties relating to its subject matter and supersede all prior discussions, arrangements or agreements that might have taken place in relation to the terms and conditions.
13.4 the contracts (rights of third parties) act 1999 shall not apply to these terms and conditions and no third party will have any right to enforce or rely on any provision of these terms and conditions.
13.5 if any court or competent authority finds that any provision of these terms and conditions (or part of any provision) is invalid, illegal or unenforceable, that provision or part-provision will, to the extent required, be deemed to be deleted, and the validity and enforceability of the other provisions of these terms and conditions will not be affected.
13.6 unless otherwise agreed, no delay, act or omission by a party in exercising any right or remedy will be deemed a waiver of that, or any other, right or remedy.
Privacy policy
1. Introduction
1.1 the ocean opportunity lab as is the operator of the website www. Toolspawn. Com (the site). Tool is registered with the ico as the data controller in relation to all such personal information.
We provide an online showcasing and matchmaking platform where individual users (the user) can create company profiles, showcase their opportunities and apply for assignments.
1.2 Indyriot as is the sites data processor.
1.2 Indyriots data protection officer is miriam ghebremedhin (miriam. Ghebremedhin@indyriot. Com)
1.3 if you have any requests concerning this policy, your personal data or any queries with regard to how we handle your data you can contact us by email at support@toolspawn. Com.
1.4 we will only process your personal data in accordance with the services we provide to you based on the contract we have as per our user agreement, or based on your consent in relation to any marketing activities we undertake. We will collect this consent when you first provide your personal data and you can withdraw that consent at any time by contacting us using the contact information provided above.
2. What information do we collect and how do we collect it?
2.1 we may collect the following types of information, some or all of which may be classified as personal data: -
(a) personal details which are submitted by you upon registration to validate your identity, for example name, address, e-mail address, ip address.
(b) information which you volunteer and submit to the site either in your cv, profile or otherwise about your experience, abilities and the services you offer. This may include date of birth, academic record, profile picture, personal website. Please do not post or add personal data to your profile that you don't want to be publically available.
(c) information that we receive from other users or third parties who are permitted to give information about you. Others may post, write about and 'tag' you or link to your profile. If you are tagged in a project by a user, you can choose whether to publish this or not.
(d) information about your computer hardware and software which we may use to help diagnose problems with our server and/or to administer our site and which may include your ip address, browser type and version, domain names, operating system and platform, access times and referring website addresses, browser plug in types and versions, your location (if you are accessing the services from a mobile device (note that most mobile devices will allow you to prevent location data being sent to us).
(e) other information about your use of our site, such as what areas you visit and what services you access, your requests or enquiries about our services, or any information which we may request from you to improve the site and/or the services, including for example information derived from your use of forums, tweets, blogs and any other services on the site.
2.2 where you pay fees to us or subscribe to premium services for which we take a payment, we and/or our payment providers may store your payment card information. (the data that we collect from you when you subscribe to premium services may be transferred to and stored at, a destination outside the european economic area ("eea"). It may also be processed by staff operating outside the eea, who work for us or for one of our suppliers. ) by submitting your personal data, you agree to this transfer, storing or processing. Where we transfer your data to a service provider or supplier that is outside of the eea we will take all appropriate steps to ensure that appropriate safeguards are in place to make sure that your personal data is held securely, processed in accordance with this privacy policy and that your rights as a data subject are upheld.
2.3 where this policy refers to personal data it is referring to data about you (or other living people) from which you could be identified such as your name, your date of birth, your contact details and even your ip address. By law all organisations in the uk are obliged to process your personal data in certain ways and to ensure that you are given an appropriate amount of information about how they use it. You also have various rights to seek information from those organisations about how they are using your data, and to prevent them from processing it unlawfully. For more information about these rights, please see the data subjects rights section of this privacy policy.
3. Purpose of processing your personal data
activity 1:
user registration
why we need to process your personal information:
to enable login to and personalisation of the tool spawn website
allow users to apply for opportunities
lawful basis to process personal information:
contract
activity 2:
Opportunity & resource matchmaking, application submission
why we need to process your personal information:
allow application management tool to access relevant information about applicant's suitability for the role
provide information relating to the opportunities applied for
lawful basis to process personal information:
contract
activity 3:
email marketing
why we need to process your personal information:
to send opportunity information, curated updates on potentially relevant insights and market place opportunities, and advice and marketing messages by email from tool spawn, our internal and partner projects/events and our TOOLbox partners.
Lawful basis to process personal information:
consent
activity 4:
segmentation, analytics, marketing profiling
why we need to process your personal information:
to provide targeted and appropriate marketing messages and product development
lawful basis to process personal information:
legitimate interest
4. The legal basis on which we rely are:
contract
processing of your personal data is necessary for us to provide our services as per our terms and conditions agreement between ourselves and our users in connection with the performance of a contract.
Consent
for email marketing and for passing data to third parties we will use consent, this will usually be in the form of an opt-in tick box, or when you submit an email address expressly for the reason of sending marketing. We will always make it clear what your data will be used for and provide a link to our privacy policy. You can change your mind at any time.
Legitimate interests
we will use legitimate interests to send occasional marketing by email or in-app and for segmentation and profiling in order to send relevant targeted communications. Our legitimate interests are to communicate with our members to keep them informed, to grow and develop our business and product and promote best practice in the industry.
5. Marketing
we conduct basic profiling for our marketing purposes to ensure relevant and targeted communications. This might be in the form of segmentation based on location or stated interests.
We would like to use your personal data to send you details of services and advice that we offer that we have identified as likely to be of interest to you. We will only send you information in line with the preferences you indicated when you agreed to our user agreements.
If at any point you would like to opt-out of receiving communications from us or would like to change the channels (such as email or post) that we use to contact you, please contact us at support@toolspawn. Com or write to us at The Ocean Opportunity Lab AS, Slemdalsveien 25, 0371 Oslo, Norway or please visit your profile at toolspawn. Com and send us an in-app message.
6. Third party sharing
TOOL aims to provide an optimal technology infrastructure for innovators in our industries to experience seamless access to shared resources and enhanced abilities to develop and scale supported by global network of innovation hubs and technology. We work closely with third parties (including for example, software providers, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers and search information providers) and may share some information about you from them. The purpose of this will be to enable the users to utilise the TOOL infrastructure across the individual platforms.
At present these are:
google analytics - Ireland - https: //analytics. Google. Com
google cloud services - Ireland - https: //cloud. Google. Com
intercom - USA - https: //intercom. Com
tripletex - Norway - https: //tripletex. No
fourpro solutions - Norway - https: // fourprosolutions. com
myonvent - Norway - https: //myonvent. com
we will only provide those third parties access to your personal data for the sole purpose of providing their services to us and they will only have access to the minimum amount of personal data they need to fulfil the services we request. We will use reasonable endeavours to ensure that those third parties: - only use your personal data for the specific purposes for which it is provided to them; - are obliged to not disclose your personal data; and- they treat your personal data consistently with this privacy policy.
7. Retention periods
we will keep your personal data in connection with the services for which it was collected for an appropriate period of time and in accordance with our data protection policy. A copy of this policy can be found on our website.
In terms of personal data we use for marketing, we will keep this data for as long as we are able to market to you and if you withdraw your consent or opt-out of marketing communications, we will keep your contact details only to ensure that we do not contact you again for marketing purposes.
8. Data subjects rights
you have rights in respect of your personal data. We will need to confirm your identity before we can consider your request so, if you wish to exercise any of these rights, we will first need to confirm your identity before we can consider your request so please supply two forms of id, one of which should be a passport or birth certificate, the other could be a driving licence or utility bill.
(a) the right to be informed you have the right to be told about the collection and use of the personal data you provide. This privacy policy sets out the purpose for which we process your personal data, how long we will keep your data, who we will share your data with. If you have any questions on how and why we process your data please contact the dpo.
(b) right of access you have the right to know whether we are processing your personal data, and to a copy of that data. We would need as much information as possible to enable us to locate your data. We will respond to your request within 28 days of receipt of your request. If you want to exercise this right, please contact the dpo at the contact details above.
(c) right to rectification you have the right to have any incorrect personal data corrected or completed if it is incomplete. You can make this request verbally or in writing. We will need as much information as possible to enable us to locate your data. We will look at any request and inform you of our decision within 28 days of receiving the request. If you want to exercise this right, please contact the dpo at the contact details above.
(d) right to erasure this right, often referred to as the right to be forgotten allows you to ask us to erase personal data where there is no valid reason for us to keep it. We will look at any request and inform you of our decision within 28 days of receiving the request. If you want to exercise this right, please contact the dpo at the contact details above.
(e) right to restrict processing you have the right to ask us to restrict processing of your data. We will look at any request and inform you of our decision within 28 days of receiving the request. If you want to exercise this right, please contact the dp at the contact details above.
(f) right to portability - where you wish to transfer certain personal data that we hold about you, which is processed by automated means, to a third party you may write to us and ask us to provide it to you in a commonly used machine-readable format.
(g) right to object you have the right to object to our processing of your personal data based on (i) legitimate interests, or for the performance of a task in the public interests/exercise of official authority (including profiling); (ii) direct marketing (including profiling); and (iii) for purposes of scientific/historical research and statistics.
Legitimate interests/legal task your objection should be based on your particular situation. We can continue to process the data if we can demonstrate compelling legitimate grounds which override your interests.
Direct marketing you have an absolute right to ask us to stop processing for the purposes of direct marketing. We will action your request as soon as possible.
Scientific/historical research and statistics - your objection should be based on your particular situation. If we are conducting research where the processing is necessary for the performance of a public task, we can refuse to comply with your objection.
If you want to exercise this right, please contact the dpo at the contact details above.
(h) processing based on consent
where we process your personal data based on your consent you have the right to withdraw that consent at any time without reason. You can opt-out by using the unsubscribe/opt-out in any marketing we send you and you can contact us using the contact details above.
9. Cookies
a cookie is a small piece of information sent by a web server to a web browser, which enables the server to collect information from the browser. Find out more about cookies on http: //www. Allaboutcookies. Org/
we use cookies to identify you when you visit this website and to keep track of your browsing patterns and build up a demographic profile.
Most browsers will allow you to turn off cookies. If you want to know how to do this please look at the menu on your browser, or look at the instruction on http: //www. Allaboutcookies. Org/ please note however that turning off cookies will restrict your use of our website.
Cookies we use
cookie:
_ga
_gat
what it does: google analytics - tracks web traffic to the site. Page views & clicks.
How to disable and consequences: disable in browser settings. No user impact
10. Third party websites
our website may contain links to other websites that are outside our control and are not covered by this privacy policy. If you access other sites using the links provided, the operators of these sites may collect information from you that will be used by them in accordance with their privacy policy, which may differ from ours.
11. Changes to the privacy policy
we keep our privacy policy under regular review and reserve the right to change any part of the privacy policy at any time and at our discretion. Any changes we make will be published on the sites. Where possible we will try to notify users of any changes, but advise all users of our sites to regularly check this page and stay updated on the policy. This policy was last updated on 23 nov 2021.
UN Global Compact
Corporate sustainability starts with a companys value system and a principles-based approach to doing business. This means operating in ways that, at a minimum, meet fundamental responsibilities in the areas of human rights, labour, environment and anti-corruption. Responsible businesses enact the same values and principles wherever they have a presence, and know that good practices in one area do not offset harm in another. By incorporating the ten principles of the un global compact into strategies, policies and procedures, and establishing a culture of integrity, companies are not only upholding their basic responsibilities to people and planet, but also setting the stage for long-term success. The ten principles of the united nations global compact are derived from: the universal declaration of human rights, the international labour organizations declaration on fundamental principles and rights at work, the rio declaration on environment and development, and the united nations convention against corruption.
TOOL partners & members should ensure and strive for delivering on the 10 principles.
Human rights principle 1: businesses should support and respect the protection of internationally proclaimed human rights; and
principle 2: make sure that they are not complicit in human rights abuses.
Labour principle 3: businesses should uphold the freedom of association and the effective recognition of the right to collective bargaining;
principle 4: the elimination of all forms of forced and compulsory labour;
principle 5: the effective abolition of child labour; and
principle 6: the elimination of discrimination in respect of employment and occupation. Environment principle 7: businesses should support a precautionary approach to environmental challenges;
principle 8: undertake initiatives to promote greater environmental responsibility; and principle 9: encourage the development and diffusion of environmentally friendly technologies.
Anti-corruption principle 10: businesses should work against corruption in all its forms, including extortion and bribery.
Its all about collaboration for the goals!
TOOL considers the UN SDGs as fundament for all our work, and encourage all partners & our industry to deep-dive into the 17 goals, to build all new business streams and solutions in a way that delivers on the global goals.
Visit UN Global Compact and explore how your company can advance each of the SDGs
appendix a
data processing agreement
this data processing agreement (dpa) forms an integral part of the subscription agreement (the agreement). The dpa shall be affixed to the agreement as appendix a and always be read in conjunction with the agreement. In case of any conflict between the agreement and the dpa, the dpa shall prevail.
1 parties
controller: The Ocean Opportunity Lab AS
processor: Indyriot AS (TOOL Spawn)
processor: MyOnvent AS (TOOL Aquarium)
processor: FourPro Solutions (Data Integration between platforms)
2 purpose
this dpa sets out the rights and obligations of the processors processing of personal data on behalf of the controller pursuant to the agreement. This dpa shall ensure that the processing complies with the requirements set out in the regulation 2016/679 (eu) - general data protection regulation (hereafter referred to as the gdpr).
3 data processing activities
the controller is granted access to the platform (the platform) in accordance with the agreement. Access to the platform enables the controller and the controllers end users to upload and share content of their own choice. The content may include personal data as defined in article 4 (1) of the gdpr. The processor will get access to the content shared on the platform, including personal data, for the purpose of operating and providing the platform to the controller, and for the purpose of maintaining and developing the platform. The information processed may be of any type that the controller or its end users choose to share on the platform. In addition, when establishing a user account, the user is asked to provide the following information:
- name
- position or title (for professional users)
- phone number
- image (optional)
all the content shared by a user will be deleted upon deletion of the associated user account.
4 the processors duties
the processor shall:
a) only process personal data in accordance with the purpose of the processing set out in section 3 and the documented instructions of the controller. The processor shall notify the controller immediately if any of the instructions are inadequate or in violation of the gdpr or norwegian data protection legislation. The processor shall also notify the controller if the processor is required by mandatory law to process personal data contrary to the controllers instructions, unless providing such notification is prohibited by law or applicable legal decision;
b) only transfer personal data to jurisdictions outside the european economic area in accordance with the controllers instructions or approval;
c) notify the controller if personal data are to be transferred outside the eea, unless providing such notification is prohibited by law or applicable legal decision, and ensure that the personal data are adequately protected by eu model clauses or other basis for transfer pursuant to the gdpr;
d) ensure that employees and sub-processors or other third parties authorised to process personal data on behalf of the controller in accordance with section 5 are subject to obligations of confidentiality, which shall survive the term of this dpa;
e) implement appropriate technical and organisational measures required pursuant to article 32 of the gdpr, including measures to ensure that data is available to the controller, to prevent the loss or destruction of data, and prevent unauthorized access to data.
F) keep an updated list of all sub-processors and ensure that any sub-processors processing personal data on behalf of the processor have entered into a binding agreement with the processor pursuant to article 28 (2) and (4) of the gdpr;
g) at the request of the controller make all information necessary to document that the controller and the processor fulfil article 28 of the gdpr available. The processor shall enable the controller to perform audits and inspections, either by the controller or by a third party designated by the controller;
h) keep a record (log) of the processing activities carried out on behalf of the controller, which shall at least contain the information required pursuant to article 30 of the gdpr. The controller can request a copy of such record at any time;
i) immediately notify the controller if the processor receives a request from an authority to disclose personal data processed under this dpa. The processor is not obliged to notify if the law prohibits such notification. Unless required by law, the processor shall not comply with such a request without prior written approval from the controller;
j) assist the controller in responding to requests from the data subjects pursuant to chapter iii of the gdpr (including the right to information, access, correction and erasure); and
k) assist the controller in fulfilling its duties pursuant to article 32-36 of the gdpr.
The scope of the processors duty to provide assistance to the controller under j) and k) shall take the nature of the processing and the information available to the processor into account.
5 the controllers duties
the controller is responsible for ensuring that the processing of personal data complies with the requirements set out in norwegian data protection legislation and the gdpr, hereunder ensuring that the processing of personal data, which the processor is instructed to perform, has a legal basis.
The controller has the right and obligation to determine the purpose and means of processing. The controller shall provide the processor with documented instructions on how the personal data should be processed.
6 notification routines
in the event of a personal data breach, the processor shall notify the controller without undue delay. The notification shall at least describe:
the nature of the breach of personal data, including, if possible, the categories and approximate number of data subjects concerned, and the categories and approximate number of personal data records concerned;
the name and contact information of the data protection officer or other contact where further information can be obtained;
the likely consequences of the personal data breach;
the measures taken or proposed to be taken to address the personal data breach, including any measures to mitigate its possible adverse effects.
If the processor is unable to provide all the information above in the first notice, the information shall be provided without undue delay and no later than 72 hours after the occurrence of the personal data breach. The controller shall ensure that an incident report is sent to the relevant data protection authority in accordance with article 33 of the gdpr.
7 use of sub-processors
the processor has the right to use the following sub-processors:
- clickup
- github
- google cloud
- google suite
- hubspot
- intercom
- slack
- stripe
- indykite
in addition, the controller hereby grants a general authorization for the processor to use sub-processors. The processor shall inform the controller before replacing existing sub-processors or adding new sub-processors, and the controller shall have the right to object to such changes. The controller may not reject a new sub-processor without a legitimate reason.
A well-founded suspicion that the level of data protection could be degraded as a result of the change of sub-processor, shall be regarded as a legitimate reason. If the sub-processor does not fulfil its data protection obligations, the processor shall remain fully liable to the controller as regards the fulfilment of the obligations of the sub-processor. This does not affect the rights of the data subjects under the GDPR in particular those foreseen in article 79 and 82.
Loading...