• The data processor does not have ownership of personal data that is processed on behalf of the data controller, but shall only process these on behalf of the data controller and in accordance with the data controller's instructions as regulated in this Standard contractual clauses.
• The data processor must immediately notify the data controller if the data processor believes that an instruction from the data controller is in breach with the privacy policy.
• The data processor shall ensure adequate protection of personal data through both technical and organizational measures in accordance with GDPR Article 32. This is done, among other things, through a risk and vulnerability analysis that provides a basis for organizational routines and technical measures.
• The data processor must maintain a security level for the processing of personal data that is sufficient in relation to the risk of the processing. The data processor shall protect the personal data from destruction, alteration, unauthorized disclosure, or unauthorized access.
• The data processor confirms that all persons who are authorized to process the personal data have undertaken to treat the data confidentially.

• Upon request, the data processor shall assist the data controller with regard to work to fulfill the latter's obligations under privacy policy, for example pursuant to GDPR Chapter III and Articles 32-36. The work is invoiced according to time spent and current hourly rates.
• The data processor shall, without undue delay, notify the data controller if a breach of personal data security has been established, or is suspected.
• The data processor can generate aggregated and anonymised statistics and analyzes of usage patterns in the Solution as part of the fulfillment of the Terms of use, and to streamline the data controllers' choice alternatives and use of the Solution.
• In order to be able to follow up the customer relationship with the data controller (such as invoicing or contacting), the data processor can access and use registered personal information such as user and company name, address, e-mail and telephone number.
• The data processor may have access to registered personal information in the event of suspicion of errors in or misuse of the Solution.

Audits

The data processor shall assist the data controller by making documentation available to the extent necessary for the data controller to be able to demonstrate that the data processor's obligations under the data processor agreement and the privacy policyhave been fulfilled. All such assistance from the data processor to the data controller is made on written request and invoiced after the elapsed time.

The data controller and relevant supervisory authority have the right to carry out audits, including inspections, of personal data that is processed, technical and organizational security measures carried out. The data controller shall not be given access to information concerning the data processor's other customers and information that is subject to confidentiality obligations. The data controller shall cover costs related to audits initiated by the data controller or incurred in the audit of the data controller, unless the audit reveals non-fulfillment of obligations under the Standard contractual clauses or privacy policy.

Confidentiality

The data processor, its subcontractors and others who, on behalf of the data processor, have access to the personal data, are subject to a duty of confidentiality and shall comply with the duty of confidentiality in connection with the processing of personal data in accordance with privacy policy. The data processor is responsible for ensuring that subcontractors and others who act on behalf of the data processor are subject to such a duty of confidentiality.

The data controller is subject to a duty of confidentiality with regard to documentation and information related to the data processor's and its subcontractors' implementation of technical and organizational security measures, and information that the data processor otherwise wishes to keep confidential. However, the data controller may always share such information with relevant supervisory authorities, if this is necessary to comply with the data controller's obligations under the privacy policy or other statutory obligations.

The duty of confidentiality also applies after the termination of the Standard contractual clauses

Deletion of and access to personal information

The data controller is responsible for determining the retention period for the personal data, so that personal data is not stored longer than is necessary for the purpose for which they were collected.

The data controller can choose to delete all or part of the information in the Solution. When deleting information, all associated data, including personal information, will also be deleted.

Access to and change of personal information

Retrieval of information on request stored in the Solution that is not included in the automated solution, but which requires separate work operations by the data processor will be invoiced to the data controller.

In cases where there is no functionality for changing personal information in the Solution, a written inquiry can be sent to the data processor. Modification of personal data will only be carried out if it is not in conflict with current legislation. The data processor will invoice the data controller for the time spent on work in connection with changes to personal data.

In the event of changes, old values will be available as backup for up to 3 months. This time period is set to prevent inconsistencies in registered personal data in the event of unforeseen events.

Name:                         ONwork AS 

Org.nr.:                        824948232 

Adress:                       Nordre gate 8, 7011 TRONDHEIM 

Contact person:          Anne Hegle Jespersen 

E-mail:                        anne@onwork.no