Data Processing Agreement
Between
[CUSTOMER LEGAL NAME] (“Data Controller” or “Customer”) [Customer Address]
and
Dalip AI AS (“Data Processor” or “Dalip.ai”) Hartmanns vei 29B, 0376 Oslo, Norway. Norwegian Organization
Number: 935208009
(Each a “Party” and together the “Parties”)
1. Background and Purpose
This Data Processing Agreement (the “DPA”) is part of the main agreement (the “Main Agreement”) between the Customer (the “Data Controller”) and Dalip AI AS (the “Data Processor”).
1.1 The purpose of this DPA is to determine the Parties’ rights and obligations regarding the Data Processor’s processing of personal data on behalf of the Data Controller under the Main Agreement.
1.2 This DPA supersedes all previous agreements and provisions between the Parties with respect to data protection.
1.3 Except as specified herein, the terms and conditions of the Main Agreement shall apply. In the event of any inconsistency between the Main Agreement and this DPA with regard to matters specifically related to data protection, the DPA shall take precedence.
2. Definitions
2.1 In this DPA, the following words and expressions shall have the meaning set out below.
2.2 “Applicable Data Protection Law”: All applicable data protection and privacy laws and regulations, including GDPR and any national implementing legislation, as amended from time to time.
2.3 “GDPR”: The EU General Data Protection Regulation 2016/679.
2.4 “Standard Contractual Clauses”: Standard Contractual Clauses for the transfer of personal data to processors established in third countries, as established by the European Commission pursuant to GDPR Article 46(2)(c).
2.5 “Sub-Processor”: Another Data Processor engaged by the Data Processor.
2.6 “Third Country”: A country outside the EEA that has not been determined by the European Commission to ensure an adequate level of protection.
2.7 Otherwise, words and expressions shall have the same meaning as attributed to them in GDPR.
3. Scope
3.1 This DPA applies to all personal data that the Data Processor has received, has been given access to, or has generated in connection with the Main Agreement.
3.2 The purpose and nature of the data processing, the type of personal data processed, and the categories of data subjects are set out in Appendix 1.
4. General Obligations
4.1 The Data Processor guarantees that it has implemented appropriate technical and organizational measures to ensure that the processing meets the requirements in accordance with Applicable Data Protection Law and safeguards the rights of the data subjects, and that these measures will be complied with throughout the contract period.
4.2 The Data Processor shall process the personal data exclusively for the purpose and within the scope set out in Appendix 1, the Main Agreement, and any documented instructions agreed between the Parties.
4.3 The Data Processor shall promptly notify the Data Controller in writing if it has reasonable grounds to believe that:
- (i) an instruction from the Data Controller may result in the Data Processor violating Applicable Data Protection Law; or
- (ii) applicable law in the EEA requires the Data Processor to process personal data beyond the scope of the Data Controller’s documented instructions, unless such law prohibits such notification for reasons of important public interest (in which case the Data Processor shall notify the Data Controller as soon as the law permits).
In the event of (i) or (ii), the Parties shall discuss in good faith how the issue can be resolved without adversely affecting the protection of the rights of data subjects.
5. Assistance to the Data Controller
5.1 The Data Processor shall, by means of appropriate technical and organizational measures, assist the Data Controller to the extent possible to fulfil the Data Controller’s obligation to respond to requests made by the data subject for the purpose of exercising their rights set out in Chapter 3 of the GDPR, including requests for information, access, correction, deletion, restriction of processing, data portability, objections, and not being subject to automated individual decisions.
5.2 With regard to the nature of the processing and the information available to the Data Processor, the Data Processor shall assist the Data Controller with the obligations pursuant to Articles 32 to 36 of the GDPR, including data security obligations (Section 6), notification of personal data breaches (Section 9), data protection impact assessments, and prior consultations with supervisory authorities.
5.3 The Data Processor shall not communicate directly with the data subjects or with supervisory authorities unless pre-approved by the Data Controller. The Data Processor shall immediately forward to the Data Controller any requests or complaints received from data subjects. The Data Processor shall also immediately forward any requests from a supervisory authority relating to inspections, investigations, or access to Personal Data, unless prohibited by law.
5.4 Assistance pursuant to this Section 5 shall be provided to the extent reasonably practicable. Any assistance requiring material effort beyond standard self-service functionality may be subject to reasonable fees, upon prior agreement.
6. Technical and Organizational Security Measures
6.1 The Data Processor shall implement appropriate technical and organizational security measures to protect the personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. The Data Processor shall, as a minimum, implement the measures required pursuant to Article 32 of the GDPR, and as further described in the Data Processor’s security overview documentation.
6.2 The Data Processor shall not disclose or make available personal data to third parties without the prior written consent of the Data Controller, with the exception of any approved Sub-Processors to the extent that they need the data to perform their tasks.
6.3 The Data Processor shall ensure that all persons authorized to process the personal data have undertaken to treat the data confidentially or are subject to an appropriate statutory duty of confidentiality. At the request of the Data Controller, the Data Processor shall provide confirmation of such confidentiality obligations.
7. Sub-processors
7.1 The Data Controller authorizes the Data Processor to engage Sub-Processors. An up-to-date list of Sub-Processors, including their location and processing purpose, is available at: https://dalip.ai/trust-center/dalip-ai-subprocessor-list/.
The Data Processor shall notify the Data Controller of material changes to this list by updating the webpage. Material changes will be communicated via email or in-app notification where reasonably practicable. The Data Controller may object to new Sub-Processors on reasonable data protection grounds within thirty (30) days.
7.2 The Data Processor shall only engage Sub-Processors who implement appropriate technical and organizational measures to ensure that the data processing meets the requirements of Applicable Data Protection Law. The Data Processor shall carry out appropriate checks on the Sub-Processors to verify their level of data protection and ensure that Sub-Processors provide sufficient guarantees of compliance.
7.3 The Data Processor shall enter into a written agreement with each Sub-Processor that imposes data protection obligations no less protective than those set out in this DPA. At the request of the Data Controller, the Data Processor may provide relevant excerpts or summaries of such agreements.
7.4 The Data Processor remains fully responsible for the Sub-Processor’s performance of its obligations.
8. International Data Transfer
8.1 The Data Processor may only transfer personal data to a Third Country or an international organization on documented instructions from the Data Controller. However, the Data Processor may do so if required by applicable law in the European Economic Area. In such cases, the Data Processor shall notify the Data Controller of said legal requirements prior to the transfer, unless such law prohibits such notification for reasons of important public interest.
8.2 If the use of an approved Sub-Processor requires the transfer of personal data to a Third Country, and such transfers have been approved by the Data Controller, the Data Controller authorizes the Data Processor to enter into Standard Contractual Clauses or other valid transfer mechanisms in accordance with Applicable Data Protection Law.
9. Personal Data Security Breaches
9.1 The Data Processor shall notify the Data Controller in writing of any breach of this DPA or the security of personal data. The notification shall be given without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach.
9.2 Notification of a personal data breach must, to the extent relevant:
a. describe the nature of the breach, including, where possible, the categories and approximate number of data subjects affected, and the categories and approximate number of personal data records affected;
b. provide the name and contact details of the Data Processor’s contact point for further information;
c. describe the likely consequences of the personal data breach;
d. describe the measures taken or proposed to deal with the breach, including measures to mitigate any harmful effects;
e. include other information required for the Data Controller to comply with Applicable Data Protection Law.
9.3 The Data Processor shall, as soon as possible, implement all measures to address the breach and prevent similar breaches in the future. The Data Processor shall allow the Data Controller to investigate, determine the cause, and verify the measures implemented.
9.4 Only the Data Controller has the right to inform the relevant supervisory authority and the affected data subjects of any personal data breach. The Data Processor shall refrain from informing the public or third parties of any personal data breach without prior authorization from the Data Controller.
10. Audit
10.1 The Data Processor shall document, as well as make available to the Data Controller, information that is necessary to demonstrate compliance with this DPA and Applicable Data Protection Law.
10.2 Audits shall be conducted at reasonable intervals, upon reasonable notice, and in a manner that does not unreasonably interfere with the Data Processor’s operations. The Data Processor may satisfy audit requests by providing third-party audit reports or certifications.
10.3 The Data Processor shall immediately notify the Data Controller if it receives a request from an authority to disclose personal data processed under this DPA. Unless required by law, the Data Processor shall not comply with such a request without the prior written consent of the Data
Controller.
10.4 If an audit reveals any deviations from the obligations of this DPA, the Data Processor shall remedy such deviations as soon as possible. The Data Controller may require processing activities to be temporarily suspended until successful remediation is confirmed.
10.5 Each Party shall bear its own costs associated with an audit.
11. Other Data Controllers
11.1 The Data Processor acknowledges that the personal data may also be processed on behalf of the Data Controller’s group companies, customers, or clients. Such other data controllers have the same rights as the Data Controller and may enforce this DPA as if they were contracting parties. However, such enforcement shall take place through the Data Controller.
11.2 The Data Controller may forward any instructions from such other data controllers, and the Data Processor shall act in accordance with such instructions as if they were the Data Controller’s own.
11.3 The Data Controller may forward any documentation and information received from the Data Processor to such other data controllers.
12. Governing Law and Jurisdiction
12.1 This DPA shall be governed by and construed in accordance with the laws of Norway, without regard to conflict of law principles.
12.2 Any dispute arising out of or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts of Oslo, Norway.
13. Duration and Termination
13.1 This DPA applies as long as the Data Processor processes personal data on behalf of the Data Controller in connection with the Main Agreement.
13.2 Upon termination or expiry of the DPA, the Data Processor shall, if the Data Controller so wishes, delete or return all personal data to the Data Controller and delete existing copies, and confirm to the Data Controller that this has been done, unless applicable law in the EEA requires the Data Processor to store the personal data (in which case the Data Processor shall ensure secure storage, but not actively process, personal data, and shall delete the personal data as soon as permitted by law).
Execution
IN WITNESS WHEREOF, the Parties have executed this Data Processing Agreement as of the Effective Date.
Data Controller (Customer)
Signed: _________________________ Name: [Print Name] Title: [Title] Date:
_________________________
Data Processor (Dalip AI AS)
Signed: _________________________ Name: [Authorized Signatory] Title: [Title] Date:
_________________________
APPENDIX 1: SCOPE OF DATA PROCESSING
Purpose of the Processing
The purpose of the data processing is for the Data Processor to be able to perform its obligations under the Main Agreement.
Nature and Purpose of the Processing
Collection, recording, structuring, analysis, storage, and deletion of personal data submitted by users or generated through use of the service.
Categories of Data Subjects
Employees, managers, and other authorized users of the Data Controller.
The type of Personal Data
Contact information (name, email address), Professional information (role, team, objectives), User-generated content (meetings, meeting agendas, notes, action items, goals, pulse updates), Audio and textual data from meetings where enabled (meeting recordings are session-only and not persisted), Usage and interaction metadata.
Special Categories of Data
Not intentionally processed. Users are instructed not to upload special category data.
APPENDIX 2: TECHNICAL AND ORGANISATIONAL SECURITY MEASURES
The technical and organisational measures implemented by Dalip.ai are described in the Security Overview – Dalip.ai, which forms an integral part of this DPA.