Data Processing Agreement

Introduction

This Data Processing Agreement applies and is part of the Agreement between 21st and the Subscriber when the Subscriber is an entity, as detailed in sections 1 and 7 of the Terms. It stipulates the rights and obligations of 21st, as a processor, and the Subscriber, as a controller, for the processing of personal data under the Agreement.

All capitalized terms herein have the same meaning as set forth in the Terms.

For the processing of personal data shared with the company Legal Plant AS, as detailed in section 6 and 7 of the Terms, the Privacy Policy applies.

Specification of Data Processing

21st will process personal data provided to and stored in the Subscriber’s account in the Service about any data subjects mentioned therein, such as e.g. names, email addresses, phone numbers, addresses, birth dates, national identity numbers, roles, shareholdings, etc. of shareholders, board members, management and other persons mentioned in documents, lists, registers, forms, etc. in the Subscriber’s account in the Service.

The personal data is processed by 21st for the purpose of providing the Service to the Subscriber in accordance with the Agreement and the Subscriber’s instruction. 21st will conduct the processing only for these purposes, and in compliance with applicable data protection law. The Subscriber warrants that it has a legal basis for all processing 21st is instructed to carry out under the Agreement and the Data Processing Agreement.

Subprocessing and Data Transfers

21st may utilize subcontractors in its processing, acting as subprocessors, provided that the subprocessors are subjected to obligations and limitations at least as strict as those imposed on 21st under this Data Processing Agreement. 21st will remain liable towards the Subscriber for the performance of the subprocessors’ obligations. A list of the current subcontractors is published here, and the Subscriber consents to 21st’s use of the subprocessors listed at the time the Agreement is entered into.

The Subscriber acknowledges that the provision of the Service may require the processing of personal data by subprocessors in countries outside the European Economic Area, in which case 21st will ensure that GDPR Chapter V is complied with.

21st will notify the Subscriber in advance of any planned change or replacement of subprocessors, giving the Subscriber the opportunity to oppose the change in question. Such notification may be given within the Service or in the published subcontractor list. If the Subscriber has not opposed the change within one week from notification, the change shall be deemed accepted. If the Subscriber opposes the change, 21st has the right to terminate the Agreement with immediate effect.

Assistance

21st will make reasonable efforts to assist the Subscriber in connection with the Subscriber’s compliance with the data subjects’ rights pursuant to GDPR Chapter III and the Subscriber’s compliance with GDPR Articles 32 to 36. Compensation for such assistance shall be subject to reasonable compensation based on 21st’s standard hourly rate for such assistance.

Security

21st will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with GDPR Article 32. A description of 21st’s security measures shall be documented and made available to the Subscriber upon request.

21st will notify the Subscriber of any personal data breach without undue delay. The Subscriber is responsible for any notifications to the relevant supervisory authorities.

21st will ensure that anyone it authorizes to process personal data under the Agreement and the Data Processing Agreement treat such personal data confidentially and in accordance with the Agreement. The duty of confidentiality shall also apply after termination of the Agreement and the Data Processing Agreement.

Audits and Information

21st will regularly conduct security audits on its organizational and technical measures relevant for the processing of personal data under the Data Processing Agreement. The Subscriber also has the right to demand a security audit, to be performed by the Subscriber or a third party, at the Subscriber’s own expense. 21st will allow for and contribute to the performance of such audits, and shall, upon request, make available to the Subscriber all information necessary to demonstrate compliance with the Data Processing Agreement. 21st shall be entitled to claim reasonable compensation for assisting the Subscriber or third-party in connection with the audit, based on 21st’s standard hourly rate for such assistance. The results of any audits shall be documented and made available to the Subscriber upon request. The Subscriber is entitled to submit the results of the audit to the relevant supervisory authorities as required.

21st will make available to the Subscriber all information necessary to demonstrate compliance with the Data Processing Agreement upon request.

Changes

Section 16 of the Terms also applies to changes to the Data Processing Agreement.

Term and Termination

The Data Processing Agreement shall apply as long as the Agreement is in force between the parties. Except as otherwise set forth in the Agreement or by written instructions from the Subscriber, 21st will return and subsequently delete the personal data processed under this Data Processing Agreement within a reasonable time after termination of the Agreement, unless a legal basis exists for retaining the personal data.

Governing Law and Legal Venue

In accordance with section 19 of the Terms.