Data Processing Agreements

This data processing agreement is established in accordance with Article 28(3) of the European Parliament and Council Regulation (EU) 2016/679 (“GDPR”) to regulate CitizenOne A/S's processing of personal data on behalf of you as the customer.

The agreement is made between:

Data Controller: [Company name, address, and CVR number] Contact Person: [Contact person and contact information]

Data Processor: CitizenOne A/S, Dronning Olgas Vej 2, 1st Floor, 2000 Frederiksberg, CVR No: 34725845 Contact: support@citizenone.dk

In the following, the parties are referred to as “the Data Controller” and “the Data Processor.” Collectively, they are referred to as “the parties.”

1. Purpose and Basis

1.1 Terms such as "personal data," "special categories of personal data," "data processing," "the data subject," "data controller," and "data processor" shall be understood in accordance with the definitions in the GDPR.

1.2 The purpose of this agreement is to ensure compliance with applicable data protection legislation and to document the data controller’s instructions to the data processor. The processing of personal data is carried out to support the data controller’s use of CitizenOne A/S’s software solution, as further described in our terms and conditions.

1.3 This agreement specifies the parties’ responsibilities and obligations regarding the processing of personal data, where CitizenOne A/S acts on behalf of the data controller.

1.4 This agreement takes precedence in the event of a conflict with other terms regarding the processing of personal data between the parties. The agreement is valid as long as the data controller uses CitizenOne A/S’s software.

1.5 Nothing in this agreement exempts the data processor from the obligations imposed under applicable data protection legislation.

2. Responsibilities and Rights of the Data Controller

2.1 The data controller shall ensure that all processing of personal data in connection with the use of CitizenOne A/S's software solution is carried out in accordance with GDPR Article 24 as well as other relevant EU or national legislation and this agreement.

2.2 The data controller has the exclusive right to make decisions regarding the purposes and means of processing personal data, including what is processed and entered into CitizenOne A/S’s system.

2.3 It is the responsibility of the data controller to ensure that there is a legal basis for the processing and sharing of personal data performed by the data processor, including to any subprocessors used by the data processor as listed in the applicable overview.

2.4 The data controller is responsible for ensuring that the personal data processed by the data processor is accurate, reliable, and lawfully collected.

2.5 The data controller shall ensure that all necessary permissions and notification requirements to relevant authorities are fulfilled in relation to the processing of personal data.

2.6 It is the responsibility of the data controller to inform data subjects about the processing of their personal data in accordance with applicable data protection legislation.

2.7 The data controller declares that CitizenOne A/S has implemented appropriate technical and organizational security measures to protect the rights and data of the data subjects.

3. Processing in Accordance with Instructions

3.1 The data processor may only process personal data in accordance with documented instructions from the data controller, unless otherwise required by EU or national law. By entering into this agreement, the data controller instructs the data processor to process personal data in the following ways:

3.1.1 In accordance with applicable law;

3.1.2 To fulfill obligations under CitizenOne A/S’s terms of use of the system;

3.1.3 As further described in this agreement.

3.2 If an instruction from the data controller is deemed to be in conflict with applicable data protection legislation, the data processor shall immediately notify the data controller.

4. Security of Processing

4.1 The data processor shall maintain a high level of security by implementing relevant organizational, technical, and physical security measures.

4.2 Access to personal data may only be granted to individuals who are subject to confidentiality obligations, and only to the extent necessary to fulfill this agreement. The confidentiality obligation also applies after the termination of the agreement.

4.3 CitizenOne A/S has implemented several security measures, including:

4.3.1 Conducting regular risk assessments to ensure that technical and organizational measures are adequate;

4.3.2 Encrypting personal data during transmission over the internet;

4.3.3 Training employees in data protection and IT security;

4.3.4 Limiting access to personal data to only relevant individuals;

4.3.5 Control systems to identify and report security breaches;

4.3.6 Ongoing testing of systems and procedures to maintain security.

5. Use of Sub-processors

5.1 CitizenOne A/S uses sub-processors as part of the operation of our software. This agreement constitutes the data controller's general written authorization for the use of sub-processors, including both within and outside the EU/EEA.

5.2 CitizenOne A/S ensures that sub-processors comply with the same obligations as those set out in this agreement. The data controller must be informed at least 30 days before a new sub-processor is used, with the right to object if data protection legislation is not complied with. If an agreement cannot be reached, the data controller may terminate its subscription on short notice.

6. Transfer to Third Countries

6.1 Any transfer of personal data to a third country or an international organization must be based on a valid transfer basis, such as the EU's Standard Contractual Clauses (SCCs).

7. Assistance to the Data Controller

7.1 The data processor shall assist the data controller in ensuring compliance with the Data Protection Regulation, including processing security, notification of data breaches, and compliance with the rights of data subjects.

7.2 The data processor may not respond to inquiries from data subjects without permission from the data controller and shall not disclose information without a legal obligation.

8. Notification of Data Breach

8.1 The data processor shall promptly notify the data controller of any security breaches involving personal data, so that the data controller can fulfill its obligations under the Data Protection Regulation.

9. Return and Deletion of Data

9.1 Upon termination of the subscription, the data controller may obtain its data. Thereafter, the data processor will delete or anonymize all personal data in accordance with applicable regulations.

10. Audit and Inspection

10.1 The data controller has the right to conduct audits of the data processor's compliance with this agreement. CitizenOne A/S will cooperate with any audits and provide necessary documentation.

11. Duration of the Agreement

11.1 This agreement is valid as long as CitizenOne A/S processes personal data on behalf of the data controller.

12. Changes to the Agreement

12.1 Changes to this agreement will be announced 30 days before taking effect. Continued use of CitizenOne A/S’s services after changes will be considered acceptance of the new terms.

13. Liability

13.1 Liability in connection with breaches of this agreement is governed by CitizenOne A/S’s general terms and conditions.

14. Governing Law and Jurisdiction

14.1 This agreement is governed by Danish law, and any disputes shall be resolved by the court in Helsingør.

Appendix A - Categories of Personal Data a. Personal data that may be processed includes, among others:

• Name
• Title
• Phone number
• E-mail
• Address
• Other relevant information.

Appendix B - Sub-processors CitizenOne A/S uses several sub-processors to deliver our services. We ensure that valid agreements are in place with all sub-processors to best protect your data.

Contact us at support@citizenone.dk if you have questions about our use of sub-processors.