Data processing agreement

This data processing agreement (“the Agreement”) is entered into between the Customer as data controller and Einvik Studio AS (“Vekterlogg”) as data processor, and governs Vekterlogg's processing of personal data on the Customer's behalf, cf. Article 28 of the General Data Protection Regulation (GDPR).

The Agreement is entered into when an administrator at the Customer signs it electronically in the customer portal (portal.vekterlogg.no). The Customer receives a signed copy as a PDF. The Agreement applies for as long as Vekterlogg processes personal data for the Customer.

1. Purpose and scope

Vekterlogg processes personal data only to deliver the service to the Customer, as described in the terms and specified in more detail in Appendix A. The Customer determines the purpose and means of the processing. Vekterlogg processes the data only on the Customer's documented instructions, including as expressed through the Customer's setup and use of the service's features.

2. The processor's obligations

Vekterlogg shall:

• process personal data only on the Customer's documented instructions, unless otherwise required by law – in which case the Customer is notified before the processing, unless the law prohibits it,
• ensure that persons with access to the data are bound by confidentiality,
• implement appropriate technical and organisational security measures, cf. GDPR Article 32 and Appendix B,
• assist the Customer in fulfilling the data subjects' rights (access, rectification, erasure etc.) as far as possible, primarily through the service's features,
• assist the Customer with security, notification of breaches and data protection impact assessments, cf. GDPR Articles 32–36,
• delete or return the personal data on termination, cf. section 7,
• make available the information needed to demonstrate that the obligations in the Agreement have been met, and facilitate audits,
• inform the Customer if Vekterlogg believes that an instruction infringes data protection law.

3. The controller's obligations

The Customer is responsible for ensuring that there is a valid legal basis for the processing, that the instructions are lawful, that the data subjects are informed, and that the data registered is lawful, correct and no more extensive than necessary. This applies in particular to the ban list, sharing of bans between the venues in the organisation, sharing of chat, radio and SOS with other organisations, incident and use-of-force reports, visit reports to the Customer's customers, HSE and whistleblowing, location sharing and time tracking.

4. Sub-processors

The Customer gives Vekterlogg general authorisation to use sub-processors to deliver the service. The current sub-processors are listed in Appendix C. Vekterlogg imposes obligations on the sub-processors equivalent to those in this Agreement and is liable to the Customer for their processing. Planned changes are notified to the Customer in reasonable time, so that the Customer can object.

5. Storage and transfer to third countries

The personal data in the service is stored in the EU (database and files at Google Cloud in Europe). Certain services used to deliver the service – sign-in, push notifications, hosting, the AI features, and transmission of audio and video while in progress, see Appendix C – may process data outside the EU/EEA. Such transfer only takes place with a valid transfer basis under Chapter V of the GDPR, for example the European Commission's Standard Contractual Clauses (SCC) or the EU–US Data Privacy Framework.

6. Personal data breaches

Vekterlogg notifies the Customer without undue delay after becoming aware of a personal data breach, and gives the Customer the information the Customer needs for its duty to notify the Norwegian Data Protection Authority and, where applicable, the data subjects.

7. Duration and termination

The Agreement applies for as long as Vekterlogg processes personal data for the Customer. On termination, Vekterlogg deletes or returns all personal data at the Customer's choice and deletes existing copies, unless storage is required by law. The Customer can also delete the organisation and the data in the service itself. The Customer is responsible for exporting any documentation the Customer needs before deletion.

8. Liability

The parties' liability follows from the GDPR and other agreements between the parties. The limitations of liability in the terms apply correspondingly as far as they are appropriate and the law permits.

9. Governing law

The Agreement is governed by Norwegian law.

Appendix A — Nature and purpose of the processing

Purpose	Delivering the Vekterlogg service: documentation and coordination of security work and safety at venues, in static guarding and on mobile patrol – guest counting, incidents and reports, sites and routes, bans, SOS and call-outs, chat and radio, schedules and time tracking, HSE and whistleblowing – and support to the Customer.
Nature of the processing	Collection, registration, storage, display, sharing within the organisation (and with other organisations – chat, radio and SOS – when the Customer has chosen to), sending to the Customer's customers (visit reports and callout notifications), speech to text and translation, alerting and deletion.
Duration	For as long as the customer relationship lasts, with the retention periods in the privacy policy and in the Customer's setup.
Categories of data subjects	(1) The Customer's users: guards, managers, the control centre and the venue's staff. (2) Guests and other people mentioned in incidents, reports, sightings, bans and lost and found. (3) Contact persons at the Customer's customers: the email addresses on the sites, which receive visit reports and callout notifications.
Data about the users	Name, call sign, ID number, email, phone, role and venue; shifts, hours and requested time off; location during an SOS, during tracking when the Customer has switched it on, and when clocking in and out; network name (Wi-Fi) and Bluetooth identifier during an SOS; chat messages, notes, photos and support messages; technical information about the device and addresses for push notifications; activity log; address and next of kin when entered; whether two-factor authentication is on; link to the shift calendar; location track on mobile patrol; voice recordings on the radio and in incidents, and the text from them; HSE deviations, whistleblowing reports and follow-up after serious incidents; feedback from the venue.
Data about others	In bans: name, date of birth or age, description, photo, reason and date. Descriptions of incidents, use of force and sightings. Owner and contact information in lost and found.
Special categories	Incident and use-of-force reports may contain health data (for example injuries) and data about criminal offences. HSE deviations about injuries and follow-up after serious incidents are health data about the employees. Whistleblowing reports may contain information about other employees. The Customer shall not register such or other sensitive data beyond what is strictly necessary and has a legal basis.

Appendix B — Technical and organisational measures

• Encryption in transit (HTTPS/TLS) and at rest at Google Cloud.
• Access control by role and venue, enforced on the server, and logical separation of each customer's data.
• Passcode lock in the app (code or biometrics) for pages with personal data.
• The ban list is locked until the data processing agreement has been signed.
• Two-factor authentication with an authenticator app. The Customer can require it for selected roles.
• The contact card: next of kin and address are only shown with a reason, for 60 seconds, and every view is logged.
• Anonymous HSE deviations and whistleblowing reports: who sent them is not shown to anyone.
• Activity log of actions in the app and a log of administrative actions by Vekterlogg.
• Automatic deletion after set retention periods, and deletion of users and organisations from the app and the customer portal.
• Restricted access for operations staff, who are bound by confidentiality.

Appendix C — Sub-processors

Google (Firebase / Google Cloud)	Sign-in, database, server functions, file storage, push notifications and speech to text (Speech-to-Text, in the EU). Data is stored in the EU; sign-in and push may be processed outside the EEA (SCC / EU–US Data Privacy Framework).
Apple	Delivery of push notifications to iPhone. USA (SCC / EU–US Data Privacy Framework).
Vercel	Hosting of the app, the website and the customer portal. USA and EU (SCC / EU–US Data Privacy Framework).
Brevo	Sending email and SMS (invitations, reports, alerts and visit reports to the Customer's customers). EU.
Anthropic	The AI features: “Improve the text”, translation of reports written in English, the check of reports before they are sent, answers to questions about a site (“Ask about the site” – from the instructions, “Important” and the log for the site), suggested text in the instructions, and suggested causes and actions for HSE deviations and draft lessons for the guards. Names of persons, phone numbers and who wrote it are not sent. In “Ask about the site”, the instructions for the site are also sent, including PDFs and images. In HSE, the text of the deviation and its handling is sent, without who reported it, the site and the photos. USA (SCC).
Cloudflare	The robot check on the website, and transmission of audio on the radio and video to the control centre while it is in progress (Cloudflare Realtime). Audio and video are not stored at Cloudflare. May be processed outside the EU/EEA (SCC).