Data processing agreement (DPA)

1. Parties and scope

1. This agreement applies between the customer as controller and Muuh AS, Sukkevannslia 4, 4638 Kristiansand, Norway, as processor ("we").
2. It forms part of the terms of service and is concluded with them when the customer accepts the terms and this agreement at purchase.
3. It applies for as long as we process data on behalf of the customer. Where it conflicts with the terms of service, this agreement takes precedence on data protection.

2. Subject matter, nature and purpose

1. We check websites named by the customer automatically for accessibility, store the results and provide them as a report, a PDF, a guided manual check and a draft accessibility statement.
2. To do so we read publicly available pages. We only process personal data where it appears on those pages or where the customer enters it in Luentis. We do not analyse it about individual people.
3. We process data for the account, purchase and billing as an independent controller. Our privacy policy applies to that, not this agreement.

3. Data and data subjects

We do not deliberately process special categories of data under Art. 9 GDPR. They can only occur if they are published on the checked pages.

4. Instructions

1. We process the data only on documented instructions from the customer. The instructions are given by this agreement, the terms of service and the customer's use of the features of Luentis. The customer gives further instructions in text form to [email protected].
2. If the law of the EU or a member state requires other processing, we tell the customer beforehand, unless that law forbids it.
3. If we consider an instruction unlawful, we tell the customer without delay. We may suspend it until it is resolved.

5. Confidentiality

Everyone at our company with access to the data is bound to confidentiality. Only people who need access to run Luentis get it.

6. Security of processing

We take technical and organisational measures under Art. 32 GDPR. They include:

1. Location: storage and processing in data centres in the EU, in Frankfurt am Main.
2. Encryption: transfer only over TLS. Passwords are only stored as a hash.
3. Access: sign-in with a password and, if wanted, a second factor. Data belongs to the customer's team, and members of other teams cannot see it. Shared reports can only be reached through a link that cannot be guessed and that the customer can withdraw at any time.
4. Separation: the scanner runs separately from the app. Requests to the scanner and its replies are signed. The scanner does not open internal or private network addresses, including after redirects.
5. Availability: regular database backups at the hosting provider.
6. Review: we review the measures regularly and adapt them to the state of the art. They may only be changed in ways that keep the level of protection.

7. Subprocessors

1. The customer agrees that we use these subprocessors:

2. We bind every subprocessor by contract to obligations that match this agreement.
3. We announce new or replaced subprocessors by email at least 30 days in advance. The customer may object within that period on reasonable data protection grounds. If we find no solution, the customer may terminate the affected contract and receive back amounts already paid for services not yet provided.

8. Transfers to third countries

We process the data in the EU and the EEA. Some subprocessors are based in the United States. Where data may reach the United States, we rely on the adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses.

9. Assistance

1. We help the customer with appropriate measures to answer requests from data subjects. If a data subject contacts us, we pass the request on to the customer.
2. We help the customer meet its obligations under Art. 32 to 36 GDPR as far as our processing is concerned.

10. Personal data breaches

We notify the customer of a personal data breach without undue delay and at the latest within 48 hours of becoming aware of it. As far as known, the notice says what happened, which data and people are affected, the likely consequences and what we are doing about it.

11. Deletion and return

1. The customer can download reports as PDFs at any time during the agreement. The customer can ask for single scans or websites to be deleted by email to [email protected].
2. If the customer closes its account or asks for deletion, we delete the data covered by this agreement within 30 days. Backups are overwritten in the normal cycle, at the latest after a further 30 days.
3. This does not apply where the law of the EU or a member state requires us to keep the data.

12. Evidence and audits

1. On request we give the customer the information needed to show that this agreement is complied with.
2. The customer, or an auditor it appoints who is bound to confidentiality, may audit compliance with at least 30 days' notice, during normal business hours and at most once a year, unless there has been a breach. The customer bears the cost of the audit.
3. For subprocessors, their current audit reports and certificates, such as ISO 27001 or SOC 2, are sufficient.

13. Liability and final provisions

1. Liability is governed by the terms of service. Art. 82 GDPR remains unaffected.
2. Norwegian law applies unless the GDPR provides otherwise. The venue is Kristiansand, Norway.
3. If a provision is invalid, the other provisions remain valid.