Data processing agreement
Draft – this text must be reviewed before it is used.
This agreement is made under GDPR Article 28 between the customer using Felly (controller) and IT Norge Consult AS, org. no. 994 066 919 (processor). It applies for as long as the customer uses Felly. The Norwegian version applies if the two versions differ.
1. Purpose
The processor processes personal data on behalf of the customer to deliver Felly: board meetings, AGMs, volunteer days, announcements, documents, finance and the other modules the customer has turned on.
2. Data subjects and data
Data subjects: board members, staff, parents/members and others the customer invites.
Data: name, email address, phone number, role and group membership, sign-ups and replies, meeting papers, minutes and decisions, signing logs, documents and financial documents uploaded by the customer, and technical logs.
Felly is not designed for special categories of personal data (Article 9). The customer shall not enter such data unless specifically agreed.
3. Obligations of the processor
- Process the data only on the customer’s documented instructions, as set out in this agreement and the customer’s use of Felly.
- Ensure that everyone with access to the data is bound by confidentiality.
- Implement technical and organisational security measures under Article 32, including encrypted transfer and storage, access control, logging and backups.
- Assist the customer in fulfilling the rights of data subjects, and with data protection impact assessments where relevant.
- Notify the customer without undue delay, and no later than 36 hours, of any personal data breach.
4. Sub-processors
The customer gives general authorisation for the processor to use sub-processors. These are used today:
- Brevo (Sendinblue SAS, France) – sending email and login codes.
- Server provider in Norway – hosting and storage.
The processor enters into data processing agreements with its sub-processors and notifies the customer before new sub-processors are used. The customer may object to a new sub-processor.
5. Transfers outside the EU/EEA
Data is stored and processed within the EU/EEA. No transfer to countries outside the EU/EEA takes place without notifying the customer and a valid transfer mechanism under Chapter V of the GDPR.
6. Audits
The processor shall give the customer the information needed to demonstrate compliance with this agreement and allow for audits. The customer gives at least 30 days’ notice of an audit.
7. When the agreement ends
When the customer stops using Felly, the customer can export all data for 30 days. The processor then deletes the data, including from backups, no later than 90 days, unless the law requires retention.
8. Contact
Enquiries about this agreement can be sent to kontakt@felly.no.