Data Processoragreement.

DATA PROCESSOR (os):

• Camsilo (v/ Casper Madsen)
• Address: Ørstedvej 15, 6560 Sommersted
• Company reg. no.: 45925145
• Contact (e-mail): kontakt@camsilo.dk

DATA CONTROLLER (jer):

• Organization name: [udfyldes af den dataansvarlige]
• Company reg. no.: [udfyldes af den dataansvarlige]
• Address: [udfyldes af den dataansvarlige]
• Contact person for data protection: [udfyldes af den dataansvarlige]
• Data Protection Officer (if you have one): [udfyldes af den dataansvarlige]

This data processing agreement is entered into between the customer (the school, company or other organisation that creates an account and invites users) as DATA CONTROLLER, and Discebo as DATA PROCESSOR.

The agreement is an integral part of the main agreement on the use of Discebo (the subscription). In case of conflict between this agreement and the main agreement, this agreement takes precedence with regard to processing of personal data. The agreement runs as long as the customer has an active account and ends at the same time as the main agreement — but clause 8 on deletion remains in force until the deletion is completed.

The Danish text is the binding version. Translations are a help to the reader and do not change the agreement's content.

SUBJECT MATTER: Discebo provides a learning and work platform. The processor's processing of personal data takes place solely as part of delivering the functionality the customer has chosen: teaching and assessment, time registration, shift and absence management, mileage and expenses, payroll and bookkeeping exports, customer register, jobs and locations, documents, forms, signing, messages and notifications.

CHARACTER: collection, recording, organisation, storage, alteration, search, display, compilation into reports and extracts, sharing with the sub-processors listed in Appendix B, and deletion and anonymisation.

PURPOSE: solely to provide the platform on customer's instructions. The data processor NEVER processes customer personal data for its own purposes — neither to train models, for marketing, for profiling nor to develop new products on customer's data.

DURATION: the processing continues until the main agreement ends, and the subsequent deletion or return under clause 8 is completed.

Categories of affected persons: students and course participants; teachers and guidance counselors; employees, apprentices and hourly workers in a company on the platform; managers and administrators; the company's own customers and contact persons (who often never used the platform themselves); recipients of inquiries and links from the customer portal.

Types of personal information — common information (art. 6): name, email address, telephone number, address, region, role, affiliation to school, class, group, team or company, employment date and employee number, profile picture, short description, education and experience, qualifications and certificates with expiry date, job search status, answers to quizzes and tests and assessments and feedback, active learning time, registered working hours and shifts, kilometres driven and routes, expenses with associated receipt photos, absence with type and period, wage basis and wage statements, offers, invoices and credit notes, cases and tasks with photos and notes, drive files, form completions, signatures with timestamp, IP address and device information for operational safety, messages and posts and notifications.

Types of personal data — special categories (art. 9): the platform contains a STRUCTURED field for absence type 'illness', which is included in the salary extract. Information about a person's sick leave is health information. The processing takes place on the customer's instruction as part of the customer's employment-related obligations and is based for the customer's behalf on art. 9, para. 2, letter b, cf. data protection law § 12. The customer is responsible for having the necessary basis; the data processor processes the information only on instruction. Free text fields (such as a note about work clothes or a message) may furthermore in practice come to contain health information, without that being the intention.

Criminal convictions and legal violations (art. 10) are not treated and the platform has no fields for it.

The data processor may only process personal data according to documented instructions from the data controller. The customer's instructions consist of: this agreement with annexes, the main agreement, and the choices the customer makes in the platform's own settings (including which modules are activated, what rights each role has, and whether AI functions may be used).

The processor shall immediately inform the controller if an instruction, in the processor's assessment, conflicts with the data protection regulation, data protection law or other applicable data protection law.

The data processor does not transfer personal data to a third country or international organisation without documented instruction, unless EU law or Danish law requires it. The transfers the customer hereby instructs in are exhaustively described in Annex B.

The data processor ensures that only those persons who currently have a need for access to fulfil the agreement receive access to the personal data — and only to the information their task requires. Access is removed as soon as the need ceases.

These persons are bound by confidentiality. The confidentiality obligation continues after employment or cooperation has ceased. The processor can, upon request, document who has or has had such access.

All administrative access to a customer's data — including when a support employee views the platform as a user to help — is logged with who, when and why. The log can be provided to the controller.

The data processor implements appropriate technical and organisational measures taking into account the risk to individuals. The measures implemented at the time of the agreement are described in Annex C. The measures may be changed, but never to a lower level of protection without prior written notice to the data controller.

The data controller is responsible for the choices made in the platform's permission setup: which roles can see what, who can approve, and who gets admin access. The data processor provides the mechanism and by default closes a new function to roles that have not explicitly been granted access.

The data processor assists the data controller in fulfilling the rights of data subjects under articles 12-23: access, rectification, erasure, restriction, data portability and objection. The platform contains self-service for access and erasure, and the data processor also provides manual assistance within 10 working days if a request cannot be fulfilled via self-service.

Access is granted to the requester's own information. Where information necessarily involves a third party — for example that another user has blocked the person in question — only the requester's own information is provided, cf. art. 15, para. 4, on the right of access must not infringe others' rights.

The data processor further assists the data controller in complying with art. 32-36: security, notification of breaches, notification of data subjects, impact assessments and prior consultation — to the extent that the information is only available from the data processor.

If an affected person submits their request directly to the data processor, the data processor forwards it to the data controller without undue delay and does not respond on the data controller's behalf.

Upon termination of the agreement, the data controller chooses whether personal data shall be DELETED or RETURNED. If return is chosen, it takes place in a commonly used, machine-readable format. If the data controller makes no choice, the data processor deletes the data after a period of 30 days from termination, following prior written notice.

The deletion also includes existing backups as these expire according to the normal retention schedule. The data processor confirms in writing when the deletion is complete.

EXCEPTION — legally required retention: where EU law or Danish law requires continued retention, only the necessary information is retained, only for as long as it is required, and only for that purpose. This applies in particular to accounting materials, including invoices and credit notes, which under the Accounting Act must be retained for 5 years from the end of the financial year the material concerns.

Be aware of the distinction between a PERSON's deletion and the COMPANY's data: if a single user deletes their personal account, the company's business data is not deleted with it, because the company is the data controller for them. If they are to be deleted, that happens under this agreement — not by the user deleting their account.

The data controller hereby gives general approval for the data processor to use the sub-processors listed in Annex B. The approval covers only those listed and only for the stated purposes.

The processor imposes on each sub-processor the same data protection obligations as in this agreement by written agreement and remains fully responsible to the controller for the sub-processor's compliance.

When adding or replacing a sub-processor, the processor informs the data controller in writing at least 30 days before the change takes effect. The data controller may within 14 days of notification make reasoned objection. If the parties cannot find a solution, the data controller can terminate the agreement with effect from the time the change was to take effect, with proportional refund of prepaid subscription.

The data controller can obtain an updated list at any time. Annex B below IS that list: it is generated from the same source in the code as the platform's personal data policy shows, precisely so that there cannot be two lists saying something different.

The data processor endeavours to process personal information within the EU/EEA. Where a sub-processor processes information outside the EU/EEA, this is explicitly stated in Annex B together with the specific transfer mechanism under articles 44-49 for that sub-processor.

Appendix B specifies for each one whether the basis is the European Commission's standard contractual clauses (SCC), a certification under the EU-U.S. Data Privacy Framework, or a decision on an adequate level of protection. The basis has been verified with the supplier itself, and the source is stated with a date. Where the basis could NOT be confirmed, it is listed as an outstanding deficiency rather than as an assumption.

Specifically about the AI functions: they only send data out when a user themselves activates the function, and they do not take part in any automatic background processing. If the data controller wants no transfer to the respective third country at all, the AI functions can be turned off for the organisation, after which no data is sent there.

The data processor notifies the data controller without undue delay and within 48 hours of becoming aware of a personal data breach, cf. article 33, section 2. The deadline is set shorter than the data controller's own 72-hour deadline to the Danish Data Protection Authority, so the data controller has real time to report it.

The notification contains, to the extent the information is available: the nature of the breach, which categories and how many data subjects and information are involved, the likely consequences, the measures taken or proposed, and a contact point. If the information is not available all at once, it is provided gradually without further unnecessary delay.

The processor NEVER reports a breach to the Data Protection Authority on behalf of the controller unless explicitly agreed in writing in the specific case, and does not notify affected persons without agreement.

The processor shall, upon request, make available the information necessary to demonstrate compliance with Article 28, and shall allow and contribute to audits and inspections, as per Article 28, Section 3, Letter h.

The data controller can conduct an audit once per year — and additionally after a breach affecting the data controller — either itself or by an independent third party that is not a competitor to the data processor and which signs a confidentiality declaration. The audit is notified in writing at least 30 days in advance, is conducted during normal working hours and must not disrupt operations unnecessarily.

The controller bears its own costs for the audit. The processor's participation is free of charge during the annual audit and audit after a breach; beyond that, fees can be agreed based on time spent.

The data processor keeps a record of the categories of processing carried out on behalf of the data controller, see art. 30, para. 2, and provides it on request.

The parties' responsibility follows art. 82 and the main agreement. Limitations of liability in the main agreement cannot limit an affected person's rights under the regulation or a party's responsibility to a supervisory authority.

Changes to the agreement are agreed in writing. However, the data processor may unilaterally change Annex B according to the procedure in point 9 and Annex C if the change does not lower the level of protection.

The agreement is governed by Danish law and disputes are resolved by the Danish courts with the data processor's home jurisdiction as the first instance unless otherwise provided by mandatory rules.