Data processing agreement

These contractual clauses (the “Clauses”) set out the rights and obligations of the data controller and the data processor when processing personal data on behalf of the data controller. They are the Danish Data Protection Agency's standard contractual clauses (version 1.2, March 2024), adopted under GDPR article 28(8) after the European Data Protection Board's opinion 14/2019, in the template's order and wording, with the choices the template leaves to the parties made where it leaves them and in the annexes.

The data controller is the customer named in its order or the company whose account Core4it ApS created (the “customer”). The data processor is Core4it ApS, Nordre Frihavnsgade 84, 5. th., 2100 København Ø, Denmark, CVR number 46251377, [email protected].

The Clauses ensure compliance with article 28(3) of Regulation (EU) 2016/679 (GDPR). The processing takes place in connection with the lets-onboard service described in the terms of service. The Clauses take precedence over any conflicting provision of other agreements between the parties. Four annexes form an integral part of the Clauses: Annex A (information about the processing), Annex B (authorised sub-processors), Annex C (instruction pertaining to the use of personal data) and Annex D (the parties' terms of agreement on other subjects).

• The data controller is responsible for ensuring that the processing of personal data takes place in compliance with the GDPR, the Danish Data Protection Act and other applicable data protection law.
• The data controller has the right and obligation to make decisions about the purposes and means of the processing.
• The data controller is responsible, among other things, for ensuring that there is a legal basis for the processing it instructs the data processor to perform: for lets-onboard, usually its employment relationship with the people it invites, and for the material it uploads, that it may upload and share it.

• The data processor processes personal data only on documented instructions from the data controller, unless required to do so by EU or Member State law to which it is subject; in that case it informs the data controller of the legal requirement before processing, unless the law prohibits it on important grounds of public interest. The instructions are the use of the service as its functions allow, specified in Annex C; later instructions may be given through the service's functions or in writing.
• The data processor immediately informs the data controller if an instruction, in its opinion, infringes the GDPR or other data protection law.

• The data processor grants access to the personal data processed on behalf of the data controller only to persons under its authority who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and only on a need-to-know basis. Those persons are the people at the data processor who operate the service.
• The data processor demonstrates, at the data controller's request, that the persons concerned are subject to such confidentiality.

GDPR article 32 requires the data controller and the data processor, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing as well as the risk to the rights and freedoms of natural persons, to implement appropriate technical and organisational measures to ensure a level of security appropriate to that risk. The data controller evaluates the risks and implements measures to address them. The data processor, independently of the data controller, likewise evaluates the risks of the processing it performs and implements measures to address them; the measures agreed are those of Annex C.2, which the data processor keeps at least at that level.

The data processor assists the data controller in ensuring compliance with its obligations under article 32 by providing information about the measures implemented, at the data controller's request.

• The data processor meets the requirements of GDPR article 28(2) and (4) to engage another processor (a sub-processor). It does so only with the data controller's general written authorisation, given here for the sub-processors listed in Annex B.
• The data processor informs the data controller in writing, by email to its admins, of any intended addition or replacement of a sub-processor at least 30 days before the sub-processor starts processing, giving the data controller the opportunity to object. The data controller may object on reasonable, documented grounds relating to data protection; if the parties cannot resolve the objection, the data controller may terminate the terms of service with effect from the day the sub-processor would start, and the data processor refunds fees paid for the time after that.
• The data processor imposes on each sub-processor, by a written contract, the same data protection obligations as those set out in these Clauses, in particular sufficient guarantees to implement appropriate technical and organisational measures so that the processing meets the requirements of the GDPR. The data processor sends a copy of the sub-processor agreement, or the relevant parts of it, to the data controller at its request; commercial terms may be redacted.
• If the sub-processor does not fulfil its data protection obligations, the data processor remains fully liable to the data controller for the performance of the sub-processor's obligations.

Any transfer of personal data to a third country or an international organisation by the data processor takes place only on documented instructions from the data controller or to comply with EU or Member State law to which the data processor is subject. Without such instructions, the data processor does not transfer personal data to a third country, let a sub-processor in a third country process it, or have it processed by itself in a third country.

The data controller's instructions on transfers are in Annex C.6: it authorises the transfers to the sub-processors in Annex B on the bases stated there — the European Commission's adequacy decision for the EU–US Data Privacy Framework (Decision (EU) 2023/1795) for certified recipients, and the EU standard contractual clauses (Decision (EU) 2021/914) otherwise, under GDPR articles 45 and 46. Where the data processor relies on the standard contractual clauses in a sub-processor's terms, it does so as the data controller's agent for that purpose.

• Taking into account the nature of the processing, the data processor assists the data controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling its obligation to respond to requests from data subjects exercising their rights under GDPR chapter III: the right to information, access, rectification, erasure, restriction, notification, portability, objection and not to be subject to automated decisions. The service's own functions let the data controller's admins see, correct, download and delete a person's data; for anything they cannot do themselves, the data processor acts within 10 business days of a written request.
• Taking into account the nature of the processing and the information available to it, the data processor assists the data controller in ensuring compliance with its obligations under GDPR articles 32 to 36: security of processing, notification of a personal data breach to the supervisory authority and to data subjects, data protection impact assessments and prior consultation. The assistance is specified in Annex C.3.

• In case of a personal data breach, the data processor notifies the data controller without undue delay after becoming aware of it, and in any case within 48 hours, by email to the data controller's admins, so that the data controller can meet its obligation to notify the supervisory authority within 72 hours (GDPR article 33).
• The data processor's notification contains, as far as it is known, what article 33(3) requires: the nature of the breach including the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects. Information that is not available at first is provided as soon as it is.
• The data processor assists the data controller in notifying data subjects where article 34 requires it.

On termination of the services, the data processor, at the data controller's choice, deletes or returns all the personal data processed on its behalf and deletes existing copies, unless EU or Member State law requires storage. In lets-onboard: the data controller may retrieve its data for 30 days after the terms of service end, including by asking for an export in a common machine-readable format; after that the data processor deletes the data, and the daily backups that hold it roll out within 14 days. The data processor confirms the deletion in writing at the data controller's request. The sub-processors delete their copies under their own terms (Annex B).

• The data processor makes available to the data controller all information necessary to demonstrate compliance with GDPR article 28 and these Clauses, and allows for and contributes to audits, including inspections, conducted by the data controller or another auditor mandated by it.
• The procedures for the data controller's audits of the data processor are specified in Annex C.7, and of the sub-processors in Annex C.8.
• The data processor is required to give supervisory authorities with access under EU or Member State law, or their representatives, access to its physical facilities on presentation of appropriate identification.

The parties may agree other clauses concerning the provision of the personal data processing service, for instance on liability, as long as they do not contradict these Clauses or prejudice the fundamental rights or freedoms of the data subject and the protection afforded by the GDPR. Those terms are in Annex D.

• These Clauses become effective on the date the terms of service start to apply to the data controller.
• Both parties are entitled to require the Clauses renegotiated if changes in the law or inexpediency of the Clauses give rise to it.
• The Clauses apply for the duration of the personal data processing. During that time they cannot be terminated unless other clauses governing the processing have been agreed between the parties.
• If the provision of the service ceases and the personal data has been deleted or returned under clause 10, the Clauses may be terminated by either party with written notice.

For the data processor: Core4it ApS, Nordre Frihavnsgade 84, 5. th., 2100 København Ø, Denmark, [email protected]. For the data controller: the admins of its lets-onboard account, at the email addresses they signed up with, and the contact person named in its order, if any. The parties may contact each other through these contacts.

A.1 The purpose of the data processor's processing of personal data on behalf of the data controller is to provide the lets-onboard service: building onboarding journeys and e-learning courses from the data controller's material, inviting the data controller's people, delivering the learning to them, recording their progress, assessment results and certificates, and sending the emails the service needs.

A.2 The processing consists of: storing the data in a database; reading uploaded documents, screenshots and pictures (including sending their text and images, and what was built from them, to the AI sub-processor for analysis, drafting, proofreading, the review of questions and the assistant's answers, when an admin asks); storing what the service and its admins build; recording learning; sending emails through the mail sub-processor; displaying the data to the data controller's admins and learners; making daily backups; deleting the data as instructed.

A.3 The processing includes the following types of personal data about data subjects: name, email address, role (admin or learner), company, start date, who invited the person and when, when they joined and last signed in; learning progress (steps done and when, tries, hints used); assessment attempts (answers, scores, pass or fail, times); certificates (name, course, company, score, date); hashed sign-in links and sessions with their timestamps, and a new email address while it is being confirmed; interview answers and questions to the assistant given by admins; and whatever personal data the data controller includes in the material it uploads (which the data controller should keep to what the training needs). No special categories of personal data (GDPR article 9) are needed for the service; the data controller must not upload them.

A.4 Categories of data subjects: the data controller's employees and other people it invites as admins or learners (contractors, temporary staff), and any person named in the material it uploads.

A.5 Duration: the data processor processes the personal data for as long as the terms of service apply, and for the 30-day retrieval period and the 14-day backup roll-out after they end, as clause 10 describes.

B.1 On commencement of the Clauses, the data controller authorises the engagement of the following sub-processors:

B.2 Prior notice of changes: 30 days, as clause 6 provides. The current list is always on this page; the date at the top changes when it does.

C.1 The subject of and instruction for the processing. The data processor processes the personal data as the functions of the service require and as the data controller's admins operate them: uploading, analysing, interviewing, building, assigning, inviting, removing and deleting. Which functions call the AI sub-processor is stated in the privacy policy, section 5. The data controller may give further written instructions at [email protected].

C.2 Security of processing

The level of security takes into account that the processing involves ordinary personal data about employees in the course of their work and training, including assessment results, and the data controller's internal material, which may be confidential. The data processor implements and maintains at least these measures:

• Tenant isolation in the database: every row belongs to one company; the application reads and writes through views that show and accept only the current company's rows, enforced by the database, not the application code.
• Access control: invitation-only accounts; sign-in by single-use links valid 15 minutes; sessions that end after 7 days idle and 30 days at most; links and sessions stored only as SHA-256 hashes; the session cookie marked Secure, HttpOnly and SameSite; rate limiting of sign-in, invitation, upload and AI requests.
• Encryption in transit: TLS between users and the network sub-processor, an encrypted tunnel from there to the server, and TLS to the AI and mail sub-processors. Processes on the server reach each other only on internal addresses.
• Least privilege on the server: each process (web, AI, console, migration, backup, mail) runs as its own hardened systemd service with its own database login granted only the views it needs; only the AI process holds the AI provider's key, and its only network egress is the AI provider; the mail process's only egress is the mail provider; no inbound port is open but SSH, which is key-only and rate-limited.
• Data minimisation: hidden metadata is stripped from uploaded images and Word documents; IP addresses and email addresses are stored only as keyed hashes for rate limiting; logs carry internal identifiers only and pass through a redaction layer; nothing about learners is sent to the AI sub-processor; the AI usage ledger holds figures, not content.
• Browser hardening: a Content-Security-Policy that allows only the service's own origin, no third-party scripts, HSTS, frame denial and cross-site request checks on every state-changing request.
• Backups and recovery: a daily dump of the whole database, the last 14 kept, with a tested restore procedure; backups serve recovery of the service only.
• Organisational measures: access to the server, the database and the backups is limited to the data processor's operating staff, each with a personal key, bound by confidentiality; the operator console shows the data processor the data controller's admins and AI usage, never its content or learners; there is no function to sign in as a user; software is deployed from version-controlled, reviewed configuration; security updates are applied promptly.

C.3 Assistance to the data controller. The data processor assists by: answering requests about data subjects' rights that the admins cannot handle themselves within 10 business days; providing the information in this agreement and the privacy policy for the data controller's records of processing and impact assessments; notifying breaches as clause 9 says and helping with the notification to Datatilsynet and to data subjects; and providing the information in C.2 for the data controller's security assessment.

C.4 Storage period and erasure. Personal data is kept as the privacy policy's section 7 states: while the account is active and until an admin deletes the person or the project, and the company's own settings while the account is active; used links, ended sessions and rate-limit counters for hours; cached AI results until any project they served is deleted or 90 days unused; logs 30 days; backups 14 days. After the terms end: retrieval for 30 days, then deletion as clause 10 says.

C.5 Processing location. Storage and processing by the data processor take place on its server at Hetzner Online GmbH in the EU, from the data processor's premises in Denmark. The AI sub-processor processes in the USA, the mail sub-processor stores its account data in the USA, and the network sub-processor processes traffic metadata in the EU and the USA, each as Annex B states.

C.6 Instruction on the transfer of personal data to third countries. The data controller instructs and authorises the data processor to transfer personal data to the sub-processors in Annex B located in the USA, on the bases stated there (the EU–US Data Privacy Framework adequacy decision for certified recipients; the EU standard contractual clauses otherwise). No other transfer is authorised.

C.7 Procedures for the data controller's audits. Once a year, the data controller may ask the data processor for a written statement of its compliance with these Clauses and the measures in C.2, and may put written questions, which the data processor answers within 20 business days at no charge. An inspection on the data processor's premises or of its systems may take place with 30 days' written notice, during business hours, once a year or after a personal data breach or a demand from a supervisory authority, at the data controller's cost, by the data controller or an independent auditor bound by confidentiality; the data processor may require that the inspection does not reach other customers' data. Supervisory authorities have the access clause 11 provides.

C.8 Procedures for audits of sub-processors. The data processor audits its sub-processors through the independent reports and certifications they publish (ISO 27001 and SOC 2 reports, the EU–US Data Privacy Framework listing, Hetzner's annually reviewed technical and organisational measures), reviews them at least once a year and when a sub-processor changes, and gives the data controller the results at its request. The data controller may ask the data processor to put specific questions to a sub-processor.

Liability. The limitation of liability in the terms of service applies to the parties' liability under these Clauses, except that it does not limit either party's liability for administrative fines, for compensation to data subjects under GDPR article 82, or for a breach of these Clauses caused by gross negligence or wilful misconduct.

Governing law and venue. These Clauses are governed by Danish law, with the venue of the terms of service.

Language. These Clauses are published in English and in Danish; for data controllers in Denmark the Danish version governs. A signed copy is available on request at [email protected].