Data processing agreement

1. Scope

1.1 This agreement is between the Customer and Docentra ApS, CVR 46853539, under Article 28 of Regulation (EU) 2016/679 (the GDPR). It forms part of the agreement under Docentra's terms of service, which define the Customer and the Service, and is accepted together with them. If the parties sign another data processing agreement, that one applies instead.

1.2 For the personal data described in Annex 1, the Customer is the controller and Docentra the processor. Where the Customer is itself a processor, for example for another company in its group, Docentra is its sub-processor, and the Customer confirms that it is authorised to engage Docentra.

1.3 Docentra is a controller, not a processor, for data it processes for its own purposes, such as invoicing, contact with the Customer and security logging. The privacy policy describes this processing.

1.4 If this agreement and the terms of service conflict on personal data, this agreement prevails.

2. The Customer's responsibilities

The Customer is responsible for ensuring that the processing it instructs is lawful, including having a legal basis and informing the data subjects.

3. Instructions

3.1 Docentra processes personal data only on the Customer's documented instructions, including for transfers outside the EU and EEA, unless EU or Danish law requires otherwise. In that case, Docentra tells the Customer first, unless the law prohibits this.

3.2 The instructions consist of this agreement, the terms of service, and how the Customer uses and configures the Service: what its users upload, send, connect and approve.

3.3 The instructions include that Docentra may use the Customer's documents and results to test and correct the Service, without disclosing them, and may compile statistics that identify neither the Customer nor any individual.

3.4 Docentra does not use the personal data to train AI models, and uses AI services only on terms that do not allow them to train on it.

3.5 Docentra tells the Customer immediately if, in its opinion, an instruction infringes data protection law.

4. Confidentiality

Only people who need access to provide the Service have access to the personal data, and they are bound by confidentiality.

5. Security

Docentra takes the measures required by Article 32 GDPR, including those in Annex 2. It may change them as long as the level of protection does not fall.

6. Sub-processors

6.1 The Customer gives Docentra general authorisation to use sub-processors. Those on Docentra's sub-processor list when the Customer accepts this agreement are approved. The list gives each one's name, country, what it does and where it processes data, as summarised in Annex 3. The Customer's owners and admins can see it in the Service under Settings › Legal, and it is confidential information under the terms of service.

6.2 Docentra gives at least 14 days' notice by email to the Customer's users with the Owner role before it adds or replaces a sub-processor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot find a solution, the Customer may end the agreement before the change takes effect and get back what it has paid in advance for the time after.

6.3 Where a sub-processor must be replaced at once to protect the personal data or keep the Service running, for example after a security incident or because the sub-processor stops its service, Docentra may replace it without notice. Docentra then tells the Customer's users with the Owner role without undue delay. The Customer may object within 14 days of being told, and if the parties cannot find a solution, the Customer may end the agreement with immediate effect and get back what it has paid in advance for the time after.

6.4 Docentra imposes the same data protection obligations on each sub-processor by contract and remains fully liable for them.

6.5 Systems that the Customer itself connects to the Service, such as its accounting system, are not Docentra's sub-processors.

7. Transfers outside the EU and EEA

7.1 Docentra transfers personal data outside the EU and EEA only as stated in Annex 3, and only on a valid basis under Chapter V GDPR, such as an adequacy decision (including the EU-U.S. Data Privacy Framework) or the European Commission's standard contractual clauses.

7.2 On request, Docentra gives the Customer its assessment of these transfers.

8. Assistance

8.1 The Customer can find, export, correct and delete personal data in the Service itself. Where that is not enough to respond to a data subject's request, Docentra helps.

8.2 If a data subject contacts Docentra about the Customer's data, Docentra passes the request on to the Customer and does not respond to it itself.

8.3 Docentra helps the Customer with security, breach notifications, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR), as far as the nature of the processing and the information available to Docentra allow.

9. Personal data breaches

9.1 Docentra notifies the Customer of a personal data breach affecting the Customer's data without undue delay, and no later than 48 hours after becoming aware of it.

9.2 The notification describes, as far as is known, what happened, who and what is affected, the likely consequences, what Docentra has done, and who to contact. Docentra provides any information not yet known as soon as it becomes available.

10. Deletion and return

10.1 The Customer can export its data at any time.

10.2 A user with the Owner role can delete the Customer's company in Settings. Its data is then deleted immediately and removed from backups within 30 days.

10.3 When the agreement ends, the Customer has 30 days to export its data. Docentra then deletes it as described in 10.2, unless the law requires it to be kept, and confirms the deletion on request.

11. Audits

11.1 Docentra gives the Customer the information needed to show that Docentra complies with this agreement and Article 28 GDPR.

11.2 Where that is not enough, the Customer may audit Docentra, either itself or through an independent auditor bound by confidentiality. Audits may take place at most once a year and on 30 days' notice, unless a breach or a supervisory authority requires more. Each party pays its own costs.

12. Liability

Liability is governed by the terms of service. Claims from data subjects are governed by Article 82 GDPR.

13. Term and changes

13.1 This agreement applies for as long as Docentra processes personal data for the Customer.

13.2 Docentra may update this agreement on 30 days' notice to reflect a change in the law or in the Service. If an update lowers the protection of the personal data, the Customer may end the agreement before the update takes effect.

13.3 Danish law applies, and disputes are settled as set out in the terms of service.

Annex 1. The processing

Purpose. Providing the Service: receiving and reading the Customer's supplier documents and emails, checking them against its agreements and public sources, showing findings and answering questions, exports, connections to the Customer's systems, user access, support and security.

Data subjects.

• the Customer's users;
• contact persons at the Customer's suppliers and other counterparties;
• suppliers who are individuals, such as sole traders and private landlords;
• others named in the documents, such as signatories, guarantors and the Customer's own staff; and
• people who email the Customer's Docentra address.

Personal data.

• Users: name, email address, role and what they do in the Customer's company (the activity log).
• Others: name, job title, business contact details, signature, and what the documents say about them, such as amounts, sole traders' bank details, and CPR numbers where a document contains one.

Special categories. None intended. Beyond what its supplier documents contain, the Customer does not send Docentra CPR numbers, special categories of data (Article 9 GDPR) or data about criminal offences (Article 10 GDPR).

Duration and retention.

Location. The Customer's data is stored in the EU. Some sub-processors process parts of it outside the EU, as Annex 3 shows.

Annex 2. Security measures

• Access: only people the Customer invites, with a confirmed email address. Owners and admins manage settings and people.
• Separation: each company's data is kept separate from other customers' data. Docentra's own staff access the Customer's data only when needed to support the Customer or to test and correct the Service.
• Encryption: all traffic uses HTTPS. Original documents are encrypted with a separate key for each company, and backups are encrypted.
• Hosting: the server is used by Docentra alone and accepts no connections from the internet. It is administered only over a private network, using personal keys.
• Logging: changes and decisions are recorded in an activity log that the Customer can export, and unusual use triggers an alert.
• Backups: the database is backed up continuously and every night. Backups are checked daily, and restoring them has been tested.
• Development: every change passes automated tests before release, and dependencies are monitored for security issues.
• Privacy by default: error reports and statistics exclude document content, and recordings of the Service hide all text.

Annex 3. Sub-processors